nordisk/holger

server/scan-worker/tests/the_worker_reads_dsse_evidence.rs

//! **The worker can read the evidence it is asked to verify** (lane HOL-CDS-5): the
//! `verify-bundle` job runs in this worker (lane HOL-SANDBOX-TRAIT), and for an airgap
//! export it checks every scan-evidence attestation, a DSSE envelope, against this side's
//! trust (`airgap::verify_import`). server-lib reads a DSSE envelope only with its `sign`
//! feature; without it every envelope is `holger-attest-9` and every export a downstream
//! takes in is refused in the sandbox. The one-way appliance's KVM proof met exactly that.
//!
//! The SHIPPED worker (its normal dependencies, never the dev ones) is resolved with
//! `cargo tree` and must build server-lib with `sign`.

use std::path::Path;
use std::process::Command;

#[test]
fn the_shipped_worker_builds_server_lib_with_sign() {
    let root = Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../.."));
    let out = Command::new(env!("CARGO"))
        .current_dir(root)
        .args([
            "tree",
            "-p",
            "holger-scan-worker",
            "-e",
            "normal,features",
            "--prefix",
            "none",
            "-i",
            "holger-server-lib",
        ])
        .output()
        .expect("cargo tree runs");
    assert!(
        out.status.success(),
        "cargo tree: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    let tree = String::from_utf8_lossy(&out.stdout);
    assert!(
        tree.lines().any(|l| l.starts_with("holger-server-lib feature \"sign\"")),
        "the shipped holger-scan-worker builds server-lib WITHOUT `sign`, so the verify-bundle job \
         refuses every DSSE evidence attestation (holger-attest-9):\n{tree}"
    );
}