Files
horizon/tests/test_install_ps1_signature.py
flexeykinDevandClaude Opus 5.5 4ac75c281a install.ps1: verify the release signature when OpenSSL 3 is found
The first install on Windows now checks SHA256SUMS.sig (a Nightly's
SHA256SUMS.v2.sig, for the version its title names) against the release
key, then the archive against SHA256SUMS, as install.sh does. OpenSSL is
looked for on the PATH and in Git for Windows. Without OpenSSL 3 it says
so and keeps the GitHub SHA-256 check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-06 15:53:25 +01:00

36 lines
1.3 KiB
Python

"""Runs tests/install_ps1_signature.ps1: packaging/server/install.ps1 checks the release signature.
PURPOSE: keep install.ps1's Ed25519 check from regressing (docs/release-flow.md, "Signed checksums").
REFS: tests/install_ps1_signature.ps1, tests/test_install_sh_signature.py (the same for install.sh).
Skips quietly off Windows and without PowerShell or OpenSSL 3. Headless, no network.
"""
import os
import shutil
import subprocess
import unittest
from pathlib import Path
SCRIPT = Path(__file__).with_name("install_ps1_signature.ps1")
class InstallPs1Signature(unittest.TestCase):
# install.ps1 installs the Windows server: junctions, %LOCALAPPDATA%, the user's PATH.
@unittest.skipUnless(os.name == "nt", "install.ps1 is for Windows")
@unittest.skipUnless(shutil.which("pwsh") or shutil.which("powershell"), "PowerShell needed")
def test_signature_cases(self):
shell = shutil.which("pwsh") or shutil.which("powershell")
run = subprocess.run(
[shell, "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", str(SCRIPT)],
capture_output=True,
text=True,
timeout=300,
)
if run.returncode == 77:
self.skipTest(run.stdout.strip())
self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
if __name__ == "__main__":
unittest.main()