stoke/test/install-apt.test.js

const { test } = require('node:test');
const assert = require('node:assert/strict');
const { spawnSync } = require('node:child_process');
const fs = require('node:fs');
const os = require('node:os');
const path = require('node:path');

const SCRIPT = path.join(__dirname, '..', 'scripts', 'install-apt.sh');

// Runs install-apt.sh against a throwaway apt directory (STOKE_APT_ETC) with
// every external command stubbed via PATH. Scenario knobs:
//   candInitial        `apt-cache policy` Candidate before any update
//   candAfterUpdate    Candidate after any `apt-get update`
//   candAfterNodesource Candidate after an update once nodesource.list exists
//   releaseStatus      HTTP status curl reports for the registry Release file
//   sourceUpdateError  stderr and exit 100 for the first signed stoke update
//   forgeUser/token    private-registry credentials
//   allowUnverified    explicit HTTPS-only integrity opt-in
// The apt-cache stub localizes the "Candidate:" label unless LC_ALL=C is set,
// so every scenario doubles as a regression test for locale-safe parsing.
const cleanups = [];
process.on('exit', () => { for (const dir of cleanups) fs.rmSync(dir, { recursive: true, force: true }); });

function runScenario({ candInitial, candAfterUpdate, candAfterNodesource, preexistingNodesourceList, releaseStatus, sourceUpdateError, forgeUser, forgeToken, allowUnverified }) {
  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-apt-test-'));
  cleanups.push(root);
  const bin = path.join(root, 'bin');
  const state = path.join(root, 'state');
  const aptEtc = path.join(root, 'etc', 'apt');
  fs.mkdirSync(bin, { recursive: true });
  fs.mkdirSync(state, { recursive: true });
  fs.mkdirSync(path.join(aptEtc, 'sources.list.d'), { recursive: true });
  fs.writeFileSync(path.join(state, 'candidate'), candInitial);
  if (preexistingNodesourceList !== undefined) {
    fs.writeFileSync(path.join(aptEtc, 'sources.list.d', 'nodesource.list'), preexistingNodesourceList);
  }

  const stub = (name, body) => {
    const p = path.join(bin, name);
    fs.writeFileSync(p, `#!/usr/bin/env bash\n${body}\n`, { mode: 0o755 });
  };

  // Force the non-root path so every mutation goes through the sudo stub.
  stub('id', 'echo 1000');
  stub('sudo', 'SUDO_ACTIVE=1 exec "$@"');
  // Registry Release-file probes (URLs under /dists/) answer with the
  // scenario's HTTP status; everything else is a key fetch.
  stub('curl', [
    'uses_netrc=false',
    'for a in "$@"; do [ "$a" = "--netrc-file" ] && uses_netrc=true; done',
    'if [ "$uses_netrc" = true ] && [ "${SUDO_ACTIVE:-}" != 1 ]; then',
    '  echo "curl: root-owned netrc is unreadable without sudo" >&2',
    '  exit 77',
    'fi',
    'for a in "$@"; do',
    '  case "$a" in */dists/*) echo "${RELEASE_STATUS:-200}"; exit 0;; esac',
    'done',
    'echo "FAKE-KEY"',
  ].join('\n'));
  stub('stoke', 'echo 1.2.0');
  stub('apt-cache', [
    'cand="$(cat "$STATE_DIR/candidate")"',
    '[ "$cand" = "absent" ] && exit 0',
    'label="Candidato"',
    '[ "${LC_ALL:-}" = "C" ] && label="Candidate"',
    'printf "nodejs:\\n  Installed: (none)\\n  %s: %s\\n" "$label" "$cand"',
  ].join('\n'));
  stub('apt-get', [
    'echo "apt-get $*" >> "$STATE_DIR/apt-get.log"',
    'source_list=""',
    'for a in "$@"; do',
    '  case "$a" in Dir::Etc::sourcelist=*) source_list="${a#*=}";; esac',
    'done',
    'for a in "$@"; do',
    '  if [ "$a" = update ]; then',
    '    if [ -n "$source_list" ] && grep -q "signed-by=" "$source_list" && [ -n "${SOURCE_UPDATE_ERROR:-}" ]; then',
    '      printf "%s\\n" "$SOURCE_UPDATE_ERROR" >&2',
    '      exit 100',
    '    fi',
    '    if [ -e "$STOKE_APT_ETC/sources.list.d/nodesource.list" ] && [ -n "${CAND_AFTER_NODESOURCE:-}" ]; then',
    '      echo "$CAND_AFTER_NODESOURCE" > "$STATE_DIR/candidate"',
    '    elif [ -n "${CAND_AFTER_UPDATE:-}" ]; then',
    '      echo "$CAND_AFTER_UPDATE" > "$STATE_DIR/candidate"',
    '    fi',
    '  fi',
    'done',
    'exit 0',
  ].join('\n'));

