nordisk/holger

intel/tests/scanner_sigs.rs

//! The scanner signature bundle's pure half (lane HOL-NCSC): what a member may be, and the
//! overlay an install makes (a hotfix lands over the set, a refresh replaces by name).

use holger_intel::sigs::{check_name, Engine, SigFile, SigsDb};

#[test]
fn a_member_is_a_bare_signature_file_name() {
    for ok in [
        "main.cvd",
        "daily.cld",
        "bytecode.cvd",
        "hotfix-2026-10-31.ndb",
        "local.hdb",
        "x.ldb",
    ] {
        check_name(Engine::Clamav, ok).unwrap_or_else(|e| panic!("{ok}: {e}"));
    }
    check_name(Engine::Yara, "rules.yar").unwrap();
    for bad in [
        "evil.sh",
        "../main.cvd",
        "a/main.cvd",
        ".hidden.cvd",
        "main",
        "",
        "main.cvd\n",
        "rules.yar",
    ] {
        assert!(
            check_name(Engine::Clamav, bad).is_err(),
            "{bad:?} must be refused"
        );
    }
    assert!(check_name(Engine::Yara, "main.cvd").is_err());
}

#[test]
fn an_install_overlays_by_name_and_names_the_whole_set() {
    let tmp = tempfile::tempdir().unwrap();
    let db = SigsDb::open(tmp.path().join("signatures"));
    assert!(
        db.installed().unwrap().is_none(),
        "before the first bundle the image's own database serves"
    );
    let f = |n: &str, b: &[u8]| SigFile {
        engine: Engine::Clamav,
        name: n.into(),
        bytes: b.to_vec(),
    };
    let now = chrono::Utc::now();
    db.install(
        "b1",
        1,
        "s",
        &[f("main.cvd", b"m1"), f("daily.cld", b"d1")],
        now,
    )
    .unwrap();
    let i = db
        .install(
            "b2",
            2,
            "s",
            &[f("hotfix-1.ndb", b"h"), f("daily.cld", b"d2")],
            now,
        )
        .unwrap();
    assert_eq!(i.sequence, 2);
    let names: Vec<_> = i.files.iter().map(|f| f.path.as_str()).collect();
    assert_eq!(
        names,
        ["clamav/daily.cld", "clamav/hotfix-1.ndb", "clamav/main.cvd"]
    );
    assert_eq!(
        std::fs::read(db.dir(Engine::Clamav).join("daily.cld")).unwrap(),
        b"d2",
        "a refresh replaces by name"
    );
    assert_eq!(
        std::fs::read(db.dir(Engine::Clamav).join("main.cvd")).unwrap(),
        b"m1",
        "the rest stays"
    );
    assert_eq!(db.installed().unwrap().unwrap(), i);
    assert!(
        db.install("b3", 3, "s", &[f("evil.sh", b"x")], now)
            .is_err(),
        "never a file that is no signature"
    );
    assert!(!db.dir(Engine::Clamav).join("evil.sh").exists());
}