Functional tests for attestations

tests/conftest.py

@@ -702,7 +702,7 @@ def xmlrpc(self, path, method, *args):
 
 
 @pytest.fixture
-def webtest(app_config_dbsession_from_env):
+def webtest(app_config_dbsession_from_env, tmp_path):
     """
     This fixture yields a test app with an alternative Pyramid configuration,
     injecting the database session and transaction manager into the app.
@@ -714,7 +714,13 @@ def webtest(app_config_dbsession_from_env):
     """
 
     # We want to disable anything that relies on TLS here.
-    app_config_dbsession_from_env.add_settings(enforce_https=False)
+    # app_config_dbsession_from_env.add_settings(enforce_https=False)
+    app_config_dbsession_from_env.add_settings(
+        {
+            "enforce_https": False,
+            "archive_files.path": tmp_path,
+        }
+    )
 
     app = app_config_dbsession_from_env.make_wsgi_app()
 

tests/functional/assets/pypi_hello_world-0.1.0-py3-none-any.whl.publish.attestation

@@ -0,0 +1 @@
+{"version":1,"verification_material":{"certificate":"MIIC4TCCAmagAwIBAgIUeQoQZze+KsP364q6eOH72BFWDWswCgYIKoZIzj0EAwMwNzEVMBMGA1UE\nChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQwODI5\nMTU0MTQ0WhcNMjQwODI5MTU1MTQ0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3fRY5RIr\n32h2fFSK5z7vJdOgDFRz5A5EWpotg+HMal4ckviSLhxjoiry9s3Vg1e+e0QylSNAej1YcjWUCOe4\nTqOCAYUwggGBMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU\n+bvTYk4hsJDJIzvyo3ZaH52JkyAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wLgYD\nVR0RAQH/BCQwIoEgYWxleGlzLmNoYWxsYW5kZUB0cmFpbG9mYml0cy5jb20wLAYKKwYBBAGDvzAB\nAQQeaHR0cHM6Ly9naXRodWIuY29tL2xvZ2luL29hdXRoMC4GCisGAQQBg78wAQgEIAweaHR0cHM6\nLy9naXRodWIuY29tL2xvZ2luL29hdXRoMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJj\nGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGRnsy+6gAABAMASDBGAiEAj64pq6I1lpTTUi9WjLLs\nr3Wg+OkLyhcgdulND14mHOICIQD/6sl1bhnb1jS0gUvmv5YRqrNusu6kobNJSnJi20KR7DAKBggq\nhkjOPQQDAwNpADBmAjEAzUhENnoHABt1b25dsencHlh7Uokc7xc2XiaxDxG6SKZZe3OAIlb8hmaB\nhL38DSSUAjEAzXqP2QGTsWaMdrw6EYLikl0qlgcuF7+GEEKJfRWpMeuH2tSsC7C8VOkU0tLVJ1wr\n","transparency_entries":[{"logIndex":"125944014","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1724946104","inclusionPromise":{"signedEntryTimestamp":"MEUCIFZW7Zwr8LJB3HCkjx4uONIcoVwYE7lgv4PdOe7ENEoQAiEA8bc30td4qkVif87E8hCmVV1I6T0G+230gW2gbtVO+fw="},"inclusionProof":{"logIndex":"4039752","rootHash":"t83MAvlWEwV0+yXgbPZCpOsty6Ga7sOa2cccJENLcF8=","treeSize":"4039754","hashes":["xCpt/4yLxw2aBLfSF3FOHBtlaOwL8+dvz0dfIdqPc7g=","556wQ9lOG6dxmxa3hIHs/hplIMZaHxFZHsH+Sa0p788=","4/0qj7mIIRUcc+dvIeGJ74ascEKzfQqI6kmaggI82Xg=","eN0MvdrB+SfjJwud+DGOBD5IFlxn0FYIv3o1564EsgI=","Zxi2oScQDP3DT9KkFyLVlL4njUBfCzzDTvN+4GyEM2U=","4sPpQZyQ44A9/q/TCcuTgkokrSzXc3wIf7rDUQAX5jk=","XsQC4gZUvk32uYOw0Da8IPeWwX5tzmHvzK/opehwQR8=","RrZsD/RSxNoujlvq/MsCEvLSkKZfv0jmQM9Kp7qbJec=","QxmVWsbTp4cClxuAkuT51UH2EY7peHMVGKq7+b+cGwQ=","Q2LAtNzOUh+3PfwfMyNxYb06fTQmF3VeTT6Fr6Upvfc=","ftwAu6v62WFDoDmcZ1JKfrRPrvuiIw5v3BvRsgQj7N8="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n4039754\nt83MAvlWEwV0+yXgbPZCpOsty6Ga7sOa2cccJENLcF8=\n\n— rekor.sigstore.dev