Use a shell script as test credentails providers

Author: sebsto

Package.swift

@@ -116,17 +116,16 @@ let package = Package(
             dependencies: [],
             swiftSettings: swiftSettings
         ),
-        .executableTarget(
-            name: "credential-process-test-helper",
-            path: "Sources/credential-process-test-helper"
-        ),
         .testTarget(
             name: "SotoCoreTests",
             dependencies: [
                 .byName(name: "SotoCore"),
                 .byName(name: "SotoTestUtils"),
                 .product(name: "NIOPosix", package: "swift-nio"),
                 .product(name: "InMemoryTracing", package: "swift-distributed-tracing"),
+            ],
+            resources: [
+                .copy("Resources/credential-process-test-helper.sh")
             ]
         ),
         .testTarget(

Sources/credential-process-test-helper/main.swift

@@ -30,10 +30,21 @@ import Foundation
 
 @Suite("Credential Process Provider")
 struct CredentialProcessProviderTests {
-    /// swift test always runs from the project root directory.
-    let testHelperPath = ".build/debug/credential-process-test-helper"
+    /// Path to the test helper shell script bundled as a test resource.
+    let testHelperPath: String
     let logger = Logger(label: "test")
 
+    init() throws {
+        guard let resourcePath = Bundle.module.path(forResource: "credential-process-test-helper", ofType: "sh") else {
+            throw TestHelperError.resourceNotFound
+        }
+        testHelperPath = resourcePath
+    }
+
+    enum TestHelperError: Error {
+        case resourceNotFound
+    }
+
     func save(content: String, prefix: String) throws -> String {
         let filepath = "\(prefix)-\(UUID().uuidString)"
         try content.write(toFile: filepath, atomically: true, encoding: .utf8)
@@ -314,9 +325,8 @@ struct CredentialProcessProviderTests {
     func endToEndExpiringWithConfigFile() async throws {
         // The INI parser strips spaces from values, so we use a wrapper script
         // to pass arguments to the test helper.
+        let scriptContent = "#!/bin/sh\nexec \"\(testHelperPath)\" --expiring\n"
         let cwd = FileManager.default.currentDirectoryPath
-        let absoluteHelperPath = "\(cwd)/\(testHelperPath)"
-        let scriptContent = "#!/bin/sh\nexec \"\(absoluteHelperPath)\" --expiring\n"
         let scriptPath = "\(cwd)/" + (try save(content: scriptContent, prefix: "expiring-script"))
         try FileManager.default.setAttributes(
             [.posixPermissions: 0o755],

Tests/SotoCoreTests/Credential/CredentialProcessProviderTests.swift

@@ -0,0 +1,91 @@
+#!/bin/sh
+#===----------------------------------------------------------------------===#
+#
+# This source file is part of the Soto for AWS open source project
+#
+# Copyright (c) 2017-2026 the Soto project authors
+# Licensed under Apache License v2.0
+#
+# See LICENSE.txt for license information
+# See CONTRIBUTORS.txt for the list of Soto project authors
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+#===----------------------------------------------------------------------===#
+
+# Test helper script for CredentialProcessProvider tests.
+# Mimics the output of a credential_process command as defined by the AWS CLI spec.
+# Accepts flags to control output for different test scenarios.
+
+# Check for flags
+INVALID_JSON=false
+INVALID_VERSION=false
+EXPIRING=false
+NO_SESSION_TOKEN=false
+EXIT_CODE=""
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --invalid-json)
+            INVALID_JSON=true
+            shift
+            ;;
+        --invalid-version)
+            INVALID_VERSION=true
+            shift
+            ;;
+        --expiring)
+            EXPIRING=true
+            shift
+            ;;
+        --no-session-token)
+            NO_SESSION_TOKEN=true
+            shift
+            ;;
+        --exit-code)
+            EXIT_CODE="$2"
+            shift 2
+            ;;
+        *)
+            shift
+            ;;
+    esac
+done
+
+# Handle --invalid-json: output garbage and exit
+if [ "$INVALID_JSON" = true ]; then
+    echo "this is not json{{{"
+    exit 0
+fi
+
+# Handle --exit-code: exit with the specified code
+if [ -n "$EXIT_CODE" ]; then
+    exit "$EXIT_CODE"
+fi
+
+# Build the JSON output
+VERSION=1
+if [ "$INVALID_VERSION" = true ]; then
+    VERSION=2
+fi
+
+# Start building JSON fields
+FIELDS="\"Version\":$VERSION,\"AccessKeyId\":\"AKID-CREDENTIAL-PROCESS\",\"SecretAccessKey\":\"SECRET-CREDENTIAL-PROCESS\""
+
+if [ "$NO_SESSION_TOKEN" = false ]; then
+    FIELDS="$FIELDS,\"SessionToken\":\"TOKEN-CREDENTIAL-PROCESS\""
+fi
+
+if [ "$EXPIRING" = true ]; then
+    # Generate an ISO8601 date 1 hour in the future
+    if date --version >/dev/null 2>&1; then
+        # GNU date (Linux)
+        EXPIRATION=$(date -u -d "+1 hour" "+%Y-%m-%dT%H:%M:%SZ")
+    else
+        # BSD date (macOS)
+        EXPIRATION=$(date -u -v+1H "+%Y-%m-%dT%H:%M:%SZ")
+    fi
+    FIELDS="$FIELDS,\"Expiration\":\"$EXPIRATION\""
+fi
+
+echo "{$FIELDS}"