feat: install plugins from approved source commits

host_agent/tests/test_catalog.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import hashlib
+import io
+import tarfile
 import tempfile
 import unittest
 from pathlib import Path
@@ -48,6 +50,36 @@ class CatalogTests(unittest.TestCase):
         plan = StoreClient(self.config, transport).get_release("demo-plugin", "1.2.3")
         self.assertEqual(plan.version, "1.2.3")
 
+    def test_commit_bound_source_archive_is_verified(self) -> None:
+        buffer = io.BytesIO()
+        with tarfile.open(fileobj=buffer, mode="w:gz") as archive:
+            content = b"[build-system]\nrequires = []\n"
+            info = tarfile.TarInfo("demo/pyproject.toml")
+            info.size = len(content)
+            archive.addfile(info, io.BytesIO(content))
+        artifact = buffer.getvalue()
+        commit = "d" * 40
+        release = release_json(
+            download_url=f"http://artifacts.test/demo/archive/{commit}.tar.gz",
+            artifact_kind="source_archive",
+            artifact_filename="demo-plugin-1.2.3-source.tar.gz",
+            commit_sha=commit,
+            sha256=hashlib.sha256(artifact).hexdigest(),
+            artifact_size=len(artifact),
+        )
+        transport = FakeTransport(
+            {
+                "http://store.test/api/v1/plugins/demo-plugin": plugin_json(),
+                "http://store.test/api/v1/plugins/demo-plugin/releases/1.2.3": release,
+            },
+            artifact,
+        )
+        client = StoreClient(self.config, transport)
+        plan = client.get_release("demo-plugin", "1.2.3")
+        directory = self.root / "source-operation"
+        directory.mkdir()
+        self.assertEqual(client.download_release(plan, directory).read_bytes(), artifact)
+
     def test_unapproved_or_mutable_release_rejected(self) -> None:
         for change in ({"approved": False}, {"immutable": False}, {"status": "pending"}):
             with self.subTest(change=change):