provenance/tests/apk_wolfi.rs
//! Real Wolfi APK provenance, verified OFFLINE against the pinned signing key.
//!
//! Fetched once on the online side (2026-10-24) from `https://packages.wolfi.dev`:
//!
//! * `wolfi/wolfi-signing.rsa.pub`: `os/wolfi-signing.rsa.pub`, Wolfi's signing key;
//! * `wolfi/os/APKINDEX.tar.gz`: `os/x86_64/APKINDEX.tar.gz` (11 MB, `.SIGN.RSA256.`,
//! an LFS file: run `git lfs pull`) and `wolfi/os/wolfi-base-1-r7.apk` from the same
//! directory (a package with no signature of its own, as every Wolfi package now);
//! * `wolfi/stage3/APKINDEX.tar.gz`: `bootstrap/stage3/x86_64/APKINDEX.tar.gz`
//! (`.SIGN.RSA.`, SHA-1) and `wolfi/stage3/libffi-3.4.2-r0.apk` (which still has a
//! `.SIGN` segment of its own before its control segment).
use holger_provenance::apk::{verify_index, verify_package, ApkKey};
use holger_provenance::{
effective, verify_artifact, ProvenanceFloor, ProvenanceGate, TrustRoot, Verdict,
};
const FX: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/fixtures");
const KEY: &str = "wolfi-signing.rsa.pub";
fn read(p: &str) -> Vec<u8> {
let b = std::fs::read(format!("{FX}/{p}")).unwrap_or_else(|e| panic!("{p}: {e}"));
assert!(
!b.starts_with(b"version https://git-lfs"),
"{p} is an LFS pointer: run `git lfs install --local && git lfs pull`"
);
b
}
fn wolfi_key() -> ApkKey {
ApkKey::from_pem(KEY, &read("wolfi/wolfi-signing.rsa.pub")).unwrap()
}
fn trust() -> TrustRoot {
TrustRoot::from_trusted_root_json(&read("sigstore/trusted_root.json"))
.unwrap()
.with_apk_keys(&[(KEY.to_string(), read("wolfi/wolfi-signing.rsa.pub"))])
.unwrap()
}
/// The default floor: verified provenance required.
fn require() -> holger_provenance::EffectivePolicy {
effective(
&ProvenanceFloor {
require_signed: true,
require_provenance: true,
..Default::default()
},
&ProvenanceGate::Off,
)
}
fn run(apk: &[u8], index: &str, trust: &TrustRoot) -> holger_provenance::ProvenanceReport {
verify_artifact(
apk,
&[("APKINDEX.tar.gz".to_string(), read(index))],
&require(),
Some(trust),
)
}
#[test]
fn the_wolfi_os_index_rsa256_and_a_package_verify() {
let idx = verify_index(&read("wolfi/os/APKINDEX.tar.gz"), &[wolfi_key()]).unwrap();
assert_eq!((idx.key.as_str(), idx.alg), (KEY, "rsa-sha256"));
assert!(idx.entries.len() > 1000, "{} entries", idx.entries.len());
let p = verify_package(&read("wolfi/os/wolfi-base-1-r7.apk"), &idx).unwrap();
assert_eq!(
(p.name.as_str(), p.version.as_str()),
("wolfi-base", "1-r7")
);
let r = run(
&read("wolfi/os/wolfi-base-1-r7.apk"),
"wolfi/os/APKINDEX.tar.gz",
&trust(),
);
assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
let c = r.verified_provenance().next().unwrap();
assert_eq!(c.origin, "apk-index:APKINDEX.tar.gz");
assert!(
matches!(&c.signer, Some(holger_provenance::SignerInfo::Key { id, alg }) if id == KEY && alg == "rsa-sha256")
);
}
#[test]
fn the_wolfi_stage3_index_rsa_sha1_and_a_signed_package_verify() {
let r = run(
&read("wolfi/stage3/libffi-3.4.2-r0.apk"),
"wolfi/stage3/APKINDEX.tar.gz",
&trust(),
);
assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
let c = r.verified_provenance().next().unwrap();
assert!(
matches!(&c.signer, Some(holger_provenance::SignerInfo::Key { alg, .. }) if alg == "rsa-sha1")
);
}
#[test]
fn a_flipped_byte_in_the_package_data_is_refused() {
let mut apk = read("wolfi/os/wolfi-base-1-r7.apk");
let last = apk.len() - 20;
apk[last] ^= 0x01;
let r = run(&apk, "wolfi/os/APKINDEX.tar.gz", &trust());
assert_eq!(
(r.verdict, r.code.as_deref()),
(Verdict::Block, Some("holger-provenance-2")),
"{}",
r.detail
);
assert!(
r.detail.contains("datahash") || r.detail.contains("data segment"),
"{}",
r.detail
);
}
#[test]
fn a_flipped_byte_in_the_index_is_refused_before_it_is_read() {
let mut idx = read("wolfi/stage3/APKINDEX.tar.gz");
let n = idx.len() - 100;
idx[n] ^= 0x01;
let e = verify_index(&idx, &[wolfi_key()]).unwrap_err();
assert_eq!(e.code_str(), "holger-provenance-3", "{e}");
}
#[test]
fn an_index_signed_by_an_unpinned_key_is_refused() {
// The right name, the wrong key: the npm registry's ECDSA key is not RSA, so use
// another RSA key by taking the Wolfi key under a different name.
