mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-07-06 17:13:24 -05:00
106 lines
2.5 KiB
Nix
106 lines
2.5 KiB
Nix
{
|
|
lib,
|
|
pkgs,
|
|
mechanism,
|
|
...
|
|
}:
|
|
|
|
let
|
|
secret = ''
|
|
foo
|
|
bar
|
|
baz
|
|
'';
|
|
secret-file = "bar";
|
|
|
|
common-credentials = {
|
|
secret-default-mechanism = {
|
|
text = "default-mechanism";
|
|
};
|
|
secret-file-nix-store = {
|
|
source = pkgs.writeText "secret-file-nix-store" secret-file;
|
|
};
|
|
secret-file-host = {
|
|
source = "./secret-file-host";
|
|
};
|
|
secret-file-host-binary = {
|
|
source = "./secret-file-host-binary";
|
|
};
|
|
};
|
|
in
|
|
|
|
{
|
|
name = "credentials-${mechanism}";
|
|
|
|
meta.maintainers = with lib.maintainers; [ arianvp ];
|
|
|
|
# No VM<->container traffic in this test; credentials are static.
|
|
requiredFeatures.devnet = lib.mkForce false;
|
|
|
|
nodes.vm = {
|
|
virtualisation.credentials = common-credentials // {
|
|
secret = {
|
|
inherit mechanism;
|
|
text = secret;
|
|
};
|
|
};
|
|
};
|
|
|
|
containers.container = {
|
|
virtualisation.credentials = common-credentials // {
|
|
secret = {
|
|
text = secret;
|
|
};
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
import base64
|
|
|
|
secret_file_host = "baz"
|
|
# Binary data with null bytes, high bytes, and other problematic characters.
|
|
secret_file_host_binary = bytes([
|
|
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
|
|
0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
|
|
0xDE, 0xAD, 0xBE, 0xEF,
|
|
0xFF, 0xFE, 0xFD, 0xFC,
|
|
0x00, 0x00, 0x00, 0x00,
|
|
0x80, 0x81, 0x82, 0x83,
|
|
])
|
|
|
|
def assert_credentials(m):
|
|
with open(m.state_dir / "secret-file-host", "w") as f:
|
|
f.write(secret_file_host)
|
|
with open(m.state_dir / "secret-file-host-binary", "wb") as f2:
|
|
f2.write(secret_file_host_binary)
|
|
|
|
t.assertEqual(
|
|
m.succeed("systemd-creds --system cat secret").strip(),
|
|
"foo\nbar\nbaz",
|
|
)
|
|
t.assertEqual(
|
|
m.succeed("systemd-creds --system cat secret-default-mechanism").strip(),
|
|
"default-mechanism",
|
|
)
|
|
t.assertEqual(
|
|
m.succeed("systemd-creds --system cat secret-file-nix-store").strip(),
|
|
"${secret-file}",
|
|
)
|
|
t.assertEqual(
|
|
m.succeed("systemd-creds --system cat secret-file-host").strip(),
|
|
secret_file_host,
|
|
)
|
|
result = m.succeed(
|
|
"systemd-creds --system cat secret-file-host-binary --transcode=base64"
|
|
).strip()
|
|
expected = base64.b64encode(secret_file_host_binary).decode("ascii")
|
|
t.assertEqual(
|
|
result,
|
|
expected,
|
|
f"Binary credential mismatch: got {result}, expected {expected}",
|
|
)
|
|
|
|
assert_credentials(vm)
|
|
assert_credentials(container)
|
|
'';
|
|
}
|