Bind the release-recovery adapter to the contract it validates

Author: durable-workflow-ops

.github/workflows/ci.yml

@@ -62,6 +62,7 @@ jobs:
             --contract scripts/ci/release-recovery-consumer-contract.json \
             --adapter scripts/ci/release-recovery-consumer-adapter.json \
             "${arguments[@]}"
+          python scripts/ci/test-component-release-recovery.py ConsumerContractIdentityRegressionTest
       - run: python -m build
       - run: twine check dist/*
       - run: python scripts/smoke-built-package.py

scripts/ci/release-recovery-consumer-adapter.json

@@ -3,8 +3,8 @@
   "consumer": "scripts/ci/component-release-recovery.py",
   "contract": {
     "path": "scripts/ci/release-recovery-consumer-contract.json",
-    "sha256": "6220a07457da22160c6522e94c019b012945ae1c9a4392ce6cf7d2cd8ab20794",
-    "version": "1.4.0"
+    "sha256": "b0852dc8cabf53498b1380fdeb8ffd437ec8ba7b6ad8ba5e6c6814f90126e4ab",
+    "version": "1.4.1"
   },
   "distribution_verification": {
     "command": [
@@ -16,7 +16,7 @@
   "schema": "durable-workflow.release-recovery-consumer-adapter/v1",
   "suite": {
     "path": "scripts/ci/release_recovery_consumer_conformance.py",
-    "sha256": "4efc61459e77c9102bc8236de3955bca0883c04c271e7a1134b5c54819cd9f87"
+    "sha256": "e5893129289f7af2688f9ea232b5b36d06370839840b33b0972ee6976608ec3d"
   },
   "target_branch": "main"
 }

scripts/ci/release-recovery-consumer-contract.json

@@ -76,7 +76,7 @@
   ],
   "schema": "durable-workflow.release-recovery-consumer-conformance/v1",
   "suite": {
-    "sha256": "4efc61459e77c9102bc8236de3955bca0883c04c271e7a1134b5c54819cd9f87"
+    "sha256": "e5893129289f7af2688f9ea232b5b36d06370839840b33b0972ee6976608ec3d"
   },
-  "version": "1.4.0"
+  "version": "1.4.1"
 }

scripts/ci/release_recovery_consumer_conformance.py

@@ -127,7 +127,12 @@ def relative_file(root: Path, value: Any, label: str) -> Path:
     path = PurePosixPath(value)
     if path.is_absolute() or ".." in path.parts:
         raise ConformanceError(f"{label} must stay within the repository")
-    resolved = root.joinpath(*path.parts)
+    repository_root = root.resolve()
+    resolved = root.joinpath(*path.parts).resolve()
+    try:
+        resolved.relative_to(repository_root)
+    except ValueError as error:
+        raise ConformanceError(f"{label} must stay within the repository") from error
     if not resolved.is_file():
         raise ConformanceError(f"{label} does not exist: {value}")
     return resolved
@@ -220,6 +225,7 @@ def validate_adapter(
     contract_sha256: str,
     repository_root: Path,
     current_suite: Path,
+    current_contract: Path,
 ) -> tuple[Path, list[str]]:
     expected_keys = {
         "component",
@@ -241,13 +247,19 @@ def validate_adapter(
     if identity not in CONSUMERS or identity not in contract["consumers"]:
         raise ConformanceError("consumer adapter is not in the contract target topology")
     contract_pin = adapter.get("contract")
-    if (
-        not isinstance(contract_pin, dict)
-        or set(contract_pin) != {"path", "sha256", "version"}
-        or contract_pin.get("version") != contract["version"]
-        or contract_pin.get("sha256") != contract_sha256
-    ):
-        raise ConformanceError("consumer adapter does not pin the exact contract version and digest")
+    if not isinstance(contract_pin, dict) or set(contract_pin) != {"path", "sha256", "version"}:
+        raise ConformanceError("consumer adapter does not declare the exact contract pin shape")
+    adapter_contract = relative_file(repository_root, contract_pin["path"], "adapter contract")
+    invoked_contract = current_contract.resolve()
+    if adapter_contract != invoked_contract:
+        raise ConformanceError("the invoked contract is not the adapter's declared contract")
+    declared_contract, declared_contract_raw = load_json_object(adapter_contract, "adapter contract")
+    if declared_contract.get("version") != contract_pin.get("version") or sha256_bytes(
+        declared_contract_raw
+    ) != contract_pin.get("sha256"):
+        raise ConformanceError("the adapter's declared contract does not match its version and digest pins")
+    if contract_pin.get("version") != contract["version"] or contract_pin.get("sha256") != contract_sha256:
+        raise ConformanceError("consumer adapter does not pin the exact invoked contract version and digest")
     suite_pin = adapter.get("suite")
     if (
         not isinstance(suite_pin, dict)
@@ -258,7 +270,6 @@ def validate_adapter(
     adapter_suite = relative_file(repository_root, suite_pin["path"], "adapter suite")
     if adapter_suite.resolve() != current_suite.resolve():
         raise ConformanceError("the invoked suite is not the adapter's declared suite")
-    relative_file(repository_root, contract_pin["path"], "adapter contract")
     consumer = relative_file(repository_root, adapter.get("consumer"), "adapter consumer")
     distribution = adapter.get("distribution_verification")
     if (
@@ -1162,6 +1173,7 @@ def main() -> int:
         contract_sha256,
         repository_root,
         suite_path,
+        contract_path,
     )
     module = load_consumer(consumer_path)
     cases, failures = run_cases(module)

scripts/ci/test-component-release-recovery.py

@@ -3,11 +3,13 @@
 
 from __future__ import annotations
 
+import copy
 import datetime as dt
 import hashlib
 import importlib.util
 import io
 import json
+import shutil
 import subprocess
 import sys
 import tempfile
@@ -16,6 +18,7 @@
 from pathlib import Path
 from unittest import mock
 
