feat: unify source and skills for Dever 0.1.2 installation

test/onboarding/test_install_entry.py

@@ -0,0 +1,90 @@
+"""Standalone Bash contract; subprocesses never install or change services."""
+
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+spec = importlib.util.spec_from_file_location("dever_install_entry", ROOT / "sdk/install-entry.py")
+generator = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(generator)
+
+
+class InstallEntryTests(unittest.TestCase):
+    def run_bash(self, script, *arguments, **kwargs):
+        return subprocess.run(["/bin/bash", "-s", "--", *arguments], input=script,
+                              env={}, text=True, capture_output=True, timeout=10, **kwargs)
+
+    def test_generated_entry_matches_source_and_independent_key(self):
+        expected = generator.render((ROOT / "skills/scripts/install.py").read_text(),
+                                    (ROOT / "skills/assets/release.pub").read_text())
+        self.assertEqual((ROOT / "install").read_text(), expected)
+        syntax = subprocess.run(["/bin/bash", "-n", str(ROOT / "install")], env={},
+                                text=True, capture_output=True, timeout=10)
+        self.assertEqual(syntax.returncode, 0, syntax.stderr)
+
+    def test_file_and_pipe_help_do_not_need_a_checkout(self):
+        with tempfile.TemporaryDirectory(prefix="dever-entry-") as directory:
+            entry = Path(directory) / "install"
+            entry.write_bytes((ROOT / "install").read_bytes())
+            for command, contents in ((["/bin/bash", str(entry), "--help"], None),
+                                      (["/bin/bash", "-s", "--", "--help"], entry.read_text())):
+                result = subprocess.run(command, input=contents, cwd=directory, env={},
+                                        text=True, capture_output=True, timeout=10)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertIn("--trusted-key", result.stdout)
+                self.assertIn("--system-root", result.stdout)
+        invalid = self.run_bash((ROOT / "install").read_text(), "--unknown-argument")
+        self.assertEqual(invalid.returncode, 2)
+
+    def test_arguments_python_isolation_and_exit_code_are_preserved(self):
+        source = '''import json
+import sys
+def main(default_key):
+    print(json.dumps([sys.argv[1:], default_key, sys.flags.isolated]))
+    raise SystemExit(37)
+'''
+        key = "ab" * 32
+        script = generator.render(source, key)
+        arguments = ["--release", "/a path/with 'quotes'", "", "$(not executed)", "*", "--no-start"]
+        result = self.run_bash(script, *arguments)
+        self.assertEqual(result.returncode, 37, result.stderr)
+        self.assertEqual(json.loads(result.stdout), [arguments, key, 1])
+
+    def test_truncated_body_does_not_execute_python_or_sudo(self):
+        script = generator.render('def main(default_key):\n    print("EXECUTED")\n', "ab" * 32)
+        for end in (script.index("import sys"), script.index("DEVER_INSTALL_PYTHON\n}"),
+                    script.index('\ndever_install "$@"')):
+            result = self.run_bash(script[:end])
+            self.assertNotIn("EXECUTED", result.stdout)
+
+    @unittest.skipUnless(os.geteuid() == 0 and Path("/usr/bin/sudo").is_file(),
+                         "real nonroot UID fixture requires root and sudo executable")
+    def test_nonroot_help_skips_sudo_and_install_forwards_through_sudo(self):
+        # Replace only the sudo command in this owned Bash process. It records
+        # argv and returns without executing Python or attempting escalation.
+        intercept = '''function /usr/bin/sudo() {
+    printf '<%s>\\n' "$@"
+    return 43
+}
+'''
+        script = intercept + (ROOT / "install").read_text()
+        lowered = {"user": 65534, "group": 65534, "extra_groups": []}
+        help_result = self.run_bash(script, "--help", **lowered)
+        self.assertEqual(help_result.returncode, 0, help_result.stderr)
+        self.assertIn("--release", help_result.stdout)
+        install = self.run_bash(script, "--system-root", "/owned image", "--no-start", **lowered)
+        self.assertEqual(install.returncode, 43, install.stderr)
+        self.assertEqual(install.stdout.splitlines(), [
+            "<-->", "</usr/bin/python3>", "<-I>", "<->", "<--system-root>",
+            "</owned image>", "<--no-start>",
+        ])
+
+
+if __name__ == "__main__":
+    unittest.main()