1 files changed, 64 insertions, 0 deletions
diff --git a/packages/meshbay-node/tests/test_packaging_audit.py b/packages/meshbay-node/tests/test_packaging_audit.py
new file mode 100644
index 0000000..4409b01
--- /dev/null
+++ b/packages/meshbay-node/tests/test_packaging_audit.py
@@ -0,0 +1,64 @@
+"""
+packaging/audit_deps.py, the pip-audit step of the builds.
+
+What can be checked without the network: a build with no network goes on
+(the audit is skipped with a warning, never a failure), what is audited is
+what ships, and the ignore list is read as ids. Whether pip-audit stops a
+build on a real advisory needs the network and was checked by hand.
+"""
+
+import importlib.util
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[3]
+SCRIPT = ROOT / "packaging" / "audit_deps.py"
+
+pytestmark = pytest.mark.skipif(not SCRIPT.exists(), reason="packaging not present")
+
+
+def _module():
+    spec = importlib.util.spec_from_file_location("audit_deps", SCRIPT)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def test_no_network_skips_the_audit_without_failing_the_build(tmp_path):
+    # A proxy nobody listens on: every request is refused at once.
+    dead = "http://127.0.0.1:9"
+    env = {**os.environ, "HTTPS_PROXY": dead, "https_proxy": dead,
+           "HTTP_PROXY": dead, "http_proxy": dead}
+    run = subprocess.run([sys.executable, str(SCRIPT), "--tool-dir", str(tmp_path / "t")],
+                         capture_output=True, text=True, env=env, timeout=60)
+    assert run.returncode == 0, run.stderr
+    assert "pip-audit skipped: no network" in run.stderr
+    assert not (tmp_path / "t").exists(), "nothing is installed when it cannot run"
+
+
+def test_what_is_audited_is_what_ships():
+    names = {line.split("==")[0].lower() for line in _module().shipped()}
+    assert "pytest" in names, "the environment's packages are listed"
+    assert not {n for n in names if n.startswith("meshbay")}, "ours are not on PyPI"
+    assert not names & {"pip", "setuptools", "wheel"}, "build tools do not ship"
+
+
+def test_the_ignore_list_is_read_as_ids(tmp_path, monkeypatch):
+    mod = _module()
+    f = tmp_path / "ignore.txt"
+    f.write_text("# a comment\n\nPYSEC-2026-1  # not reached: no JWK import\n"
+                 "GHSA-xxxx-yyyy-zzzz\n", encoding="utf-8")
+    monkeypatch.setattr(mod, "IGNORE_FILE", f)
+    assert mod.ignored() == ["PYSEC-2026-1", "GHSA-xxxx-yyyy-zzzz"]
+
+
+def test_the_shipped_ignore_list_lets_nothing_through_unexplained():
+    """Every id in the real file carries its reason."""
+    mod = _module()
+    for line in mod.IGNORE_FILE.read_text(encoding="utf-8").splitlines():
+        if line.strip() and not line.lstrip().startswith("#"):
+            assert "#" in line, f"no reason given: {line!r}"