+import release_recovery_consumer_conformance as consumer_conformance
 from cli_release_verifier_contract import (  # noqa: F401 - imported for unittest discovery
     CliRecoveryWorkflowSourceTest,
     CliReleaseAuthorityTest,
@@ -33,6 +36,7 @@
 RECOVERY_SCRIPT = Path(__file__).with_name("component-release-recovery.py")
 CONSUMER_CONFORMANCE_SCRIPT = Path(__file__).with_name("release_recovery_consumer_conformance.py")
 CONSUMER_CONTRACT_PATH = Path(__file__).with_name("release-recovery-consumer-contract.json")
+CONSUMER_ADAPTER_PATH = Path(__file__).with_name("release-recovery-consumer-adapter.json")
 RUST_WORKFLOW_FIXTURE = Path(__file__).with_name("sdk-rust-release-plan-recovery.fixture.yml")
 REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
 RECOVERY_WORKFLOW = REPOSITORY_ROOT / ".github/workflows/release-plan-recovery.yml"
@@ -236,6 +240,114 @@ def test_unavailable_previous_commit_is_rejected(self):
         )
 
 
+class ConsumerContractIdentityRegressionTest(unittest.TestCase):
+    def adapter_fixture(
+        self,
+        root: Path,
+    ) -> tuple[dict[str, object], dict[str, object], str, Path, Path]:
+        ci_root = root / "scripts/ci"
+        ci_root.mkdir(parents=True)
+        suite_path = ci_root / CONSUMER_CONFORMANCE_SCRIPT.name
+        contract_path = ci_root / CONSUMER_CONTRACT_PATH.name
+        consumer_path = ci_root / RECOVERY_SCRIPT.name
+        verifier_path = ci_root / Path(__file__).name
+        shutil.copyfile(CONSUMER_CONFORMANCE_SCRIPT, suite_path)
+        contract = json.loads(CONSUMER_CONTRACT_PATH.read_text())
+        contract_raw = consumer_conformance.canonical_json(contract)
+        contract_path.write_bytes(contract_raw)
+        consumer_path.write_text("# consumer fixture\n")
+        verifier_path.write_text("# verifier fixture\n")
+        adapter = json.loads(CONSUMER_ADAPTER_PATH.read_text())
+        return (
+            adapter,
+            contract,
+            consumer_conformance.sha256_bytes(contract_raw),
+            suite_path,
+            contract_path,
+        )
+
+    def test_matching_declared_and_invoked_contract_passes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            adapter, contract, digest, suite_path, contract_path = self.adapter_fixture(root)
+
+            consumer, command = consumer_conformance.validate_adapter(
+                adapter,
+                contract,
+                digest,
+                root,
+                suite_path,
+                contract_path,
+            )
+
+        self.assertEqual("component-release-recovery.py", consumer.name)
+        self.assertEqual(["{python}", "scripts/ci/test-component-release-recovery.py"], command)
+
+    def test_alternate_invoked_contract_is_rejected(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            adapter, contract, digest, suite_path, contract_path = self.adapter_fixture(root)
+            alternate_path = contract_path.with_name("alternate-contract.json")
+            alternate_path.write_bytes(contract_path.read_bytes())
+
+            with self.assertRaisesRegex(
+                consumer_conformance.ConformanceError,
+                "invoked contract is not the adapter's declared contract",
+            ):
+                consumer_conformance.validate_adapter(
+                    adapter,
+                    contract,
+                    digest,
+                    root,
+                    suite_path,
+                    alternate_path,
+                )
+
+    def test_stale_declared_contract_is_rejected(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            adapter, contract, digest, suite_path, contract_path = self.adapter_fixture(root)
+            stale_path = contract_path.with_name("stale-contract.json")
+            stale_contract = copy.deepcopy(contract)
+            stale_contract["version"] = "1.4.0"
+            stale_path.write_bytes(consumer_conformance.canonical_json(stale_contract))
+            adapter["contract"]["path"] = stale_path.relative_to(root).as_posix()
+
+            with self.assertRaisesRegex(
+                consumer_conformance.ConformanceError,
+                "invoked contract is not the adapter's declared contract",
+            ):
+                consumer_conformance.validate_adapter(
+                    adapter,
+                    contract,
+                    digest,
+                    root,
+                    suite_path,
+                    contract_path,
+                )
+
+    def test_mismatched_declared_contract_bytes_are_rejected(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            adapter, contract, digest, suite_path, contract_path = self.adapter_fixture(root)
+            mismatched_contract = copy.deepcopy(contract)
+            mismatched_contract["cases"][0]["requirement"] += " (mismatched declared bytes)"
+            contract_path.write_bytes(consumer_conformance.canonical_json(mismatched_contract))
+
+            with self.assertRaisesRegex(
+                consumer_conformance.ConformanceError,
+                "declared contract does not match its version and digest pins",
+            ):
+                consumer_conformance.validate_adapter(
+                    adapter,
+                    contract,
+                    digest,
+                    root,
+                    suite_path,
+                    contract_path,
+                )
+
+
 def load_recovery_for_retry_tests():
     loaded = globals().get("recovery")
     if loaded is not None: