|
|
@@ -0,0 +1,86 @@
|
|
|
+#!/usr/bin/env bash
|
|
|
+# Self-test for process-compose-ops — fully offline: no network, no download.
|
|
|
+#
|
|
|
+# Wraps the skill's binary-integrity verifier (scripts/verify-binary.ps1), which
|
|
|
+# re-checks the committed process-compose.exe SHA-256 against the recorded
|
|
|
+# EXE_HASH. Unlike the three §7 staleness scripts this verifier is PowerShell and
|
|
|
+# platform-locked to a Windows binary, so the suite has two layers:
|
|
|
+# * contract / structural (run anywhere, no PowerShell host required): the .ps1
|
|
|
+# exists and encodes the Get-FileHash/EXE_HASH compare plus the mismatch
|
|
|
+# throw — proving it is a real check, not a vacuous rubber stamp;
|
|
|
+# * behavioural happy + negative against a temp bin/ — exercised only when a
|
|
|
+# PowerShell host (pwsh | powershell) is present. A dummy .exe and a
|
|
|
+# hand-written EXE_HASH stand in for the real binary, so no download and no
|
|
|
+# network ever occur. SKIP'd (suite stays green) on a PowerShell-less Linux
|
|
|
+# runner — the structural layer still runs.
|
|
|
+#
|
|
|
+# Usage: bash tests/run.sh
|
|
|
+# Exit: 0 all pass, 1 one or more failures
|
|
|
+
|
|
|
+set -uo pipefail
|
|
|
+
|
|
|
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
+SKILL="$(dirname "$HERE")"
|
|
|
+V="$SKILL/scripts/verify-binary.ps1"
|
|
|
+
|
|
|
+# A PowerShell host, if any (pwsh = PowerShell 7 cross-platform; powershell =
|
|
|
+# Windows PowerShell 5.1). Absent on most Linux CI runners.
|
|
|
+PSHOST=""
|
|
|
+for c in pwsh powershell; do
|
|
|
+ if command -v "$c" >/dev/null 2>&1 && "$c" -NoProfile -Command 'exit 0' >/dev/null 2>&1; then PSHOST="$c"; break; fi
|
|
|
+done
|
|
|
+
|
|
|
+SB="$(mktemp -d)"; trap 'rm -rf "$SB"' EXIT
|
|
|
+PASS=0; FAIL=0
|
|
|
+ok() { PASS=$((PASS+1)); printf ' PASS %s\n' "$1"; }
|
|
|
+no() { FAIL=$((FAIL+1)); printf ' FAIL %s\n' "$1"; }
|
|
|
+expect_exit() { [[ "$2" == "$3" ]] && ok "$1 (exit $3)" || no "$1 (want $2 got $3)"; }
|
|
|
+expect_has() { case "$3" in *"$2"*) ok "$1";; *) no "$1 (missing '$2')";; esac; }
|
|
|
+
|
|
|
+echo "=== process-compose-ops self-test ==="
|
|
|
+
|
|
|
+# ── contract / structural (runs anywhere, no PowerShell host needed) ──────────
|
|
|
+echo "-- contract --"
|
|
|
+[[ -f "$V" ]] && ok "verify-binary.ps1 present" || no "verify-binary.ps1 present"
|
|
|
+[[ -s "$V" ]] && ok "verify-binary.ps1 non-empty" || no "verify-binary.ps1 non-empty"
|
|
|
+# The verifier must encode the integrity check it claims to run: a SHA-256
|
|
|
+# compare of the binary against EXE_HASH that throws on mismatch. If these
|
|
|
+# markers were gutted the verifier would be a vacuous rubber stamp.
|
|
|
+vtxt="$(cat "$V")"
|
|
|
+expect_has "computes SHA-256 of the binary" "Get-FileHash" "$vtxt"
|
|
|
+expect_has "reads recorded EXE_HASH" "EXE_HASH" "$vtxt"
|
|
|
+expect_has "fails loud on mismatch" "MISMATCH" "$vtxt"
|
|
|
+
|
|
|
+# ── behavioural (happy + negative) under a PowerShell host, if present ─────────
|
|
|
+echo "-- behavioural (${PSHOST:-no powershell host}) --"
|
|
|
+if [[ -z "$PSHOST" ]]; then
|
|
|
+ echo " SKIP happy/negative (no pwsh/powershell on this runner — structural layer above still ran)"
|
|
|
+else
|
|
|
+ # happy: a dummy .exe whose recorded EXE_HASH matches its actual SHA-256.
|
|
|
+ mkdir -p "$SB/ok/bin"
|
|
|
+ printf 'process-compose-fake-bytes' > "$SB/ok/bin/process-compose.exe"
|
|
|
+ # sha256sum and Get-FileHash compute the identical digest; the verifier
|
|
|
+ # compares lowercased + trimmed, so this matches what it recomputes.
|
|
|
+ sha256sum "$SB/ok/bin/process-compose.exe" | awk '{print $1}' > "$SB/ok/bin/EXE_HASH"
|
|
|
+ "$PSHOST" -NoProfile -File "$V" -BinDir "$SB/ok/bin" >/dev/null 2>&1
|
|
|
+ expect_exit "matching EXE_HASH -> 0" 0 $?
|
|
|
+
|
|
|
+ # negative: a recorded EXE_HASH that disagrees with the actual SHA-256.
|
|
|
+ mkdir -p "$SB/bad/bin"
|
|
|
+ printf 'process-compose-fake-bytes' > "$SB/bad/bin/process-compose.exe"
|
|
|
+ printf '0000000000000000000000000000000000000000000000000000000000000000' > "$SB/bad/bin/EXE_HASH"
|
|
|
+ "$PSHOST" -NoProfile -File "$V" -BinDir "$SB/bad/bin" >"$SB/neg.out" 2>&1
|
|
|
+ rc=$?
|
|
|
+ [[ "$rc" -ne 0 ]] && ok "mismatched EXE_HASH -> nonzero (exit $rc)" || no "mismatched EXE_HASH -> nonzero (got 0)"
|
|
|
+ expect_has "verifier reports MISMATCH" "MISMATCH" "$(cat "$SB/neg.out")"
|
|
|
+fi
|
|
|
+
|
|
|
+# ── SKILL.md sanity ───────────────────────────────────────────────────────────
|
|
|
+echo "-- SKILL.md --"
|
|
|
+grep -q '^name: process-compose-ops$' "$SKILL/SKILL.md" && ok "frontmatter name" || no "frontmatter name"
|
|
|
+grep -q 'verify-binary.ps1' "$SKILL/SKILL.md" && ok "verifier cited from SKILL.md" || no "verifier cited from SKILL.md"
|
|
|
+
|
|
|
+echo ""
|
|
|
+echo "=== $PASS passed, $FAIL failed ==="
|
|
|
+[[ "$FAIL" -eq 0 ]] || exit 1
|
|
|
+exit 0
|
0xDarkMatter