246 lines
10 KiB
JavaScript
246 lines
10 KiB
JavaScript
const { test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const { spawnSync } = require('node:child_process');
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
|
|
const SCRIPT = path.join(__dirname, '..', 'scripts', 'install-apt.sh');
|
|
|
|
// Runs install-apt.sh against a throwaway apt directory (STOKE_APT_ETC) with
|
|
// every external command stubbed via PATH. Scenario knobs:
|
|
// candInitial `apt-cache policy` Candidate before any update
|
|
// candAfterUpdate Candidate after any `apt-get update`
|
|
// candAfterNodesource Candidate after an update once nodesource.list exists
|
|
// releaseStatus HTTP status curl reports for the registry Release file
|
|
// sourceUpdateError stderr and exit 100 for the first signed stoke update
|
|
// forgeUser/token private-registry credentials
|
|
// The apt-cache stub localizes the "Candidate:" label unless LC_ALL=C is set,
|
|
// so every scenario doubles as a regression test for locale-safe parsing.
|
|
const cleanups = [];
|
|
process.on('exit', () => { for (const dir of cleanups) fs.rmSync(dir, { recursive: true, force: true }); });
|
|
|
|
function runScenario({ candInitial, candAfterUpdate, candAfterNodesource, preexistingNodesourceList, releaseStatus, sourceUpdateError, forgeUser, forgeToken }) {
|
|
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-apt-test-'));
|
|
cleanups.push(root);
|
|
const bin = path.join(root, 'bin');
|
|
const state = path.join(root, 'state');
|
|
const aptEtc = path.join(root, 'etc', 'apt');
|
|
fs.mkdirSync(bin, { recursive: true });
|
|
fs.mkdirSync(state, { recursive: true });
|
|
fs.mkdirSync(path.join(aptEtc, 'sources.list.d'), { recursive: true });
|
|
fs.writeFileSync(path.join(state, 'candidate'), candInitial);
|
|
if (preexistingNodesourceList !== undefined) {
|
|
fs.writeFileSync(path.join(aptEtc, 'sources.list.d', 'nodesource.list'), preexistingNodesourceList);
|
|
}
|
|
|
|
const stub = (name, body) => {
|
|
const p = path.join(bin, name);
|
|
fs.writeFileSync(p, `#!/usr/bin/env bash\n${body}\n`, { mode: 0o755 });
|
|
};
|
|
|
|
// Force the non-root path so every mutation goes through the sudo stub.
|
|
stub('id', 'echo 1000');
|
|
stub('sudo', 'SUDO_ACTIVE=1 exec "$@"');
|
|
// Registry Release-file probes (URLs under /dists/) answer with the
|
|
// scenario's HTTP status; everything else is a key fetch.
|
|
stub('curl', [
|
|
'uses_netrc=false',
|
|
'for a in "$@"; do [ "$a" = "--netrc-file" ] && uses_netrc=true; done',
|
|
'if [ "$uses_netrc" = true ] && [ "${SUDO_ACTIVE:-}" != 1 ]; then',
|
|
' echo "curl: root-owned netrc is unreadable without sudo" >&2',
|
|
' exit 77',
|
|
'fi',
|
|
'for a in "$@"; do',
|
|
' case "$a" in */dists/*) echo "${RELEASE_STATUS:-200}"; exit 0;; esac',
|
|
'done',
|
|
'echo "FAKE-KEY"',
|
|
].join('\n'));
|
|
stub('stoke', 'echo 1.2.0');
|
|
stub('apt-cache', [
|
|
'cand="$(cat "$STATE_DIR/candidate")"',
|
|
'[ "$cand" = "absent" ] && exit 0',
|
|
'label="Candidato"',
|
|
'[ "${LC_ALL:-}" = "C" ] && label="Candidate"',
|
|
'printf "nodejs:\\n Installed: (none)\\n %s: %s\\n" "$label" "$cand"',
|
|
].join('\n'));
|
|
stub('apt-get', [
|
|
'echo "apt-get $*" >> "$STATE_DIR/apt-get.log"',
|
|
'source_list=""',
|
|
'for a in "$@"; do',
|
|
' case "$a" in Dir::Etc::sourcelist=*) source_list="${a#*=}";; esac',
|
|
'done',
|
|
'for a in "$@"; do',
|
|
' if [ "$a" = update ]; then',
|
|
' if [ -n "$source_list" ] && grep -q "signed-by=" "$source_list" && [ -n "${SOURCE_UPDATE_ERROR:-}" ]; then',
|
|
' printf "%s\\n" "$SOURCE_UPDATE_ERROR" >&2',
|
|
' exit 100',
|
|
' fi',
|
|
' if [ -e "$STOKE_APT_ETC/sources.list.d/nodesource.list" ] && [ -n "${CAND_AFTER_NODESOURCE:-}" ]; then',
|
|
' echo "$CAND_AFTER_NODESOURCE" > "$STATE_DIR/candidate"',
|
|
' elif [ -n "${CAND_AFTER_UPDATE:-}" ]; then',
|
|
' echo "$CAND_AFTER_UPDATE" > "$STATE_DIR/candidate"',
|
|
' fi',
|
|
' fi',
|
|
'done',
|
|
'exit 0',
|
|
].join('\n'));
|
|
|
|
// Restrictive umask: apt-readable 0644 files must come from the script's
|
|
// explicit chmod, not from a lucky default.
