1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
"""Tests for decryption keys file structure"""
import os
import stat
import pytest
def _get_keys_path():
"""Get decryption_keys.yml path from molecule environment"""
scenario_dir = os.environ.get("MOLECULE_SCENARIO_DIRECTORY")
if scenario_dir:
return os.path.join(scenario_dir, "decryption_keys.yml")
test_dir = os.path.dirname(os.path.abspath(__file__))
return os.path.join(test_dir, "..", "decryption_keys.yml")
def test_decryption_keys_file_exists():
"""Test that decryption_keys.yml exists"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
def test_decryption_keys_file_permissions():
"""Test that decryption_keys.yml has secure permissions"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
file_stat = os.stat(keys_path)
file_mode = stat.S_IMODE(file_stat.st_mode)
assert file_mode == 0o600, (
f"decryption_keys.yml should have 0600 permissions, got {oct(file_mode)}"
)
def test_decryption_keys_structure_single_repo():
"""Test single-repo hosts have correct key format"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
with open(keys_path, "r") as f:
content = f.read()
assert "borg-client_borg-client:" in content, (
"Single repo host should have key named 'hostname_repo_name'"
)
def test_decryption_keys_structure_multi_repo():
"""Test multi-instance hosts have correct key format"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
with open(keys_path, "r") as f:
content = f.read()
assert "borg-client-multi_configs:" in content, (
"Multi-instance host should have key for 'configs' repo"
)
assert "borg-client-multi_home-data:" in content, (
"Multi-instance host should have key for 'home-data' repo"
)
def test_decryption_keys_multi_instance_separate_entries():
"""Test multi-instance hosts have separate keys for each repo"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
with open(keys_path, "r") as f:
content = f.read()
configs_count = content.count("borg-client-multi_configs:")
home_data_count = content.count("borg-client-multi_home-data:")
assert configs_count == 1, (
f"configs key should appear exactly once, found {configs_count}"
)
assert home_data_count == 1, (
f"home-data key should appear exactly once, found {home_data_count}"
)
def test_decryption_keys_contain_paper_key_format():
"""Test that decryption keys use borg paper key format"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
with open(keys_path, "r") as f:
content = f.read()
assert "BORG PAPER KEY" in content, (
"Decryption keys should contain borg paper key format"
)
def test_decryption_keys_all_hosts_present():
"""Test that all expected hosts have keys"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
with open(keys_path, "r") as f:
content = f.read()
expected_keys = [
"borg-client_borg-client:",
"borg-client-multi_configs:",
"borg-client-multi_home-data:",
]
for key in expected_keys:
assert key in content, f"Expected key {key} not found in decryption_keys.yml"
def test_no_keys_for_disabled_export():
"""Test that no decryption keys are exported when disabled"""
keys_path = _get_keys_path()
if not os.path.exists(keys_path):
pytest.skip("decryption_keys.yml not yet generated")
with open(keys_path, "r") as f:
content = f.read()
assert "borg-client-2_borg-client-2:" not in content, (
"Keys should not be exported for borg-client-2 (export disabled)"
)
|
