nordisk/holger

server/cli/tests/sigstore_trust_cli.rs

//! **`holger sigstore-trust`** (lane HOL-OCI-EVIDENCE): the release build signs the pinned
//! public-good `trusted_root.json` into the trust bundle the medium carries, with the policy
//! that pins its signer; a root that is not the pinned one is refused by name unless the
//! caller says `--unpinned` (a test's own Sigstore); `status` says what a box installed.
#![cfg(all(feature = "secure_update", feature = "export-push"))]

use std::process::Command;

const BIN: &str = env!("CARGO_BIN_EXE_holger");
const ROOT: &str = concat!(
    env!("CARGO_MANIFEST_DIR"),
    "/../../provenance/tests/fixtures/sigstore/trusted_root.json"
);

fn holger(args: &[&str]) -> (bool, String) {
    let o = Command::new(BIN).args(args).output().unwrap();
    (
        o.status.success(),
        format!(
            "{}{}",
            String::from_utf8_lossy(&o.stdout),
            String::from_utf8_lossy(&o.stderr)
        ),
    )
}

#[test]
fn make_signs_the_pinned_root_and_refuses_another_by_name() {
    let d = tempfile::tempdir().unwrap();
    let (signer, out, policy) = (
        d.path().join("signer"),
        d.path().join("sigstore-trust.holger.znippy"),
        d.path().join("bundle-trust.ron"),
    );
    let s = |p: &std::path::Path| p.display().to_string();
    let (ok, text) = holger(&[
        "sigstore-trust",
        "make",
        "--root",
        ROOT,
        "--signer-dir",
        &s(&signer),
        "--out",
        &s(&out),
        "--policy-out",
        &s(&policy),
        "--sequence",
        "5",
    ]);
    assert!(ok, "{text}");
    assert!(out.is_file() && policy.is_file(), "{text}");
    let p =
        update_bundle::TrustPolicy::from_ron(&std::fs::read_to_string(&policy).unwrap()).unwrap();
    assert!(
        p.allowed_products
            .iter()
            .any(|x| x == "holger.sigstore-trust/v1"),
        "{p:?}"
    );
    let members = update_bundle::container::load_bundle_verified(&out, &p)
        .expect("the bundle verifies against the policy beside it");
    assert_eq!(
        members.get("payload/trusted_root.json").cloned(),
        Some(std::fs::read(ROOT).unwrap()),
        "the bundle carries the pinned root byte for byte"
    );
    // The same signer signs the next refresh; the policy stays the same.
    let (ok, text) = holger(&[
        "sigstore-trust",
        "make",
        "--root",
        ROOT,
        "--signer-dir",
        &s(&signer),
        "--out",
        &s(&d.path().join("b2")),
        "--policy-out",
        &s(&d.path().join("p2")),
        "--sequence",
        "6",
    ]);
    assert!(ok, "{text}");
    assert_eq!(
        std::fs::read(&policy).unwrap(),
        std::fs::read(d.path().join("p2")).unwrap(),
        "one signer, one policy"
    );

    let other = d.path().join("other.json");
    std::fs::write(
        &other,
        br#"{"mediaType":"application/vnd.dev.sigstore.trustedroot+json;version=0.1"}"#,
    )
    .unwrap();
    let (ok, text) = holger(&[
        "sigstore-trust",
        "make",
        "--root",
        &s(&other),
        "--signer-dir",
        &s(&signer),
        "--out",
        &s(&d.path().join("x")),
    ]);
    assert!(
        !ok && text.contains("[holger-trust-1]"),
        "a root that is not the pinned one: {text}"
    );
}