holger-recipe/tests/oneway_appliance.rs
//! **The one-way downstream appliance** (lane HOL-CDS-5, owner 2026-10-30): `holger-downstream`
//! as its own korp appliance that boots WITHOUT pairing. Pairing dials the estate's front, which
//! a `boundary: OneWay` box refuses, so its PID-1 duties are the `pid1` feature alone: the
//! reaper, the declared NIC from the medium (static or DHCP), the clean stop and the USB
//! stick's inbox. It dials nothing and takes packages only through its inbox.
//!
//! Its keys and its trust configuration come from the MEDIUM (an admin provisions them when the
//! medium is composed: the declaration, the bundle trust policy, the upstream's attestation root
//! and signer), never from a stick.
//!
//! Held by name, as a forge resolves them: the payload row, the medium, its declaration.
use holger_recipe::downstream_ron::{render_one_way, OneWayRon};
use nornir_build_thing::params::Landing;
use nornir_build_thing::variant::ArtifactKind;
const MEDIUM: &str = "holger-downstream-oneway-installer";
const PAYLOAD: &str = "downstream-musl";
const FETCH_PAYLOAD: &str = "downstream-fetch-musl";
const FETCH_MEDIUM: &str = "holger-downstream-installer";
const BEARER: &str = "site-admin-bearer-of-sufficient-length-0123";
#[test]
fn the_one_way_payload_is_holger_downstream_static_with_its_init_and_nothing_that_dials() {
let set = holger_recipe::declared();
let v = set
.get(PAYLOAD)
.unwrap_or_else(|| panic!("no `{PAYLOAD}` row"));
assert_eq!(
(v.package.as_deref(), v.bin.as_deref()),
(Some("holger-downstream"), Some("holger-downstream"))
);
assert_eq!(
v.target.as_deref(),
Some("x86_64-unknown-linux-musl"),
"an OS-less medium needs the static binary"
);
assert_eq!(v.kind, ArtifactKind::Exe);
assert!(
!v.no_default_features,
"the gateway is the product crate's own, one-way"
);
assert_eq!(
v.features,
["pid1", "heimdall"],
"PID 1's duties and its jobs under Heimdall (lane cds4), nothing more: {:?}",
v.features
);
for never in [
"fetch",
"paired",
"downstream-wg",
"online",
"federation",
"full",
"metered",
] {
assert!(
!v.features.iter().any(|x| x == never),
"{PAYLOAD} must not carry `{never}`: {:?}",
v.features
);
}
// The fetching appliance is its own row.
let f = set
.get(FETCH_PAYLOAD)
.unwrap_or_else(|| panic!("no `{FETCH_PAYLOAD}` row"));
for want in ["fetch", "downstream-wg", "paired"] {
assert!(
f.features.iter().any(|x| x == want),
"{FETCH_PAYLOAD} carries `{want}`: {:?}",
f.features
);
}
}
#[test]
fn the_one_way_medium_carries_its_declaration_net_and_trust_from_the_admin() {
let set = holger_recipe::declared();
let m = set
.installers
.iter()
.find(|i| i.name == MEDIUM)
.unwrap_or_else(|| panic!("no [[build.installer]] `{MEDIUM}`"));
assert_eq!(m.variant, PAYLOAD);
assert_eq!(
set.get(MEDIUM).expect("its pointer variant").kind,
ArtifactKind::Installer
);
assert!(
m.boot_params
.iter()
.any(|b| b == "korp.entry=holger-downstream"),
"{:?}",
m.boot_params
);
assert_eq!(m.cmd, ["start", "--config", "/data/holger.ron"]);
assert_eq!(
m.env.get("HOLGER_NET").map(String::as_str),
Some("eth0:dhcp"),
"the default when the medium names no net"
);
// `HOLGER_APPLIANCE=1` asks for the WireGuard identity ceremony (feature `appliance`), which
// a one-way box has not: its start would be refused by name.
