evangelostsak 33dbd1ed8c test(inventory): pin what the mesh writer may put on disk ...

Asserted against real files in a tempdir, because the guarantees are about
files: which host_vars a secret may appear in, and whether a second run of an
unchanged mesh leaves them alone.

Two cases carry the security argument. A private key must reach exactly one
host_vars file, which is what keeps one host's inventory from impersonating
another, and it must never appear there in plaintext. A third covers the
inverse of the idempotence shortcut: a public key whose credential has gone
missing is worse than no key, because peers accept it while its owner cannot
use it, so that member is reported unkeyed and the pair is reminted together.

A worker is asserted NOT to receive the data mesh. Carrying it would peer the
worker directly with the NFS server and bypass the routing through the hub that
this topology depends on.

2026-09-18 09:29:35 +02:00

..

__init__.py

…

test_plan.py

…

test_write.py

test(inventory): pin what the mesh writer may put on disk

2026-09-18 09:29:35 +02:00