mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-06 13:10:37 -04:00
033f0c84da
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Co-authored-by: Aditya Tripathi <aditya@climactic.co>
68 lines
3.3 KiB
PHP
68 lines
3.3 KiB
PHP
<?php
|
|
|
|
use Tests\TestCase;
|
|
|
|
uses(TestCase::class);
|
|
|
|
test('known hosts lines accept host names with an underscore', function () {
|
|
expect(gitKnownHostsLines('[git_host.internal]:2222 ssh-ed25519 AAAA'))->toBe(['[git_host.internal]:2222 ssh-ed25519 AAAA']);
|
|
});
|
|
|
|
test('known hosts lines drop other keys for pinned hosts', function (string $line) {
|
|
expect(gitKnownHostsLines($line))->toBe([]);
|
|
})->with([
|
|
'pinned host' => 'github.com ssh-ed25519 AAAA',
|
|
'pinned host with port' => '[bitbucket.org]:2222 ssh-ed25519 AAAA',
|
|
'pinned host in a list' => 'git.example.com,bitbucket.org ssh-ed25519 AAAA',
|
|
'pinned port 443 host' => '[ssh.github.com]:443 ssh-ed25519 AAAA',
|
|
]);
|
|
|
|
test('the ssh setup pins the port 443 endpoints of the large git hosts', function () {
|
|
$script = gitSshSetupCommand('test-uuid');
|
|
preg_match_all("/echo '([^']+)'/", $script, $matches);
|
|
[$knownHosts, $config] = array_map(base64_decode(...), $matches[1]);
|
|
|
|
preg_match('/\AHost (.+)$/m', $config, $strictHosts);
|
|
|
|
expect(explode(' ', $strictHosts[1]))->toEqualCanonicalizing(['github.com', 'gitlab.com', 'bitbucket.org', 'ssh.github.com', 'altssh.gitlab.com', 'altssh.bitbucket.org'])
|
|
->and($knownHosts)->toContain('[ssh.github.com]:443 ssh-ed25519 ')
|
|
->and($knownHosts)->toContain('[altssh.gitlab.com]:443 ssh-ed25519 ')
|
|
->and($knownHosts)->toContain('[altssh.bitbucket.org]:443 ssh-ed25519 ');
|
|
});
|
|
|
|
test('accepting fetched keys replaces every saved line of the same host and port', function () {
|
|
$saved = implode("\n", [
|
|
'git.example.com,1.2.3.4 ssh-ed25519 OLD',
|
|
'[git.example.com]:22 ssh-rsa OLDRSA',
|
|
'[git.example.com]:2222 ssh-ed25519 OTHERPORT',
|
|
'keep.example.com ssh-ed25519 KEEP',
|
|
]);
|
|
|
|
expect(gitKnownHostsReplaceHostKeys($saved, ['git.example.com ssh-ed25519 NEW']))->toBe([
|
|
'[git.example.com]:2222 ssh-ed25519 OTHERPORT',
|
|
'keep.example.com ssh-ed25519 KEEP',
|
|
'git.example.com ssh-ed25519 NEW',
|
|
]);
|
|
});
|
|
|
|
test('the ssh setup checks pinned hosts strictly and trusts other hosts on first use', function () {
|
|
$script = gitSshSetupCommand('test-uuid', 'git.example.com ssh-ed25519 SAVED');
|
|
preg_match_all("/echo '([^']+)'/", $script, $matches);
|
|
[$knownHosts, $config] = array_map(base64_decode(...), $matches[1]);
|
|
|
|
expect($config)->toMatch('/\AHost github\.com[^\n]*\n StrictHostKeyChecking yes\nHost \*\n StrictHostKeyChecking accept-new\n UserKnownHostsFile \/root\/\.ssh\/coolify_git_test-uuid\.known_hosts\n/')
|
|
->and($knownHosts)->toContain("\ngit.example.com ssh-ed25519 SAVED\n")
|
|
->and($script)->toContain('tee /root/.ssh/coolify_git_test-uuid.config');
|
|
});
|
|
|
|
test('github keys are pinned for ssh.github.com on port 22, where a port 443 redirect in the ssh config can end', function () {
|
|
$githubEd25519 = collect(GIT_PINNED_HOST_KEYS)->first(fn (string $line) => str_starts_with($line, 'github.com') && str_contains($line, 'ssh-ed25519'));
|
|
|
|
expect(explode(',', strtok($githubEd25519, ' ')))->toContain('ssh.github.com', '[ssh.github.com]:443');
|
|
});
|
|
|
|
test('the ssh setup in the helper container does not probe the ssh version', function () {
|
|
expect(gitSshSetupCommand('test-uuid'))->not->toContain('ssh -F /dev/null -G')
|
|
->and(gitSshSetupCommand('test-uuid'))->not->toContain(' if ');
|
|
});
|