"""Config, security advisories, baselines and the drill-down payload.
These four modules are the contract the Go TUI reads, so the tests are mostly
about shape and honesty: does the payload say which baseline it used, does the
advisory sort put fixable first, does a corrupt config fall back rather than
explode.
"""
from __future__ import annotations
import json
import sys
import tempfile
from pathlib import Path
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
from updater import changes, config, detail, security # noqa: E402
CLONE = Path.home() / ".cache/paru/clone"
# --------------------------------------------------------------------------
# config
# --------------------------------------------------------------------------
def test_config_round_trips_and_persists_ignores():
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
cfg = config.Config.load(path)
assert cfg.ignored == [] and not cfg.is_ignored("linux")
cfg.ignore("linux")
cfg.ignore("mesa")
cfg.ignore("linux") # idempotent
cfg.save(path)
again = config.Config.load(path)
assert again.ignored == ["linux", "mesa"]
assert again.is_ignored("linux")
again.unignore("linux")
assert not again.is_ignored("linux")
def test_config_toggle_reports_the_new_state():
cfg = config.Config()
assert cfg.toggle_ignored("vim") is True
assert cfg.is_ignored("vim")
assert cfg.toggle_ignored("vim") is False
assert not cfg.is_ignored("vim")
def test_config_survives_a_corrupt_file():
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
path.write_text("{ this is not json at all")
cfg = config.Config.load(path)
assert cfg.ignored == []
cfg.ignore("x")
cfg.save(path)
assert config.Config.load(path).ignored == ["x"]
def test_config_ignores_unknown_fields_from_a_newer_version():
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
path.write_text(json.dumps({"ignored": ["a"], "something_new": 42}))
cfg = config.Config.load(path)
assert cfg.ignored == ["a"]
def test_config_save_is_atomic():
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
cfg = config.Config()
cfg.ignore("a")
cfg.save(path)
assert path.is_file()
assert not list(Path(td).glob("*.tmp")), "a temp file was left behind"
def test_advisory_acknowledgements_round_trip():
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
cfg = config.Config.load(path)
assert cfg.acked == [] and not cfg.is_acked("AVG-1")
cfg.ack("AVG-1")
cfg.ack("AVG-2")
cfg.ack("AVG-1") # idempotent
cfg.save(path)
again = config.Config.load(path)
assert again.acked == ["AVG-1", "AVG-2"], again.acked
assert again.is_acked("AVG-2")
again.unack("AVG-2")
assert not again.is_acked("AVG-2")
def test_clearing_acks_reports_how_many_there_were():
cfg = config.Config()
cfg.ack("AVG-1")
cfg.ack("AVG-2")
assert cfg.clear_acks() == 2
assert cfg.acked == []
assert cfg.clear_acks() == 0
def test_acks_and_ignores_do_not_clobber_each_other():
"""Both live in one file and are written by different code paths."""
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
cfg = config.Config.load(path)
cfg.ignore("linux")
cfg.ack("AVG-1")
cfg.save(path)
again = config.Config.load(path)
assert again.ignored == ["linux"], again.ignored
assert again.acked == ["AVG-1"], again.acked
# and a Go-style write that only knows about one of them must not drop
# the other: both are read back from the same document
again.unack("AVG-1")
again.save(path)
final = config.Config.load(path)
assert final.ignored == ["linux"]
assert final.acked == []
def test_a_config_without_acks_loads_cleanly():
"""Forward compatibility: the field is new."""
with tempfile.TemporaryDirectory() as td:
path = Path(td) / "config.json"
path.write_text('{"ignored": ["a"], "color_accent": "13"}')
cfg = config.Config.load(path)
assert cfg.acked == []
assert cfg.ignored == ["a"]
assert cfg.color_accent == "13"
def test_config_colours_are_ansi_slots_not_hex():
"""The terminal decides what a slot looks like; a hex value would not."""
cfg = config.Config()
for name in (
"color_accent",
"color_muted",
"color_ok",
"color_warn",
"color_alert",
"color_new",
"color_ver",
):
value = getattr(cfg, name)
assert value.isdigit() and 0 <= int(value) <= 15, (name, value)
# --------------------------------------------------------------------------
# advisories
# --------------------------------------------------------------------------
RAW = [
{
"name": "AVG-1",
"packages": ["libtiff"],
"severity": "High risk",
"status": "Unknown",
"type": "unknown",
"fixed": None,
"issues": ["CVE-2022-1", "CVE-2022-2"],
},
{
"name": "AVG-2",
"packages": ["linux-lts", "linux"],
"severity": "Medium risk",
"status": "Vulnerable",
"type": "dos",
"fixed": "6.16.9-1",
"issues": ["CVE-2022-3"],
},
{
"name": "AVG-3",
"packages": ["linux"],
"severity": "Critical risk",
"status": "Fixed",
"type": "rce",
"fixed": "6.16.10-1",
"issues": ["CVE-2022-4"],
},
]
def report(raw=None) -> security.Vulnerabilities:
return security.Vulnerabilities(
available=True, advisories=[security.Advisory.from_json(r) for r in (raw or RAW)]
)
def test_advisory_parses_the_arch_audit_json_shape():
a = security.Advisory.from_json(RAW[1])
assert a.id == "AVG-2"
assert a.packages == ("linux-lts", "linux")
assert a.has_fix and a.fixed == "6.16.9-1"
assert a.url == "https://security.archlinux.org/AVG-2"
assert a.issues == ("CVE-2022-3",)
assert not security.Advisory.from_json(RAW[0]).has_fix
def test_fixable_and_unfixable_are_derived_from_the_advisories():
v = report()
assert v.fixable == ["linux", "linux-lts"]
assert v.unfixable == ["libtiff"]
assert v.total == 3
def test_advisories_sort_fixable_first_then_severity():
"""An update can only resolve the fixable ones, so those belong at the top."""
order = [a.id for a in report().sorted_advisories()]
# both fixable ones first, worst severity leading, unfixable last
assert order == ["AVG-3", "AVG-2", "AVG-1"], order
def test_severity_ranking_is_worst_first():
rank = lambda sev: (
security.Advisory.from_json( # noqa: E731
{"name": "x", "severity": sev}
).severity_rank
)
ordered = [
rank(s) for s in ("Critical risk", "High risk", "Medium risk", "Low risk", "Unknown")
]
assert ordered == sorted(ordered), ordered
assert ordered[0] == 0
# anything unrecognised sorts last rather than silently ranking as safe
assert rank("nonsense") == len(security.SEVERITY_ORDER)
def test_by_package_groups_multi_package_advisories():
grouped = report().by_package
assert len(grouped["linux"]) == 2
assert len(grouped["linux-lts"]) == 1
assert [a.id for a in report().for_package("linux")] == ["AVG-3", "AVG-2"]
def test_an_empty_advisory_list_is_clean_not_broken():
v = security.Vulnerabilities(available=True)
assert v.clean and v.total == 0 and v.advisories == []
def test_unavailable_security_is_reported_not_silently_clean():
v = security.Vulnerabilities(available=False, reason="arch-audit is not installed")
assert not v.clean, "an unavailable scan must not look like a clean bill of health"
assert v.reason
def test_scan_never_raises_even_when_arch_audit_is_missing(monkeypatch=None):
v = security.scan(timeout=5)
assert isinstance(v, security.Vulnerabilities)
if not v.available:
assert v.reason
# --------------------------------------------------------------------------
# baselines
# --------------------------------------------------------------------------
def test_split_version_handles_epoch_and_pkgrel():
assert changes.split_version("1.2.3-4") == ("1.2.3", "4", "")
assert changes.split_version("1:2.3.4-5") == ("2.3.4", "5", "1")
assert changes.split_version("r893.96ab414-1") == ("r893.96ab414", "1", "")
assert changes.split_version("1.0") == ("1.0", "", "")
def test_recorded_baseline_wins_over_the_version_search():
if not (CLONE / "android-studio").is_dir():
return
head = changes.head(CLONE / "android-studio")
commit, how = changes.baseline(CLONE, "android-studio", "2026.1.4.8-2", head.sha)
assert how == "recorded" and commit == head.sha
def test_version_baseline_is_reconstructed_from_git_history():
"""This is what makes a diff possible before the tool has ever been run."""
if not (CLONE / "aescrypt").is_dir():
return
repo = CLONE / "aescrypt"
older = changes.history(repo, "PKGBUILD", limit=6)[2]
body = changes.show(repo, older.sha, "PKGBUILD")
from updater.srcinfo import parse_pkgbuild
version = parse_pkgbuild(body).one("pkgver")
assert version
commit, how = changes.baseline(CLONE, "aescrypt", f"{version}-1")
assert how == "version" and commit
# the contract is "the newest commit that declares this pkgver", not a
# specific sha: several commits may share a pkgver and differ only in pkgrel
from updater.srcinfo import parse_pkgbuild as parse
declared = parse(changes.show(repo, commit, "PKGBUILD")).one("pkgver")
assert declared == version, f"returned a commit declaring {declared!r}"
def test_no_baseline_is_reported_as_such_rather_than_guessed():
commit, how = changes.baseline(Path("/definitely/not/here"), "nope", "1.0-1")
assert commit == ""
assert how == "missing", "no clone at all is distinct from a history miss"
def test_a_history_miss_is_distinct_from_a_missing_clone():
"""These read the same to the user only if the tool is being lazy.
