nordisk/dwarves

crates/dwarves-slsa/tests/lock.rs

use dwarves_slsa::lock::{dependencies_of, parse_lock};

const LOCK: &str = r#"
# This file is automatically @generated by Cargo.
version = 4

[[package]]
name = "holger-errcode"
version = "2.0.0"

[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1111111111111111111111111111111111111111111111111111111111111111"

[[package]]
name = "tiny"
version = "0.1.0"
source = "git+https://github.com/x/tiny?branch=main#abcdef0123456789abcdef0123456789abcdef01"
"#;

const LOCK2: &str = r#"
version = 4

[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1111111111111111111111111111111111111111111111111111111111111111"

[[package]]
name = "anyhow"
version = "1.0.99"
source = "sparse+https://index.crates.io/"
checksum = "2222222222222222222222222222222222222222222222222222222222222222"
"#;

#[test]
fn every_package_is_read() {
    let p = parse_lock(LOCK).unwrap();
    assert_eq!(p.len(), 3);
    assert!(!p[0].is_registry());
    assert!(p[1].is_registry());
    assert_eq!(
        p[2].git_rev(),
        Some((
            "https://github.com/x/tiny".to_string(),
            "abcdef0123456789abcdef0123456789abcdef01".to_string()
        ))
    );
    assert_eq!(p[1].git_rev(), None);
}

#[test]
fn the_dependencies_are_deduplicated_sorted_and_path_packages_left_out() {
    let deps = dependencies_of(&[parse_lock(LOCK).unwrap(), parse_lock(LOCK2).unwrap()]);
    let uris: Vec<&str> = deps.iter().map(|d| d.uri.as_deref().unwrap()).collect();
    assert_eq!(
        uris,
        vec![
            "git+https://github.com/x/tiny",
            "pkg:cargo/anyhow@1.0.99",
            "pkg:cargo/serde@1.0.229"
        ]
    );
    assert_eq!(
        deps[2].digest["sha256"],
        "1111111111111111111111111111111111111111111111111111111111111111"
    );
    assert_eq!(
        deps[0].digest["gitCommit"],
        "abcdef0123456789abcdef0123456789abcdef01"
    );
}

#[test]
fn a_lock_that_is_not_toml_is_refused() {
    assert!(parse_lock("[[package]\nname=").is_err());
}

const PATCHED: &str = r#"
version = 4

[[package]]
name = "gunnar-recipe"
version = "0.1.1"
dependencies = ["nornir-build-thing", "serde"]

[[package]]
name = "nornir-build-thing"
version = "0.2.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3333333333333333333333333333333333333333333333333333333333333333"
dependencies = ["gix", "serde 1.0.229"]

[[package]]
name = "gix"
version = "0.88.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4444444444444444444444444444444444444444444444444444444444444444"
dependencies = ["gix-features"]

[[package]]
name = "gix-features"
version = "0.50.0"

[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1111111111111111111111111111111111111111111111111111111111111111"

[[package]]
name = "xtask"
version = "1.5.0"
dependencies = ["gix-features", "gunnar-store"]

[[package]]
name = "gunnar-store"
version = "1.5.0"
"#;

#[test]
fn the_path_packages_a_release_crate_reaches_are_its_patched_externals() {
    use dwarves_slsa::lock::path_externals;
    let steps: std::collections::BTreeSet<String> = ["gunnar-recipe".to_string()].into();
    let ext = path_externals(&[parse_lock(PATCHED).unwrap()], &steps);
    // gix-features is reached through crates.io crates; xtask and gunnar-store are not reached.
    assert_eq!(
        ext.into_iter().collect::<Vec<_>>(),
        vec![("gix-features".to_string(), "0.50.0".to_string())]
    );
}

#[test]
fn the_newest_semver_compatible_version_is_what_packaging_takes() {
    use dwarves_slsa::lock::newest_compatible;
    let v = |s: &[&str]| s.iter().map(|x| x.to_string()).collect::<Vec<_>>();
    assert_eq!(
        newest_compatible(&v(&["0.49.1", "0.50.0", "0.50.2", "0.51.0"]), "0.50.0").as_deref(),
        Some("0.50.2")
    );
    assert_eq!(
        newest_compatible(&v(&["1.0.0", "1.4.0", "2.0.0"]), "1.2.0").as_deref(),
        Some("1.4.0")
    );
    assert_eq!(
        newest_compatible(&v(&["0.0.3", "0.0.4"]), "0.0.3").as_deref(),
        Some("0.0.3")
    );
    assert_eq!(
        newest_compatible(&v(&["0.50.3-rc.1", "0.50.1"]), "0.50.0").as_deref(),
        Some("0.50.1")
    );
    assert_eq!(newest_compatible(&v(&["0.49.0"]), "0.50.0"), None);
}