holger-intel 3.0.0

//! S7: OSV / NVD / KEV → signed intel bundle → (USB) → verify → local advisory
//! database → offline scan. Every test runs on fixture feeds; none opens a socket.

mod common;

use std::sync::atomic::{AtomicU64, Ordering};
use std::sync::Arc;

use chrono::{Duration, Utc};
use common::*;
use holger_intel::feeds::FeedSpec;
use holger_intel::net::{Fetch, IntelNet, NetError};
use holger_intel::resolve::{FINDING_EXPIRED, FINDING_MISSING, FINDING_STALE};
use holger_intel::{
    import, resolve, resolve_local, ImportRequest, IntelScanner, LiveIntel, LocalIntelDb,
    Staleness, StalenessRule,
};
use holger_update_bundle::digest::sha256_hex;
use modgunn::core::{ArtifactRef, Decision, Severity};
use modgunn::scan::{Artifact, Policy, Provenance, ProvenancePolicy};

fn scan_policy() -> Policy {
    Policy {
        version: "intel-test".into(),
        provenance: ProvenancePolicy::Ignore,
        ..Policy::default()
    }
}

fn wheel_artifact(dir: &std::path::Path) -> Artifact {
    let bytes = std::fs::read(fixture_wheel(dir)).unwrap();
    let (name, version) = wheel_coords(&bytes);
    Artifact::new(
        ArtifactRef {
            ecosystem: "pip".into(),
            name,
            version,
            blob_sha256: sha256_hex(&bytes),
        },
        Some("Apache-2.0".into()),
        Provenance::unsigned(),
    )
}

fn import_at(
    pki: &Pki,
    db: &LocalIntelDb,
    bundle: &std::path::Path,
    first: bool,
) -> anyhow::Result<holger_intel::ImportOutcome> {
    let req = ImportRequest {
        bundle,
        policy: &pki.policy,
        db,
        first_import: first,
    };
    import(&req, &Fixed(Utc::now()), &MemAudit::default())
}

#[test]
fn feeds_normalize_into_one_enriched_set() {
    let dir = tempfile::tempdir().unwrap();
    let set = fixture_set(dir.path(), Utc::now());
    assert_eq!(
        set.sources.len(),
        3,
        "osv, nvd and kev are each recorded: {:?}",
        set.sources
    );
    let req = set
        .advisories
        .iter()
        .find(|a| a.package == "requests")
        .expect("the OSV record");
    assert!(req.aliases.iter().any(|a| a == "CVE-2018-18074"), "{req:?}");
    assert!(req.kev, "KEV enriches by alias");
    assert!(
        req.cvss.starts_with("CVSS:3.1/"),
        "NVD enriches by alias: {req:?}"
    );
    assert!(req.cwe.contains(&"CWE-522".to_string()));
    assert_eq!(
        req.severity,
        Severity::High,
        "NVD's stronger severity is taken"
    );
    let again = fixture_set(dir.path(), set.generated_at);
    let json = |s: &holger_intel::AdvisorySet| serde_json::to_vec(&s.advisories).unwrap();
    assert_eq!(
        json(&set),
        json(&again),
        "the same feeds give the same advisory bytes"
    );
}

#[test]
fn build_then_import_then_scan_finds_the_known_cve_in_a_fixture_wheel() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let built = bundle(&pki, dir.path(), 42, Utc::now());
    assert!(built.report.approvals.len() == 2 && built.advisories >= 2);

    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    let out = import_at(&pki, &db, &built.path, true).expect("first import");
    assert_eq!(out.record.outcome, "new");
    assert_eq!(out.installed.sequence, 42);
    assert!(out.stored_bundle.exists() && out.receipt.exists());

