feat: update version to 2026.9.7 in pyproject.toml

Signed-off-by: d9pouces <github@19pouces.net>

tests/test_apt.py

@@ -1,7 +1,15 @@
+import subprocess
+from unittest.mock import MagicMock
+
+import pytest
+
 from id_configurator.config import Configuration
 from id_configurator.context import Context
 from id_configurator.modules.apt import AptModule
 
+KEY_CONTENT = "fake-armored-gpg-key"
+KEYRING_BYTES = b"fake-dearmored-keyring-bytes"
+
 SOURCE_CONTENT = {
     "uuid": "12345678-1234-5678-1234-567812345678",
     "organisation": "InterDiode",
@@ -12,13 +20,7 @@ SOURCE_CONTENT = {
                     "name": "interdiode",
                     "uris": ["http://example.invalid/debian"],
                     "suites": ["stable"],
-                    "signed-by": "/etc/apt/keyrings/interdiode.asc",
-                }
-            ],
-            "keys": [
-                {
-                    "name": "interdiode",
-                    "content": "fake-key-bytes",
+                    "signed-by": KEY_CONTENT,
                 }
             ],
         }
@@ -30,6 +32,36 @@ def make_config() -> Configuration:
     return Configuration.model_validate(SOURCE_CONTENT)
 
 
+def make_config_with(source_extra: dict) -> Configuration:
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+        "configurations": {
+            "apt": {
+                "sources": [
+                    {
+                        "name": "interdiode",
+                        "uris": ["http://example.invalid/debian"],
+                        "suites": ["stable"],
+                        **source_extra,
+                    }
+                ],
+            }
+        },
+    }
+    return Configuration.model_validate(data)
+
+
+def _mock_gpg_dearmor_success(monkeypatch, output: bytes = KEYRING_BYTES) -> MagicMock:
+    mock_run = MagicMock(
+        return_value=subprocess.CompletedProcess(
+            args=[], returncode=0, stdout=output, stderr=b""
+        )
+    )
+    monkeypatch.setattr("id_configurator.modules.apt.subprocess.run", mock_run)
+    return mock_run
+
+
 def test_is_relevant_false_without_src(tmp_path) -> None:
     context = Context(config=make_config(), dst=tmp_path / "dst", src=None)
     assert AptModule().is_relevant(context) is False
@@ -49,7 +81,10 @@ def test_is_relevant_true_with_apt_dir(tmp_path) -> None:
     assert AptModule().is_relevant(context) is True
 
 
-def test_apply_disables_existing_sources_and_adds_configured_ones(tmp_path) -> None:
+def test_apply_disables_existing_sources_and_adds_configured_ones(
+    tmp_path, monkeypatch
+) -> None:
+    mock_run = _mock_gpg_dearmor_success(monkeypatch)
     src = tmp_path / "src"
     apt_dir = src / "etc/apt"
     sources_list_d = apt_dir / "sources.list.d"
@@ -98,19 +133,22 @@ def test_apply_disables_existing_sources_and_adds_configured_ones(tmp_path) -> N
 
     assert not (dst / "etc/apt/sources.list.d/ignored.txt").exists()
 
-    keyring = (dst / "etc/apt/keyrings/interdiode.asc").read_bytes()
-    assert keyring == b"fake-key-bytes"
+    keyring = (dst / "etc/apt/keyrings/interdiode.gpg").read_bytes()
+    assert keyring == KEYRING_BYTES
+    mock_run.assert_called_once()
+    assert mock_run.call_args.kwargs["input"] == KEY_CONTENT.encode("utf-8")
 
     configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
         encoding="utf-8"
     )
     assert configured_source == (
         "Types: deb\nURIs: http://example.invalid/debian\nSuites: stable\n"
-        "Signed-By: /etc/apt/keyrings/interdiode.asc\nEnabled: yes\n"
+        "Signed-By: /etc/apt/keyrings/interdiode.gpg\nEnabled: yes\n"
     )
 
