|
1 | 1 | <# |
2 | 2 | .SYNOPSIS |
3 | | - Automated Test Runner for RackStack v1.122.3 |
| 3 | + Automated Test Runner for RackStack v1.122.4 |
4 | 4 |
|
5 | 5 | .DESCRIPTION |
6 | 6 | Comprehensive non-interactive test suite covering: |
@@ -10754,6 +10754,65 @@ catch { |
10754 | 10754 | Write-TestResult "Defender Interpreter Guard Tests" $false $_.Exception.Message |
10755 | 10755 | } |
10756 | 10756 |
|
| 10757 | +# ============================================================================ |
| 10758 | +# SECTION 209: BUILD METADATA INTEGRITY (what ps2exe stamps into the EXE) |
| 10759 | +# ============================================================================ |
| 10760 | +# Every release through v1.122.3 shipped a binary whose CompanyName, |
| 10761 | +# ProductName, FileDescription and LegalCopyright were EMPTY — verified by |
| 10762 | +# reading the version resource out of the published v1.122.3 artifact. Two |
| 10763 | +# costs: an empty version resource is a mild heuristic-AV signal because |
| 10764 | +# legitimate software populates it, and -RequireAdmin raises a UAC prompt that |
| 10765 | +# displays FileDescription as the program name, so users were asked to elevate |
| 10766 | +# a blank. |
| 10767 | +# |
| 10768 | +# The compiler version is pinned here too. ps2exe builds the binary that ships |
| 10769 | +# to users, so an unpinned Install-Module let the released artifact change |
| 10770 | +# without a commit — the exposure the SHA-pinning policy already closes for |
| 10771 | +# actions, including transitive ones. |
| 10772 | +Write-SectionHeader "SECTION 209: BUILD METADATA INTEGRITY" |
| 10773 | + |
| 10774 | +try { |
| 10775 | + $ciPath209 = Join-Path $script:ModuleRoot '.github\workflows\ci.yml' |
| 10776 | + if (Test-Path -LiteralPath $ciPath209) { |
| 10777 | + $ci209 = Get-Content -LiteralPath $ciPath209 -Raw |
| 10778 | + |
| 10779 | + # Compiler must be pinned to an exact version, never floating. |
| 10780 | + Write-TestResult "Build: ps2exe is pinned to an explicit version" ` |
| 10781 | + ([bool]($ci209 -match "\`$ps2exeVersion\s*=\s*'\d+\.\d+\.\d+'")) |
| 10782 | + Write-TestResult "Build: ps2exe install uses -RequiredVersion" ` |
| 10783 | + ([bool]($ci209 -match 'Install-Module ps2exe -RequiredVersion')) |
| 10784 | + Write-TestResult "Build: ps2exe install is not unpinned" ` |
| 10785 | + ([bool]($ci209 -notmatch 'Install-Module ps2exe -Force')) |
| 10786 | + |
| 10787 | + # The version resource must actually be populated. |
| 10788 | + $p2e209 = [regex]::Match($ci209, '(?s)Invoke-PS2EXE.*?(?=\r?\n\s*\$info\s*=)') |
| 10789 | + Write-TestResult "Build: Invoke-PS2EXE call is locatable" $p2e209.Success ` |
| 10790 | + "regex found no ps2exe invocation — the checks below would pass vacuously" |
| 10791 | + $call209 = $p2e209.Value |
| 10792 | + foreach ($flag in @('title', 'product', 'company', 'copyright', 'description')) { |
| 10793 | + Write-TestResult "Build: EXE metadata sets -$flag" ` |
| 10794 | + ($p2e209.Success -and $call209 -match "-$flag\s+'") |
| 10795 | + } |
| 10796 | + Write-TestResult "Build: EXE still stamps -Version" ` |
| 10797 | + ($p2e209.Success -and $call209 -match '-Version\s+\$ver') |
| 10798 | + |
| 10799 | + # One identity across every published surface. The EXE's CompanyName |
| 10800 | + # must agree with the Gallery manifest rather than drifting on its own. |
| 10801 | + $psd209 = Get-Content (Join-Path $script:ModuleRoot 'RackStack.psd1') -Raw |
| 10802 | + $psdCompany209 = [regex]::Match($psd209, "CompanyName\s*=\s*'([^']+)'").Groups[1].Value |
| 10803 | + $exeCompany209 = [regex]::Match($call209, "-company\s+'([^']+)'").Groups[1].Value |
| 10804 | + Write-TestResult "Build: EXE CompanyName matches RackStack.psd1 ('$psdCompany209')" ` |
| 10805 | + ($psdCompany209 -and $exeCompany209 -and $psdCompany209 -eq $exeCompany209) ` |
| 10806 | + "psd1='$psdCompany209' exe='$exeCompany209'" |
| 10807 | + } |
| 10808 | + else { |
| 10809 | + Write-TestResult "Build: metadata integrity" -Skipped -Message "no .github/workflows in this layout" |
| 10810 | + } |
| 10811 | +} |
| 10812 | +catch { |
| 10813 | + Write-TestResult "Build Metadata Integrity Tests" $false $_.Exception.Message |
| 10814 | +} |
| 10815 | + |
10757 | 10816 | # ============================================================================ |
10758 | 10817 | # FINAL SUMMARY |
10759 | 10818 | # ============================================================================ |
|
0 commit comments