nordisk/holger

server/scan-worker/tests/common/mod.rs

//! Shared fixtures of the scan worker's tests.
#![allow(dead_code)]

use std::path::{Path, PathBuf};

/// A signed update bundle and the policy that trusts its signers.
pub fn signed_bundle(dir: &Path) -> (PathBuf, update_bundle::TrustPolicy) {
    use rcgen::{CertificateParams, DnType, KeyPair, PKCS_ED25519};
    use update_bundle::policy::{
        ApprovedSigner, CertificateValidity, ExpiredPosture, TrustMode, TrustPolicy,
    };
    let mint = |cn: &str| {
        let k = KeyPair::generate_for(&PKCS_ED25519).unwrap();
        let mut p = CertificateParams::new(vec![]).unwrap();
        p.distinguished_name.push(DnType::CommonName, cn);
        let c = p.self_signed(&k).unwrap();
        (
            c.der().to_vec(),
            k.serialize_der(),
            update_bundle::digest::sha256_hex(c.der()),
        )
    };
    let (rev, own, rel) = (
        mint("security-reviewer"),
        mint("system-owner"),
        mint("release"),
    );
    let policy = TrustPolicy {
        schema_version: update_bundle::schema::POLICY_SCHEMA.into(),
        trust_mode: Some(TrustMode::PinnedSigners),
        trusted_roots: vec![],
        certificate_validity: CertificateValidity::Enforce,
        approved_signers: vec![
            ApprovedSigner {
                fingerprint: rev.2.clone(),
                subject: None,
                roles: vec!["security-reviewer".into()],
            },
            ApprovedSigner {
                fingerprint: own.2.clone(),
                subject: None,
                roles: vec!["system-owner".into()],
            },
        ],
        required_approval_roles: vec!["security-reviewer".into(), "system-owner".into()],
        minimum_distinct_approvers: 2,
        trusted_release_signers: vec![rel.2.clone()],
        release_signer_must_be_distinct: true,
        maximum_bundle_age_secs: None,
        require_expiry: true,
        on_expired_metadata: Some(ExpiredPosture::Refuse),
        require_sbom: false,
        require_vex: false,
        require_scan: false,
        allowed_products: vec!["ExampleDrive".into()],
        allowed_models: vec![],
    };
    let now = chrono::Utc::now();
    let prep = update_bundle::prepare::Preparation {
        bundle_id: "fw-1".into(),
        sequence: 1,
        created_at: now,
        expires_at: Some(now + chrono::Duration::days(30)),
        producer: "intake-station".into(),
        supplier: "ExampleCorp".into(),
        product: "ExampleDrive".into(),
        release_version: "1.2.1".into(),
        supported_hardware_models: vec![],
        supported_hardware_revisions: vec![],
        source_provenance: update_bundle::core::SourceProvenance {
            source_kind: "vendor-portal".into(),
            source_uri: None,
            source_repository: None,
            source_asset_path: None,
            fetched_at: Some(now),
            reported_size: Some(5),
            vendor_checksum: None,
            vendor_signature_status: None,
            tls_origin: None,
            transfer_receipt_digest: None,
        },
        policy_result: update_bundle::core::PolicyResult {
            policy_digest: update_bundle::digest::sha256_hex(b"p"),
            advisory_snapshot_digest: None,
            verdict: "pass".into(),
            non_production: true,
        },
        supersedes: vec![],
        withdraws: vec![],
        payloads: vec![update_bundle::prepare::PayloadInput {
            relative_path: "firmware.bin".into(),
            bytes: b"hello".to_vec(),
            media_type: "application/octet-stream".into(),
        }],
        evidence: vec![],
    };
    let mut m = prep.build().unwrap().members;
    update_bundle::finalize::add_approval(&mut m, "security-reviewer", &rev.0, &rev.1, None, now)
        .unwrap();
    update_bundle::finalize::add_approval(&mut m, "system-owner", &own.0, &own.1, None, now)
        .unwrap();
    update_bundle::finalize::finalize(&mut m, &policy, &rel.0, &rel.1, now).unwrap();
    let out = dir.join("fw-1.holger.znippy");
    update_bundle::container::pack_bundle(&m, &out).unwrap();
    (out, policy)
}