 
-def test_apply_without_existing_top_level_sources_list(tmp_path) -> None:
+def test_apply_without_existing_top_level_sources_list(tmp_path, monkeypatch) -> None:
+    _mock_gpg_dearmor_success(monkeypatch)
     src = tmp_path / "src"
     (src / "etc/apt").mkdir(parents=True)
     dst = tmp_path / "dst"
@@ -120,3 +158,93 @@ def test_apply_without_existing_top_level_sources_list(tmp_path) -> None:
 
     assert not (dst / "etc/apt/sources.list").exists()
     assert (dst / "etc/apt/sources.list.d/interdiode.sources").exists()
+
+
+def test_apply_uses_signed_by_file_when_no_key_content(tmp_path, monkeypatch) -> None:
+    mock_run = _mock_gpg_dearmor_success(monkeypatch)
+    dst = tmp_path / "dst"
+    context = Context(
+        config=make_config_with({"signed-by-file": "/etc/apt/keyrings/existing.gpg"}),
+        dst=dst,
+        src=None,
+    )
+
+    AptModule().apply(context)
+
+    mock_run.assert_not_called()
+    assert not (dst / "etc/apt/keyrings").exists()
+    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
+        encoding="utf-8"
+    )
+    assert configured_source == (
+        "Types: deb\nURIs: http://example.invalid/debian\nSuites: stable\n"
+        "Signed-By: /etc/apt/keyrings/existing.gpg\nEnabled: yes\n"
+    )
+
+
+def test_apply_signed_by_takes_precedence_over_signed_by_file(
+    tmp_path, monkeypatch
+) -> None:
+    mock_run = _mock_gpg_dearmor_success(monkeypatch)
+    dst = tmp_path / "dst"
+    context = Context(
+        config=make_config_with(
+            {
+                "signed-by": KEY_CONTENT,
+                "signed-by-file": "/etc/apt/keyrings/existing.gpg",
+            }
+        ),
+        dst=dst,
+        src=None,
+    )
+
+    AptModule().apply(context)
+
+    mock_run.assert_called_once()
+    assert (dst / "etc/apt/keyrings/interdiode.gpg").read_bytes() == KEYRING_BYTES
+    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
+        encoding="utf-8"
+    )
+    assert "Signed-By: /etc/apt/keyrings/interdiode.gpg\n" in configured_source
+
+
+def test_apply_without_signed_by_writes_no_keyring_or_field(
+    tmp_path, monkeypatch
+) -> None:
+    mock_run = _mock_gpg_dearmor_success(monkeypatch)
+    dst = tmp_path / "dst"
+    context = Context(config=make_config_with({}), dst=dst, src=None)
+
+    AptModule().apply(context)
+
+    mock_run.assert_not_called()
+    assert not (dst / "etc/apt/keyrings").exists()
+    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
+        encoding="utf-8"
+    )
+    assert configured_source == (
+        "Types: deb\nURIs: http://example.invalid/debian\nSuites: stable\nEnabled: yes\n"
+    )
+
+
+def test_resolve_signed_by_raises_when_gpg_not_on_path(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("id_configurator.modules.apt.shutil.which", lambda _: None)
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(), dst=dst, src=None)
+
+    with pytest.raises(RuntimeError, match="gpg is not available"):
+        AptModule().apply(context)
+
+
+def test_resolve_signed_by_raises_on_invalid_key(tmp_path, monkeypatch) -> None:
+    mock_run = MagicMock(
+        return_value=subprocess.CompletedProcess(
+            args=[], returncode=2, stdout=b"", stderr=b"gpg: no valid data found"
+        )
+    )
+    monkeypatch.setattr("id_configurator.modules.apt.subprocess.run", mock_run)
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(), dst=dst, src=None)
+
+    with pytest.raises(RuntimeError, match="invalid GPG key for apt source interdiode"):
+        AptModule().apply(context)