All checks were successful
buildbot/nix-build .#checks.aarch64-darwin.nixos-test_install_machine Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-flash-installer Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-iso-installer Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-test_install_machine Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-iso-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.check-for-breakpoints Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-app-no-breakpoints Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-webview-ui Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-ts-api Build done.
buildbot/nix-build .#checks.x86_64-linux.package-default Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-e2fsprogs Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-test-backup Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-fakeroot Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-git Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-nix Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-cli-docs Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-flash-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-cli Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-apk Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-deb Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-bash Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-archlinux Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-rpm Build done.
buildbot/nix-build .#checks.x86_64-linux.package-module-docs Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-test-backup Build done.
buildbot/nix-build .#checks.x86_64-linux.renderClanOptions Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-test-backup Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-sshpass Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-openssh Build done.
buildbot/nix-build .#checks.x86_64-linux."clan-dep-python3.11-mypy" Build done.
buildbot/nix-build .#checks.x86_64-linux."clan-dep-python3.11-qemu" Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-rsync Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-docs Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-sops Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-zbar Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-age Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-tor Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-inventory-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-clan-cli Build done.
buildbot/nix-build .#checks.x86_64-linux.inventory-schema-checks Build done.
buildbot/nix-build .#checks.x86_64-linux.lib-jsonschema-example-valid Build done.
buildbot/nix-build .#checks.x86_64-linux.container Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-default Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-app-pytest Build done.
buildbot/nix-build .#checks.x86_64-linux.borgbackup Build done.
buildbot/nix-build .#checks.x86_64-linux.matrix-synapse Build done.
buildbot/nix-build .#checks.x86_64-linux.deltachat Build done.
buildbot/nix-build .#checks.x86_64-linux.module-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.package-editor Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-test_install_machine Build done.
buildbot/nix-build .#checks.x86_64-linux.lib-jsonschema-nix-unit-tests Build done.
buildbot/nix-build .#checks.x86_64-linux.package-deploy-docs Build done.
buildbot/nix-build .#checks.x86_64-linux.package-impure-checks Build done.
buildbot/nix-build .#checks.x86_64-linux.package-tea-create-pr Build done.
buildbot/nix-build .#checks.x86_64-linux.treefmt Build done.
buildbot/nix-build .#checks.x86_64-linux.package-inventory-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.package-moonlight-sunshine-accept Build done.
buildbot/nix-build .#checks.x86_64-linux.package-pending-reviews Build done.
buildbot/nix-build .#checks.x86_64-linux.package-merge-after-ci Build done.
buildbot/nix-build .#checks.x86_64-linux.package-zerotier-members Build done.
buildbot/nix-build .#checks.x86_64-linux.package-zerotierone Build done.
buildbot/nix-build .#checks.x86_64-linux.package-zt-tcp-relay Build done.
buildbot/nix-build .#checks.x86_64-linux.postgresql Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-flash-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-iso-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-app Build done.
buildbot/nix-build .#checks.x86_64-linux.package-webview-ui Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-install-test-ubuntu-22-04 Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-pytest-with-core Build done.
buildbot/nix-build .#checks.x86_64-linux.package-docs Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-clan-app Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-pytest-without-core Build done.
buildbot/nix-build .#checks.x86_64-linux.test-backups Build done.
checks / checks-impure (pull_request) Successful in 2m45s
buildbot/nix-build .#checks.x86_64-linux.flash Build done.
buildbot/nix-eval Build done.
buildbot/nix-build .#checks.x86_64-linux.test-installation Build done.
