dig-capsule 0.5.0

The DIG Network .dig capsule data plane — one crate over the DIGS format, capsule read-crypto, compiler, staging, and the guest/host serve triad.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

use super::common::{sample_generations, sample_manifest, store_id, store_pubkey, trusted_keys};
use crate::imp::compiler::{Compiler, CompilerConfig};

fn compile_to_bytes(dir: &std::path::Path, obfuscate: bool) -> Vec<u8> {
    let cfg = CompilerConfig {
        output_dir: dir.to_path_buf(),
        obfuscate,
        optimize: false,
        template_override: None,
        // Small uniform budget keeps the emitted module tiny/fast.
        uniform_blob_len: 64 * 1024,
    };
    let gens = sample_generations();
    let outcome = Compiler::compile(
        &cfg,
        store_id(),
        store_pubkey(),
        &gens,
        sample_manifest(),
        super::common::no_auth(),
        &trusted_keys(),
        None,
        None,
    )
    .expect("compiles");
    std::fs::read(&outcome.result.output_path).unwrap()
}

#[test]
fn two_compiles_are_byte_identical() {
    let d1 = std::env::temp_dir().join(format!("digc-det1-{}", std::process::id()));
    let d2 = std::env::temp_dir().join(format!("digc-det2-{}", std::process::id()));
    std::fs::create_dir_all(&d1).unwrap();
    std::fs::create_dir_all(&d2).unwrap();

    let a = compile_to_bytes(&d1, false);
    let b = compile_to_bytes(&d2, false);
    assert_eq!(a, b, "compilation must be byte-identical (paper 19.3)");

    std::fs::remove_dir_all(&d1).ok();
    std::fs::remove_dir_all(&d2).ok();
}

#[test]
fn two_obfuscated_compiles_are_byte_identical() {
    let d1 = std::env::temp_dir().join(format!("digc-detob1-{}", std::process::id()));
    let d2 = std::env::temp_dir().join(format!("digc-detob2-{}", std::process::id()));
    std::fs::create_dir_all(&d1).unwrap();
    std::fs::create_dir_all(&d2).unwrap();

    let a = compile_to_bytes(&d1, true);
    let b = compile_to_bytes(&d2, true);
    assert_eq!(a, b, "obfuscated compilation must also be byte-identical");

    std::fs::remove_dir_all(&d1).ok();
    std::fs::remove_dir_all(&d2).ok();
}