let other = ApkKey {
name: "someone-else.rsa.pub".into(),
..wolfi_key()
};
let e = verify_index(&read("wolfi/stage3/APKINDEX.tar.gz"), &[other]).unwrap_err();
assert_eq!(e.code_str(), "holger-provenance-4", "{e}");
// A trust root with no apk key at all refuses by name, not by a crash.
let bare = TrustRoot::from_trusted_root_json(&read("sigstore/trusted_root.json")).unwrap();
let r = run(
&read("wolfi/stage3/libffi-3.4.2-r0.apk"),
"wolfi/stage3/APKINDEX.tar.gz",
&bare,
);
assert_eq!(
(r.verdict, r.code.as_deref()),
(Verdict::Block, Some("holger-provenance-4")),
"{}",
r.detail
);
}
#[test]
fn a_package_the_index_does_not_name_is_refused() {
// wolfi-base 1-r7 is in the os index and not in stage3's.
let r = run(
&read("wolfi/os/wolfi-base-1-r7.apk"),
"wolfi/stage3/APKINDEX.tar.gz",
&trust(),
);
assert_eq!(
(r.verdict, r.code.as_deref()),
(Verdict::Block, Some("holger-provenance-2")),
"{}",
r.detail
);
assert!(
r.detail.contains("names no wolfi-base 1-r7"),
"{}",
r.detail
);
}
#[test]
fn a_policy_narrowed_to_another_apk_key_refuses_and_slsa_min_is_refused_by_name() {
let gate = ProvenanceGate::Require {
identity: None,
identities: vec![],
builders: vec![],
keys: vec![],
apk_keys: vec!["chainguard-extras.rsa.pub".into()],
pgp_keys: vec![],
slsa_min: None,
};
let floor = ProvenanceFloor {
require_provenance: true,
..Default::default()
};
holger_provenance::check_tightens(&floor, &gate, "wolfi").unwrap();
let apk = read("wolfi/stage3/libffi-3.4.2-r0.apk");
let m = [(
"APKINDEX.tar.gz".to_string(),
read("wolfi/stage3/APKINDEX.tar.gz"),
)];
let r = verify_artifact(&apk, &m, &effective(&floor, &gate), Some(&trust()));
assert_eq!(
(r.verdict, r.code.as_deref()),
(Verdict::Block, Some("holger-provenance-4")),
"{}",
r.detail
);
let slsa = effective(
&ProvenanceFloor {
require_provenance: true,
slsa_min: 2,
..Default::default()
},
&ProvenanceGate::Off,
);
let r = verify_artifact(&apk, &m, &slsa, Some(&trust()));
assert_eq!(
(r.verdict, r.code.as_deref()),
(Verdict::Block, Some("holger-provenance-7")),
"{}",
r.detail
);
}
#[test]
fn an_index_entry_carries_its_dependencies_its_provides_and_its_stanza() {
// What a pull-through needs from the signed index: the closure to pull, and the
// stanza to list once the package is AVAILABLE (lane T8).
let idx = verify_index(&read("wolfi/stage3/APKINDEX.tar.gz"), &[wolfi_key()]).unwrap();
let e = idx.entries.iter().find(|e| e.name == "libffi").unwrap();
assert_eq!(e.depends, ["so:libc.so.6"]);
assert_eq!(e.provides, ["so:libffi.so.8=8"]);
assert!(
e.stanza
.starts_with("C:Q125bMmvVC13SP1NtBwN+YKl+ro34=\nP:libffi\nV:3.4.2-r0\n"),
"{}",
e.stanza
);
assert!(
!e.stanza.ends_with('\n'),
"a stanza is its lines, without the blank line between stanzas"
);
let g = idx.entries.iter().find(|e| e.name == "glibc").unwrap();
assert!(
g.depends.iter().any(|d| d == "wolfi-baselayout"),
"{:?}",
g.depends
);
assert!(
g.provides.iter().any(|p| p == "so:libc.so.6=6"),
"{:?}",
g.provides
);
}