57 lines
2.3 KiB
Python
57 lines
2.3 KiB
Python
import hashlib
|
|
from pathlib import Path
|
|
import unittest
|
|
|
|
from pi_dictate_service.startup import EXPECTED_BASE_UNIT_SHA256
|
|
|
|
|
|
REPOSITORY_ROOT = Path(__file__).resolve().parents[3]
|
|
UNIT_DIR = REPOSITORY_ROOT / "systemd/user"
|
|
|
|
|
|
class SystemdUnitTests(unittest.TestCase):
|
|
def test_startup_hash_matches_the_checked_in_service_unit(self) -> None:
|
|
self.assertEqual(
|
|
hashlib.sha256((UNIT_DIR / "pi-dictate.service").read_bytes()).hexdigest(),
|
|
EXPECTED_BASE_UNIT_SHA256,
|
|
)
|
|
|
|
def test_socket_unit_owns_the_exact_private_runtime_path(self) -> None:
|
|
socket_unit = (UNIT_DIR / "pi-dictate.socket").read_text(encoding="utf-8")
|
|
self.assertIn("ListenStream=%t/pi-dictate.sock", socket_unit)
|
|
self.assertIn("SocketMode=0600", socket_unit)
|
|
self.assertIn("Accept=no", socket_unit)
|
|
self.assertIn("RemoveOnStop=yes", socket_unit)
|
|
|
|
def test_service_is_offline_hardened_and_uses_private_native_caches(self) -> None:
|
|
service_unit = (UNIT_DIR / "pi-dictate.service").read_text(encoding="utf-8")
|
|
for expected in (
|
|
"PI_DICTATE_MODEL_PATH=%h/.local/share/pi-dictate/models/",
|
|
"PI_DICTATE_TERMS_PATH=%h/.local/share/pi-dictate/config/coding-terms.txt",
|
|
"PI_DICTATE_BOOST_ALPHA=1.0",
|
|
"HF_HUB_OFFLINE=1",
|
|
"TRANSFORMERS_OFFLINE=1",
|
|
"TRITON_CACHE_DIR=/tmp/pi-dictate-triton",
|
|
"NUMBA_CACHE_DIR=/tmp/pi-dictate-numba",
|
|
"TimeoutStopSec=5s",
|
|
"LimitCORE=0",
|
|
"MemorySwapMax=0",
|
|
"ProtectSystem=strict",
|
|
"ProtectHome=tmpfs",
|
|
"BindReadOnlyPaths=%h/.local/share/pi-dictate",
|
|
"BindReadOnlyPaths=%h/.local/share/uv/python",
|
|
"BindReadOnlyPaths=%h/.config/pi-dictate/config.json",
|
|
"BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service",
|
|
"BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service.d",
|
|
"BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.socket",
|
|
"BindReadOnlyPaths=%t/pipewire-0",
|
|
"RestrictAddressFamilies=AF_UNIX",
|
|
"SystemCallFilter=~bind listen",
|
|
"IPAddressDeny=any",
|
|
):
|
|
self.assertIn(expected, service_unit)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|