'paru never downloaded this' and 'your installed version is not in the
history' call for different things: one is worth fetching, the other is not.
"""
if not (CLONE / "aescrypt").is_dir():
return
_, missing = changes.baseline(Path("/definitely/not/here"), "aescrypt", "1.0-1")
_, miss = changes.baseline(CLONE, "aescrypt", "0.0.1-does-not-exist")
assert missing == "missing"
assert miss == "", f"expected a history miss, got {miss!r}"
assert missing != miss
def test_diff_against_returns_both_sides():
if not (CLONE / "aescrypt").is_dir():
return
repo = CLONE / "aescrypt"
older = changes.history(repo, "PKGBUILD", limit=6)[2]
old, new = changes.diff_against(CLONE, "aescrypt", older.sha)
assert old and new
assert old != new
# --------------------------------------------------------------------------
# the drill-down payload
# --------------------------------------------------------------------------
def test_diff_lines_are_lines_not_characters():
"""The first version sliced the original string and emitted one char per row."""
lines = detail.diff_lines("a\nb\nc\n", "a\nB\nc\n")
texts = [l["text"] for l in lines if l["kind"] != "gap"]
assert texts == ["a", "b", "c", "B"] or "b" in texts and "B" in texts
assert all(len(l["text"]) <= 2 for l in lines), "a multi-char line leaked"
assert any(l["kind"] == "del" and l["old"] == 2 for l in lines)
assert any(l["kind"] == "add" and l["new"] == 2 for l in lines)
def test_diff_lines_marks_gaps_between_hunks():
old = "\n".join(f"line{i}" for i in range(40))
new = old.replace("line0", "CHANGED").replace("line39", "ALSO")
lines = detail.diff_lines(old, new)
assert any(l["kind"] == "gap" for l in lines)
assert sum(1 for l in lines if l["kind"] == "add") == 2
assert sum(1 for l in lines if l["kind"] == "del") == 2
def test_package_detail_shape_for_a_real_package():
if not (CLONE / "aescrypt").is_dir():
return
payload = detail.package_detail(CLONE, "aescrypt", installed="4.5.0-1", available="4.6.0-1")
for key in (
"package",
"installed",
"available",
"baseline_how",
"baseline_note",
"diff",
"findings",
"verdict",
"meta",
"advisories",
):
assert key in payload, key
assert payload["baseline_how"] in ("recorded", "version", "")
assert payload["baseline_note"], "an empty baseline must explain itself"
def test_package_detail_without_a_baseline_offers_a_reference_listing():
if not (CLONE / "aescrypt").is_dir():
return
payload = detail.package_detail(CLONE, "aescrypt", installed="0.0.1-1")
assert payload["baseline_how"] == ""
assert payload["diff"]["lines"] or payload.get("pkgbuild"), "nothing to show at all"
if not payload["diff"]["lines"]:
assert payload["pkgbuild"], "no diff and no reference listing"
def test_package_detail_is_json_serialisable():
if not (CLONE / "aescrypt").is_dir():
return
payload = detail.package_detail(CLONE, "aescrypt", installed="4.5.0-1")
assert json.loads(json.dumps(payload)) == payload
def test_advisory_detail_is_json_serialisable():
payload = detail.advisory_detail(security.Advisory.from_json(RAW[1]))
assert json.loads(json.dumps(payload)) == payload
assert payload["url"].endswith("AVG-2")
assert payload["packages"] == ["linux-lts", "linux"]
def test_summary_line_describes_the_change():
assert "finding" in detail.summary_line({"findings": [{"severity": "BLOCK"}], "diff": {}})
assert "-1" in detail.summary_line({"findings": [], "diff": {"added": 2, "removed": 1}})
assert detail.summary_line({"findings": [], "diff": {}}) == ""
def main() -> int:
tests = [(n, f) for n, f in sorted(globals().items()) if n.startswith("test_") and callable(f)]
failed = 0
for name, fn in tests:
try:
fn()
except Exception as exc: # noqa: BLE001
failed += 1
print(f"FAIL {name}\n {type(exc).__name__}: {exc}")
else:
print(f"ok {name}")
print(f"\n{len(tests) - failed}/{len(tests)} passed")
return 1 if failed else 0
if __name__ == "__main__":
raise SystemExit(main())