  // Restrictive umask: apt-readable 0644 files must come from the script's
  // explicit chmod, not from a lucky default.
  const res = spawnSync('bash', ['-c', 'umask 077 && exec bash "$1"', 'bash', SCRIPT], {
    encoding: 'utf8',
    env: {
      ...process.env,
      PATH: `${bin}:${process.env.PATH}`,
      STOKE_APT_ETC: aptEtc,
      STATE_DIR: state,
      CAND_AFTER_UPDATE: candAfterUpdate || '',
      CAND_AFTER_NODESOURCE: candAfterNodesource || '',
      RELEASE_STATUS: releaseStatus || '',
      SOURCE_UPDATE_ERROR: sourceUpdateError || '',
      FORGE_USER: forgeUser || '',
      FORGE_TOKEN: forgeToken || '',
      STOKE_ALLOW_UNVERIFIED_APT: allowUnverified || '',
      LC_ALL: 'es_ES.UTF-8', // localized environment; the script must force C
    },
  });

  const read = (p) => (fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null);
  const mode = (p) => (fs.existsSync(p) ? fs.statSync(p).mode & 0o777 : null);
  const result = {
    res,
    aptEtc,
    nodesourceList: read(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
    nodesourceListMode: mode(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
    nodesourceKey: read(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
    nodesourceKeyMode: mode(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
    forgeKeyMode: mode(path.join(aptEtc, 'keyrings', 'forgejo-heavy-duty.asc')),
    forgeList: read(path.join(aptEtc, 'sources.list.d', 'forgejo-heavy-duty.list')),
    forgeAuth: read(path.join(aptEtc, 'auth.conf.d', 'forgejo-heavy-duty.conf')),
    forgeAuthMode: mode(path.join(aptEtc, 'auth.conf.d', 'forgejo-heavy-duty.conf')),
    aptGetLog: read(path.join(state, 'apt-get.log')) || '',
  };
  // Drop the throwaway tree after we have read everything we need.
  fs.rmSync(root, { recursive: true, force: true });
  return result;
}

test('suitable nodejs candidate already available: installs without touching NodeSource', () => {
  // Epoch-prefixed version also covers the epoch-stripping in the comparison.
  const s = runScenario({ candInitial: '1:22.23.1-1nodesource1' });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.equal(s.nodesourceList, null);
  assert.match(s.aptGetLog, /install -y stoke/);
  assert.equal(s.forgeKeyMode, 0o644, 'forge keyring must be readable by _apt');
});

test('no cached metadata: refreshes apt lists before deciding, no NodeSource needed', () => {
  const s = runScenario({ candInitial: 'absent', candAfterUpdate: '22.23.1-1nodesource1' });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.equal(s.nodesourceList, null);
  assert.match(s.aptGetLog, /install -y stoke/);
});

test('distro nodejs too old: bootstraps NodeSource and installs', () => {
  const s = runScenario({
    candInitial: '20.19.2+dfsg-1+deb13u2',
    candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
    candAfterNodesource: '22.23.1-1nodesource1',
  });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.match(s.nodesourceList, /deb \[signed-by=.*nodesource\.asc\] https:\/\/deb\.nodesource\.com\/node_22\.x nodistro main/);
  assert.equal(s.nodesourceKey, 'FAKE-KEY\n');
  assert.equal(s.nodesourceKeyMode, 0o644, 'NodeSource keyring must be readable by _apt');
  assert.equal(s.nodesourceListMode, 0o644, 'NodeSource list must be readable by _apt');
  assert.match(s.aptGetLog, /install -y stoke/);
});

