tests: improve passwd/group parsing tests (#2045)

Author: stevebeattie

pkg/passwd/group_test.go

@@ -1,4 +1,4 @@
-// Copyright 2022, 2023 Chainguard, Inc.
+// Copyright 2022-2026 Chainguard, Inc.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ import (
 	"bytes"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	apkfs "chainguard.dev/apko/pkg/apk/fs"
@@ -28,15 +29,40 @@ func TestGroupParser(t *testing.T) {
 	gf, err := ReadOrCreateGroupFile(fsys, "group")
 	require.NoError(t, err)
 
+	require.NotEmpty(t, gf, "group file in existing testdata file should not be empty")
+
+	found_root := false
+	found_daemon := false
+	found_nobody := false
 	for _, ge := range gf.Entries {
 		if ge.GID == 0 {
-			require.Equal(t, "root", ge.GroupName, "gid 0 is not root")
+			assert.Equal(t, "root", ge.GroupName, "gid 0 is not root")
+			assert.Equal(t, "x", ge.Password, "gid 0 password entry is not set to x")
+			assert.Equal(t, []string{"root"}, ge.Members, "gid 0 members should just be the root user")
+			found_root = true
+		}
+
+		if ge.GID == 2 {
+			assert.Equal(t, "daemon", ge.GroupName, "gid 2 is not daemon")
+			assert.Equal(t, "x", ge.Password, "gid 2 password entry is not set to x")
+			assert.ElementsMatch(t, []string{"root", "bin", "daemon"}, ge.Members, "gid 2 members should contain root, bin, and daemon users")
+			found_daemon = true
 		}
 
 		if ge.GID == 65534 {
-			require.Equal(t, "nobody", ge.GroupName, "gid 65534 is not nobody")
+			assert.Equal(t, "nobody", ge.GroupName, "gid 65534 is not nobody")
+			assert.Equal(t, "x", ge.Password, "gid 65534 password entry is not set to x")
+			// XXX if there's no users listed as group members, Parse
+			// returns a list with one empty string as a result, not
+			// sure if that's intended behavior.
+			assert.Equal(t, []string{""}, ge.Members, "gid 65534 members should be empty")
+			found_nobody = true
 		}
 	}
+
+	assert.True(t, found_root, "group file should contain the root group")
+	assert.True(t, found_daemon, "group file should contain the daemon group")
+	assert.True(t, found_nobody, "group file should contain the nobody group")
 }
 
 func TestGroupWriter(t *testing.T) {

pkg/passwd/passwd_test.go

@@ -1,4 +1,4 @@
-// Copyright 2022, 2023 Chainguard, Inc.
+// Copyright 2022-2026 Chainguard, Inc.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ import (
 	"os"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	apkfs "chainguard.dev/apko/pkg/apk/fs"
@@ -34,16 +35,27 @@ func TestParser(t *testing.T) {
 	require.NoError(t, err)
 	uf, err := ReadOrCreateUserFile(fsys, "etc/passwd")
 	require.NoError(t, err)
+	require.NotEmpty(t, uf, "parsed passwd file should not be empty")
 
+	found_root := false
+	found_nobody := false
 	for _, ue := range uf.Entries {
 		if ue.UID == 0 {
-			require.Equal(t, "root", ue.UserName, "uid 0 is not root")
+			assert.Equal(t, "root", ue.UserName, "uid 0 is not root")
+			assert.Equal(t, "/bin/ash", ue.Shell, "uid 0 shell is not /bin/ash")
+			assert.Equal(t, "/root", ue.HomeDir, "uid 0 homedir is not /root")
+			found_root = true
 		}
 
 		if ue.UID == 65534 {
-			require.Equal(t, "nobody", ue.UserName, "uid 65534 is not nobody")
+			assert.Equal(t, "nobody", ue.UserName, "uid 65534 is not nobody")
+			assert.Equal(t, "/bin/false", ue.Shell, "uid 65534 shell is not /bin/false")
+			assert.Equal(t, "/", ue.HomeDir, "uid 65534 homedir is not /")
+			found_nobody = true
 		}
 	}
+	assert.True(t, found_root, "passwd file should contain the root user")
+	assert.True(t, found_nobody, "passwd file should contain the nobody user")
 }
 
 func TestWriter(t *testing.T) {