crates/dwarves-slsa/tests/runner.rs
//! A release build is a Runa pipeline (lane RELBUILD-RUNA): its sealed containers'
//! isolation, checked on the data before the pipeline exists; the pipeline itself
//! (Runa's own gate, no shell, every action known); and the vendor check.
use std::collections::BTreeSet;
use std::path::Path;
use dwarves_runa::Step;
use dwarves_slsa::lock::parse_lock;
use dwarves_slsa::runner::{
binaries_file, check_isolation, fetch_container, package_container, probe_lock_container,
probe_vendor_container, release_pipeline, steps_file, verify_vendor, Bind, Layout, Sealed,
ACTIONS,
};
use dwarves_slsa::spec::ReleaseSpec;
const IMAGE: &str = "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334";
const ROOT: &str = "/home/u/slsa-runs/holger-2.0.1-20261029T120000Z";
fn spec() -> ReleaseSpec {
ReleaseSpec::parse(&format!(
r#"
name = "holger-2.0.1"
image = "{IMAGE}"
lock = ["holger/Cargo.toml", "holger/estate/Cargo.toml"]
[[repo]]
name = "holger"
org = "nordisk"
commit = "87e5ada50ab5745464e4b46305bfd62d0460f52c"
[[crate]]
name = "holger-errcode"
version = "2.0.1"
repo = "holger"
path = "errcode"
[[crate]]
name = "holger"
version = "2.0.1"
repo = "holger"
path = "server/cli"
[[binary]]
crate = "holger"
bin = "holger"
features = ["full", "online"]
"#
))
.unwrap()
}
fn layout() -> Layout {
Layout::new(ROOT)
}
fn build() -> Sealed {
package_container(&layout(), &spec(), &spec().crates[1], 4)
}
#[test]
fn a_build_container_is_sealed() {
let c = build();
check_isolation(&c, &layout(), true).unwrap();
assert!(!c.network, "network none");
assert_eq!(c.image, IMAGE, "the image by digest");
assert_eq!(
c.cmd,
["cargo", "package", "--locked", "--offline", "--no-verify", "--registry", "crates-io", "-p", "holger", "--target-dir", "/target/holger"]
);
assert_eq!(c.workdir, "/src/holger/server/cli");
for ro in ["/src", "/vendor", "/plan", "/stage", "/published"] {
assert!(c.bind(ro).unwrap().read_only, "{ro} read-only");
}
for rw in ["/target", "/cargo-home"] {
assert!(!c.bind(rw).unwrap().read_only, "{rw} writable");
}
assert!(c.binds.iter().all(|b| b.host.starts_with(ROOT)), "{:?}", c.binds);
// No sccache, no shared registry, no shared target, no key.
let all = format!("{c:?}");
for never in ["sccache", "RUSTC_WRAPPER", ".cargo/registry", "/home/u/.cargo", "/home/u/tgt", ".dwarves", ".ssh"] {
assert!(!all.contains(never), "{never} in {all}");
}
assert!(c.env.iter().any(|(k, v)| k == "CARGO_BUILD_JOBS" && v == "4"));
}
#[test]
fn the_fetch_container_vendors_every_lock_read_only_sources() {
let c = fetch_container(&layout(), &spec());
check_isolation(&c, &layout(), false).unwrap();
assert_eq!(
c.cmd,
["cargo", "vendor", "--locked", "--versioned-dirs", "-s", "/src/holger/estate/Cargo.toml", "/vendor/crates"]
);
assert_eq!(c.workdir, "/src/holger");
assert!(c.bind("/src").unwrap().read_only);
assert!(c.network, "the fetch needs the network");
let p = probe_vendor_container(&layout(), &spec());
check_isolation(&p, &layout(), false).unwrap();
assert!(!p.bind("/probe").unwrap().read_only);
assert_eq!(&p.cmd[..5], ["cargo", "vendor", "--locked", "--versioned-dirs", "--no-delete"]);
assert_eq!(probe_lock_container(&layout(), &spec()).cmd, ["cargo", "generate-lockfile"]);
}
fn refuses(c: Sealed, build: bool, why: &str) {
let e = check_isolation(&c, &layout(), build).expect_err(why);
assert!(e.0.contains(why), "expected {why:?} in: {e}");
}
#[test]
fn a_build_with_the_network_on_is_refused() {
refuses(Sealed { network: true, ..build() }, true, "network");
}
#[test]
fn a_mount_from_outside_the_run_is_refused() {
let mut c = build();
c.binds.push(Bind { host: "/home/u/.cargo/registry".into(), path: "/usr/local/cargo/registry".into(), read_only: true });
refuses(c, true, "outside the run");
let mut c = build();
c.binds.push(Bind { host: format!("{ROOT}/../../.dwarves").into(), path: "/k".into(), read_only: true });
refuses(c, true, "outside the run");
}
