48 lines
1.6 KiB
Python
48 lines
1.6 KiB
Python
import os
|
|
import shutil
|
|
import subprocess
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
@unittest.skipUnless(
|
|
all(shutil.which(tool) for tool in ("agenix", "age", "ssh-keygen")),
|
|
"requires agenix, age, and ssh-keygen on PATH",
|
|
)
|
|
class AgenixRulesTests(unittest.TestCase):
|
|
def test_decrypt_from_outside_rules_directory(self):
|
|
with tempfile.TemporaryDirectory(prefix="agenix-rules-test-") as raw:
|
|
root = Path(raw)
|
|
secrets = root / "secrets"
|
|
secrets.mkdir()
|
|
elsewhere = root / "elsewhere"
|
|
elsewhere.mkdir()
|
|
key = root / "identity"
|
|
subprocess.run(
|
|
["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", str(key)],
|
|
check=True,
|
|
)
|
|
public_key = key.with_suffix(".pub").read_text().strip()
|
|
rules = secrets / "secrets.nix"
|
|
rules.write_text(
|
|
'{ "knot-env.age".publicKeys = [ "' + public_key + '" ]; }\n'
|
|
)
|
|
plaintext = b"KNOT_MASTER_KEY=" + b"A" * 43 + b"=\n"
|
|
encrypted = subprocess.run(
|
|
["age", "-r", public_key], input=plaintext, capture_output=True, check=True
|
|
)
|
|
(secrets / "knot-env.age").write_bytes(encrypted.stdout)
|
|
result = subprocess.run(
|
|
["agenix", "-d", "knot-env.age", "-i", str(key)],
|
|
cwd=elsewhere,
|
|
env={**os.environ, "AGENIX_RULES": str(rules)},
|
|
capture_output=True,
|
|
check=True,
|
|
)
|
|
self.assertEqual(result.stdout, plaintext)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|