test('bootstrap failure: NodeSource still lacks a suitable nodejs, exits with error', () => {
  const s = runScenario({
    candInitial: '20.19.2+dfsg-1+deb13u2',
    candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
    candAfterNodesource: '20.19.2+dfsg-1+deb13u2',
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /still no nodejs >= 22\.12/);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});

test('pre-existing user-managed nodesource.list is never overwritten', () => {
  const marker = '# user-managed entry\n';
  const s = runScenario({
    candInitial: '18.19.1+dfsg-6ubuntu5',
    candAfterUpdate: '18.19.1+dfsg-6ubuntu5',
    preexistingNodesourceList: marker,
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /refusing to overwrite/);
  assert.equal(s.nodesourceList, marker);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});

test('registry Release file 404s: fails fast with a clear message before apt runs', () => {
  const s = runScenario({ candInitial: '22.23.1-1nodesource1', releaseStatus: '404' });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /no stoke package has been published/);
  assert.match(s.res.stderr, /npm/);
  assert.match(s.res.stderr, /dists\/stable\/Release returned 404/);
  assert.equal(s.aptGetLog, '', 'must abort before any apt-get invocation');
});

test('registry Release file present: proceeds with the install', () => {
  const s = runScenario({ candInitial: '22.23.1-1nodesource1', releaseStatus: '200' });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.match(s.aptGetLog, /install -y stoke/);
});

test('signature verification failure refuses by default and removes the forge source', () => {
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    sourceUpdateError: 'W: OpenPGP signature verification failed: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Malformed MPI: leading bit is not set',
  });
  assert.notEqual(s.res.status, 0);
  assert.equal(s.forgeList, null);
  assert.match(s.res.stderr, /sqv-based apt cannot parse\s+the Forgejo registry signature/);
  assert.match(s.res.stderr, /STOKE_ALLOW_UNVERIFIED_APT=1/);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});

test('exact opt-in permits an HTTPS-only forge source after signature failure', () => {
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    sourceUpdateError: 'W: OpenPGP signature verification failed: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Malformed MPI: leading bit is not set',
    allowUnverified: '1',
  });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.match(s.forgeList, /\[trusted=yes\]/);
  assert.match(s.res.stderr, /OpenPGP signature verification is disabled/);
  assert.match(s.res.stderr, /HTTPS-only integrity/);
  assert.match(s.aptGetLog, /install -y stoke/);
});

test('opt-in cannot bypass a missing signing key', () => {
  const failure = 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.';
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    sourceUpdateError: failure,
    allowUnverified: '1',
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, new RegExp(failure.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
  assert.match(s.forgeList, /\[signed-by=/);
  assert.doesNotMatch(s.forgeList, /trusted=yes/);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});

test('unrecognized opt-in value is rejected before configuring apt', () => {
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    allowUnverified: 'yes',
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /STOKE_ALLOW_UNVERIFIED_APT must be unset or exactly 1/);
  assert.equal(s.forgeList, null);
  assert.equal(s.aptGetLog, '');
});

test('network update failure stays fatal and never disables signature verification', () => {
  const failure = 'Temporary failure resolving forgejo.heavyduty.builders';
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    sourceUpdateError: failure,
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, new RegExp(failure));
  assert.match(s.forgeList, /\[signed-by=/);
  assert.doesNotMatch(s.forgeList, /trusted=yes/);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});

test('private-registry credentials stay in a root-readable auth file, not the source URL', () => {
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    forgeUser: 'apt-user',
    forgeToken: 'secret-token',
  });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.equal(s.forgeAuthMode, 0o600);
  assert.equal(s.forgeAuth, [
    'machine forgejo.heavyduty.builders',
    'login apt-user',
    'password secret-token',
    '',
  ].join('\n'));
  assert.doesNotMatch(s.forgeList, /apt-user|secret-token/);
});

test('incomplete private-registry credentials fail before configuring apt', () => {
  const s = runScenario({
    candInitial: '22.23.1-1nodesource1',
    forgeUser: 'apt-user',
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /FORGE_USER and FORGE_TOKEN must be set together/);
  assert.equal(s.forgeList, null);
  assert.equal(s.aptGetLog, '');
});