"""构建期授权守护测试：公钥注入 + 私钥泄漏守卫。 对齐 `test_build_plugin.py` 对"插件包不得包含 secret_key"的同类断言 —— **签发私钥绝不能进入部署产物**：它是授权的唯一信任根，一旦随包发布， 任何人都能签发授权，机器码绑定形同虚设。 运行方式：`python test/test_license_build.py`，或 `uv run pytest test/test_license_build.py`。 """ import os import sys import tempfile import tomllib from pathlib import Path ROOT = Path(__file__).resolve().parent.parent sys.path.insert(0, str(ROOT)) sys.path.insert(0, str(ROOT / "utils" / "cli" / "src")) from chongming_cli.build import ( # noqa: E402 ALLOW_NO_KEY_ENV, LICENSE_PUBKEY_ENV, _resolve_license_public_key, _set_license_pubkey, _stage_license_guard, ) failures: list[str] = [] def check(name, cond, detail=""): status = "PASS" if cond else "FAIL" print(f"[{status}] {name}" + (f" — {detail}" if detail else "")) if not cond: failures.append(name) def test_pubkey_injection_is_section_scoped(): """公钥只写进 [license] 段，注释与其它段不受影响。""" src = (ROOT / "public" / "config.toml").read_text(encoding="utf-8") out = _set_license_pubkey(src, "AAAABBBB=") body = tomllib.loads(out) check("注入后 TOML 可解析", body["license"]["public_key"] == "AAAABBBB=", str(body["license"].get("public_key"))) # 只改了 [license] 段内那一行 lic_start = out.index("[license]") prod_start = out.index("[production]") check("公钥位于 [license] 段内", 'public_key = "AAAABBBB="' in out[lic_start:prod_start]) check("[production] 段未被误改", "public_key" not in out[prod_start:]) check("注释保留", "# 机器码授权" in out) check("其它段结构完整", "[production.module_system]" in out) check("[license] 段仍保留 path/min_match", body["license"]["path"] == "license.lic" and body["license"]["min_match"] == 3) diff = [i for i, (a, b) in enumerate(zip(src.splitlines(), out.splitlines())) if a != b] check("仅一行发生变化", len(diff) == 1, f"变化行号={diff}") def test_pubkey_resolution_order(): """公钥解析优先级：环境变量 > 文件环境变量 > 默认文件 license_public.key。 必须在**空的临时目录**里跑：默认回退路径 ``license_public.key`` 是相对 CWD 的， 而厂商在项目根放过这个文件是正常用法（也正是构建取公钥的正规途径）， 测试不能依赖它"不存在"。 """ tmp = Path(tempfile.mkdtemp()) key_file = tmp / "pk.txt" key_file.write_text("FROMFILE", encoding="utf-8") old_cwd = os.getcwd() old_env = dict(os.environ) try: os.chdir(tmp) # 空目录：既无 license_public.key 也无其它干扰 for var in (LICENSE_PUBKEY_ENV, "CHONGMING_LICENSE_PUBKEY_FILE"): os.environ.pop(var, None) check("三者都无时返回空", _resolve_license_public_key() == "") # 默认文件回退（构建按此取公钥，之前漏测） (tmp / "license_public.key").write_text("FROMDEFAULT", encoding="utf-8") check("回退到默认文件 license_public.key", _resolve_license_public_key() == "FROMDEFAULT") os.environ["CHONGMING_LICENSE_PUBKEY_FILE"] = str(key_file) check("文件环境变量优先于默认文件", _resolve_license_public_key() == "FROMFILE") os.environ[LICENSE_PUBKEY_ENV] = "FROMENV" check("环境变量优先于文件", _resolve_license_public_key() == "FROMENV") finally: os.chdir(old_cwd) os.environ.clear() os.environ.update(old_env) def test_guard_detects_private_key(): """守护能检出私钥（按内容，与扩展名无关，含跨块边界）。""" tmp = Path(tempfile.mkdtemp()) build = tmp / "build" (build / "sub").mkdir(parents=True) old_cwd = os.getcwd() try: os.chdir(tmp) (build / "ok.txt").write_text("正常内容\n", encoding="utf-8") check("干净产物通过", _stage_license_guard() == "未发现私钥泄漏") # 证书类 .pem 是合法的构建内容，不应被误判 (build / "cert.pem").write_text( "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n", encoding="utf-8" ) check("合法证书 .pem 