wNI9ajBEAiA3nqaxIpDg/TAcYsWUkXtZiW1rXMnKSmMq7LU5yMb9JgIgO4032Z1JX6ZlFuypMUt/ZevDWoESS243vMALXkQsv2w=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNmM4MmE1NGZmYzZlMGFlYWVmZTZkYWI1NDM0NjRkN2Y4MGNmYjcwM2NhMzQ0NmRkNTY2M2U2ZTg2NzlkZWVhMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA2YzJjNTc5NThiMWVjOTI2MTM4MjI5MGY3ZmM4OWEwNDRiNzY1MjA4NzdmZTBjMGNmMDJkMGUwM2Q4OWNiNzgifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRQ1E0THR1TjdYUjdxYkVRbG1qWFVjcHVIUmtXVUgxVHJpdTlyd1dJVnZlUndJaEFMc1VyK05kRHVBSzlkTTF5VlpHU09TRkIwWEx5RDBjbm9JTTRhbWVVd2pZIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VNMFZFTkRRVzFoWjBGM1NVSkJaMGxWWlZGdlVWcDZaU3RMYzFBek5qUnhObVZQU0RjeVFrWlhSRmR6ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwUmQwOUVTVFZOVkZVd1RWUlJNRmRvWTA1TmFsRjNUMFJKTlUxVVZURk5WRkV3VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVXpabEpaTlZKSmNqTXlhREptUmxOTE5YbzNka3BrVDJkRVJsSjZOVUUxUlZkd2IzUUtaeXRJVFdGc05HTnJkbWxUVEdoNGFtOXBjbms1Y3pOV1p6RmxLMlV3VVhsc1UwNUJaV294V1dOcVYxVkRUMlUwVkhGUFEwRlpWWGRuWjBkQ1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVXJZblpVQ2xsck5HaHpTa1JLU1hwMmVXOHpXbUZJTlRKS2EzbEJkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMHhuV1VSV1VqQlNRVkZJTDBKRFVYZEpiMFZuV1ZkNGJHVkhiSHBNYlU1dldWZDRjMWxYTld0YVZVSXdZMjFHY0dKSE9XMVpiV3d3WTNrMWFncGlNakIzVEVGWlMwdDNXVUpDUVVkRWRucEJRa0ZSVVdWaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTW5oMldqSnNkVXd5T1doa1dGSnZDazFETkVkRGFYTkhRVkZSUW1jM09IZEJVV2RGU1VGM1pXRklVakJqU0UwMlRIazVibUZZVW05a1YwbDFXVEk1ZEV3eWVIWmFNbXgxVERJNWFHUllVbThLVFVsSFRFSm5iM0pDWjBWRlFXUmFOVUZuVVVOQ1NEQkZaWGRDTlVGSVkwRXpWREIzWVhOaVNFVlVTbXBIVWpSamJWZGpNMEZ4U2t0WWNtcGxVRXN6THdwb05IQjVaME00Y0Rkdk5FRkJRVWRTYm5ONUt6Wm5RVUZDUVUxQlUwUkNSMEZwUlVGcU5qUndjVFpKTVd4d1ZGUlZhVGxYYWt4TWMzSXpWMmNyVDJ0TUNubG9ZMmRrZFd4T1JERTBiVWhQU1VOSlVVUXZObk5zTVdKb2JtSXhhbE13WjFWMmJYWTFXVkp4Y2s1MWMzVTJhMjlpVGtwVGJrcHBNakJMVWpkRVFVc0tRbWRuY1docmFrOVFVVkZFUVhkT2NFRkVRbTFCYWtWQmVsVm9SVTV1YjBoQlFuUXhZakkxWkhObGJtTkliR2czVlc5cll6ZDRZekpZYVdGNFJIaEhOZ3BUUzFwYVpUTlBRVWxzWWpob2JXRkNhRXd6T0VSVFUxVkJha1ZCZWxoeFVESlJSMVJ6VjJGTlpISjNOa1ZaVEdscmJEQnhiR2RqZFVZM0swZEZSVXRLQ21aU1YzQk5aWFZJTW5SVGMwTTNRemhXVDJ0Vk1IUk1Wa294ZDNJS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19"}]},"envelope":{"statement":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJu\nYW1lIjoicHlwaV9oZWxsb193b3JsZC0wLjEuMC1weTMtbm9uZS1hbnkud2hsIiwiZGlnZXN0Ijp7\nInNoYTI1NiI6ImQzOWMwZjY1ZThlYWEyZDVlY2YwOThkOWEzZDM4ZjEzNWYyODFjNDgwYjY1Y2Vj\nYTZlODk1Y2E1MDliYzFmNDUifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9kb2NzLnB5cGku\nb3JnL2F0dGVzdGF0aW9ucy9wdWJsaXNoL3YxIiwicHJlZGljYXRlIjpudWxsfQ==\n","signature":"MEYCIQCQ4LtuN7XR7qbEQlmjXUcpuHRkWUH1Triu9rwWIVveRwIhALsUr+NdDuAK9dM1yVZGSOSF\nB0XLyD0cnoIM4ameUwjY\n"}}

