nordisk/holger

provenance/tests/dwarves_buildthing.rs

//! Provenance from the **dwarves build door** (`dwarves buildthing` with
//! `DWARVES_PROVENANCE_KEY=dev`): the envelope shape it writes as
//! `<artifact>.intoto.jsonl`, signed with the PUBLISHED development provenance key,
//! accepted under a policy that allow-lists the door — and the three refusals.
//!
//! The development key is published by derivation (dwarves `provenance_step`):
//! `seed = SHA-256(DEV_LEAF_DOMAIN || korp DEVELOPMENT_SEED)`, so this test signs
//! with it and pins its public half as the test trust root. It vouches for
//! nothing — anyone can sign with it — which is exactly why it is fit for a test.

mod common;

use common::*;
use holger_provenance::{
    effective, verify_artifact, BuilderRule, KeyAlg, ProvenanceFloor, ProvenanceGate, TrustedKey,
    Verdict,
};
use ring::signature::{Ed25519KeyPair, KeyPair as _};
use serde_json::json;
use sha2::{Digest, Sha256};

/// The door's SLSA `builder.id` (dwarves `provenance_step::BUILDER_ID`).
const BUILDER: &str = "https://git.gunnar.rs/nordisk/dwarves/buildthing@v1";
/// edda `BUILD_TYPE_VARIANT_V1`.
const BUILD_TYPE: &str =
    "https://git.gunnar.rs/nordisk/edda/buildtypes/nornir-build-thing/variant/v1";
/// The development key's DSSE keyid: its certificate's SHA-256, as dwarves prints it.
const DEV_KEYID: &str = "428a61809d26b938fb171b7ef67e14a322d584ccff574331761745673a577616";
/// The development key's SubjectPublicKeyInfo, base64 — the test trust root.
const DEV_SPKI: &str = "MCowBQYDK2VwAyEAFSu0Uh/R+pwOZi1gxF2W91kTxeFZmLK6swiXBQe7Zlk=";

const ARTIFACT: &[u8] = b"\x7fELF holger-cli bytes, built by the dwarves build door";

fn dev_key() -> Ed25519KeyPair {
    let mut h = Sha256::new();
    h.update(b"nordisk build-provenance DEVELOPMENT leaf v1");
    h.update(b"korp DEVELOPMENT key NOT SECRET!");
    Ed25519KeyPair::from_seed_unchecked(&h.finalize()).unwrap()
}

fn dev_trusted() -> TrustedKey {
    TrustedKey {
        id: DEV_KEYID.into(),
        alg: KeyAlg::Ed25519,
        public_key: DEV_SPKI.into(),
    }
}

/// The statement the door writes (edda `to_slsa_statement`), about `bytes`.
fn door_statement(bytes: &[u8], builder: &str) -> Vec<u8> {
    serde_json::to_vec(&json!({
        "_type": "https://in-toto.io/Statement/v1",
        "subject": [{"name": "holger-cli", "digest": {"sha256": hex::encode(Sha256::digest(bytes))}}],
        "predicateType": "https://slsa.dev/provenance/v1",
        "predicate": {
            "buildDefinition": {
                "buildType": BUILD_TYPE,
                "externalParameters": {"variant": "cli", "repo": "holger", "profile": "release", "features": [],
                    "cargoArgs": ["build", "-p", "holger-cli", "--bin", "holger-cli", "--profile", "release"]},
                "internalParameters": {"rustc": "rustc 1.97.1", "cargo": "cargo 1.97.1", "host": "x86_64-unknown-linux-gnu"},
                "resolvedDependencies": [
                    {"name": "holger", "uri": "git+https://git.gunnar.rs/nordisk/holger", "digest": {"gitCommit": "69bbe5756d320fdfadb7e0eec01da3067d17e200"}},
                    {"name": "edda", "uri": "git+https://git.gunnar.rs/nordisk/edda", "digest": {"gitCommit": "d865b9fcf3caf8e5645349c2ac3e4c2e644a1441"}},
                    {"name": "toolchain-image", "uri": "nordisk-cargo-toolchain", "digest": {"sha256": "86d575e874677da3eb9aff3ba6e38ca600781ee9b7948a9df43ef89a6213c762"}}
                ]
            },
            "runDetails": {"builder": {"id": builder, "builderDependencies": []},
                "metadata": {"invocationId": "cd6906a6-361e-4d3c-aef8-e8e6d07404d3", "startedOn": "2026-10-29T12:20:36Z"}}
        }
    }))
    .unwrap()
}