不误判", _stage_license_guard() == "未发现私钥泄漏") # 私钥改名藏进普通文件 -> 按内容仍能检出 leak = build / "sub" / "innocent.txt" leak.write_text("-----BEGIN PRIVATE KEY-----\nMIIEvQ\n", encoding="utf-8") try: _stage_license_guard() check("按内容检出改名的私钥", False, "未检出") except RuntimeError as exc: check("按内容检出改名的私钥", "innocent.txt" in str(exc)) leak.unlink() # 跨 1MB 块边界的私钥 (build / "big.bin").write_bytes( b"x" * (1 << 20) + b"-----BEGIN RSA PRIVATE KEY-----" + b"y" * (1 << 20) ) try: _stage_license_guard() check("检出跨块边界的私钥", False, "未检出") except RuntimeError as exc: check("检出跨块边界的私钥", "big.bin" in str(exc)) (build / "big.bin").unlink() # 文件名叫 license_private* 的一律拦下 (build / "license_private.pem").write_text("(truncated)", encoding="utf-8") try: _stage_license_guard() check("按文件名拦下授权私钥文件", False, "未检出") except RuntimeError as exc: check("按文件名拦下授权私钥文件", "license_private" in str(exc)) finally: os.chdir(old_cwd) def test_build_fails_without_pubkey(): """打包时缺少公钥 -> 构建失败（避免产出拒绝所有插件的砖头包）。""" import chongming_cli.build as build_mod tmp = Path(tempfile.mkdtemp()) old_cwd = os.getcwd() old_env = dict(os.environ) try: # 复刻 build/ 最小结构：_stage_prepare_build_dir 需要 public/ 与 config.toml (tmp / "public" / "utils").mkdir(parents=True) (tmp / "public" / "main.py").write_text("", encoding="utf-8") (tmp / "public" / "server.py").write_text("", encoding="utf-8") (tmp / "public" / "config.toml").write_text( (ROOT / "public" / "config.toml").read_text(encoding="utf-8"), encoding="utf-8" ) os.chdir(tmp) for var in (LICENSE_PUBKEY_ENV, "CHONGMING_LICENSE_PUBKEY_FILE", ALLOW_NO_KEY_ENV): os.environ.pop(var, None) try: build_mod._stage_prepare_build_dir({}, "pyinstaller") # type: ignore[arg-type] check("缺少公钥时构建失败", False, "未抛异常") except RuntimeError as exc: check("缺少公钥时构建失败", LICENSE_PUBKEY_ENV in str(exc)) # 显式放行时才允许无公钥构建 os.environ[ALLOW_NO_KEY_ENV] = "1" build_mod._stage_prepare_build_dir({}, "pyinstaller") # type: ignore[arg-type] built = tomllib.loads((tmp / "build" / "config.toml").read_text(encoding="utf-8")) check("显式放行时构建成功且公钥为空", built["license"]["public_key"] == "") # 提供公钥后应注入到产物配置 os.environ[LICENSE_PUBKEY_ENV] = "INJECTEDKEY=" build_mod._stage_prepare_build_dir({}, "pyinstaller") # type: ignore[arg-type] built = tomllib.loads((tmp / "build" / "config.toml").read_text(encoding="utf-8")) check("公钥被注入产物配置", built["license"]["public_key"] == "INJECTEDKEY=") check("产物配置仍含 min_match", built["license"]["min_match"] == 3) finally: os.chdir(old_cwd) os.environ.clear() os.environ.update(old_env) def test_mbank_signing_is_not_a_trust_root(): """.mbank 验签用随包发布的对称密钥 —— 不能作为授权信任根。 本测试固化这一认知：只要 sqlite_vfs 的 sign 仍是 HMAC，就说明它只能算防篡改， 授权必须依赖非对称签名（chongming_license 的 Ed25519）。 """ import inspect from sqlite_vfs import core as vfs_core src = inspect.getsource(vfs_core.SQLiteVFS.sign) check("确认 .mbank 签名为 HMAC（对称）", "hmac.new" in src, "若已改为非对称，可更新本测试与文档说明") check("确认验证端同样是对称 HMAC", "hmac.new" in inspect.getsource(vfs_core.SQLiteVFS.verify_signature)) def main(): tests = [v for k, v in sorted(globals().items()) if k.startswith("test_")] for fn in tests: print(f"\n--- {fn.__name__} ---") fn() print("\n" + "=" * 56) if failures: print(f"❌ {len(failures)} 项未通过: {failures}") return 1 print("✅ 全部通过") return 0 if __name__ == "__main__": sys.exit(main())