Fixed artifact exporter

forgetest/tests/test_redact.py

@@ -0,0 +1,64 @@
+# Copyright 2026 514 LLC d/b/a OpenGlow
+# Written by Scott Wiederhold
+# https://community.openglow.org
+# SPDX-License-Identifier:    MIT
+
+"""The release artifact carries no machine identity (redact.py).
+
+The artifact is committed to a public repository. These hold the exporter
+to that, and to not redacting what the gate recomputes.
+"""
+import json
+import unittest
+
+from forgetest.redact import scrub
+
+
+class RedactTests(unittest.TestCase):
+
+    def test_keyed_identity_is_replaced(self):
+        out = scrub({"gf_serial": "15232020", "machine_id": "JTY-876",
+                     "hostname": "forgefirm-b00a"})
+        self.assertNotIn("15232020", json.dumps(out))
+        self.assertNotIn("JTY-876", json.dumps(out))
+        self.assertNotIn("forgefirm-b00a", json.dumps(out))
+
+    def test_a_known_value_is_replaced_in_free_text_too(self):
+        # A hostname in a log line is the same leak as one in its own field.
+        out = scrub({"evidence": {"hostname": "forgefirm-b00a"},
+                     "log": ["set hostname 'forgefirm-b00a' ok"]})
+        self.assertNotIn("forgefirm-b00a", json.dumps(out))
+
+    def test_addresses_and_macs_go(self):
+        out = scrub(["ping 172.16.1.97", "wlan0 2C:6B:7D:0D:B0:0A up"])
+        t = json.dumps(out)
+        self.assertNotIn("172.16.1.97", t)
+        self.assertNotIn("2C:6B:7D:0D:B0:0A", t)
+
+    def test_loopback_is_kept(self):
+        self.assertIn("127.0.0.1", json.dumps(scrub(["curl http://127.0.0.1:8090/"])))
+
+    def test_numbering_is_stable_within_an_export(self):
+        out = scrub(["a 10.0.0.5", "b 10.0.0.6", "c 10.0.0.5"])
+        self.assertEqual(out[0].split()[1], out[2].split()[1])
+        self.assertNotEqual(out[0].split()[1], out[1].split()[1])
+
+    def test_integrity_values_survive(self):
+        # The gate recomputes these; a long hex blob is what they look like.
+        rec = {"fingerprint": "a" * 64, "manifest_sha": "b" * 64,
+               "source_sha": "c" * 64, "sha256": "d" * 64,
+               "catalog_hash": "e" * 64, "identity_sha": "f" * 64}
+        self.assertEqual(scrub(rec), rec)
+
+    def test_a_clock_time_is_not_an_address(self):
+        out = scrub(["2026-09-18T18:50:11Z baseline: pre: clean"])
+        self.assertIn("18:50:11", out[0])
+
+    def test_result_fields_the_gate_reads_are_untouched(self):
+        rec = {"result": "PASS", "ts": "2026-09-18T18:50:11Z",
+               "campaign": "c-1", "fingerprint": "a" * 64}
+        self.assertEqual(scrub(rec), rec)
+
+
+if __name__ == "__main__":
+    unittest.main()