Documentation
¶
Overview ¶
Package pintest gives tests a HOME whose directory chain passes the pinned-host-keys ancestor rule (sdk/go/remote, sshd secure_path style): no directory above the pin store may be group or world writable unless it is a sticky directory such as /tmp.
Why: CI hosts keep TMPDIR on an external drive whose mount root is 0775. t.TempDir() then sits under a writable ancestor and every v1.5 test that pins a host key is refused. The production rule is correct and stays as it is; tests that are not about that rule ask for Home instead of t.TempDir().
Inputs: a testing.TB. Output: a fresh, empty, test-owned directory. Constraints: stdlib only; never relaxes any permission check.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Home ¶
Home returns a fresh directory suitable as $HOME for a pin-store test. It uses t.TempDir() when that location's ancestors are sealed (the normal case, byte-for-byte the old behaviour) and otherwise a directory under /tmp, removed when the test ends. When no location is sealed the test is skipped with the reason instead of failing on the host's layout.
func Sealed ¶
Sealed reports whether dir passes the same ancestor rule as production (sdk/go/remote ancestorOK): every directory above it, on the path as given and with symlinks resolved, is owned by the current user or root, and is not group/world writable unless it is a root-owned sticky directory.
Types ¶
This section is empty.
Source Files