#[test]
fn writable_sources_are_refused() {
let mut c = build();
c.binds.iter_mut().find(|b| b.path == "/src").unwrap().read_only = false;
refuses(c, true, "read-only");
}
#[test]
fn a_shell_a_secret_or_an_image_by_tag_is_refused() {
refuses(Sealed { cmd: vec!["/bin/bash".into(), "-c".into(), "cargo build".into()], ..build() }, true, "no shell");
let mut c = build();
c.env.push(("CARGO_REGISTRY_TOKEN".into(), "x".into()));
refuses(c, true, "secret");
let mut c = build();
c.env.push(("GITHUB_TOKEN".into(), "x".into()));
refuses(c, true, "secret");
refuses(Sealed { image: "localhost/nordisk-cargo-toolchain:latest".into(), ..build() }, true, "digest");
}
#[test]
fn the_release_is_a_runa_pipeline_of_sealed_containers_and_forge_actions() {
let mut published = BTreeSet::new();
published.insert(("holger-errcode".to_string(), "2.0.1".to_string()));
let p = release_pipeline(&spec(), &layout(), &published, 4).unwrap();
assert_eq!(p.name, "release-build");
let names: Vec<&str> = p.stages.iter().map(|s| s.name.as_str()).collect();
assert_eq!(
names,
[
"sources", "seal-sources", "fetch", "probe-lock", "probe-vendor", "vendor-check",
"stage-0-holger-errcode", "package-1-holger", "stage-1-holger",
"binary-0-holger-sources", "binary-0-holger", "binary-0-holger-out",
],
"a published crate is staged, not packaged"
);
for w in p.stages.windows(2) {
assert_eq!(w[1].needs, [w[0].name.clone()], "each stage waits for the one before");
}
// Runa's own gate passes, and survives a round trip through RON
p.validate().unwrap();
let back = dwarves_runa::Pipeline::from_ron_str(&p.to_ron_string().unwrap()).unwrap();
assert_eq!(back, p);
let mut sandboxes = 0;
for st in &p.stages {
for s in &st.steps {
match s {
Step::Sandbox { cmd, network, image, .. } => {
sandboxes += 1;
assert_eq!(cmd[0], "cargo", "no shell: {cmd:?}");
assert_eq!(image, IMAGE);
let build = !["fetch", "probe-lock", "probe-vendor"].contains(&st.name.as_str());
assert_eq!(*network, !build, "{}", st.name);
}
Step::Forge { action, .. } => assert!(ACTIONS.contains(&action.as_str()), "{action}"),
other => panic!("a release step is a Sandbox or a Forge action, not {other:?}"),
}
}
}
assert_eq!(sandboxes, 5);
}
#[test]
fn there_is_no_shell_script_and_no_container_program_in_the_release_runner() {
let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
assert!(!src.join("inner.sh").exists(), "the build container's shell script is gone");
for e in std::fs::read_dir(&src).unwrap() {
let p = e.unwrap().path();
let text = std::fs::read_to_string(&p).unwrap();
for never in ["Command::new(\"podman\")", "Command::new(\"curl\")", "Command::new(\"chmod\")", "Command::new(\"cp\")", "/bin/bash", "\"sh\", \"-c\""] {
assert!(!text.contains(never), "{never} in {}", p.display());
}
}
}
#[test]
fn the_plan_lists_the_steps_in_order_with_their_mode() {
let mut published = BTreeSet::new();
published.insert(("holger-errcode".to_string(), "2.0.1".to_string()));
assert_eq!(
steps_file(&spec(), &published),
"holger-errcode 2.0.1 holger errcode published\nholger 2.0.1 holger server/cli package\n"
);
assert_eq!(binaries_file(&spec()), "holger 2.0.1 holger 0 full,online\n");
}
fn vendored(dir: &Path, name: &str, version: &str, package: &str) {
let d = dir.join(format!("{name}-{version}"));
std::fs::create_dir_all(&d).unwrap();
std::fs::write(
d.join(".cargo-checksum.json"),
format!("{{\"files\":{{}},\"package\":\"{package}\"}}"),
)
.unwrap();
}
const LOCK: &str = r#"
version = 4
[[package]]
name = "holger-errcode"
version = "2.0.1"
[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1111111111111111111111111111111111111111111111111111111111111111"
[[package]]
name = "anyhow"
version = "1.0.99"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2222222222222222222222222222222222222222222222222222222222222222"
"#;
#[test]
fn the_vendor_check_passes_when_every_crate_has_the_lock_checksum() {
let d = tempfile::tempdir().unwrap();