117 lines
3.9 KiB
Python
117 lines
3.9 KiB
Python
import ipaddress
|
|
from typing import TYPE_CHECKING
|
|
|
|
import pytest
|
|
from cli import Cli
|
|
from fixtures_flakes import FlakeForTest
|
|
from validator import is_valid_age_key, is_valid_ssh_key
|
|
|
|
from clan_cli.facts.secret_modules.sops import SecretStore
|
|
from clan_cli.machines.facts import machine_get_fact
|
|
from clan_cli.machines.machines import Machine
|
|
from clan_cli.secrets.folders import sops_secrets_folder
|
|
|
|
if TYPE_CHECKING:
|
|
from age_keys import KeyPair
|
|
|
|
|
|
@pytest.mark.impure
|
|
def test_generate_secret(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
test_flake_with_core: FlakeForTest,
|
|
age_keys: list["KeyPair"],
|
|
) -> None:
|
|
monkeypatch.chdir(test_flake_with_core.path)
|
|
monkeypatch.setenv("SOPS_AGE_KEY", age_keys[0].privkey)
|
|
cli = Cli()
|
|
cli.run(
|
|
[
|
|
"secrets",
|
|
"users",
|
|
"add",
|
|
"--flake",
|
|
str(test_flake_with_core.path),
|
|
"user1",
|
|
age_keys[0].pubkey,
|
|
]
|
|
)
|
|
cli.run(
|
|
[
|
|
"secrets",
|
|
"groups",
|
|
"add-user",
|
|
"--flake",
|
|
str(test_flake_with_core.path),
|
|
"admins",
|
|
"user1",
|
|
]
|
|
)
|
|
cmd = ["facts", "generate", "--flake", str(test_flake_with_core.path), "vm1"]
|
|
cli.run(cmd)
|
|
store1 = SecretStore(Machine(name="vm1", flake=test_flake_with_core.path))
|
|
|
|
assert store1.exists("", "age.key")
|
|
assert store1.exists("", "zerotier-identity-secret")
|
|
network_id = machine_get_fact(
|
|
test_flake_with_core.path, "vm1", "zerotier-network-id"
|
|
)
|
|
assert len(network_id) == 16
|
|
secrets_folder = sops_secrets_folder(test_flake_with_core.path)
|
|
age_key = secrets_folder / "vm1-age.key" / "secret"
|
|
identity_secret = secrets_folder / "vm1-zerotier-identity-secret" / "secret"
|
|
age_key_mtime = age_key.lstat().st_mtime_ns
|
|
secret1_mtime = identity_secret.lstat().st_mtime_ns
|
|
|
|
# Assert that the age key is valid
|
|
age_secret = store1.get("", "age.key").decode()
|
|
assert age_secret.isprintable()
|
|
assert is_valid_age_key(age_secret)
|
|
|
|
# test idempotency for vm1 and also generate for vm2
|
|
cli.run(["facts", "generate", "--flake", str(test_flake_with_core.path)])
|
|
assert age_key.lstat().st_mtime_ns == age_key_mtime
|
|
assert identity_secret.lstat().st_mtime_ns == secret1_mtime
|
|
|
|
assert (
|
|
secrets_folder / "vm1-zerotier-identity-secret" / "machines" / "vm1"
|
|
).exists()
|
|
|
|
store2 = SecretStore(Machine(name="vm2", flake=test_flake_with_core.path))
|
|
|
|
assert store2.exists("", "password")
|
|
assert store2.exists("", "password-hash")
|
|
assert store2.exists("", "user-password")
|
|
assert store2.exists("", "user-password-hash")
|
|
assert store2.exists("", "ssh.id_ed25519")
|
|
assert store2.exists("", "age.key")
|
|
assert store2.exists("", "zerotier-identity-secret")
|
|
|
|
ip = machine_get_fact(test_flake_with_core.path, "vm1", "zerotier-ip")
|
|
assert ipaddress.IPv6Address(ip).is_private
|
|
|
|
# Assert that the age key is valid
|
|
age_secret = store2.get("", "age.key").decode()
|
|
assert age_secret.isprintable()
|
|
assert is_valid_age_key(age_secret)
|
|
|
|
# Assert that the ssh key is valid
|
|
ssh_secret = store2.get("", "ssh.id_ed25519").decode()
|
|
ssh_pub = machine_get_fact(test_flake_with_core.path, "vm2", "ssh.id_ed25519.pub")
|
|
assert is_valid_ssh_key(ssh_secret, ssh_pub)
|
|
|
|
# Assert that root-password is valid
|
|
pwd_secret = store2.get("", "password").decode()
|
|
assert pwd_secret.isprintable()
|
|
assert pwd_secret.isascii()
|
|
pwd_hash = store2.get("", "password-hash").decode()
|
|
assert pwd_hash.isprintable()
|
|
assert pwd_hash.isascii()
|
|
|
|
# Assert that user-password is valid
|
|
pwd_secret = store2.get("", "user-password").decode()
|
|
assert pwd_secret.isprintable()
|
|
assert pwd_secret.isascii()
|
|
pwd_hash = store2.get("", "user-password-hash").decode()
|
|
assert pwd_hash.isprintable()
|
|
assert pwd_hash.isascii()
|