nordisk/gunnar

xtask/tests/key_census.rs

//! **No private key joins the three the repository knowingly publishes.**
//!
//! `assets/test/vetra-test-pki/` holds three throwaway keys, committed in the
//! clear and documented at length as deliberate. The argument is sound —
//! nothing in this repository references them, and the generator beside them
//! reproduces the chain in one command — but the repository went public on
//! 2026-09-08, and a published private key trips every scanner ever pointed at
//! a git remote whether or not it is worthless.
//!
//! This does not delete them; that is a decision for whoever knows which
//! sibling repositories consume the fixture. It pins the exception at exactly
//! those files, so a fourth key cannot arrive by being dropped in beside them.

use xtask::key_census::{census, holds_a_private_key, workspace_root, ALLOWED};

/// **The tracked tree holds exactly the keys that are argued for.**
///
/// Both directions. A key that is not on the list is the finding; a file on the
/// list that no longer holds a key means the list has outlived the exception
/// and should shrink, which is how an allowlist turns into a place things hide.
#[test]
fn the_only_tracked_private_keys_are_the_documented_test_pki() {
    let found = census(&workspace_root()).expect("read the tracked tree");

    let unexpected: Vec<&String> = found
        .iter()
        .filter(|path| !ALLOWED.contains(&path.as_str()))
        .collect();
    assert!(
        unexpected.is_empty(),
        "a private key is tracked that is not the documented test-PKI \
         exception: {unexpected:?}"
    );

    let stale: Vec<&&str> = ALLOWED
        .iter()
        .filter(|path| !found.contains(&(*path).to_string()))
        .collect();
    assert!(
        stale.is_empty(),
        "these paths are excused and hold no private key any more; an allowlist \
         that outlives what it excuses is a place to hide one: {stale:?}"
    );
}

/// **The base64 half is seen.**
///
/// Every artefact in that directory ships twice, PEM and `.pem.b64`, and the
/// `.b64` copies carry the same private keys past any scan that greps for
/// `BEGIN PRIVATE KEY`. A census that read only the plain form would report
/// three keys in a tree that holds six, and would have called a directory clean
/// whose other half nobody had looked at.
///
/// So the count is asserted, and it is six.
#[test]
fn the_census_sees_a_key_through_its_base64_wrapper() {
    let found = census(&workspace_root()).expect("read the tracked tree");
    let wrapped = found.iter().filter(|p| p.ends_with(".b64")).count();
    assert_eq!(
        wrapped, 3,
        "the census found {wrapped} base64-wrapped keys; the test PKI ships each \
         artefact twice, so three of the six are `.b64` and a census that misses \
         them is reading half the tree: {found:?}"
    );

    // The detector itself, both ways, so a `holds_a_private_key` that answered
    // `true` to everything could not produce the count above by luck.
    const PEM: &[u8] = b"-----BEGIN PRIVATE KEY-----\nMIGH\n";
    assert!(holds_a_private_key(PEM), "the plain form is not detected");
    assert!(
        holds_a_private_key(b"LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0g="),
        "the base64 form is not detected"
    );
    assert!(
        !holds_a_private_key(b"-----BEGIN CERTIFICATE-----\nMIIB\n"),
        "a certificate is not a private key"
    );
    assert!(
        !holds_a_private_key(b"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t"),
        "a base64 certificate is not a private key either"
    );
}