|
|
const res = spawnSync('bash', ['-c', 'umask 077 && exec bash "$1"', 'bash', SCRIPT], {
|
|
encoding: 'utf8',
|
|
env: {
|
|
...process.env,
|
|
PATH: `${bin}:${process.env.PATH}`,
|
|
STOKE_APT_ETC: aptEtc,
|
|
STATE_DIR: state,
|
|
CAND_AFTER_UPDATE: candAfterUpdate || '',
|
|
CAND_AFTER_NODESOURCE: candAfterNodesource || '',
|
|
RELEASE_STATUS: releaseStatus || '',
|
|
SOURCE_UPDATE_ERROR: sourceUpdateError || '',
|
|
FORGE_USER: forgeUser || '',
|
|
FORGE_TOKEN: forgeToken || '',
|
|
LC_ALL: 'es_ES.UTF-8', // localized environment; the script must force C
|
|
},
|
|
});
|
|
|
|
const read = (p) => (fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null);
|
|
const mode = (p) => (fs.existsSync(p) ? fs.statSync(p).mode & 0o777 : null);
|
|
const result = {
|
|
res,
|
|
aptEtc,
|
|
nodesourceList: read(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
|
|
nodesourceListMode: mode(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
|
|
nodesourceKey: read(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
|
|
nodesourceKeyMode: mode(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
|
|
forgeKeyMode: mode(path.join(aptEtc, 'keyrings', 'forgejo-heavy-duty.asc')),
|
|
forgeList: read(path.join(aptEtc, 'sources.list.d', 'forgejo-heavy-duty.list')),
|
|
forgeAuth: read(path.join(aptEtc, 'auth.conf.d', 'forgejo-heavy-duty.conf')),
|
|
forgeAuthMode: mode(path.join(aptEtc, 'auth.conf.d', 'forgejo-heavy-duty.conf')),
|
|
aptGetLog: read(path.join(state, 'apt-get.log')) || '',
|
|
};
|
|
// Drop the throwaway tree after we have read everything we need.
|
|
fs.rmSync(root, { recursive: true, force: true });
|
|
return result;
|
|
}
|
|
|
|
test('suitable nodejs candidate already available: installs without touching NodeSource', () => {
|
|
// Epoch-prefixed version also covers the epoch-stripping in the comparison.
