26 lines
938 B
Bash
26 lines
938 B
Bash
#!/usr/bin/env bats
|
|
# Seam: the entropy helper unlocks the known LUKS-on-md device and mounts via
|
|
# the host's fstab entry, preserving the existing mount options and directory
|
|
# ownership rather than inventing a second mount configuration.
|
|
|
|
load helpers
|
|
|
|
@test "entropy helper is executable and has the expected safe shell shape" {
|
|
run bash -c "test -x '$REPO_ROOT/scripts/mount-entropy.sh'"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run grep -E '^set -euo pipefail$' "$REPO_ROOT/scripts/mount-entropy.sh"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run grep -F 'udisksctl unlock --block-device /dev/md0' "$REPO_ROOT/scripts/mount-entropy.sh"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run grep -F 'sudo mount "$MOUNTPOINT"' "$REPO_ROOT/scripts/mount-entropy.sh"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "entropy helper does not embed a secret or alter mount ownership" {
|
|
run grep -Eiq 'password|secret|chmod|chown' "$REPO_ROOT/scripts/mount-entropy.sh"
|
|
[ "$status" -eq 1 ]
|
|
}
|