nordisk/gunnar-ui

crates/gunnar-public-site/tests/release_signing.rs

//! **Release signing**: the key Gunnar's and Holger's releases are signed with (the
//! owner's YubiKey key, P-256, attested on the device) lives in ONE place,
//! `release_key::RELEASE_KEY_ID`. Since 2026-10-29 no public page draws it.

mod common;
use common::*;

use gunnar_public_site::release_key::{GUNNAR_SLSA_URL, HOLGER_SLSA_URL, RELEASE_KEY_ID};
use http::StatusCode;

const OWNER_KEY_ID: &str = "d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249e";

#[test]
fn the_key_id_is_the_owners_yubikey_key() {
    assert_eq!(RELEASE_KEY_ID, OWNER_KEY_ID);
    // WWW-CANON (owner 2026-10-30): the site is www.gunnar.rs.
    assert_eq!(GUNNAR_SLSA_URL, "https://www.gunnar.rs/nordisk/gunnar/tree/slsa");
    assert_eq!(HOLGER_SLSA_URL, "https://www.gunnar.rs/nordisk/holger/tree/slsa");
}

/// PUB-HOME (owner 2026-10-29): `/` is the console's landing again and draws
/// nothing of the site's, so the release key is named in `llms.txt` and
/// `llms-full.txt` only; the home adds no visible section for it.
#[tokio::test]
async fn the_home_page_draws_no_release_section() {
    let (site, _) = site().await;
    let a = get(&app(site), "/").await;
    assert_eq!(a.status, StatusCode::OK, "{}", a.body);
    assert!(!a.body.contains("<h2>Release signing</h2>"), "{}", a.body);
}

/// The owner (2026-10-29): llms.txt and llms-full.txt carry the one line of what
/// Gunnar is, the way in and the repositories; the key lives in `slsa/`.
#[tokio::test]
async fn llms_txt_and_llms_full_txt_carry_no_release_section() {
    let (site, _) = site().await;
    let app = app(site);
    for path in ["/llms.txt", "/llms-full.txt"] {
        let a = get(&app, path).await;
        assert_eq!(a.status, StatusCode::OK, "{path}");
        assert!(!a.body.contains("## Release signing") && !a.body.contains(OWNER_KEY_ID), "{path}: {}", a.body);
    }
}

/// The id is written once in the crate's sources and docs; every page takes it from the const.
#[test]
fn the_key_id_is_written_in_one_place() {
    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
    let mut hits = Vec::new();
    for dir in ["src"] {
        for e in std::fs::read_dir(root.join(dir)).unwrap() {
            let p = e.unwrap().path();
            let text = std::fs::read_to_string(&p).unwrap_or_default();
            for _ in text.matches(OWNER_KEY_ID) {
                hits.push(p.display().to_string());
            }
        }
    }
    assert_eq!(hits.len(), 1, "{hits:?}");
    assert!(hits[0].ends_with("release_key.rs"), "{hits:?}");
}