vendored(d.path(), "serde", "1.0.229", &"1".repeat(64));
vendored(d.path(), "anyhow", "1.0.99", &"2".repeat(64));
assert_eq!(
verify_vendor(d.path(), &[parse_lock(LOCK).unwrap()]).unwrap(),
2
);
}
#[test]
fn a_missing_or_changed_vendored_crate_is_refused() {
let d = tempfile::tempdir().unwrap();
vendored(d.path(), "serde", "1.0.229", &"1".repeat(64));
let e = verify_vendor(d.path(), &[parse_lock(LOCK).unwrap()]).unwrap_err();
assert!(e.0.contains("anyhow"), "{e}");
vendored(d.path(), "anyhow", "1.0.99", &"3".repeat(64));
let e = verify_vendor(d.path(), &[parse_lock(LOCK).unwrap()]).unwrap_err();
assert!(e.0.contains("checksum"), "{e}");
}
#[test]
fn only_files_committed_raw_against_their_lfs_attribute_may_show_as_modified() {
use dwarves_slsa::runner::unexplained_dirt;
let fsck = "pointer: unexpectedGitObject: \"docs/manual.pdf\" (treeish ec2c239c27d83530d48b62ab4688952a0ebb9718) should have been a pointer but was not\n\
pointer: unexpectedGitObject: \"a b/x.png\" (treeish ec2c) should have been a pointer but was not\n";
assert!(unexplained_dirt(" M docs/manual.pdf\n M \"a b/x.png\"\n", fsck).is_empty());
assert_eq!(
unexplained_dirt(" M docs/manual.pdf\n M src/lib.rs\n?? new.txt\n", fsck),
vec![" M src/lib.rs", "?? new.txt"]
);
assert_eq!(
unexplained_dirt(" M src/lib.rs\n", ""),
vec![" M src/lib.rs"]
);
}
#[test]
fn the_probe_asks_crates_io_for_each_patched_external_with_every_feature() {
use dwarves_slsa::runner::probe_manifest;
let m = probe_manifest(&[(
"gix-features".to_string(),
"0.50.0".to_string(),
vec!["crc32".to_string(), "zlib".to_string()],
)]);
let v: toml::Value = toml::from_str(&m).unwrap();
assert_eq!(v["package"]["name"].as_str(), Some("dwarves-slsa-probe"));
assert_eq!(v["package"]["publish"].as_bool(), Some(false));
assert!(v.get("workspace").is_some(), "its own workspace");
let d = &v["dependencies"]["gix-features"];
assert_eq!(d["version"].as_str(), Some("=0.50.0"));
assert_eq!(d["features"].as_array().unwrap().len(), 2);
}
/// The release every release build has the shape of (one repository, one crate, one
/// binary), as `pipelines/release-build.runa.ron` declares it.
fn example() -> (ReleaseSpec, Layout) {
let spec = ReleaseSpec::parse(&format!(
r#"
name = "example-1.0.0"
image = "{IMAGE}"
lock = ["example/Cargo.toml"]
[[repo]]
name = "example"
org = "nordisk"
commit = "{}"
[[crate]]
name = "example"
version = "1.0.0"
repo = "example"
path = "crates/example"
[[binary]]
crate = "example"
bin = "example"
"#,
"0".repeat(40)
))
.unwrap();
(spec, Layout::new("/srv/relbuild/runs/example-1.0.0-20261029T000000Z"))
}
const HEADER: &str = "// release-build.runa.ron — the SHAPE of every SLSA release build (lane RELBUILD-RUNA).
//
// A release build is a Runa pipeline: `dwarves release-build` plans one per request
// (`dwarves_slsa::runner::release_pipeline`) and the release runner (`relbuild`, on
// dwarf's host) runs it through the forge's Runa runner with CI's caps and cancel. Its
// runs are this pipeline's runs: `dwarves history`, the Pipeline tab, the server's
// History / GetRunReport / StepLog. This file is that plan for an example release (one
// repository, one crate, one binary); a test keeps it equal to the code. Run releases
// with `dwarves release-build request …`, never with `dwarves run` on this file: its
// Forge steps belong to the release runner.
";
#[test]
fn the_declared_release_pipeline_is_the_shape_every_release_runs() {
let (spec, l) = example();
let p = release_pipeline(&spec, &l, &BTreeSet::new(), 4).unwrap();
let file = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../pipelines/release-build.runa.ron");
if std::env::var("DWARVES_SLSA_WRITE_PIPELINE").is_ok() {
std::fs::write(&file, format!("{HEADER}{}\n", p.to_ron_string().unwrap())).unwrap();
}
let text = std::fs::read_to_string(&file).unwrap();
assert_eq!(dwarves_runa::Pipeline::from_ron_str(&text).unwrap(), p, "{} drifted from release_pipeline", file.display());
}