reachableceo
efb6988719
Host FDE is no longer required — only guest (ISO) FDE matters per owner direction. The build host's security posture is the owner's responsibility. The Docker container already isolates the build process. Changes: - run.sh: Removed check_host_fde() function and its call in iso build path - run.sh: Fixed SB key chmod in inline SECUREBOOT_HOOK (C-04 complete) - run.sh: Fixed cache manifest format — no longer capped at 20 files (H-09) - docs/PRD.md: Removed FR-011 Host FDE, renumbered FR-011 = Secure Boot/UKI - docs/COMPLIANCE.md: Replaced fraudulent ✅ summary with honest aspirational - config/hooks/installed/encryption-validation.sh: lsblk discovery (H-06) - src/security-hardening.sh: Synced WiFi blacklist with live hook (M-12) - tests/: Updated 3 test files for guest encryption instead of host FDE - AGENTS.md, README.md, audit docs: Removed host FDE references - STATUS.md: Updated for current state - JOURNAL.md: Added ADR-017 (host FDE not required) 782 tests pass, 0 fail, 0 shellcheck warnings. Reference: DeepReport-2026-05-08.md C-02, C-04, H-06, H-09, M-12 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
133 lines
3.5 KiB
Bash
133 lines
3.5 KiB
Bash
#!/usr/bin/env bats
|
|
# KNEL-Football Unit Tests - run.sh Basic Tests
|
|
# Reference: PRD.md FR-010 (ISO Build Process)
|
|
# Copyright © 2026 Known Element Enterprises LLC
|
|
# License: GNU Affero General Public License v3.0 only
|
|
|
|
# =============================================================================
|
|
# File Existence and Properties
|
|
# =============================================================================
|
|
|
|
@test "run.sh exists" {
|
|
[ -f "/workspace/run.sh" ]
|
|
}
|
|
|
|
@test "run.sh is executable" {
|
|
[ -x "/workspace/run.sh" ]
|
|
}
|
|
|
|
@test "run.sh is a valid bash script" {
|
|
run bash -n /workspace/run.sh
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "run.sh uses strict mode" {
|
|
grep -q "set -euo pipefail" /workspace/run.sh
|
|
}
|
|
|
|
# =============================================================================
|
|
# Basic Commands
|
|
# =============================================================================
|
|
|
|
@test "run.sh help command shows usage" {
|
|
run bash /workspace/run.sh help
|
|
[ "$status" -eq 1 ]
|
|
[[ "$output" == *"Usage"* ]] || [[ "$output" == *"Commands"* ]]
|
|
}
|
|
|
|
@test "run.sh help mentions build" {
|
|
run bash /workspace/run.sh help
|
|
[[ "$output" == *"build"* ]]
|
|
}
|
|
|
|
@test "run.sh help mentions test" {
|
|
run bash /workspace/run.sh help
|
|
[[ "$output" == *"test"* ]]
|
|
}
|
|
|
|
@test "run.sh help mentions iso" {
|
|
run bash /workspace/run.sh help
|
|
[[ "$output" == *"iso"* ]]
|
|
}
|
|
|
|
@test "run.sh without arguments shows usage" {
|
|
run bash /workspace/run.sh
|
|
[ "$status" -eq 1 ]
|
|
}
|
|
|
|
# =============================================================================
|
|
# Docker Integration
|
|
# =============================================================================
|
|
|
|
@test "run.sh uses Docker image knel-football-dev" {
|
|
grep -q "knel-football-dev" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh mounts workspace in Docker" {
|
|
grep -q "/workspace" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh mounts output directory in Docker" {
|
|
grep -q "/output" /workspace/run.sh
|
|
}
|
|
|
|
# =============================================================================
|
|
# Test Commands
|
|
# =============================================================================
|
|
|
|
@test "run.sh has test:unit command" {
|
|
grep -q "test:unit)" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has test:integration command" {
|
|
grep -q "test:integration)" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has test:security command" {
|
|
grep -q "test:security)" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has test:system command" {
|
|
grep -q "test:system)" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has lint command" {
|
|
grep -q "lint)" /workspace/run.sh
|
|
}
|
|
|
|
# =============================================================================
|
|
# VM Test Commands
|
|
# =============================================================================
|
|
|
|
@test "run.sh has test:iso command" {
|
|
grep -q "test:iso)" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh test:iso checks prerequisites" {
|
|
grep -q "vm_check_prerequisites" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has VM create command" {
|
|
grep -q "vm_create" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has VM destroy command" {
|
|
grep -q "vm_destroy" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has VM console command" {
|
|
grep -q "vm_console" /workspace/run.sh
|
|
}
|
|
|
|
@test "run.sh has VM status command" {
|
|
grep -q "vm_status" /workspace/run.sh
|
|
}
|
|
|
|
# =============================================================================
|
|
# Security Requirements
|
|
# =============================================================================
|
|
|
|
@test "run.sh references guest FDE (LUKS2) for iso command" {
|
|
grep -A 15 -F 'iso|iso:demo)' /workspace/run.sh | grep -qi "luks\|encryption"
|
|
}
|