From fe7f6360e806efd470cd6d9a9d930a1c37c36572 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 14 Jul 2020 11:20:35 +0100 Subject: [PATCH] add integration test for sops-pgp-hook --- .github/workflows/test.yml | 6 +- default.nix | 1 + pkgs/sops-pgp-hook/default.nix | 6 +- pkgs/sops-pgp-hook/hook_test.go | 54 ++++++++++++++++++ pkgs/sops-pgp-hook/sops-pgp-hook.bash | 12 +++- .../test-assets/existing-key.gpg | Bin 0 -> 1815 bytes pkgs/sops-pgp-hook/test-assets/keys/key.asc | 1 + pkgs/sops-pgp-hook/test-assets/keys/key.gpg | Bin 0 -> 1815 bytes pkgs/sops-pgp-hook/test-assets/shell.nix | 14 +++++ shell.nix | 1 + 10 files changed, 87 insertions(+), 8 deletions(-) create mode 100644 pkgs/sops-pgp-hook/hook_test.go create mode 100644 pkgs/sops-pgp-hook/test-assets/existing-key.gpg create mode 120000 pkgs/sops-pgp-hook/test-assets/keys/key.asc create mode 100644 pkgs/sops-pgp-hook/test-assets/keys/key.gpg create mode 100644 pkgs/sops-pgp-hook/test-assets/shell.nix diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fe0aa40..e007430 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,5 +28,7 @@ jobs: run: nix run nixpkgs.nix-build-uncached -c nix-build-uncached default.nix - name: Add keys group (needed for go tests) run: sudo groupadd keys - - name: Run go tests - run: nix-shell --run "sudo unshare --mount --fork go test ./pkgs/sops-install-secrets" + - name: Run sops-install-secrets tests + run: nix-shell --pure --run "$(command -v sudo) unshare --mount --fork go test ./pkgs/sops-install-secrets" + - name: Run sops-pgp-hook tests + run: nix-shell --pure --run "NIX_PATH=nixpkgs=$(nix-instantiate --find-file nixpkgs) go test ./pkgs/sops-pgp-hook" diff --git a/default.nix b/default.nix index 2b67a87..9b97904 100644 --- a/default.nix +++ b/default.nix @@ -6,6 +6,7 @@ in rec { inherit vendorSha256; }; sops-pgp-hook = pkgs.callPackage ./pkgs/sops-pgp-hook {}; + ssh-to-pgp = pkgs.callPackage ./pkgs/ssh-to-pgp { inherit vendorSha256; }; diff --git a/pkgs/sops-pgp-hook/default.nix b/pkgs/sops-pgp-hook/default.nix index 9384123..56241d4 100644 --- a/pkgs/sops-pgp-hook/default.nix +++ b/pkgs/sops-pgp-hook/default.nix @@ -1,8 +1,8 @@ -{ makeSetupHook, gnupg, sops }: +{ stdenv, makeSetupHook, gnupg, sops, go, nix }: -makeSetupHook { +(makeSetupHook { substitutions = { gpg = "${gnupg}/bin/gpg"; }; deps = [ sops gnupg ]; -} ./sops-pgp-hook.bash +} ./sops-pgp-hook.bash) diff --git a/pkgs/sops-pgp-hook/hook_test.go b/pkgs/sops-pgp-hook/hook_test.go new file mode 100644 index 0000000..6d4f8f2 --- /dev/null +++ b/pkgs/sops-pgp-hook/hook_test.go @@ -0,0 +1,54 @@ +package main + +import ( + "bytes" + "fmt" + "io/ioutil" + "os" + "os/exec" + "path" + "path/filepath" + "runtime" + "strings" + "testing" +) + +// ok fails the test if an err is not nil. +func ok(tb testing.TB, err error) { + if err != nil { + _, file, line, _ := runtime.Caller(1) + fmt.Printf("\033[31m%s:%d: unexpected error: %s\033[39m\n\n", filepath.Base(file), line, err.Error()) + tb.FailNow() + } +} + +func TestShellHook(t *testing.T) { + _, filename, _, _ := runtime.Caller(0) + assets := path.Join(path.Dir(filename), "test-assets") + tempdir, err := ioutil.TempDir("", "testdir") + ok(t, err) + defer os.RemoveAll(tempdir) + + cmd := exec.Command("nix-shell", "shell.nix", "--run", "echo SOPS_PGP_FP=$SOPS_PGP_FP") + cmd.Env = append(os.Environ(), fmt.Sprintf("GNUPGHOME=%s", tempdir)) + var stdoutBuf, stderrBuf bytes.Buffer + cmd.Stdout = &stdoutBuf + cmd.Stderr = &stderrBuf + cmd.Dir = assets + err = cmd.Run() + stdout := string(stdoutBuf.Bytes()) + stderr := string(stderrBuf.Bytes()) + fmt.Printf("$ %s\nstdout: \n%s\nstderr: \n%s\n", strings.Join(cmd.Args, " "), stdout, stderr) + ok(t, err) + + expectedStdout := "SOPS_PGP_FP=C6DA56E69A7C756564A8AFEB4A6B05B714D13EFD,4EC40F8E04A945339F7F7C0032C5225271038E3F,7FB89715AADA920D65D25E63F9BA9DEBD03F57C0" + if strings.Index(stdout, expectedStdout) == -1 { + t.Fatalf("'%v' not in '%v'", expectedStdout, stdout) + } + + expectedStderr := "./non-existing-key.gpg does not exists" + if strings.Index(stderr, expectedStderr) == -1 { + t.Fatalf("'%v' not in '%v'", expectedStderr, stdout) + } + +} diff --git a/pkgs/sops-pgp-hook/sops-pgp-hook.bash b/pkgs/sops-pgp-hook/sops-pgp-hook.bash index dbbd539..5bb0097 100644 --- a/pkgs/sops-pgp-hook/sops-pgp-hook.bash +++ b/pkgs/sops-pgp-hook/sops-pgp-hook.bash @@ -3,18 +3,24 @@ _sopsAddKey() { local fpr fpr=$(@gpg@ --with-fingerprint --with-colons --show-key "$key" \ | awk -F: '$1 == "fpr" { print $10;}') - export SOPS_PGP_FP=''${SOPS_PGP_FP}''${SOPS_PGP_FP:+','}$fpr + if [[ $fpr != "" ]]; then + export SOPS_PGP_FP=''${SOPS_PGP_FP}''${SOPS_PGP_FP:+','}$fpr + fi } sopsPGPHook() { local key dir for key in $sopsPGPKeys; do - _sopsAddKey "$key" + if [[ -f "$key" ]]; then + _sopsAddKey "$key" + else + echo "$key does not exists" >&2 + fi done for dir in $sopsPGPKeyDirs; do while IFS= read -r -d '' key; do _sopsAddKey "$key" - done < <(find "$dir" -type f -name '*.gpg' -o -name '*.asc' -print0) + done < <(find -L "$dir" -type f \( -name '*.gpg' -o -name '*.asc' \) -print0) done } diff --git a/pkgs/sops-pgp-hook/test-assets/existing-key.gpg b/pkgs/sops-pgp-hook/test-assets/existing-key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..eba373876ddadb4d792d45c1b0e633a50bd7044d GIT binary patch literal 1815 zcmX?lWCjZZ0|Nsi55q;R29Esm+Ty3CxJ;fXB);;UsNJ4#A{uulp4eh}p8e>l!@Bz} z*gwtS&DvspNBJ>>+JuAKrY!%sGJ2xllzfir>Z83Ghr^dfMf&M!Ed8$D_M z1qWW-U%bwBeZlIhzZItU&diwoq3m4N#XX`uqBk|g7vGwAHJ%MWpr!j)}(^cMF#{j*qv9L|8VB*F{gKuC&O=8Pdl%aa?2;MBG>z%GQV|_zQ0^z z*Crr`SFCD-NF^|4Q~Fn{{o_10p~Edn1_8kYS!zC6cmUd)sf zuh}~m%Jqi*>(!Was;AUz{cVMRhIvIoYfa2ruP?apKvO4tqU}ka%_rV{4ZE-Q>&B4@ zUw+HX{=b}krAb3#STozMrJHUYpMNMM#cI{wGjY5PoRwd7B_u9(v9oV>d(->CPgbGq zM${`Yb{+cz*B>18^yH51xPOW3)1ui^w?9$eyhdMV{ZW@&yr;5G_og|ooqT9oxP+R5 z@21<=Lm31a85kLO7!H1^V!Cly-@dV4GK7=s!ky(VVjMEJw;l1Ud-@}g=cAxA=R`l2 zB%zhl{5#HN^~_CB?bS}>%GY+w zdmVp&e2%fmwZ*x=Ev6sR4(I3WD?7rq`hU}mh)?yB!p~DJ1LSOzRc6eY_G8^U*>9?9 zH;yDdoVmCvrQ*J}wrsBAO_BNHTbfTTzgkjepRlg$%t6l7wjZ3Yvw~OV331Mwm6FKs zxy)&QgLT>2S)OV&>=7k?rB@ktJu;o?ZmoQcvD#FyF2L-Nyv~Mlch@~9&-}YEJLkny zHik>>x;_U5)_$&D7QVP_;u<%b?wMcAl_u6-zJBaUmy=d;3^T_RIicTsSI_Y2JRn}T z?(81R{#?>GaJLd z2xk4sN8A^xop9NpRcX+d_s1^d=tQGueSK!XFBnUFyQNvQ<}-feKzu0k3SVJxqg^up#45I&ERd~FTI-$O&U|4zP7h_^)gZDpFVX(f=%0=ICcLWv3EHl zvUIj>+{V0kDf`T7+wQ2vGa|3;Z{KkDU~G)Xh1dF~uh!pLiSj*{@wjHeex*S48H zwylfJTcv#>hD-l~?~O;5=e2ScTj)>cj%NQJy=Kk(z$1FoJ6ASopZAlzeRGrioN2xP zc9nK)mklg-h;W%+!N1)6ri~fL%cZ^^s~(G|GQ|si)luB}&1?CI#A>yRyCN61TX6W? qpCBFj_(}WBj)mVEHdt-xY`$rj`&*;5<|NCeZpX`V)r;0Q>;(X;rDsh5 literal 0 HcmV?d00001 diff --git a/pkgs/sops-pgp-hook/test-assets/keys/key.asc b/pkgs/sops-pgp-hook/test-assets/keys/key.asc new file mode 120000 index 0000000..34bc240 --- /dev/null +++ b/pkgs/sops-pgp-hook/test-assets/keys/key.asc @@ -0,0 +1 @@ +../../../sops-install-secrets/test-assets/key.asc \ No newline at end of file diff --git a/pkgs/sops-pgp-hook/test-assets/keys/key.gpg b/pkgs/sops-pgp-hook/test-assets/keys/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..c168d7400078d06ffc04e81b851b888c91ee3ae3 GIT binary patch literal 1815 zcmX?lWCjZZ0|Nsi55uNR@kmyUh@X}!