intel/tests/media_intel.rs
//! **The intel a Holger medium ships** (row HOL-INTEL-ON-MEDIA, owner 2026-11-03).
//!
//! The install medium carries a fresh `holger.intel/v1` bundle, built when the medium is
//! composed, dated, and signed by Holger's RELEASE signer alone (no approvers: the release key
//! already vouches for everything else on the medium). The box imports it at first boot against
//! [`media::release_policy`], the same verify, floor and audit path every intel import takes.
//! The console's one line ([`media::status`]) says where the live data came from, who signed it
//! and how old it is.
mod common;
use chrono::{Duration, Utc};
use common::{fixture_set, mint, Fixed, MemAudit, Pki};
use holger_intel::media::{self, Landed, Source, State};
use holger_intel::{import, ImportRequest, LocalIntelDb};
#[test]
fn a_media_bundle_signed_by_the_release_key_alone_imports_against_the_release_policy() {
let dir = tempfile::tempdir().unwrap();
let release = mint("holger release intel");
let now = Utc::now();
let set = fixture_set(dir.path(), now);
let out = dir.path().join("media.holger.znippy");
let built = media::build_media_bundle(&set, &release.files, now, out.clone()).unwrap();
assert_eq!(built.sequence, holger_intel::bundle::sequence_for(now));
assert!(built.advisories >= 1);
let policy = media::release_policy(&release.files.cert_der);
assert_eq!(
policy.trusted_release_signers,
vec![release.fingerprint.clone()]
);
assert_eq!(
policy.minimum_distinct_approvers, 0,
"the release key alone signs it"
);
assert!(policy.require_expiry);
assert_eq!(
policy.allowed_products,
vec![holger_intel::INTEL_PRODUCT.to_string()]
);
let db = LocalIntelDb::open(dir.path().join("db"));
let audit = MemAudit::default();
let out = import(
&ImportRequest {
bundle: &out,
policy: &policy,
db: &db,
first_import: true,
},
&Fixed(now),
&audit,
)
.unwrap();
assert_eq!(out.record.outcome, "new");
assert_eq!(
db.installed().unwrap().unwrap().release_signer_fingerprint,
release.fingerprint
);
// Another release key is refused: the box's pin is Holger's release signer, nobody else's.
let stranger = mint("not holger");
let other = dir.path().join("other.holger.znippy");
media::build_media_bundle(
&set,
&stranger.files,
now + Duration::seconds(5),
other.clone(),
)
.unwrap();
let db2 = LocalIntelDb::open(dir.path().join("db2"));
let refused = import(
&ImportRequest {
bundle: &other,
policy: &policy,
db: &db2,
first_import: true,
},
&Fixed(now),
&audit,
);
assert!(
refused.is_err(),
"a stranger's release signature is refused"
);
assert!(db2.installed().unwrap().is_none(), "nothing went live");
}
#[test]
fn the_staged_text_form_reads_back_to_the_same_bytes() {
// A medium's staged files are text, so the bundle rides as base64; the box reads either.
let bytes: Vec<u8> = (0..=255u8).cycle().take(1000).collect();
let text = media::to_staged_text(&bytes);
assert!(text.is_ascii() && !text.contains('\n'));
assert_eq!(media::from_staged(text.as_bytes()).unwrap(), bytes);
assert_eq!(
media::from_staged(format!("{text}\n").as_bytes()).unwrap(),
bytes,
"a trailing newline is no change"
);
assert!(media::from_staged(b"not base64 !!").is_err());
}
#[test]
fn the_console_line_says_where_the_data_came_from_who_signed_it_and_how_old_it_is() {
let dir = tempfile::tempdir().unwrap();
let release = mint("holger release intel");
let estate = Pki::new();
let now = Utc::now();
let set = fixture_set(dir.path(), now);
let bundle = dir.path().join("media.holger.znippy");
media::build_media_bundle(&set, &release.files, now, bundle.clone()).unwrap();
let policy = media::release_policy(&release.files.cert_der);
let db = LocalIntelDb::open(dir.path().join("db"));
let releases = vec![release.fingerprint.clone()];
// No data: red, and every pull is held.
let s = media::status(&db, &releases, 7, now);
assert_eq!(s.state, State::None);
assert_eq!(s.source, Source::None);
assert!(s.line.starts_with("CVE data: none"), "{}", s.line);
assert!(s.line.contains("held"), "{}", s.line);
// Loud: the status carries the alert every console and log line says, word for word.
assert_eq!(s.alert.as_deref(), Some(media::NO_DATA_ALERT), "{s:?}");
assert_eq!(
media::NO_DATA_ALERT,
"no signed CVE data: pulls are held until a bundle is imported"
);
assert!(s.line.contains(media::NO_DATA_ALERT), "{}", s.line);
assert!(
s.missing_popular.is_empty(),
"no data at all is said once, by the alert"
);
let o = import(
&ImportRequest {
bundle: &bundle,
policy: &policy,
db: &db,
first_import: true,
},
&Fixed(now),
&MemAudit::default(),
)
.unwrap();
media::record_landed(
&db,
&Landed {
source: Source::Bundled,
bundle_id: o.record.bundle_id.clone(),
},
)
.unwrap();
let s = media::status(&db, &releases, 7, now);
assert_eq!(s.source, Source::Bundled);
assert_eq!(s.state, State::Ok);
assert_eq!(s.alert, None, "live data raises no alert");
assert_eq!(s.age_days, Some(0));
assert_eq!(s.signer, media::RELEASE_LABEL);
let date = now.format("%Y-%m-%d").to_string();
assert_eq!(s.date.as_deref(), Some(date.as_str()));
// The fixture feeds carry PyPI's popular names only: the line says which lists are
// missing, since every pull of those ecosystems is held (H32-TYPOSQUAT fails closed).
assert_eq!(
s.missing_popular,
vec!["cargo".to_string(), "npm".to_string()]
);
assert_eq!(
s.line,
format!(
"CVE data: bundled {date} (signed by Holger release) · 0 days old · no popular-names list for cargo, npm: their pulls are held"
)
);
// Yellow past seven days.
let s = media::status(&db, &releases, 7, now + Duration::days(8));
assert_eq!(s.state, State::Stale);
assert!(s.line.contains("· 8 days old"), "{}", s.line);
let s = media::status(&db, &releases, 7, now + Duration::days(1));
assert!(s.line.contains("· 1 day old ·"), "{}", s.line);
assert_eq!(s.state, State::Ok);
// A newer bundle by the estate's own signers: imported, named by its signer.
let next = common::bundle(
&estate,
dir.path(),
holger_intel::bundle::sequence_for(now) + 1,
now,
);
let o = import(
&ImportRequest {
bundle: &next.path,
policy: &estate.policy,
db: &db,
first_import: false,
},
&Fixed(now),
&MemAudit::default(),
)
.unwrap();
media::record_landed(
&db,
&Landed {
source: Source::Imported,
bundle_id: o.record.bundle_id.clone(),
},
)
.unwrap();
let s = media::status(&db, &releases, 7, now);
assert_eq!(s.source, Source::Imported);
assert!(
s.signer.contains(&estate.release.fingerprint[..12]),
"{}",
s.signer
);
assert!(
s.line
.starts_with(&format!("CVE data: imported {date} (signed by ")),
"{}",
s.line
);
// A live set no landing record names (an older box's import) reads as imported.
std::fs::remove_file(db.root().join(media::LANDED_FILE)).unwrap();
assert_eq!(
media::status(&db, &releases, 7, now).source,
Source::Imported
);
}