|
2 | 2 | require 'json' |
3 | 3 |
|
4 | 4 | describe 'Dockerfile' do |
5 | | - |
6 | 5 | before(:all) do |
7 | 6 | set :env, { |
8 | | - 'DATASOURCES_DEFAULT_HOST' => '172.17.0.2', |
| 7 | + 'DATASOURCES_DEFAULT_HOST' => '172.17.0.2', |
9 | 8 | 'DATASOURCES_DEFAULT_PASSWORD' => 'P4ssb0lt', |
10 | 9 | 'DATASOURCES_DEFAULT_USERNAME' => 'passbolt', |
11 | 10 | 'DATASOURCES_DEFAULT_DATABASE' => 'passbolt', |
12 | | - 'PASSBOLT_GPG_KEYRING' => '/var/lib/passbolt/.gnupg' |
| 11 | + 'PASSBOLT_GPG_KEYRING' => '/var/lib/passbolt/.gnupg' |
13 | 12 | } |
14 | 13 |
|
15 | 14 | if ENV['GITLAB_CI'] |
|
18 | 17 | 'password' => ENV['CI_REGISTRY_PASSWORD'].to_s, |
19 | 18 | 'serveraddress' => 'https://registry.gitlab.com/' |
20 | 19 | ) |
21 | | - if ENV['ROOTLESS'] == 'true' |
22 | | - @image = Docker::Image.create('fromImage' => "#{ENV['CI_REGISTRY_IMAGE']}:#{ENV['PASSBOLT_FLAVOUR']}-rootless-latest") |
23 | | - else |
24 | | - @image = Docker::Image.create('fromImage' => "#{ENV['CI_REGISTRY_IMAGE']}:#{ENV['PASSBOLT_FLAVOUR']}-root-latest") |
25 | | - end |
| 20 | + @image = if ENV['ROOTLESS'] == 'true' |
| 21 | + Docker::Image.create('fromImage' => "#{ENV['CI_REGISTRY_IMAGE']}:#{ENV['PASSBOLT_FLAVOUR']}-rootless-latest") |
| 22 | + else |
| 23 | + Docker::Image.create('fromImage' => "#{ENV['CI_REGISTRY_IMAGE']}:#{ENV['PASSBOLT_FLAVOUR']}-root-latest") |
| 24 | + end |
26 | 25 | else |
27 | | - @image = Docker::Image.build_from_dir(ROOT_DOCKERFILES, { 'dockerfile' => $dockerfile, 'buildargs' => JSON.generate($buildargs) } ) |
| 26 | + @image = Docker::Image.build_from_dir( |
| 27 | + ROOT_DOCKERFILES, |
| 28 | + { |
| 29 | + 'dockerfile' => $dockerfile, |
| 30 | + 'buildargs' => JSON.generate($buildargs) |
| 31 | + } |
| 32 | + ) |
28 | 33 | end |
29 | 34 | set :docker_image, @image.id |
30 | 35 | set :docker_container_create_options, { 'Cmd' => '/bin/sh' } |
|
34 | 39 | let(:php_conf) { '/etc/php/7.4/fpm/php.ini' } |
35 | 40 | let(:site_conf) { '/etc/nginx/sites-enabled/nginx-passbolt.conf' } |
36 | 41 | let(:supervisor_conf) do |
37 | | - [ '/etc/supervisor/conf.d/nginx.conf', |
38 | | - '/etc/supervisor/conf.d/php.conf', |
39 | | - '/etc/supervisor/conf.d/cron.conf' ] |
| 42 | + ['/etc/supervisor/conf.d/nginx.conf', |
| 43 | + '/etc/supervisor/conf.d/php.conf', |
| 44 | + '/etc/supervisor/conf.d/cron.conf'] |
40 | 45 | end |
41 | 46 | let(:passbolt_home) { '/usr/share/php/passbolt' } |
42 | 47 | let(:passbolt_tmp) { '/var/lib/passbolt/tmp' } |
43 | 48 | let(:passbolt_image) { "#{passbolt_home}/webroot/img/public" } |
44 | 49 | let(:passbolt_owner) { 'www-data' } |
45 | | - let(:exposed_ports) { [ $http_port, $https_port ] } |
46 | | - let(:php_extensions) { [ |
47 | | - 'gd', 'intl', 'json', 'mysqlnd', 'xsl', 'phar', |
48 | | - 'posix', 'xml', 'zlib', 'ctype', 'pdo', 'gnupg', 'pdo_mysql' |
49 | | - ] } |
| 50 | + let(:exposed_ports) { [$http_port, $https_port] } |
| 51 | + let(:php_extensions) do |
| 52 | + %w[ |
| 53 | + gd intl json mysqlnd xsl phar |
| 54 | + posix xml zlib ctype pdo gnupg pdo_mysql |
| 55 | + ] |
| 56 | + end |
50 | 57 | let(:wait_for) { '/usr/bin/wait-for.sh' } |