&D(R%Y}1QkUO6j7O1fQn_G0#$^bajh-oBZ( zK{m5zW=dJegTUw|PbW^~Si72Mk5KdV(%8dK)_zi&K6x)k*wRm*Z7zi_aKCxdx~l2l zIr-do51xBo3Eq@lbpGbepo+_XUM0_{@>IH~$=p1RFFs2^Du7+MPdIH zJ$JQO9C5W$d={ZO$x(Fgr8j1MmRx_%JpHox#KYH9mu?mMdjEe+rJuu0t955vSG_s0 zV2hFbSC0vEPAW^bCp+D_durz;W|Lw)d&8UmBJy3ISZ}*^LcI8!{~3i1iDyh>yv?_~ z%FJBk$?v&A_f>x2@{TV7f0dT-JYNv+v{UVm**7~G)f*4>Zs8&m|6hw|TH8Nc78M-QdPsPON}1)K zx7Jr{j$Etqd{k;N`-$=E!%wf<9A>#X@#~)B`kd>N?n*4L`7-GPyKSxeBo!goYST#v zF4pqbI^Ua|bZA}J1~(&r>-(>r*x$9k*!@9-`Ma)=LCMb9nj%Lf3$9A0d$;~O@b!qk zZLwS*x=IJ-zO!{+H3A> zr0|Dlj?h_krh{4+#ixIq@vt|wVD7SI9Jl5w{57`FSvU2?VWSfH>jh3>2|vV_i*GP# zy{}Mj!m;b5;7Q#{lkywiIBG5S6|CL!Ly2~%M7PQO@np)``+IC@ul3dq*@$(WF53c*+;UcyC zA{)cSYUPOuKh@UFZOG=YkBQRw(E7eX;oerkJ)c&)_g)iQWr~|F=!tc4tZ5e|wYOU#p*7H1ZEsv|9A$x5b&6 zzdqbwxp42q2fUM;XRQ{<;L%Wa{SiCWUG2tpmOE=tMZftGQ&wabzWNQr>VMtY`MPWj zx7g>p24CHE=nfEx&feE?*-5;rv3M6~YO& z^10!y3r*`e>;!zfE=|3BC!xf1LZ{=$$VtYM>W4Iv&+?aLFL-k7q4Wb=Zm*hm?ay9y zD9xBvy{_lvm8XAeFKyHlpMU@HyhObpHkYyw`fNFxsW!v&@WaC_6IAT}`Isg?dA@Dw zd@c9rRfbv&>m3u#8(f@^A%Svsoq`N!Tf86=)y_isfp?l7Q z+5J{GeqUag`EJ9D#OviJVv9cSS-@yKc^B8Mty3l+`SL1c%j|g8_4E15y(}GtZwjxH zvGhr)fBB%>zIUnlf(}88Xjj&}{FhftCv^rW8LHgzt)KR!Eh*wji13>Tt%lFh6?cO= z7+&4qk{ojPiluY%TebQ&4%MW~95S~9+iyCh{K)*sSmS#A2G6SY2_bi$?Kvx2l%HRs zU;`o@a`KZCb29RaOY9CEc*G*i$iX1S$^y*r|%Wb~_E0xb)Ovp2??K9!rd%?-0X`TPY zr=MHdxFVLC`3H2(*{j%dY|hTFE6N|vjt;uL#&XgHrJ#?=GjUp%SwXDU0ZEl|{+liyQVr7p7Pm+|Z@%(jaUABbT%UZ+cmYeSLcIHP( zf4k9SY-AbppmG8Wt8+$u16w}pvCSIuWcvAX>3qTt@$-cP*J*QSLjFudWm zGI>97Mzb96)OSf7v+_$$D^2-qe`Q6mq175u!KdL9AE>cdYlZIM|8I0Xhr4{uQeM7& zdk&unQwpA~{&?;?hw8AatedVV=h<`HG`yWTMLV74sbPi3oJM0g!5;^Wmh5|VC{j^9 z=B!LaLy&0O^KX?K-{@(ta+~7WIWusnfWr~tFZ!;vt%sN#KdgQmoA=-K*q8sVmL^e) rEv46<=eGDWH)=s#v{6M@H^a=7lQzpjRzyF^@Y(ct=Fy(F=jQ {}; +mkShell { + sopsPGPKeyDirs = [ + "./keys" + ]; + sopsPGPKeys = [ + "./existing-key.gpg" + "./non-existing-key.gpg" + ]; + nativeBuildInputs = [ + (pkgs.callPackage ../../.. {}).sops-pgp-hook + ]; +} diff --git a/shell.nix b/shell.nix index 7b695f2..7f1bda6 100644 --- a/shell.nix +++ b/shell.nix @@ -6,6 +6,7 @@ pkgs.mkShell { delve gnupg utillinux + nix ]; # delve does not compile with hardening enabled hardeningDisable = [ "all" ];