    let resolved = resolve(
        &db,
        StalenessRule::default(),
        &IntelNet::offline(),
        &[],
        Utc::now(),
    )
    .unwrap();
    assert_eq!(resolved.evidence.source, "local-intel");
    assert_eq!(resolved.evidence.sequence, Some(42));
    let date = Utc::now().format("%Y-%m-%d").to_string();
    assert_eq!(
        resolved.evidence.snapshot_date.as_deref(),
        Some(date.as_str())
    );
    let scanner = IntelScanner::new(scan_policy(), resolved);
    let v = scanner.scan(&wheel_artifact(dir.path()));
    let hit = v
        .verdict
        .findings
        .iter()
        .find(|f| f.id == "PYSEC-2018-28")
        .unwrap_or_else(|| panic!("the CVE is found: {:?}", v.verdict));
    assert_eq!(
        hit.severity,
        Severity::Critical,
        "a KEV hit escalates to Critical"
    );
    assert_eq!(v.verdict.decision, Decision::Block);
    assert!(
        v.verdict.advisory_db_rev.contains("seq 42") && v.verdict.advisory_db_rev.contains(&date),
        "the evidence names the bundle sequence and date: {}",
        v.verdict.advisory_db_rev
    );
    assert!(
        v.evidence.describe().contains("offline"),
        "{}",
        v.evidence.describe()
    );
}

#[test]
fn a_tampered_bundle_is_refused_and_writes_nothing() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let built = bundle(&pki, dir.path(), 7, Utc::now());
    // The attack that matters: unpack, drop the advisory that would have
    // blocked, repack. Every byte the archive holds is still well-formed.
    let mut members = holger_update_bundle::load_bundle(&built.path).unwrap();
    let key = format!("payload/{}", holger_intel::ADVISORIES_REL);
    let mut set = holger_intel::AdvisorySet::from_json_bytes(&members[&key]).unwrap();
    set.advisories.retain(|a| a.package != "requests");
    members.insert(key, set.to_json_bytes().unwrap());
    let tampered = dir.path().join("tampered.holger.znippy");
    holger_update_bundle::pack_bundle(&members, &tampered).unwrap();
    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    let err = import_at(&pki, &db, &tampered, true).expect_err("a tampered bundle must be refused");
    assert!(
        format!("{err:#}").contains("verification failed") || format!("{err:#}").contains("intel"),
        "{err:#}"
    );
    assert!(db.installed().unwrap().is_none(), "nothing went live");

    // A bundle signed by someone the policy does not trust is refused the same way.
    let stranger = Pki::new();
    let foreign = bundle(&stranger, dir.path(), 8, Utc::now());
    let err =
        import_at(&pki, &db, &foreign.path, true).expect_err("an untrusted signer must be refused");
    assert!(
        format!("{err:#}").contains("verification failed"),
        "{err:#}"
    );
    assert!(db.installed().unwrap().is_none());
}

#[test]
fn an_older_sequence_is_refused_and_the_newer_set_stays_live() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let older = bundle(&pki, dir.path(), 10, Utc::now() - Duration::days(1));
    let newer = bundle(&pki, dir.path(), 11, Utc::now());
    let db = LocalIntelDb::open(dir.path().join("intel-db"));

    // No floor yet: refused unless the operator says --first-import.
    let err = import_at(&pki, &db, &newer.path, false).expect_err("no floor without first_import");
    assert!(
        format!("{err:#}").to_lowercase().contains("floor"),
        "{err:#}"
    );
    import_at(&pki, &db, &newer.path, true).expect("first import");
    let err = import_at(&pki, &db, &older.path, false).expect_err("rollback must be refused");
    assert!(
        format!("{err:#}").contains("10") && format!("{err:#}").contains("11"),
        "{err:#}"
    );
    // first_import does not weaken a floor in force.
    import_at(&pki, &db, &older.path, true).expect_err("first_import never bypasses a floor");
    assert_eq!(db.installed().unwrap().unwrap().sequence, 11);
    // The same bundle again is an idempotent re-import, not a replay.
    let again = import_at(&pki, &db, &newer.path, false).unwrap();
    assert_eq!(again.record.outcome, "idempotent-reimport");
}

#[test]
fn an_audit_failure_refuses_the_import_and_changes_nothing() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let first = bundle(&pki, dir.path(), 20, Utc::now());
    let second = bundle(&pki, dir.path(), 21, Utc::now());
    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    fn req<'a>(
        b: &'a std::path::Path,
        pki: &'a Pki,
        db: &'a LocalIntelDb,
        first: bool,
    ) -> ImportRequest<'a> {
        ImportRequest {
            bundle: b,
            policy: &pki.policy,
            db,
            first_import: first,
        }
    }

