about summary refs log tree commit diff
path: root/nixos/tests/signal-desktop.nix
blob: 5e2b648c7cf598e90a072e867908b20f4ba70ebf (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
import ./make-test-python.nix ({ pkgs, ...} :

let
  sqlcipher-signal = pkgs.writeShellScriptBin "sqlcipher" ''
    set -eu

    readonly CFG=~/.config/Signal/config.json
    readonly KEY="$(${pkgs.jq}/bin/jq --raw-output '.key' $CFG)"
    readonly DB="$1"
    readonly SQL="SELECT * FROM sqlite_master where type='table'"
    ${pkgs.sqlcipher}/bin/sqlcipher "$DB" "PRAGMA key = \"x'$KEY'\"; $SQL"
  '';
in {
  name = "signal-desktop";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ flokli primeos ];
  };

  nodes.machine = { ... }:

  {
    imports = [
      ./common/user-account.nix
      ./common/x11.nix
    ];

    services.xserver.enable = true;
    test-support.displayManager.auto.user = "alice";
    environment.systemPackages = with pkgs; [
      signal-desktop file sqlite sqlcipher-signal
    ];
  };

  enableOCR = true;

  testScript = { nodes, ... }: let
    user = nodes.machine.config.users.users.alice;
  in ''
    start_all()
    machine.wait_for_x()

    # start signal desktop
    machine.execute("su - alice -c signal-desktop >&2 &")

    # Wait for the Signal window to appear. Since usually the tests
    # are run sandboxed and therfore with no internet, we can not wait
    # for the message "Link your phone ...". Nor should we wait for
    # the "Failed to connect to server" message, because when manually
    # running this test it will be not sandboxed.
    machine.wait_for_text("Signal")
    machine.wait_for_text("File Edit View Window Help")
    machine.screenshot("signal_desktop")

    # Test if the database is encrypted to prevent these issues:
    # - https://github.com/NixOS/nixpkgs/issues/108772
    # - https://github.com/NixOS/nixpkgs/pull/117555
    print(machine.succeed("su - alice -c 'file ~/.config/Signal/sql/db.sqlite'"))
    machine.fail(
        "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -e SQLite -e database"
    )
    # Only SQLCipher should be able to read the encrypted DB:
    machine.fail(
        "su - alice -c 'sqlite3 ~/.config/Signal/sql/db.sqlite .tables'"
    )
    print(machine.succeed(
        "su - alice -c 'sqlcipher ~/.config/Signal/sql/db.sqlite'"
    ))
  '';
})