mfer/mfer/gpg_timeout_unix_test.go

//go:build unix

// The deadline tests need an executable stand-in for gpg first on PATH,
// which is written as a POSIX shell script, and they exercise the
// process-group kill that only exists on unix. There is no equivalent
// coverage on other platforms.

//nolint:testpackage // white-box tests exercise unexported internals
package mfer

import (
	"context"
	"os"
	"path/filepath"
	"strconv"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

const (
	// gpgTestDeadline is the deadline the deadline tests give gpg. It is
	// short so the suite stays fast; gpgTimeout itself is far too long to
	// wait out in a test, and passing an earlier deadline is exactly the
	// caller-propagation path under test.
	gpgTestDeadline = 200 * time.Millisecond

	// fakeGPGSleepSeconds is how long the stand-in gpg blocks. It must be
	// long enough that only cancellation can end it -- if the deadline is
	// not enforced, the test hangs until `go test` times out, which is the
	// loud failure we want rather than a silently passing race.
	fakeGPGSleepSeconds = 30

	// fakeGPGPerms makes the stand-in script executable.
	fakeGPGPerms os.FileMode = 0o700
)

// fakeSlowGPGOnPath puts a stand-in for gpg first on PATH that blocks
// until it is killed, so a deadline is the only thing that can end the
// invocation.
//
// The stand-in is a shell script that spawns a child, which means the
// child inherits the write end of the captured stdout and stderr pipes.
// That mirrors a real gpg delegating to a helper process, and it is the
// case that hangs Cmd.Wait if only the direct child is killed.
func fakeSlowGPGOnPath(t *testing.T) {
	t.Helper()

	dir := t.TempDir()
	script := "#!/bin/sh\nsleep " + strconv.Itoa(fakeGPGSleepSeconds) + "\n"

	// fakeGPGPerms is 0700 rather than 0600 because the stand-in has to
	// be executable to be run at all; it lives in a test-controlled
	// t.TempDir().
	require.NoError(t,
		os.WriteFile(filepath.Join(dir, "gpg"), []byte(script), fakeGPGPerms))

	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
}

// TestGPGDeadlineIsEnforced pins that a gpg invocation which outlives its
// deadline returns a timeout error naming the operation, rather than
// hanging or surfacing a bare context error.
//
//nolint:paralleltest // fakeSlowGPGOnPath mutates the process-global PATH
func TestGPGDeadlineIsEnforced(t *testing.T) {
	fakeSlowGPGOnPath(t)

	ctx, cancel := context.WithTimeout(context.Background(), gpgTestDeadline)
	defer cancel()

	started := time.Now()
	sig, err := gpgSign(ctx, []byte("data to sign"), GPGKeyID("KEYID"))
	elapsed := time.Since(started)

	require.Error(t, err)
	require.ErrorIs(t, err, errGPGTimeout)
	assert.Empty(t, sig)

	// The error must say which invocation stalled. "context deadline
	// exceeded" alone tells an operator nothing.
	assert.Contains(t, err.Error(), gpgOpSign)

	// Returning at all is the headline, but it has to return promptly:
	// if the stand-in's child kept the output pipes open, Cmd.Wait would
	// sit there until gpgWaitDelay elapsed.
	assert.Less(t, elapsed, gpgWaitDelay,
		"Run should return on cancellation, not wait out gpgWaitDelay")
}

// TestGPGCancellationPropagates pins that a caller's cancellation reaches
// gpg and is reported as a cancellation rather than as a timeout.
//
//nolint:paralleltest // fakeSlowGPGOnPath mutates the process-global PATH
func TestGPGCancellationPropagates(t *testing.T) {
	fakeSlowGPGOnPath(t)

	ctx, cancel := context.WithCancel(context.Background())
	cancel()

	_, err := gpgSign(ctx, []byte("data to sign"), GPGKeyID("KEYID"))

	require.Error(t, err)
	require.ErrorIs(t, err, context.Canceled)
	require.NotErrorIs(t, err, errGPGTimeout)
	assert.Contains(t, err.Error(), gpgOpSign)
}