tests/functional/test_attestations.py

@@ -0,0 +1,155 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import collections
+import hashlib
+import time
+
+from datetime import datetime
+from http import HTTPStatus
+from pathlib import Path
+
+import packaging.utils
+import pretend
+
+from pypi_attestations import Attestation
+from sigstore.verify import Verifier
+from webtest.forms import Upload
+
+from tests.common.db.oidc import GitHubPublisherFactory
+from tests.common.db.packaging import ProjectFactory
+from warehouse.macaroons import caveats
+from warehouse.macaroons.services import DatabaseMacaroonService
+from warehouse.packaging import Release
+
+
+def get_macaraoon(macaroon_service, publisher):
+    not_before = int(time.time())
+    expires_at = not_before + 900
+    claims = {"sha": "some-sha", "ref": "some-ref"}
+
+    serialized, dm = macaroon_service.create_macaroon(
+        "localhost",
+        (f"OpenID token: TODO " f"({datetime.fromtimestamp(not_before).isoformat()})"),
+        [
+            caveats.OIDCPublisher(
+                oidc_publisher_id=str(publisher.id),
+            ),
+            caveats.ProjectID(project_ids=[str(p.id) for p in publisher.projects]),
+            caveats.Expiration(expires_at=expires_at, not_before=not_before),
+        ],
+        oidc_publisher_id=str(publisher.id),
+        additional={"oidc": publisher.stored_claims(claims)},
+    )
+
+    return serialized
+
+
+_HERE = Path(__file__).parent
+_ASSETS = _HERE / "assets"
+_WHEEL_PACKAGE = _ASSETS / "pypi_hello_world-0.1.0-py3-none-any.whl"
+
+
+class TestPackageWithAttestations:
+
+    def upload_package(
+        self, webtest, monkeypatch, project, wheel_filename: Path, publisher
+    ):
+
+        name, version, _, __ = packaging.utils.parse_wheel_filename(wheel_filename.name)
+        attestation = Attestation.model_validate_json(
+            (
+                wheel_filename.parent / f"{wheel_filename.name}.publish.attestation"
+            ).read_text()
+        )
+
+        md5_digest = hashlib.file_digest(wheel_filename.open("rb"), "md5").hexdigest()
+
+        data = collections.OrderedDict(
+            {
+                ":action": "file_upload",
+                "metadata_version": "1.2",
+                "name": project.name,
+                "attestations": f"[{attestation.model_dump_json()}]",
+                "version": str(version),
+                "filetype": "bdist_wheel",
+                "pyversion": "cp312",
+                "md5_digest": md5_digest,
+                "content": (
+                    Upload(
+                        wheel_filename.name,
+                        wheel_filename.read_bytes(),
+                        "application/tar",
+                    )
+                ),
+            }
+        )
+
+        db_session = webtest.extra_environ["warehouse.db_session"]
+        macaroon_service = DatabaseMacaroonService(db_session)
+        webtest.set_authorization(
+            ("Basic", ("__token__", get_macaraoon(macaroon_service, publisher)))
+        )
+
+        verify = pretend.call_recorder(
+            lambda _self, _verifier, _policy, _dist: (
+                "https://docs.pypi.org/attestations/publish/v1",
+                None,
+            )
+        )
+        monkeypatch.setattr(Attestation, "verify", verify)
+        monkeypatch.setattr(Verifier, "production", lambda: pretend.stub())
+
+        resp = webtest.post("/legacy/", params=data)
+
+        assert resp.status_code == HTTPStatus.OK
+
+        release_db = db_session.query(Release).filter(Release.project == project).one()
+        release_file = release_db.files[0]
+        assert release_file.filename == wheel_filename.name
+
+
+    def view_package(self, webtest, project):
+        resp = webtest.get(f"/simple/{project.normalized_name}/")
+
+        release_version = project.releases[0].version
+        release_filename = project.releases[0].files[0].filename
+
+        assert resp.status_code == HTTPStatus.OK
+        assert release_filename in resp.text
+
+        # Use simple JSON API
+        resp = webtest.get(
+            f"/simple/{project.normalized_name}/",
+            headers={"Accept": "application/vnd.pypi.simple.v1+json"},
+        )
+        assert resp.status_code == HTTPStatus.OK
+        assert resp.json["files"][0]["filename"] == release_filename
+
+        # Use soon-to-be deprecated legacy API
+        # Remove me once deprecated
+        resp = webtest.get(f"/pypi/{project.normalized_name}/json")
+        assert resp.status_code == HTTPStatus.OK
+        assert resp.content_type == "application/json"
+
+        content = resp.json
+        assert content["releases"][release_version][0]["filename"] == release_filename
+
+    def test_package(self, webtest, monkeypatch):
+
+        project_name = "pypi_hello_world"
+        project = ProjectFactory.create(name=project_name)
+
+        # Shortcut here: we directly associate our publisher to the project
+        publisher = GitHubPublisherFactory.create(projects=[project])
+
+        self.upload_package(webtest, monkeypatch, project, _WHEEL_PACKAGE, publisher)
+        self.view_package(webtest, project)