nordisk/holger

holger-recipe/tests/the_appliance_runs_heimdall.rs

//! **The main's appliance runs its jobs under Heimdall** (lane HOL-HEIMDALL-03): the medium
//! carries Heimdall's static shim and the released verify-bundle guests beside the sandbox, the
//! appliance rows are built with the server's `heimdall`, and the estate's declaration names
//! `engine: heimdall` with crun over the laid worker rootfs as its fallback (the box says which
//! one runs, by name; with Heimdall 0.2.1 a root server maps every job's root to host ids 100000+).

use holger_recipe::estate_ron::{render, EstateRon};

/// The released guests the medium lays (holger `guests/heimdall/0.2.1/`).
const GUESTS: [&str; 10] = [
    "heimdall-verify-bundle-verifier.wasm",
    "heimdall-verify-bundle-verifier.wasm.blake3",
    "heimdall-verify-bundle-verifier.wasm.p7s",
    "heimdall-verify-bundle-decoder.wasm",
    "heimdall-verify-bundle-decoder.wasm.blake3",
    "heimdall-verify-bundle-decoder.wasm.p7s",
    "heimdall-verify-bundle.wasm",
    "heimdall-verify-bundle.wasm.blake3",
    "heimdall-verify-bundle.wasm.p7s",
    "heimdall-guests-0.2.1.intoto.jsonl",
];

#[test]
fn the_sandbox_entries_carry_heimdalls_shim_and_the_released_guests() {
    let e = holger_recipe::packaging::sandbox_payload_entries();
    assert_eq!(
        e.get("sandbox/heimdall-container-shim").map(String::as_str),
        Some(".sandbox-out/heimdall-container-shim")
    );
    for g in GUESTS {
        assert_eq!(
            e.get(&format!("sandbox/{g}")),
            Some(&format!(".sandbox-out/{g}")),
            "{g}"
        );
    }
}

#[test]
fn the_appliance_rows_are_built_with_heimdall() {
    let set = holger_recipe::declared();
    for row in [
        "mvp-server-musl",
        "mvp-server-musl-metered",
        "mvp-server-metered",
    ] {
        let v = set.get(row).unwrap_or_else(|| panic!("no `{row}` row"));
        assert!(
            v.features.iter().any(|f| f == "heimdall"),
            "{row}: {:?}",
            v.features
        );
    }
}

#[test]
fn the_estate_declares_engine_heimdall_with_crun_as_its_fallback() {
    let r = render(&EstateRon::on_a_box(Some("test3.holger.rs")));
    let sb = "/data/holger/sandbox";
    let want = format!(
        "sandbox: Some((engine: heimdall, crun: \"{sb}/crun\", rootfs: Some(\"{sb}/worker/rootfs\"), work_dir: Some(\"{sb}/jobs\"), state_dir: Some(\"{sb}/state\"), \
         heimdall: Some((image_layout: \"{sb}/oci\", rootfs_tar: Some(\"{sb}/holger-scan-worker.rootfs.tar\"), shim: Some(\"{sb}/heimdall-container-shim\"), work_dir: Some(\"{sb}/heimdall\"), \
         guests: Some(\"{sb}/heimdall-guests\"), guests_trust_root: Some(\"/run/korp/release/korp-root-ca.pem\"))))),"
    );
    assert!(r.contains(&want), "{want}\nin\n{r}");
}

// ── the downstream media (lane cds4, plan rows HOL-CDS-4 and H32-CDS4-REST) ──────────

/// The one-way and the fetching downstream verify every bundle in a job too: their media carry
/// the same sandbox entries (Heimdall's shim and the released guests among them), so their
/// payloads are built with the server's `heimdall` and their declarations name it.
#[test]
fn the_downstream_rows_are_built_with_heimdall() {
    let set = holger_recipe::declared();
    for row in [
        holger_recipe::packaging::ONEWAY_PAYLOAD_VARIANT,
        holger_recipe::packaging::DOWNSTREAM_PAYLOAD_VARIANT,
    ] {
        let v = set.get(row).unwrap_or_else(|| panic!("no `{row}` row"));
        assert!(
            v.features.iter().any(|f| f == "heimdall"),
            "{row}: {:?}",
            v.features
        );
    }
}

/// Both downstream declarations name `engine: heimdall` over the laid sandbox, crun over the
/// laid worker rootfs its fallback, and the released guests under the korp root the medium
/// stages on its release (`plugin_trust_root`).
#[test]
fn both_downstream_declarations_declare_engine_heimdall_with_crun_as_its_fallback() {
    use holger_recipe::downstream_ron::{
        render, render_one_way, DownstreamRon, OneWayRon, Via, WIREGUARD_DOOR,
    };
    let sb = "/data/holger/sandbox";
    let want = format!(
        "sandbox: Some((engine: heimdall, crun: \"{sb}/crun\", rootfs: Some(\"{sb}/worker/rootfs\"), work_dir: Some(\"{sb}/jobs\"), state_dir: Some(\"{sb}/state\"), \
         heimdall: Some((image_layout: \"{sb}/oci\", rootfs_tar: Some(\"{sb}/holger-scan-worker.rootfs.tar\"), shim: Some(\"{sb}/heimdall-container-shim\"), work_dir: Some(\"{sb}/heimdall\"), \
         guests: Some(\"{sb}/heimdall-guests\"), guests_trust_root: Some(\"/run/korp/release/korp-root-ca.pem\"))))))),"
    );
    let bearer = "b".repeat(40);
    let one_way = render_one_way(&OneWayRon::on_a_box("lab-1", "LAB", &bearer).unwrap());
    assert!(one_way.contains(&want), "{want}\nin\n{one_way}");
    let fetching = render(
        &DownstreamRon::on_a_box(
            "lab-2",
            "test3.holger.rs",
            &"a".repeat(64),
            Via::Wireguard,
            WIREGUARD_DOOR,
            &bearer,
        )
        .unwrap(),
    );
    assert!(fetching.contains(&want), "{want}\nin\n{fetching}");
}