    // Off from the start: nothing at all.
    let err = import(
        &req(&first.path, &pki, &db, true),
        &Fixed(Utc::now()),
        &OffAudit,
    )
    .expect_err("audit off");
    assert!(format!("{err:#}").contains("audit"), "{err:#}");
    assert!(db.installed().unwrap().is_none());
    assert!(
        !db.state_dir().exists() || std::fs::read_dir(db.state_dir()).unwrap().next().is_none(),
        "no floor"
    );

    import(
        &req(&first.path, &pki, &db, true),
        &Fixed(Utc::now()),
        &MemAudit::default(),
    )
    .unwrap();
    let before = std::fs::read(db.root().join("installed.json")).unwrap();
    let err = import(
        &req(&second.path, &pki, &db, false),
        &Fixed(Utc::now()),
        &FailingAudit,
    )
    .expect_err("audit write fails");
    assert!(
        format!("{err:#}").contains("audit record could not be written"),
        "{err:#}"
    );
    assert_eq!(
        std::fs::read(db.root().join("installed.json")).unwrap(),
        before,
        "the live set is unchanged"
    );
    assert!(
        !db.root().join(LocalIntelDb::generation_file(21)).exists(),
        "the staged generation is undone"
    );
    assert!(!db
        .bundles_dir()
        .join(format!("{}.holger.znippy", second.bundle_id))
        .exists());
    // The floor did not move: the same bundle imports once the sink works.
    let ok = import(
        &req(&second.path, &pki, &db, false),
        &Fixed(Utc::now()),
        &MemAudit::default(),
    )
    .unwrap();
    assert_eq!(ok.record.outcome, "new");
}

/// A fetcher that counts every call and never answers: it would only ever be
/// reached by a network call.
struct Tripwire(Arc<AtomicU64>);

impl Fetch for Tripwire {
    fn get(&self, url: &str) -> Result<Vec<u8>, NetError> {
        self.0.fetch_add(1, Ordering::SeqCst);
        Err(NetError::Unavailable {
            url: url.into(),
            why: "tripwire".into(),
        })
    }
}

#[test]
fn offline_mode_refuses_the_network() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let built = bundle(&pki, dir.path(), 5, Utc::now());
    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    import_at(&pki, &db, &built.path, true).unwrap();
    let feeds = FeedSpec::default_set(&["PyPI".to_string()], 2026);

    // The offline gate refuses a URL outright; nothing stands behind it.
    let offline = IntelNet::offline();
    let err = offline
        .get("https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip")
        .unwrap_err();
    assert!(err.is_refused(), "{err}");
    assert!(err.to_string().contains("network refused"));

    // Resolving offline never asks the gate at all, and reads the local DB.
    let r = resolve(&db, StalenessRule::default(), &offline, &feeds, Utc::now()).unwrap();
    assert_eq!(r.evidence.source, "local-intel");
    assert_eq!(
        offline.refused_count(),
        1,
        "only the explicit call above reached the gate"
    );

    // Online with no network: the feeds are tried, then the local DB answers.
    let calls = Arc::new(AtomicU64::new(0));
    let online = IntelNet::online(Box::new(Tripwire(calls.clone())));
    let r = resolve(&db, StalenessRule::default(), &online, &feeds, Utc::now()).unwrap();
    assert_eq!(
        calls.load(Ordering::SeqCst),
        1,
        "online mode does try the network"
    );
    assert_eq!(r.evidence.source, "local-intel");
    assert!(
        r.evidence
            .network
            .as_deref()
            .unwrap_or("")
            .contains("no network"),
        "{:?}",
        r.evidence
    );
}

#[test]
fn a_stale_database_warns_then_blocks() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let snapshot = Utc::now() - Duration::days(2);
    let built = bundle(&pki, dir.path(), 30, snapshot);
    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    import_at(&pki, &db, &built.path, true).unwrap();
    let rule = StalenessRule {
        warn_after_days: 7,
        block_after_days: 30,
    };
    rule.validate().unwrap();
    assert!(StalenessRule {
        warn_after_days: 30,
        block_after_days: 7
    }
    .validate()
    .is_err());

