<commit_before># development role excludes apache, in favor of flask runner,
# so ensure that apache is not installed.
unwanted_packages = %w(
  securedrop-app-code
  apache2-mpm-worker
  libapache2-mod-wsgi
  libapache2-mod-xsendfile
)
unwanted_packages.each do |unwanted_package|
  describe package(unwanted_package) do
    it { should_not be_installed }
  end
end

# ensure default html dir is absent
describe file("/var/www/html") do
  it { should_not exist }
end

securedrop_app_directories = [
  property['securedrop_data'],
  "#{property['securedrop_data']}/keys",
  "#{property['securedrop_data']}/tmp",
  "#{property['securedrop_data']}/store",
]
# ensure securedrop app directories exist with correct permissions
securedrop_app_directories.each do |securedrop_app_directory|
  describe file(securedrop_app_directory) do
    it { should be_directory }
    it { should be_owned_by property['securedrop_user'] }
    it { should be_grouped_into property['securedrop_user'] }
    it { should be_mode '700' }
  end
end

# /vagrant has 770 permissions, so test
# separately from the 700 permissions above
describe file(property['securedrop_code']) do
  it { should be_directory }
  it { should be_owned_by property['securedrop_user'] }
  it { should be_grouped_into property['securedrop_user'] }
  # Vagrant VirtualBox environments show /vagrant as 770,
  # but the Vagrant DigitalOcean droplet shows /vagrant as 775.
  # This appears to be a side-effect of the default umask
  # in the snapci instances. (The rsync provisioner for the
  # vagrant-digitalocean plugin preserves permissions from the host.)
  # The spectests for 'staging' still check for an explicit mode,
  # so it's OK to relax this test for now.
  #it { should be_mode '700' }
  # TODO: should be 700 in all environments; ansible task is
  # straightforward about this.
  it { should be_readable.by('owner') }
  it { should be_writable.by('owner') }
  it { should be_executable.by('owner') }
end

# ensure cronjob for securedrop tmp dir cleanup is enabled
describe cron do
  # TODO: this should be using property, but the ansible role
  # doesn't use a var, it's hard-coded. update ansible, then fix test.
  # it { should have_entry "@daily #{property['securedrop_code']}/manage.py clean_tmp" }
  it { should have_entry "@daily /var/www/securedrop/manage.py clean_tmp" }
end


# ensure default logo header file exists
# TODO: add check for custom logo header file
describe file("#{property['securedrop_code']}/static/i/logo.png") do
  it { should be_file }
  # TODO: Ansible task declares mode 400 but not as string, needs to be fixed
  # and tests updated. Also, not using "mode" in tests below because umask
  # on snapci machines differs from the /vagrant folder in dev VM.
  # Fixing Ansible task may fix differing perms.
  it { should be_writable.by('owner') }
  it { should be_readable.by('owner') }
  it { should be_readable.by('group') }
  it { should be_readable.by('others') }
  it { should be_owned_by property['securedrop_user'] }
  it { should be_grouped_into property['securedrop_user'] }
end<commit_msg>Updates spectest for development VM docroot<commit_after># development role excludes apache, in favor of flask runner,
# so ensure that apache is not installed.
unwanted_packages = %w(
  securedrop-app-code
  apache2-mpm-worker
  libapache2-mod-wsgi
  libapache2-mod-xsendfile
)
unwanted_packages.each do |unwanted_package|
  describe package(unwanted_package) do
    it { should_not be_installed }
  end
end

# ensure default html dir is absent
describe file("/var/www/html") do
  it { should_not exist }
end

securedrop_app_directories = [
  property['securedrop_data'],
  "#{property['securedrop_data']}/keys",
  "#{property['securedrop_data']}/tmp",
  "#{property['securedrop_data']}/store",
]
# ensure securedrop app directories exist with correct permissions
securedrop_app_directories.each do |securedrop_app_directory|
  describe file(securedrop_app_directory) do
    it { should be_directory }
    it { should be_owned_by property['securedrop_user'] }
    it { should be_grouped_into property['securedrop_user'] }
    it { should be_mode '700' }
  end
end

# /vagrant has 770 permissions, so test
# separately from the 700 permissions above
describe file(property['securedrop_code']) do
  it { should be_directory }
  it { should be_owned_by property['securedrop_user'] }
  it { should be_grouped_into property['securedrop_user'] }
  # Vagrant VirtualBox environments show /vagrant as 770,
  # but the Vagrant DigitalOcean droplet shows /vagrant as 775.
  # This appears to be a side-effect of the default umask
  # in the snapci instances. (The rsync provisioner for the
  # vagrant-digitalocean plugin preserves permissions from the host.)
  # The spectests for 'staging' still check for an explicit mode,
  # so it's OK to relax this test for now.
  #it { should be_mode '700' }
  # TODO: should be 700 in all environments; ansible task is
  # straightforward about this.
  it { should be_readable.by('owner') }
  it { should be_writable.by('owner') }
  it { should be_executable.by('owner') }
end

# ensure cronjob for securedrop tmp dir cleanup is enabled
describe cron do
  # TODO: this should be using property, but the ansible role
  # doesn't use a var, it's hard-coded. update ansible, then fix test.
  # it { should have_entry "@daily #{property['securedrop_code']}/manage.py clean_tmp" }
  it { should have_entry "@daily /vagrant/securedrop/manage.py clean_tmp" }
end


# ensure default logo header file exists
# TODO: add check for custom logo header file
describe file("#{property['securedrop_code']}/static/i/logo.png") do
  it { should be_file }
  # TODO: Ansible task declares mode 400 but not as string, needs to be fixed
  # and tests updated. Also, not using "mode" in tests below because umask
  # on snapci machines differs from the /vagrant folder in dev VM.
  # Fixing Ansible task may fix differing perms.
  it { should be_writable.by('owner') }
  it { should be_readable.by('owner') }
  it { should be_readable.by('group') }
  it { should be_readable.by('others') }
  it { should be_owned_by property['securedrop_user'] }
  it { should be_grouped_into property['securedrop_user'] }
end
{'fraction_non_alphanumeric': 0.092914653784219, 'fraction_numerical': 0.008695652173913044, 'mean_word_length': 4.4626209322779244, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 3, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7146490', 'n_tokens_mistral': 2033, 'n_tokens_neox': 1886, 'n_words': 660}