release: implement site registry v0.4 trust pipeline

This commit is contained in:
Nic Weyand 2026-09-13 12:22:05 -04:00
commit e26efc19fa
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
67 changed files with 10698 additions and 640 deletions

View file

@ -45,6 +45,8 @@ class SourceReleaseTests(unittest.TestCase):
"LICENSE": "Synthetic code license fixture\n",
"UPSTREAM.json": "{}\n",
"crates/argand-site-registry/LICENSE_SOURCES.md": "Synthetic source terms\n",
"crates/argand-site-registry/examples/observer.env": "ARGAND_REGISTRY_PIN=fixture\n",
"crates/argand-site-registry/tests/fixtures/v03-contract.json": "{}\n",
"src/lib.rs": "// Synthetic Rust source\n",
"src/.gitignore": "*.temporary\n",
}
@ -129,8 +131,12 @@ class SourceReleaseTests(unittest.TestCase):
release.verify(self.output, release.digest(encoded))
def test_special_source_paths_refused(self):
release.safe_path("crates/argand-site-registry/examples/observer.env")
release.safe_path("crates/argand-site-registry/tests/fixtures/v03-contract.json")
for path in ("/tmp/a.rs", "a/../b.rs", "a//b.rs", "a\\b.rs", "data/a.md",
".git/config.toml", "secret.key", "x\na.rs"):
".git/config.toml", "secret.key", "secrets.env",
"config/observer.env", "other.json", "fixtures/provider.json",
"x\na.rs"):
with self.subTest(path=path), self.assertRaises(ValueError):
release.safe_path(path)