    // A clean artifact, so only the database's age decides.
    let clean = Artifact::new(
        ArtifactRef {
            ecosystem: "pip".into(),
            name: "requests".into(),
            version: "2.31.0".into(),
            blob_sha256: "00".into(),
        },
        None,
        Provenance::unsigned(),
    );
    let at = |days: i64| {
        let r = resolve_local(&db, rule, snapshot + Duration::days(days), None).unwrap();
        IntelScanner::new(scan_policy(), r).scan(&clean)
    };
    let fresh = at(3);
    assert_eq!(fresh.evidence.staleness, Staleness::Fresh);
    assert_eq!(
        fresh.verdict.decision,
        Decision::Pass,
        "{:?}",
        fresh.verdict
    );

    let warn = at(8);
    assert_eq!(warn.evidence.staleness, Staleness::Warn);
    assert_eq!(warn.verdict.decision, Decision::Warn);
    let f = warn
        .verdict
        .findings
        .iter()
        .find(|f| f.id == FINDING_STALE)
        .expect("a stale finding");
    assert!(
        f.summary.contains("seq 30") && f.summary.contains("8 days"),
        "{}",
        f.summary
    );

    let block = at(31);
    assert_eq!(block.evidence.staleness, Staleness::Block);
    assert_eq!(block.verdict.decision, Decision::Block);
    assert!(block
        .verdict
        .findings
        .iter()
        .any(|f| f.id == FINDING_EXPIRED));

    // No database at all blocks too.
    let empty = LocalIntelDb::open(dir.path().join("empty"));
    let r = resolve_local(&empty, rule, Utc::now(), None).unwrap();
    let v = IntelScanner::new(scan_policy(), r).scan(&clean);
    assert_eq!(v.verdict.decision, Decision::Block);
    assert!(v.verdict.findings.iter().any(|f| f.id == FINDING_MISSING));
}

#[test]
fn a_database_edited_after_import_is_refused() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let built = bundle(&pki, dir.path(), 3, Utc::now());
    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    import_at(&pki, &db, &built.path, true).unwrap();
    let live = db.root().join(LocalIntelDb::generation_file(3));
    let mut bytes = std::fs::read(&live).unwrap();
    bytes.extend_from_slice(b" ");
    std::fs::write(&live, bytes).unwrap();
    let err = db.load().expect_err("an edited database is refused");
    assert!(
        format!("{err:#}").contains("does not match its install record"),
        "{err:#}"
    );
}

#[test]
fn an_import_goes_live_without_a_restart() {
    let dir = tempfile::tempdir().unwrap();
    let pki = Pki::new();
    let db = LocalIntelDb::open(dir.path().join("intel-db"));
    let live = LiveIntel::new(db.clone(), StalenessRule::default());
    let (_, e) = live.current(Utc::now()).unwrap();
    assert_eq!(e.source, "none");
    import_at(
        &pki,
        &db,
        &bundle(&pki, dir.path(), 1, Utc::now()).path,
        true,
    )
    .unwrap();
    let (adb, e) = live.current(Utc::now()).unwrap();
    assert_eq!(e.sequence, Some(1));
    assert!(!adb.advisories.is_empty());
    import_at(
        &pki,
        &db,
        &bundle(&pki, dir.path(), 2, Utc::now()).path,
        false,
    )
    .unwrap();
    let (_, e) = live.current(Utc::now()).unwrap();
    assert_eq!(
        e.sequence,
        Some(2),
        "the second import is what the next scan reads"
    );
}

/// SANDBOX-SCAN: the image CVE scanner matches an image's apk packages against
/// the Wolfi and Chainguard advisories, so a default online build fetches them,
/// and a real OSV Wolfi record lands under the `wolfi` label the image's
/// packages carry.
#[test]
fn the_default_feeds_carry_the_image_distributions() {
    let defaults = holger_intel::feeds::DEFAULT_ECOSYSTEMS;
    for want in ["Wolfi", "Chainguard"] {
        assert!(
            defaults.contains(&want),
            "{want} is not fetched by default: {defaults:?}"
        );
    }
    let rec = std::fs::read_to_string(
        std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../server/lib/tests/fixtures/sandbox/osv-wolfi-openssl.json"),
    )
    .unwrap();
    let advisories = holger_intel::modgunn::osv::parse_doc(&rec).unwrap();
    assert!(
        advisories
            .iter()
            .any(|a| a.ecosystem == "wolfi" && a.package == "openssl"),
        "{:?}",
        advisories
            .iter()
            .map(|a| (&a.ecosystem, &a.package))
            .collect::<Vec<_>>()
    );
}