nordisk/dwarves

crates/dwarves-slsa/tests/common/mod.rs

#![allow(dead_code)]
//! A throwaway P-256 key per test (ring), the way the YubiKey signs: ASN.1 DER
//! ECDSA over SHA-256 of the message.

use std::collections::BTreeMap;

use dwarves_slsa::statement::{
    Provenance, ResourceDescriptor, Subject, BUILDER_ID_DWARVES_SERVER, BUILD_TYPE_CARGO_RELEASE,
};
use ring::rand::SystemRandom;
use ring::signature::{EcdsaKeyPair, KeyPair, ECDSA_P256_SHA256_ASN1_SIGNING};
use serde_json::json;

/// The fixed DER prefix of a P-256 SubjectPublicKeyInfo.
pub const P256_SPKI_PREFIX: &str = "3059301306072a8648ce3d020106082a8648ce3d030107034200";

pub struct TestKey {
    pub kp: EcdsaKeyPair,
    pub spki: Vec<u8>,
}

pub fn key() -> TestKey {
    let rng = SystemRandom::new();
    let pkcs8 = EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, &rng).unwrap();
    let kp =
        EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_ASN1_SIGNING, pkcs8.as_ref(), &rng).unwrap();
    let mut spki = hex::decode(P256_SPKI_PREFIX).unwrap();
    spki.extend_from_slice(kp.public_key().as_ref());
    TestKey { kp, spki }
}

pub fn sign(k: &TestKey, msg: &[u8]) -> Vec<u8> {
    k.kp.sign(&SystemRandom::new(), msg)
        .unwrap()
        .as_ref()
        .to_vec()
}

pub fn hex64(c: char) -> String {
    std::iter::repeat_n(c, 64).collect()
}

pub fn provenance() -> Provenance {
    let mut version = BTreeMap::new();
    version.insert("dwarves-slsa".to_string(), "0.1.0".to_string());
    Provenance {
        build_type: BUILD_TYPE_CARGO_RELEASE.to_string(),
        external_parameters: json!({
            "release": "holger-2.0.1",
            "repositories": [
                {"name": "holger", "repository": "https://git.gunnar.rs/nordisk/holger", "commit": "87e5ada50ab5745464e4b46305bfd62d0460f52c"}
            ],
            "crates": [{"name": "holger-errcode", "version": "2.0.1", "repo": "holger", "path": "errcode"}]
        }),
        internal_parameters: json!({"image": "localhost/nordisk-cargo-toolchain@sha256:875a"}),
        resolved_dependencies: vec![ResourceDescriptor::new(
            Some("holger"),
            "git+https://git.gunnar.rs/nordisk/holger.git",
            "gitCommit",
            "87e5ada50ab5745464e4b46305bfd62d0460f52c",
        )],
        builder_id: BUILDER_ID_DWARVES_SERVER.to_string(),
        builder_version: version,
        invocation_id: "holger-2.0.1/20261029T120000Z-0011223344556677".to_string(),
        started_on: "2026-10-29T12:00:00Z".to_string(),
        finished_on: "2026-10-29T12:03:00Z".to_string(),
        byproducts: vec![ResourceDescriptor::new(
            Some("logs/build.log"),
            "file:logs/build.log",
            "sha256",
            &hex64('b'),
        )],
    }
}

pub fn subjects() -> Vec<Subject> {
    vec![
        Subject::sha256("crates/holger-errcode-2.0.1.crate", hex64('a')),
        Subject::sha256("bin/holger", hex64('c')),
    ]
}