mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 01:32:44 +08:00
94 lines
3.0 KiB
JavaScript
94 lines
3.0 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const { readFileSync } = require('node:fs');
|
|
const path = require('node:path');
|
|
const { test } = require('node:test');
|
|
|
|
const root = path.resolve(__dirname, '../..');
|
|
const scriptPath = path.join(
|
|
root,
|
|
'scripts/ql3-vault-transit-prompt-output-custody-live-contract.cjs',
|
|
);
|
|
const source = readFileSync(scriptPath, 'utf8');
|
|
const manifest = JSON.parse(readFileSync(path.join(root, 'package.json')));
|
|
const { IMAGE } = require(scriptPath);
|
|
|
|
test('Vault Transit live gate is explicit and digest pinned', () => {
|
|
assert.equal(
|
|
IMAGE,
|
|
'docker.io/hashicorp/vault@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569',
|
|
);
|
|
assert.match(source, /QL3_RUN_VAULT_TRANSIT_LIVE/);
|
|
assert.equal(
|
|
manifest.scripts['test:vault-transit-custody-live:ql3'],
|
|
'pnpm --filter @qinglong/ai build && pnpm --filter @qinglong/cluster-admin build && node scripts/ql3-vault-transit-prompt-output-custody-live-contract.cjs',
|
|
);
|
|
});
|
|
|
|
test('fixture is loopback-only, non-root, TLS-only and capability bounded', () => {
|
|
for (const exact of [
|
|
"'127.0.0.1::8200'",
|
|
'process.getuid',
|
|
'process.getgid',
|
|
"'--cap-drop'",
|
|
"'ALL'",
|
|
"'--cap-add'",
|
|
"'IPC_LOCK'",
|
|
"'no-new-privileges:true'",
|
|
"'--read-only'",
|
|
"'/tmp:rw,noexec,nosuid,size=16m'",
|
|
"'/bin/vault'",
|
|
'tls_min_version = "tls13"',
|
|
'tls_max_version = "tls13"',
|
|
"transport: 'https'",
|
|
]) {
|
|
assert.equal(source.includes(exact), true, exact);
|
|
}
|
|
});
|
|
|
|
test('persistent barrier is initialized, threshold-unsealed and replaced', () => {
|
|
for (const exact of [
|
|
'\'storage "file" {\'',
|
|
"'/v1/sys/init'",
|
|
"'/v1/sys/unseal'",
|
|
"docker(['rm', '--force', container])",
|
|
'assert.notEqual(secondContainerId, firstContainerId)',
|
|
'sealedAfterContainerReplacement',
|
|
'persistentBarrierSurvivesContainerReplacement',
|
|
'transitKeySurvivesContainerReplacement',
|
|
'untrustedCaRejectedBeforeVaultApi',
|
|
]) {
|
|
assert.equal(source.includes(exact), true, exact);
|
|
}
|
|
});
|
|
|
|
test('real ceremony reaches the shared adapter and offline product verifier', () => {
|
|
for (const symbol of [
|
|
'readCommand',
|
|
'run(wrapCommand)',
|
|
'run(unwrapCommand)',
|
|
'readClusterPromptOutputExternalRecoveryInput',
|
|
'runClusterPromptOutputExternalRecoveryVerifier',
|
|
'disposeClusterPromptOutputExternalRecoveryInput',
|
|
'realVaultTransitEncryptDecrypt',
|
|
'officialArtifactOpenVerified',
|
|
]) {
|
|
assert.equal(source.includes(symbol), true, symbol);
|
|
}
|
|
});
|
|
|
|
test('success and failure always remove private state and the exact container', () => {
|
|
assert.match(source, /finally \{/);
|
|
assert.equal(
|
|
source.includes(
|
|
"docker(['rm', '--force', container], { allowFailure: true })",
|
|
),
|
|
true,
|
|
);
|
|
assert.equal(
|
|
source.includes('rmSync(directory, { recursive: true, force: true })'),
|
|
true,
|
|
);
|
|
assert.equal(source.includes('reportIsContentFree: true'), true);
|
|
assert.equal(source.includes('serialized.includes(forbidden)'), true);
|
|
});
|