feat(pip): verify git & https access from pip container (Fixes #216)

tests/test_pip_git_https_access.py

@@ -0,0 +1,37 @@
+"""Test verifying Git & HTTPS access from pip container identity."""
+import os
+import sys
+import json
+import unittest
+import subprocess
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+PARTITION_TABLE_PATH = os.path.join(REPO_ROOT, "fleet", "partition-table.json")
+
+class TestPipGitHttpsAccess(unittest.TestCase):
+    def test_partition_table_pip_entry(self):
+        self.assertTrue(os.path.exists(PARTITION_TABLE_PATH))
+        with open(PARTITION_TABLE_PATH) as f:
+            pt = json.load(f)
+        pip_entry = pt.get("contributors", {}).get("pip")
+        self.assertIsNotNone(pip_entry)
+        self.assertEqual(pip_entry.get("username"), "pip")
+        self.assertTrue(pip_entry.get("clone_url", "").startswith("https://pip:"))
+        self.assertIn("tea.muse-dev.online/super/box.git", pip_entry.get("clone_url", ""))
+
+    def test_pip_git_ls_remote(self):
+        exec_script = os.path.join(REPO_ROOT, "bin", "netvm-exec.sh")
+        if not os.path.exists(exec_script):
+            self.skipTest("netvm-exec.sh not available")
+
+        with open(PARTITION_TABLE_PATH) as f:
+            pt = json.load(f)
+        clone_url = pt["contributors"]["pip"]["clone_url"]
+
+        cmd = [exec_script, "pip", "--", "git", "ls-remote", clone_url, "HEAD"]
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
+        self.assertEqual(proc.returncode, 0, f"git ls-remote failed: {proc.stderr}")
+        self.assertIn("HEAD", proc.stdout)
+
+if __name__ == "__main__":
+    unittest.main()