nordisk/holger-ui

crates/holger-public-site/tests/release_signing.rs

//! **Release signing** (owner 2026-10-29): `/llms.txt` and `/llms-full.txt` name the key
//! Holger's releases are signed with (the owner's YubiKey key, P-256, attested on the
//! device) by its key id, and link to `slsa/` in the holger and gunnar repositories. The
//! id lives in ONE place, `release_key::RELEASE_KEY_ID`.

use holger_public_site::release_key::{GUNNAR_SLSA_URL, HOLGER_SLSA_URL, RELEASE_KEY_ID};
use holger_public_site::{llms_full_txt, llms_txt, Config};

const OWNER_KEY_ID: &str = "d24d3785e8281bcd37e8f2c40a3a85e8152d3ce2200a5c929a1a5ca636e8249e";

#[test]
fn the_key_id_is_the_owners_yubikey_key() {
    assert_eq!(RELEASE_KEY_ID, OWNER_KEY_ID);
    // WWW-CANON (owner 2026-10-30): the site is www.gunnar.rs.
    assert_eq!(HOLGER_SLSA_URL, "https://www.gunnar.rs/nordisk/holger/tree/slsa");
    assert_eq!(GUNNAR_SLSA_URL, "https://www.gunnar.rs/nordisk/gunnar/tree/slsa");
}

#[test]
fn llms_txt_and_llms_full_txt_name_the_release_key() {
    let c = Config::holger();
    for (name, body) in [("llms.txt", llms_txt(&c, "https://holger.example")), ("llms-full.txt", llms_full_txt(&c, "https://holger.example"))] {
        assert!(body.contains("## Release signing"), "{name}: {body}");
        assert!(body.contains(OWNER_KEY_ID), "{name}: {body}");
        assert!(body.contains("YubiKey") && body.contains("P-256") && body.contains("attest"), "{name}: {body}");
        assert!(body.contains(HOLGER_SLSA_URL) && body.contains(GUNNAR_SLSA_URL), "{name}: {body}");
    }
}

/// The id is written once in the crate's sources and docs.
#[test]
fn the_key_id_is_written_in_one_place() {
    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
    let mut hits = Vec::new();
    for dir in ["src", "docs"] {
        for e in std::fs::read_dir(root.join(dir)).unwrap() {
            let p = e.unwrap().path();
            let text = std::fs::read_to_string(&p).unwrap_or_default();
            for _ in text.matches(OWNER_KEY_ID) {
                hits.push(p.display().to_string());
            }
        }
    }
    assert_eq!(hits.len(), 1, "{hits:?}");
    assert!(hits[0].ends_with("release_key.rs"), "{hits:?}");
}