unkin/artifactapi
3
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases 1 Wiki Activity

Run the dockerised e2e suite with write auth enabled
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details

Browse Source 
Real clients now authenticate every local publish against a static mock
OIDC issuer, and each type checks unauthenticated publishes are refused
while anonymous reads keep working.
This commit is contained in:
Unkin Agent
2026-11-02 22:01:44 +11:00
parent f8d6db3bd2
commit a161c44575
17 changed files with 249 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e-docker/helm_local_test.go
+25 -7
View File
@@ -29,10 +29,10 @@ func TestLocalHelmRealClient(t *testing.T) {
createVirtual(t, `{"name":"vhelm","package_type":"helm","members":["local-helm"]}`)
defer deleteVirtual(t, "vhelm")
helm := func(script string) string {
helm := func(t *testing.T, script string) string {
t.Helper()
out, err := exec.Command("docker", "run", "--rm", "--network", network, "--entrypoint", "sh",
"alpine/helm:3.16.4", "-c", "set -eu; "+script).Output()
out, err := exec.Command("docker", "run", "--rm", "--network", network, "-e", "TOKEN="+authToken, "-e", "BAD="+badToken,
"--entrypoint", "sh", "alpine/helm:3.16.4", "-c", "set -eu; "+script).Output()
if err != nil {
stderr := ""
if ee, ok := err.(*exec.ExitError); ok {
@@ -43,7 +43,7 @@ func TestLocalHelmRealClient(t *testing.T) {
return string(out)
}
chart := helm("cd /tmp && helm create e2echart >/dev/null && helm package e2echart >/dev/null && cat e2echart-0.1.0.tgz")
chart := helm(t, "cd /tmp && helm create e2echart >/dev/null && helm package e2echart >/dev/null && cat e2echart-0.1.0.tgz")
uploadFile(t, "local-helm", "e2echart-0.1.0.tgz", []byte(chart), "application/gzip")
// Chart metadata is recorded asynchronously after upload; poll the index.
@@ -58,14 +58,32 @@ func TestLocalHelmRealClient(t *testing.T) {
if !strings.Contains(string(body), "e2echart-0.1.0.tgz") || !strings.Contains(string(body), "digest: ") {
t.Fatalf("index.yaml never listed the chart:\n%s", body)
}
assertWriteGated(t, http.MethodPut, api("/api/v2/remotes/local-helm/files/e2echart-0.2.0.tgz"), []byte(chart), "application/gzip", api("/api/v1/local/local-helm/index.yaml"))
for _, repoURL := range []string{internal + "/api/v1/local/local-helm", internal + "/api/v1/virtual/vhelm"} {
out := helm("helm repo add e2e " + repoURL + " >/dev/null && " +
"helm search repo e2e/e2echart && " +
"cd /tmp && helm pull e2e/e2echart --version 0.1.0 && " +
out := helm(t, "helm repo add e2e "+repoURL+" >/dev/null && "+
"helm search repo e2e/e2echart && "+
"cd /tmp && helm pull e2e/e2echart --version 0.1.0 && "+
"helm template rel e2echart-0.1.0.tgz | grep -c 'kind: Deployment'")
if !strings.Contains(out, "e2e/e2echart") || !strings.Contains(out, "0.1.0") || !strings.HasSuffix(strings.TrimSpace(out), "1") {
t.Fatalf("helm via %s:\n%s", repoURL, out)
}
}
t.Run("oci", func(t *testing.T) {
t.Skip("helm (oras-go) fetches the registry token with an OAuth2 POST form the server ignores; fixed on benvin/registry-token-oauth-post")
createRepo(t, `{"name":"local-helm-oci","package_type":"docker","repo_type":"local"}`)
defer deleteRepo(t, "local-helm-oci")
reg := strings.TrimPrefix(internal, "http://")
out := helm(t, "cd /tmp && helm create e2echart >/dev/null && helm package e2echart >/dev/null && "+
"echo \"$BAD\" | helm registry login "+reg+" -u ci --password-stdin --insecure && "+
"if helm push e2echart-0.1.0.tgz oci://"+reg+"/local-helm-oci --plain-http; then echo 'invalid token push accepted'; exit 1; fi && "+
"echo \"$TOKEN\" | helm registry login "+reg+" -u ci --password-stdin --insecure && "+
"helm push e2echart-0.1.0.tgz oci://"+reg+"/local-helm-oci --plain-http && "+
"helm registry logout "+reg+" && rm -rf e2echart* && "+
"helm pull oci://"+reg+"/local-helm-oci/e2echart --version 0.1.0 --plain-http && ls e2echart-0.1.0.tgz")
if !strings.Contains(out, "e2echart-0.1.0.tgz") {
t.Fatalf("helm OCI push/pull:\n%s", out)
}
})
}