2026-10-01 23:08:50 +02:00
|
|
|
"""Keep public package sources and release inclusion rules free of case data."""
|
|
|
|
|
|
|
|
|
|
import json
|
|
|
|
|
import re
|
|
|
|
|
import tomllib
|
|
|
|
|
import unittest
|
|
|
|
|
from importlib.resources import files
|
|
|
|
|
from pathlib import Path
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class ReleaseHygieneTests(unittest.TestCase):
|
|
|
|
|
def test_public_package_and_explicit_release_allowlist(self) -> None:
|
|
|
|
|
package = files("netscaler_triage")
|
|
|
|
|
personal = re.compile(
|
|
|
|
|
r"/(?:Users|home)/[^\s/]+|[A-Za-z]:[\\/]Users[\\/][^\s\\/]+"
|
|
|
|
|
r"|(?im:^[ \t]*(?:Bearbeitung|Prepared by|Analyst|Investigator|Customer|Case ID)\s*:)"
|
|
|
|
|
)
|
|
|
|
|
stack = [package]
|
|
|
|
|
while stack:
|
|
|
|
|
directory = stack.pop()
|
|
|
|
|
for entry in directory.iterdir():
|
|
|
|
|
if entry.is_dir() and entry.name != "__pycache__":
|
|
|
|
|
stack.append(entry)
|
|
|
|
|
elif entry.name.endswith((".py", ".json", ".yml", ".yaml")):
|
|
|
|
|
self.assertIsNone(
|
|
|
|
|
personal.search(entry.read_text(encoding="utf-8")), entry.name
|
|
|
|
|
)
|
|
|
|
|
public = json.loads(package.joinpath("data", "threat_intel.json").read_text())
|
|
|
|
|
sources = {entry["id"] for entry in public["sources"]}
|
|
|
|
|
for indicator in public["indicators"]:
|
|
|
|
|
self.assertEqual(indicator["status"], "reference_only")
|
|
|
|
|
self.assertTrue(set(indicator["source_ids"]) <= sources)
|
|
|
|
|
|
|
|
|
|
# Installed-wheel tests lack repository metadata; package checks above still run.
|
|
|
|
|
project = Path(__file__).resolve().parents[1] / "pyproject.toml"
|
|
|
|
|
if project.is_file():
|
|
|
|
|
config = tomllib.loads(project.read_text(encoding="utf-8"))
|
|
|
|
|
allowed = {
|
|
|
|
|
"src/",
|
|
|
|
|
"tests/",
|
|
|
|
|
"typing_stubs/",
|
|
|
|
|
"examples/",
|
|
|
|
|
"README.md",
|
|
|
|
|
"RULES.txt",
|
|
|
|
|
"VALIDATION.txt",
|
|
|
|
|
"THREAT_INTELLIGENCE.txt",
|
2026-10-05 14:13:39 +02:00
|
|
|
"FILESYSTEM_COVERAGE.txt",
|
|
|
|
|
"scripts/analyze_filesystem_exports.py",
|
2026-10-01 23:08:50 +02:00
|
|
|
"LICENSE.txt",
|
|
|
|
|
"config/threat_intel.json",
|
|
|
|
|
"uv.lock",
|
|
|
|
|
".python-version",
|
|
|
|
|
".gitignore",
|
|
|
|
|
"pyproject.toml",
|
|
|
|
|
}
|
|
|
|
|
ignore = (project.parent / ".gitignore").read_text().splitlines()
|
|
|
|
|
self.assertTrue({"private/", "/private/"} & set(ignore))
|
|
|
|
|
included = set(config["tool"]["hatch"]["build"]["targets"]["sdist"]["include"])
|
|
|
|
|
self.assertFalse(any("private" in entry for entry in included))
|
|
|
|
|
self.assertTrue(
|
|
|
|
|
included <= allowed, f"Unreviewed release include entries: {included - allowed}"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
|
unittest.main()
|