fn envelope(key: &Ed25519KeyPair, keyid: &str, payload: &[u8]) -> Vec<u8> {
    serde_json::to_vec(&json!({
        "payloadType": IN_TOTO,
        "payload": b64(payload),
        "signatures": [{"keyid": keyid, "sig": b64(key.sign(&pae(payload)).as_ref())}],
    }))
    .unwrap()
}

/// The policy: the dev key, the door allow-listed at SLSA build level 1 (what a
/// published key reaches — see the report), `Require(slsa_min: 1)`.
fn policy() -> holger_provenance::EffectivePolicy {
    let floor = ProvenanceFloor {
        keys: vec![dev_trusted()],
        builders: vec![BuilderRule {
            id: BUILDER.into(),
            level: Some(1),
        }],
        ..Default::default()
    };
    let gate = ProvenanceGate::Require {
        identity: None,
        identities: vec![],
        builders: vec![],
        keys: vec![],
        apk_keys: vec![],
        pgp_keys: vec![],
        slsa_min: Some(1),
    };
    effective(&floor, &gate)
}

fn run(artifact: &[u8], env: Vec<u8>) -> holger_provenance::ProvenanceReport {
    verify_artifact(
        artifact,
        &[("holger-cli.intoto.jsonl".to_string(), env)],
        &policy(),
        None,
    )
}

#[test]
fn the_published_dev_key_is_the_one_dwarves_signs_with() {
    // The trust root pinned above IS the public half of the derived seed.
    let mut spki = hex::decode("302a300506032b6570032100").unwrap();
    spki.extend_from_slice(dev_key().public_key().as_ref());
    assert_eq!(b64(&spki), DEV_SPKI);
}

#[test]
fn a_door_sealed_build_passes() {
    let r = run(
        ARTIFACT,
        envelope(&dev_key(), DEV_KEYID, &door_statement(ARTIFACT, BUILDER)),
    );
    assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
    let c = r.verified_provenance().next().unwrap();
    let s = c.slsa.as_ref().unwrap();
    assert_eq!(
        (s.builder_id.as_str(), s.build_type.as_str()),
        (BUILDER, BUILD_TYPE)
    );
    assert_eq!(s.resolved_dependencies.len(), 3);
    assert_eq!(c.slsa_level, Some(1));
}

#[test]
fn a_tampered_artifact_is_refused() {
    let env = envelope(&dev_key(), DEV_KEYID, &door_statement(ARTIFACT, BUILDER));
    let mut tampered = ARTIFACT.to_vec();
    tampered.push(b'X');
    let r = run(&tampered, env);
    assert_eq!(
        (r.verdict, r.code.as_deref()),
        (Verdict::Block, Some("holger-provenance-2")),
        "{}",
        r.detail
    );
}

#[test]
fn a_wrong_key_is_refused() {
    // Another key claiming the dev keyid: the signature does not verify.
    let other = Ed25519KeyPair::from_seed_unchecked(&[7u8; 32]).unwrap();
    let r = run(
        ARTIFACT,
        envelope(&other, DEV_KEYID, &door_statement(ARTIFACT, BUILDER)),
    );
    assert_eq!(
        (r.verdict, r.code.as_deref()),
        (Verdict::Block, Some("holger-provenance-3")),
        "{}",
        r.detail
    );
}

#[test]
fn a_wrong_builder_id_is_refused() {
    let r = run(
        ARTIFACT,
        envelope(
            &dev_key(),
            DEV_KEYID,
            &door_statement(ARTIFACT, "nornir-build-thing://rickard@dwarf"),
        ),
    );
    assert_eq!(
        (r.verdict, r.code.as_deref()),
        (Verdict::Block, Some("holger-provenance-6")),
        "{}",
        r.detail
    );
}