nordisk/dwarves

crates/dwarves-slsa/tests/release_build.rs

//! dwarves' release-build mode: the builder is the dwarves server; workspace binaries
//! (the Build Thing path); the publish decisions.

use dwarves_slsa::publish::{decide, parse_retry_after, Decision};
use dwarves_slsa::runner::{workspace_binaries_file, workspace_binary_container, Layout};
use dwarves_slsa::spec::ReleaseSpec;
use dwarves_slsa::statement::BUILDER_ID_DWARVES_SERVER;
use dwarves_slsa::verify::Expect;

const IMAGE: &str = "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334";

fn ws_spec(extra: &str) -> String {
    format!(
        r#"
name = "gunnar-server-variant"
image = "{IMAGE}"
lock = ["gunnar/Cargo.toml"]
[[repo]]
name = "gunnar"
org = "nordisk"
commit = "72b99016b83d5328d8dbbf4639517afdfa066873"
[[workspace_binary]]
manifest = "gunnar/Cargo.toml"
package = "gunnar"
bin = "gunnar"
features = ["engine-znippy", "http"]
no_default_features = true
{extra}"#
    )
}

#[test]
fn the_builder_is_the_dwarves_server() {
    assert_eq!(
        BUILDER_ID_DWARVES_SERVER,
        "https://git.gunnar.rs/nordisk/dwarves/slsa/builders/dwarves-server/v1"
    );
    assert_eq!(Expect::default().builder_id, BUILDER_ID_DWARVES_SERVER);
}

#[test]
fn a_release_of_workspace_binaries_only_is_a_release() {
    let s = ReleaseSpec::parse(&ws_spec("")).unwrap();
    assert!(s.crates.is_empty());
    assert_eq!(s.workspace_binaries[0].package, "gunnar");
    assert_eq!(
        workspace_binaries_file(&s),
        "gunnar/Cargo.toml gunnar gunnar 1 engine-znippy,http\n"
    );
    assert_eq!(
        s.external_parameters()["workspaceBinaries"][0]["bin"],
        "gunnar"
    );
}

#[test]
fn a_workspace_binary_of_an_unpinned_repo_or_outside_path_is_refused() {
    let e = ReleaseSpec::parse(&ws_spec("").replace(
        "manifest = \"gunnar/Cargo.toml\"",
        "manifest = \"edda/Cargo.toml\"",
    ))
    .unwrap_err();
    assert!(e.0.contains("pinned"), "{e}");
    let e = ReleaseSpec::parse(&ws_spec("").replace(
        "manifest = \"gunnar/Cargo.toml\"",
        "manifest = \"gunnar/../x/Cargo.toml\"",
    ))
    .unwrap_err();
    assert!(e.0.contains("path"), "{e}");
}

#[test]
fn a_workspace_binary_is_built_offline_from_the_snapshot_in_a_sealed_container() {
    let s = ReleaseSpec::parse(&ws_spec("")).unwrap();
    let l = Layout::new("/home/u/slsa-runs/r");
    let c = workspace_binary_container(&l, &s, &s.workspace_binaries[0], 4);
    dwarves_slsa::runner::check_isolation(&c, &l, true).unwrap();
    assert_eq!(
        c.cmd,
        [
            "cargo", "build", "--release", "--locked", "--offline", "--manifest-path", "/src/gunnar/Cargo.toml",
            "-p", "gunnar", "--bin", "gunnar", "--target-dir", "/target/ws", "--no-default-features",
            "--features", "engine-znippy,http"
        ]
    );
    assert_eq!(c.workdir, "/src/gunnar");
}

#[test]
fn the_publish_decides_by_the_attested_sha256() {
    let a = "a".repeat(64);
    assert_eq!(decide(&a, None), Decision::Publish);
    assert_eq!(decide(&a, Some(&a)), Decision::Skip);
    match decide(&a, Some(&"b".repeat(64))) {
        Decision::Red(m) => assert!(m.contains("not the attested"), "{m}"),
        d => panic!("{d:?}"),
    }
}

#[test]
fn a_crates_io_rate_limit_names_when_to_try_again() {
    let out = "error: failed to publish\n  the remote server responded with an error (status 429 Too Many Requests): You have published too many new crates in a short period of time. Please try again after Wed, 28 Oct 2026 17:56:18 GMT or email help@crates.io";
    // 2026-10-28T17:56:18Z
    assert_eq!(parse_retry_after(out), Some(1_793_210_178));
    assert_eq!(parse_retry_after("no limit here"), None);
}

#[test]
fn the_publish_container_never_builds_beside_the_token() {
    use dwarves_slsa::publish::{publish_container, Token};
    let l = Layout::new("/home/u/slsa-runs/r");
    std::env::set_var("CARGO_REGISTRY_TOKEN", "t0k3n");
    let c = publish_container(
        &l,
        IMAGE,
        "/src/holger/errcode",
        &Token::EnvByName,
        &["publish", "--locked", "--no-verify", "-p", "holger-errcode"],
    )
    .unwrap();
    assert!(
        c.env.iter().any(|(k, _)| k == "CARGO_REGISTRY_TOKEN"),
        "the token reaches the publish container's environment"
    );
    assert!(!c.cmd.join(" ").contains("t0k3n"), "never on a command line");
    assert_eq!(c.cmd[..3], ["cargo", "publish", "--locked"]);
    assert!(c.bind("/src").unwrap().read_only);
    assert!(
        publish_container(&l, IMAGE, "/src", &Token::None, &["publish", "--locked", "-p", "x"]).is_err(),
        "a verify build beside the token"
    );
    assert!(publish_container(&l, IMAGE, "/src", &Token::None, &["build", "--locked", "--no-verify"]).is_err());
    let f = publish_container(
        &l,
        IMAGE,
        "/src",
        &Token::File("/home/u/.cargo/credentials.toml".into()),
        &["publish", "--locked", "--no-verify"],
    )
    .unwrap();
    let b = f.bind("/cargo-home/credentials.toml").unwrap();
    assert!(b.read_only && b.host == std::path::Path::new("/home/u/.cargo/credentials.toml"));
}

#[test]
fn there_is_one_builder_id() {
    assert_eq!(dwarves_slsa::statement::BUILDER_ID, BUILDER_ID_DWARVES_SERVER);
}

#[test]
fn the_steps_table_is_read_from_a_publish_script() {
    let script = "#!/bin/bash\nSTEPS=$(cat <<'EOF'\n1  holger-errcode  2.0.1  holger  errcode  all\n# c\n2  holger  2.0.1  holger  server/cli  default\nEOF\n)\necho 1 2 3\n";
    let t = dwarves_slsa::cli::steps_of_script(script).unwrap();
    assert_eq!(t.lines().count(), 2);
    assert!(dwarves_slsa::cli::steps_of_script("echo none").is_err());
}