assert!(!m.env.contains_key("HOLGER_APPLIANCE"), "{:?}", m.env);
let p = |n: &str| m.params.iter().find(|p| p.name == n);
for (name, required, file) in [
("holger_ron", true, "holger.ron"),
("holger_net", false, "holger-net"),
("trust_policy", true, "trust-policy.ron"),
("upstream_root", true, "upstream-root.pem"),
("upstream_signer", true, "upstream-signer.pem"),
] {
let x = p(name).unwrap_or_else(|| panic!("{MEDIUM} declares no `{name}`"));
assert_eq!(
(x.required, x.staged_file.as_str(), x.lands),
(required, file, Landing::Release),
"`{name}` rides the medium's release"
);
}
for gone in ["pairing_seed", "hub_conf", "underlay", "downstream_ca"] {
assert!(
p(gone).is_none(),
"a one-way downstream carries no `{gone}`"
);
}
// It scans nothing, yet verifies every bundle in a job: crun and the worker ride its medium.
assert_eq!(
m.payload_entries,
holger_recipe::packaging::sandbox_payload_entries(),
"the job sandbox rides the medium"
);
let fetch = set
.installers
.iter()
.find(|i| i.name == FETCH_MEDIUM)
.expect("the fetching medium");
assert_eq!(
fetch.variant, FETCH_PAYLOAD,
"{FETCH_MEDIUM} lays the fetching payload"
);
let others: Vec<&str> = set
.installers
.iter()
.filter(|i| i.name != MEDIUM)
.map(|i| i.volume_id.as_str())
.collect();
assert!(
!others.contains(&m.volume_id.as_str()),
"{MEDIUM} is resolved by its own volume id"
);
}
#[test]
fn the_one_way_declaration_dials_nothing_and_trusts_only_the_medium() {
let r = OneWayRon::on_a_box("site-a", "onprem-lab", BEARER).unwrap();
let t = render_one_way(&r);
assert!(t.contains(" boundary: OneWay,\n"), "{t}");
assert!(t.contains(" domain: \"onprem-lab\",\n"), "{t}");
assert!(t.contains(" trust: (first_import: Admin),\n"), "{t}");
for never in [
"mirror:",
"sync:",
"export:",
"network: Online",
"-remote",
"pull_through",
] {
assert!(
!t.contains(never),
"a one-way declaration names no `{never}`: {t}"
);
}
// Every trust anchor is a file of the MEDIUM's release, never of the data disk a stick
// could reach.
assert!(
t.contains("trust_policy: Some(\"/run/korp/release/trust-policy.ron\")"),
"{t}"
);
assert!(
t.contains("trust_roots: [\"/run/korp/release/upstream-root.pem\"]"),
"{t}"
);
assert!(
t.contains("enrolled_signers: [\"/run/korp/release/upstream-signer.pem\"]"),
"{t}"
);
assert!(
t.contains("ron_http_url: Some(\"0.0.0.0:8443\"), insecure: true)"),
"its LAN door, clear text written down (HOL-NCSC): {t}"
);
assert!(
t.contains("rules: (sandbox: required)")
&& t.contains("sandbox: Some((engine: heimdall, crun: \"/data/holger/sandbox/crun\""),
"every bundle is verified in a job under Heimdall, the medium's crun its fallback (lane cds4): {t}"
);
assert!(
t.contains(&format!(
"StaticToken(subject: \"admin\", token: Some(\"{BEARER}\"))"
)),
"the site admin's bearer: {t}"
);
assert!(
t.contains("duties: {\"admin\": [RepositoryAdmin, Auditor]}"),
"the admin authorizes the first import: {t}"
);
for (bad, tag) in [
(
OneWayRon::on_a_box("site a", "lab", BEARER),
"[downstream-ron-name]",
),
(
OneWayRon::on_a_box("site-a", "", BEARER),
"[downstream-ron-domain]",
),
(
OneWayRon::on_a_box("site-a", "lab", "short"),
"[downstream-ron-bearer]",
),
] {
assert!(
bad.as_ref().is_err_and(|e| e.starts_with(tag)),
"{tag}: {bad:?}"
);
}
}