|
|
const s = runScenario({ candInitial: '1:22.23.1-1nodesource1' });
|
|
assert.equal(s.res.status, 0, s.res.stderr);
|
|
assert.equal(s.nodesourceList, null);
|
|
assert.match(s.aptGetLog, /install -y stoke/);
|
|
assert.equal(s.forgeKeyMode, 0o644, 'forge keyring must be readable by _apt');
|
|
});
|
|
|
|
test('no cached metadata: refreshes apt lists before deciding, no NodeSource needed', () => {
|
|
const s = runScenario({ candInitial: 'absent', candAfterUpdate: '22.23.1-1nodesource1' });
|
|
assert.equal(s.res.status, 0, s.res.stderr);
|
|
assert.equal(s.nodesourceList, null);
|
|
assert.match(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('distro nodejs too old: bootstraps NodeSource and installs', () => {
|
|
const s = runScenario({
|
|
candInitial: '20.19.2+dfsg-1+deb13u2',
|
|
candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
|
|
candAfterNodesource: '22.23.1-1nodesource1',
|
|
});
|
|
assert.equal(s.res.status, 0, s.res.stderr);
|
|
assert.match(s.nodesourceList, /deb \[signed-by=.*nodesource\.asc\] https:\/\/deb\.nodesource\.com\/node_22\.x nodistro main/);
|
|
assert.equal(s.nodesourceKey, 'FAKE-KEY\n');
|
|
assert.equal(s.nodesourceKeyMode, 0o644, 'NodeSource keyring must be readable by _apt');
|
|
assert.equal(s.nodesourceListMode, 0o644, 'NodeSource list must be readable by _apt');
|
|
assert.match(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('bootstrap failure: NodeSource still lacks a suitable nodejs, exits with error', () => {
|
|
const s = runScenario({
|
|
candInitial: '20.19.2+dfsg-1+deb13u2',
|
|
candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
|
|
candAfterNodesource: '20.19.2+dfsg-1+deb13u2',
|
|
});
|
|
assert.notEqual(s.res.status, 0);
|
|
assert.match(s.res.stderr, /still no nodejs >= 22\.12/);
|
|
assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('pre-existing user-managed nodesource.list is never overwritten', () => {
|
|
const marker = '# user-managed entry\n';
|
|
const s = runScenario({
|
|
candInitial: '18.19.1+dfsg-6ubuntu5',
|
|
candAfterUpdate: '18.19.1+dfsg-6ubuntu5',
|
|
preexistingNodesourceList: marker,
|
|
});
|
|
assert.notEqual(s.res.status, 0);
|
|
assert.match(s.res.stderr, /refusing to overwrite/);
|
|
assert.equal(s.nodesourceList, marker);
|
|
assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('registry Release file 404s: fails fast with a clear message before apt runs', () => {
|
|
const s = runScenario({ candInitial: '22.23.1-1nodesource1', releaseStatus: '404' });
|
|
assert.notEqual(s.res.status, 0);
|
|
assert.match(s.res.stderr, /no stoke package has been published/);
|
|
assert.match(s.res.stderr, /npm/);
|
|
assert.match(s.res.stderr, /dists\/stable\/Release returned 404/);
|
|
assert.equal(s.aptGetLog, '', 'must abort before any apt-get invocation');
|
|
});
|
|
|
|
test('registry Release file present: proceeds with the install', () => {
|
|
const s = runScenario({ candInitial: '22.23.1-1nodesource1', releaseStatus: '200' });
|
|
assert.equal(s.res.status, 0, s.res.stderr);
|
|
assert.match(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('signature verification failure alone may use the trusted compatibility fallback', () => {
|
|
const s = runScenario({
|
|
candInitial: '22.23.1-1nodesource1',
|
|
sourceUpdateError: 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.',
|
|
});
|
|
assert.equal(s.res.status, 0, s.res.stderr);
|
|
assert.match(s.forgeList, /\[trusted=yes\]/);
|
|
assert.match(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('network update failure stays fatal and never disables signature verification', () => {
|
|
const failure = 'Temporary failure resolving forgejo.heavyduty.builders';
|
|
const s = runScenario({
|
|
candInitial: '22.23.1-1nodesource1',
|
|
sourceUpdateError: failure,
|
|
});
|
|
assert.notEqual(s.res.status, 0);
|
|
assert.match(s.res.stderr, new RegExp(failure));
|
|
assert.match(s.forgeList, /\[signed-by=/);
|
|
assert.doesNotMatch(s.forgeList, /trusted=yes/);
|
|
assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
|
|
});
|
|
|
|
test('private-registry credentials stay in a root-readable auth file, not the source URL', () => {
|
|
const s = runScenario({
|
|
candInitial: '22.23.1-1nodesource1',
|
|
forgeUser: 'apt-user',
|
|
forgeToken: 'secret-token',
|
|
});
|
|
assert.equal(s.res.status, 0, s.res.stderr);
|
|
assert.equal(s.forgeAuthMode, 0o600);
|
|
assert.equal(s.forgeAuth, [
|
|
'machine forgejo.heavyduty.builders',
|
|
'login apt-user',
|
|
'password secret-token',
|
|
'',
|
|
].join('\n'));
|
|
assert.doesNotMatch(s.forgeList, /apt-user|secret-token/);
|
|
});
|
|
|
|
test('incomplete private-registry credentials fail before configuring apt', () => {
|
|
const s = runScenario({
|
|
candInitial: '22.23.1-1nodesource1',
|
|
forgeUser: 'apt-user',
|
|
});
|
|
assert.notEqual(s.res.status, 0);
|
|
assert.match(s.res.stderr, /FORGE_USER and FORGE_TOKEN must be set together/);
|
|
assert.equal(s.forgeList, null);
|
|
assert.equal(s.aptGetLog, '');
|
|
});
|