0377e9d814
72df5aa60e dropped HERMES_DISABLE_LAZY_INSTALLS=1 from the image: opt-in
extras install into PM generations under $HERMES_HOME, never the sealed
/opt/hermes tree. The hosted write-policy smoke test still required the
refusal, so the desktop/amd64 image job failed. Assert it is unset.
70 lines
2.2 KiB
Python
70 lines
2.2 KiB
Python
"""Docker smoke tests for immutable install permissions."""
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import textwrap
|
|
|
|
|
|
def test_container_sets_hosted_write_policy_env(built_image: str) -> None:
|
|
script = (
|
|
'test "$HERMES_HOME" = "/opt/data" && '
|
|
'test "$HERMES_WRITE_SAFE_ROOT" = "/opt/data" && '
|
|
# Opt-in extras install into PM generations under $HERMES_HOME, never
|
|
# the sealed /opt/hermes tree, so the image must not refuse them.
|
|
'test -z "${HERMES_DISABLE_LAZY_INSTALLS:-}" && '
|
|
'test "$PYTHONDONTWRITEBYTECODE" = "1"'
|
|
)
|
|
result = subprocess.run(
|
|
["docker", "run", "--rm", "--entrypoint", "sh", built_image, "-c", script],
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=60,
|
|
)
|
|
assert result.returncode == 0, result.stderr[-2000:]
|
|
|
|
|
|
def test_hermes_user_cannot_modify_install_but_can_write_data(built_image: str) -> None:
|
|
script = textwrap.dedent(
|
|
r"""
|
|
set -eu
|
|
/opt/hermes/.venv/bin/python - <<'PY'
|
|
from pathlib import Path
|
|
|
|
install_file = Path("/opt/hermes/agent/message_sanitization.py")
|
|
try:
|
|
with install_file.open("a", encoding="utf-8") as handle:
|
|
handle.write("\n# unexpected hosted mutation\n")
|
|
except PermissionError:
|
|
pass
|
|
else:
|
|
raise SystemExit("install source write unexpectedly succeeded")
|
|
|
|
skill_dir = Path("/opt/data/skills/permission-smoke")
|
|
skill_dir.mkdir(parents=True, exist_ok=True)
|
|
skill_file = skill_dir / "SKILL.md"
|
|
skill_file.write_text("# Permission smoke\n", encoding="utf-8")
|
|
if skill_file.read_text(encoding="utf-8") != "# Permission smoke\n":
|
|
raise SystemExit("data write verification failed")
|
|
PY
|
|
"""
|
|
).strip()
|
|
result = subprocess.run(
|
|
[
|
|
"docker",
|
|
"run",
|
|
"--rm",
|
|
"--entrypoint",
|
|
"su",
|
|
built_image,
|
|
"hermes",
|
|
"-s",
|
|
"/bin/sh",
|
|
"-c",
|
|
script,
|
|
],
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=120,
|
|
)
|
|
assert result.returncode == 0, result.stderr[-2000:]
|