nordisk/gunnar

crates/gunnar-recipe/tests/cli_download.rs

//! **A customer can GET the Gunnar command-line tool from the estate's own site** (E4,
//! owner 2026-10-11): the Build Thing builds `gunnar-cli` (the product's program, git with
//! the encrypted repositories and the control plane) for `x86_64-unknown-linux-musl` and
//! SIGNS it (the forge's sign step: `.p7s` + `.blake3` beside it), and that is the binary
//! the front embeds and serves under `/download/` (`xtask/src/cli_stage.rs`, gunnar-front
//! build.rs, `downloads`). Since GUN-PRODUCTS (2026-10-30) it is the row `gunnar-cli-musl`;
//! the client-only `gunnar` bin (row `gunnar-musl`) is retired: its name was the server's.

use gunnar_recipe::GunnarBuildThing;
use nornir_build_thing::plugin::BuildThing as _;

#[test]
fn the_downloadable_cli_is_gunnar_cli_static_and_signed() {
    let set = GunnarBuildThing.variants();
    let v = set
        .variants
        .iter()
        .find(|v| v.name == "gunnar-cli-musl")
        .expect("a `gunnar-cli-musl` row: the CLI a customer downloads");
    assert_eq!(
        (v.package.as_deref(), v.bin.as_deref()),
        (Some("gunnar-cli"), Some("gunnar-cli")),
        "{v:?}"
    );
    assert!(
        v.no_default_features && v.features == ["client", "control"],
        "the product's program, no server: {:?}",
        v.features
    );
    assert_eq!(
        v.target.as_deref(),
        Some("x86_64-unknown-linux-musl"),
        "static: it runs on hosts nobody here pins"
    );
    assert_eq!(
        v.sign,
        Some(nornir_build_thing::sign::SignSpec::default()),
        "the forge signs it (purpose plugin)"
    );
    // Nothing else asks the forge for a signature it would not ship.
    let signed: Vec<&str> = set
        .variants
        .iter()
        .filter(|v| v.sign.is_some())
        .map(|v| v.name.as_str())
        .collect();
    assert_eq!(signed, ["gunnar-cli-musl"]);
}

#[test]
fn the_emitted_declaration_says_the_row_is_signed() {
    let toml = gunnar_recipe::emitted_toml().expect("emits");
    let at = toml.find("name = \"gunnar-cli-musl\"").expect("emitted");
    let row = &toml[at..at + toml[at..].find("[[build.").unwrap_or(toml.len() - at)];
    assert!(
        row.contains("sign = { purpose = \"plugin\" }")
            || row.contains("[build.variant.sign]")
            || row.contains("purpose = \"plugin\""),
        "{row}"
    );
}