From 59c75c8a01c889c0fcb8345d4ba46e0c31c333d9 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] =?UTF-8?q?cve:=20actually=20test=20the=20narrowing=20?=
 =?UTF-8?q?=E2=80=94=20the=20previous=20commit=20shipped=20it=20uncovered?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Disabling the filter left all twenty-two assertions green, which means nothing
tested it. The counter-case I had written exercises the skip in the derivation,
not the filter inside the registry selection, so the feature went out with no
coverage at all — the project's own favourite failure, in the change that was
meant to remove noise.

Three assertions now cover it: three repositories of which one runs, the
counter-case showing the same call returns all three without estate knowledge,
and one that pins what the rule must not do — it excludes repositories, not old
tags, so a rollback target of a running service still counts.

Same sabotage as before now turns one of them red.
---
 monitoring/cve/test_targets.py | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/monitoring/cve/test_targets.py b/monitoring/cve/test_targets.py
index a82ba1f..b8c37b1 100644
--- a/monitoring/cve/test_targets.py
+++ b/monitoring/cve/test_targets.py
@@ -184,6 +184,39 @@ class RegistryAuswahl(unittest.TestCase):
         ziele = targets.ziele_registry("reg.example", je_repo=5)
         self.assertEqual(ziele, {"reg.example/sorb/x:v1.0.0"})
 
+    def _stelle_repos(self, repos):
+        targets.registry_repos = lambda reg, timeout=15.0: repos
+        targets.registry_tags = lambda reg, repo, token="", timeout=15.0: ["v1.0.0"]
+        targets.tag_erstellt = lambda reg, repo, tag, token="", timeout=15.0: ts(2026, 5, 1)
+
+    def test_nur_repos_mit_laufendem_tag_zaehlen(self):
+        # ⚠️ Der Kern der Einengung (#0051): Von drei Repos laeuft nur eines.
+        # element-desktop-build und windows-vm sind Bau-Artefakte und trugen
+        # zusammen 61 CRITICAL, davon 1 behebbar.
+        self._stelle_repos(["sorb/threadnet-web", "sorb/element-desktop-build", "sorb/windows-vm"])
+        laufend = {"reg.example/sorb/threadnet-web:v0.6.0"}
+        ziele = targets.ziele_registry("reg.example", je_repo=3, laufend=laufend)
+        self.assertEqual(ziele, {"reg.example/sorb/threadnet-web:v1.0.0"})
+
+    def test_gegenprobe_ohne_einengung_kaemen_die_bau_artefakte_mit(self):
+        # Belegt, dass der Test darueber ueberhaupt etwas prueft: ohne
+        # Bestandswissen liefert dieselbe Funktion alle drei Repos.
+        self._stelle_repos(["sorb/threadnet-web", "sorb/element-desktop-build", "sorb/windows-vm"])
+        ziele = targets.ziele_registry("reg.example", je_repo=3, laufend=None)
+        self.assertEqual(len(ziele), 3)
+        self.assertIn("reg.example/sorb/windows-vm:v1.0.0", ziele)
+
+    def test_einengung_trifft_nur_das_repo_nicht_den_tag(self):
+        # Laeuft v0.6.0, ist v0.5.4 trotzdem ein gueltiges Rollback-Ziel -
+        # die Einengung schliesst REPOS aus, nicht alte Fassungen.
+        targets.registry_repos = lambda reg, timeout=15.0: ["sorb/threadnet-web"]
+        targets.registry_tags = lambda reg, repo, token="", timeout=15.0: ["v0.6.0", "v0.5.4"]
+        targets.tag_erstellt = lambda reg, repo, tag, token="", timeout=15.0: (
+            ts(2026, 8, 19) if tag == "v0.6.0" else ts(2026, 8, 17))
+        laufend = {"reg.example/sorb/threadnet-web:v0.6.0"}
+        ziele = targets.ziele_registry("reg.example", je_repo=3, laufend=laufend)
+        self.assertIn("reg.example/sorb/threadnet-web:v0.5.4", ziele)
+
     def test_tag_ohne_zeitstempel_wird_uebersprungen_nicht_geraten(self):
         tags = ["v1.0.0", "v2.0.0"]
         zeiten = {"v1.0.0": ts(2026, 5, 10)}      # v2.0.0 liefert None