From 55ea3d3476101ef1dce6d6e88770b0b0fb12c7c3 Mon Sep 17 00:00:00 2001
From: Bernardo Meurer Costa <beme@anthropic.com>
Date: Sun, 19 Oct 2025 00:04:30 +0000
Subject: [PATCH] test(tests/nixos/s3-binary-cache-store): test public bucket
 operations

Add `test_public_bucket_operations` to validate that store operations
work correctly on public S3 buckets without requiring credentials.
Tests nix store info and nix copy operations.
---
 tests/nixos/s3-binary-cache-store.nix | 37 +++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tests/nixos/s3-binary-cache-store.nix b/tests/nixos/s3-binary-cache-store.nix
index 96ca37f19..40804f599 100644
--- a/tests/nixos/s3-binary-cache-store.nix
+++ b/tests/nixos/s3-binary-cache-store.nix
@@ -340,6 +340,42 @@ in
           print("  ✓ nix copy works")
           print("  ✓ Credentials cached on client")
 
+      @setup_s3(populate_bucket=[PKGS['A'], PKGS['B']], public=True)
+      def test_public_bucket_operations(bucket):
+          """Test store operations on public bucket without credentials"""
+          print("\n=== Testing Public Bucket Operations ===")
+
+          store_url = make_s3_url(bucket)
+
+          # Verify store info works without credentials
+          client.succeed(f"nix store info --store '{store_url}' >&2")
+          print("  ✓ nix store info works without credentials")
+
+          # Get and validate store info JSON
+          info_json = client.succeed(f"nix store info --json --store '{store_url}'")
+          store_info = json.loads(info_json)
+
+          if not store_info.get("url"):
+              raise Exception("Store should have a URL")
+
+          print(f"  ✓ Store URL: {store_info['url']}")
+
+          # Verify packages are not yet in client store
+          client.fail(f"nix path-info {PKGS['A']}")
+          client.fail(f"nix path-info {PKGS['B']}")
+
+          # Test copy from public bucket without credentials
+          client.succeed(
+              f"nix copy --debug --no-check-sigs "
+              f"--from '{store_url}' {PKGS['A']} {PKGS['B']} 2>&1"
+          )
+
+          # Verify packages were copied successfully
+          client.succeed(f"nix path-info {PKGS['A']}")
+          client.succeed(f"nix path-info {PKGS['B']}")
+
+          print("  ✓ nix copy from public bucket works without credentials")
+
       @setup_s3(populate_bucket=[PKGS['A']])
       def test_url_format_variations(bucket):
           """Test different S3 URL parameter combinations"""
@@ -506,6 +542,7 @@ in
       test_error_message_formatting()
       test_fork_credential_preresolution()
       test_store_operations()
+      test_public_bucket_operations()
       test_url_format_variations()
       test_concurrent_fetches()
       test_compression_narinfo_gzip()