enprot 0.4.0

Engyon Protected Text (EPT) — confidentiality processor and capability ledger
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

use assert_cmd::Command;
use tempfile::tempdir;

// `enprot fingerprint` exposes capability::KeyFp::from_pem so users
// can build trust_roots lists for policy files (TODO.finalize/26)
// without writing their own SHA3-256 computation.

#[test]
fn fingerprint_outputs_64_hex_chars_for_ed25519_pub() {
    let dir = tempdir().unwrap();
    let pub_pem = dir.path().join("pub.pem");

    Command::cargo_bin("enprot")
        .unwrap()
        .args(["keygen", "ed25519", "--out-pub"])
        .arg(&pub_pem)
        .assert()
        .success();

    let out = Command::cargo_bin("enprot")
        .unwrap()
        .arg("fingerprint")
        .arg(&pub_pem)
        .assert()
        .success();
    let s = std::str::from_utf8(&out.get_output().stdout)
        .unwrap()
        .trim();
    assert_eq!(s.len(), 64, "fingerprint must be 64 hex chars (32 bytes)");
    assert!(
        s.chars().all(|c| c.is_ascii_hexdigit()),
        "fingerprint must be lowercase hex"
    );
}

#[test]
fn fingerprint_is_stable_across_invocations() {
    let dir = tempdir().unwrap();
    let pub_pem = dir.path().join("pub.pem");

    Command::cargo_bin("enprot")
        .unwrap()
        .args(["keygen", "ed25519", "--out-pub"])
        .arg(&pub_pem)
        .assert()
        .success();

    let out1 = Command::cargo_bin("enprot")
        .unwrap()
        .arg("fingerprint")
        .arg(&pub_pem)
        .assert()
        .success();
    let out2 = Command::cargo_bin("enprot")
        .unwrap()
        .arg("fingerprint")
        .arg(&pub_pem)
        .assert()
        .success();

    assert_eq!(
        std::str::from_utf8(&out1.get_output().stdout).unwrap(),
        std::str::from_utf8(&out2.get_output().stdout).unwrap(),
        "same pubkey must produce same fingerprint"
    );
}

#[test]
fn fingerprint_differs_for_different_keys() {
    let dir = tempdir().unwrap();
    let pub_a = dir.path().join("a.pub");
    let pub_b = dir.path().join("b.pub");

    Command::cargo_bin("enprot")
        .unwrap()
        .args(["keygen", "ed25519", "--out-pub"])
        .arg(&pub_a)
        .assert()
        .success();
    Command::cargo_bin("enprot")
        .unwrap()
        .args(["keygen", "ed25519", "--out-pub"])
        .arg(&pub_b)
        .assert()
        .success();

    let out_a = Command::cargo_bin("enprot")
        .unwrap()
        .arg("fingerprint")
        .arg(&pub_a)
        .assert()
        .success();
    let out_b = Command::cargo_bin("enprot")
        .unwrap()
        .arg("fingerprint")
        .arg(&pub_b)
        .assert()
        .success();

    assert_ne!(
        std::str::from_utf8(&out_a.get_output().stdout).unwrap(),
        std::str::from_utf8(&out_b.get_output().stdout).unwrap(),
        "different pubkeys must produce different fingerprints"
    );
}

#[test]
fn fingerprint_rejects_missing_file() {
    Command::cargo_bin("enprot")
        .unwrap()
        .arg("fingerprint")
        .arg("/nonexistent/path/pub.pem")
        .assert()
        .failure();
}