51 | | - jwt_conf = "#{PASSBOLT_CONFIG_PATH + '/jwt'}" |
52 | | - let(:jwt_key_pair) { [ "#{jwt_conf}/jwt.key", "#{jwt_conf}/jwt.pem" ] } |
| 58 | + let(:jwt_conf) { "#{PASSBOLT_CONFIG_PATH + '/jwt'}" } |
| 59 | + let(:jwt_key_pair) { ["#{jwt_conf}/jwt.key", "#{jwt_conf}/jwt.pem"] } |
53 | 60 |
|
54 | 61 | describe 'passbolt required php extensions' do |
55 | 62 | it 'has php extensions installed' do |
|
67 | 74 | it 'has config files' do |
68 | 75 | supervisor_conf.each do |config| |
69 | 76 | expect(file(config)).to exist |
| 77 | + if ENV['ROOTLESS'] == 'true' |
| 78 | + expect(file(config)).to be_owned_by(passbolt_owner) |
| 79 | + else |
| 80 | + expect(file(config)).to be_owned_by('root') |
| 81 | + end |
| 82 | + expect(file(config)).to be_writable.by('owner') |
| 83 | + expect(file(config)).not_to be_writable.by('group') |
| 84 | + expect(file(config)).not_to be_writable.by('others') |
70 | 85 | end |
71 | 86 | end |
72 | 87 | end |
|
159 | 174 | end |
160 | 175 | end |
161 | 176 |
|
162 | | - describe file(jwt_conf) do |
163 | | - it { should be_a_directory } |
164 | | - it { should be_mode 770 } |
165 | | - it { should be_owned_by($root_user) } |
166 | | - it { should be_grouped_into($config_group) } |
167 | | - end |
| 177 | + describe 'jwt configuration' do |
| 178 | + it 'should have the correct permissions' do |
| 179 | + expect(file(jwt_conf)).to be_a_directory |
| 180 | + expect(file(jwt_conf)).to be_mode 770 |
| 181 | + expect(file(jwt_conf)).to be_owned_by($root_user) |
| 182 | + expect(file(jwt_conf)).to be_grouped_into($config_group) |
| 183 | + end |
168 | 184 |
|
169 | | - describe file("#{jwt_conf}/jwt.key") do |
170 | | - it { should_not exist } |
171 | | - end |
172 | | - describe file("#{jwt_conf}/jwt.pem") do |
173 | | - it { should_not exist } |
| 185 | + describe 'JWT key file' do |
| 186 | + it 'should not exist' do |
| 187 | + expect(file("#{jwt_conf}/jwt.key")).not_to exist |
| 188 | + end |
| 189 | + end |
| 190 | + |
| 191 | + describe 'JWT pem file' do |
| 192 | + it 'should not exist' do |
| 193 | + expect(file("#{jwt_conf}/jwt.pem")).not_to exist |
| 194 | + end |
| 195 | + end |
174 | 196 | end |
175 | 197 |
|
176 | 198 | describe '/etc/environment' do |
177 | 199 | it 'exists and has the correct permissions' do |
178 | 200 | expect(file('/etc/environment')).to exist |
179 | 201 | if ENV['ROOTLESS'] == 'true' |
180 | 202 | expect(file('/etc/environment')).to be_owned_by(passbolt_owner) |
181 | | - expect(file('/etc/environment')).to be_mode 600 |
| 203 | + expect(file('/etc/environment')).to be_mode 600 |
182 | 204 | else |
183 | 205 | expect(file('/etc/environment')).to be_owned_by($root_user) |
184 | | - expect(file('/etc/environment')).to be_mode 644 |
| 206 | + expect(file('/etc/environment')).to be_mode 644 |
185 | 207 | end |
186 | 208 | end |
187 | 209 | end |
188 | 210 |
|
189 | 211 | describe 'cron table' do |
190 | 212 | it 'exists and executes the email job' do |
191 | | - expect(cron.table).to match(/PASSBOLT_BASE_DIR\/bin\/cron/) |
| 213 | + expect(cron.table).to match(%r{PASSBOLT_BASE_DIR/bin/cron}) |
192 | 214 | end |
193 | 215 | end |
194 | 216 | end |
0 commit comments