Establish public verified release boundary

test/installer_e2e.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+# req: installer/001, installer/002, installer/003, installer/004, installer/006 test
+import hashlib
+import http.server
+import os
+from pathlib import Path
+import socketserver
+import subprocess
+import tempfile
+import threading
+
+ROOT = Path(__file__).resolve().parents[1]
+TARGET = "x86_64-linux-musl"
+
+
+def sha(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+with tempfile.TemporaryDirectory() as raw:
+    tmp = Path(raw)
+    server_root = tmp / "server"
+    ink_release = server_root / "releases" / "v-test" / "ink"
+    tools_release = server_root / "releases" / "v-tools" / "toolset"
+    ink_release.mkdir(parents=True)
+    tools_release.mkdir(parents=True)
+
+    ink_asset = ink_release / f"ink-{TARGET}"
+    ink_asset.write_text("#!/bin/sh\necho ink\n")
+    os.chmod(ink_asset, 0o755)
+    (ink_release / "ink-SHA256SUMS").write_text(f"{sha(ink_asset)}  {ink_asset.name}\n")
+
+    rows = []
+    for name, group in (("facts", "text"), ("lines", "text"), ("httpget", "web"), ("gitstatus", "git")):
+        asset = tools_release / f"{name}-{TARGET}"
+        asset.write_text(f"#!/bin/sh\necho {name}\n")
+        os.chmod(asset, 0o755)
+        rows.append(("tmk241/ink-toolset", "fixture-commit", name, group, TARGET, asset.stat().st_size, sha(asset), asset.name))
+
+    manifest_name = f"ink-toolset-v-tools-{TARGET}.manifest.tsv"
+    manifest = tools_release / manifest_name
+    manifest.write_text("source_repository\tsource_commit\texecutable\tset\ttarget\tbytes\tsha256\tasset\n" + "".join("\t".join(map(str, row)) + "\n" for row in rows))
+    sums = [f"{sha(tools_release / row[7])}  {row[7]}\n" for row in rows]
+    sums.append(f"{sha(manifest)}  {manifest.name}\n")
+    (tools_release / "ink-toolset-SHA256SUMS").write_text("".join(sums))
+
+    class Quiet(http.server.SimpleHTTPRequestHandler):
+        def log_message(self, *_args):
+            pass
+
+    handler = lambda *args, **kwargs: Quiet(*args, directory=server_root, **kwargs)
+    with socketserver.TCPServer(("127.0.0.1", 0), handler) as server:
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        port = server.server_address[1]
+        prefix = tmp / "prefix"
+        home = tmp / "home"
+        home.mkdir()
+        policy = home / "policy.tsv"
+        policy.write_text("sentinel\n")
+        env = {
+            **os.environ,
+            "HOME": str(home),
+            "INK_RELEASE_BASE": f"http://127.0.0.1:{port}",
+        }
+        result = subprocess.run(
+            ["/bin/sh", str(ROOT / "install.sh"), "--ink-version", "v-test", "--toolset-version", "v-tools", "--set", "text", "--tool", "httpget", "--prefix", str(prefix), "--yes"],
+            env=env,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+        )
+        server.shutdown()
+
+    assert result.returncode == 0, result.stderr
+    assert sorted(path.name for path in (prefix / "bin").iterdir()) == ["facts", "httpget", "ink", "lines"]
+    assert subprocess.check_output([prefix / "bin" / "ink"], text=True).strip() == "ink"
+    assert not (prefix / "bin" / "gitstatus").exists()
+    assert policy.read_text() == "sentinel\n"
+    assert not (home / ".profile").exists()