mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-09-28 09:11:11 -07:00
65 lines
2.5 KiB
Python
65 lines
2.5 KiB
Python
# Copyright 2026 514 LLC d/b/a OpenGlow
|
|
# Written by Scott Wiederhold
|
|
# https://community.openglow.org
|
|
# SPDX-License-Identifier: MIT
|
|
|
|
"""The release artifact carries no machine identity (redact.py).
|
|
|
|
The artifact is committed to a public repository. These hold the exporter
|
|
to that, and to not redacting what the gate recomputes.
|
|
"""
|
|
import json
|
|
import unittest
|
|
|
|
from forgetest.redact import scrub
|
|
|
|
|
|
class RedactTests(unittest.TestCase):
|
|
|
|
def test_keyed_identity_is_replaced(self):
|
|
out = scrub({"gf_serial": "15232020", "machine_id": "JTY-876",
|
|
"hostname": "forgefirm-b00a"})
|
|
self.assertNotIn("15232020", json.dumps(out))
|
|
self.assertNotIn("JTY-876", json.dumps(out))
|
|
self.assertNotIn("forgefirm-b00a", json.dumps(out))
|
|
|
|
def test_a_known_value_is_replaced_in_free_text_too(self):
|
|
# A hostname in a log line is the same leak as one in its own field.
|
|
out = scrub({"evidence": {"hostname": "forgefirm-b00a"},
|
|
"log": ["set hostname 'forgefirm-b00a' ok"]})
|
|
self.assertNotIn("forgefirm-b00a", json.dumps(out))
|
|
|
|
def test_addresses_and_macs_go(self):
|
|
out = scrub(["ping 172.16.1.97", "wlan0 2C:6B:7D:0D:B0:0A up"])
|
|
t = json.dumps(out)
|
|
self.assertNotIn("172.16.1.97", t)
|
|
self.assertNotIn("2C:6B:7D:0D:B0:0A", t)
|
|
|
|
def test_loopback_is_kept(self):
|
|
self.assertIn("127.0.0.1", json.dumps(scrub(["curl http://127.0.0.1:8090/"])))
|
|
|
|
def test_numbering_is_stable_within_an_export(self):
|
|
out = scrub(["a 10.0.0.5", "b 10.0.0.6", "c 10.0.0.5"])
|
|
self.assertEqual(out[0].split()[1], out[2].split()[1])
|
|
self.assertNotEqual(out[0].split()[1], out[1].split()[1])
|
|
|
|
def test_integrity_values_survive(self):
|
|
# The gate recomputes these; a long hex blob is what they look like.
|
|
rec = {"fingerprint": "a" * 64, "manifest_sha": "b" * 64,
|
|
"source_sha": "c" * 64, "sha256": "d" * 64,
|
|
"catalog_hash": "e" * 64, "identity_sha": "f" * 64}
|
|
self.assertEqual(scrub(rec), rec)
|
|
|
|
def test_a_clock_time_is_not_an_address(self):
|
|
out = scrub(["2026-09-18T18:50:11Z baseline: pre: clean"])
|
|
self.assertIn("18:50:11", out[0])
|
|
|
|
def test_result_fields_the_gate_reads_are_untouched(self):
|
|
rec = {"result": "PASS", "ts": "2026-09-18T18:50:11Z",
|
|
"campaign": "c-1", "fingerprint": "a" * 64}
|
|
self.assertEqual(scrub(rec), rec)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|