mkit-cli 0.5.0

The mkit command-line tool: a content-addressed VCS with native attestation support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

//! End-to-end HTTP-transport sparse-checkout coverage (issue #158).
//! Spins up a `mockito` server that responds to
//! `POST /<project>/trees/<hex>/sparse?sparse=<filter-hex>` with a
//! server-built sparse envelope, then asserts the client decodes and
//! verifies it.

#![cfg(feature = "sparse-checkout")]
#![allow(clippy::unwrap_used)] // unwrap is the assertion in test helpers

use std::path::PathBuf;

use mkit_core::hash::{Hash, to_hex};
use mkit_core::object::{EntryMode, Tree, TreeEntry};
use mkit_core::sparse::{build_sparse, encode_sparse_response, hash_filter, tree_hash};
use mkit_transport_http::HttpTransport;
use mockito::{Matcher, Server};

fn entry(name: &[u8]) -> TreeEntry {
    TreeEntry {
        name: name.to_vec(),
        mode: EntryMode::Blob,
        object_hash: [0u8; 32],
    }
}

fn tree_for(names: &[&[u8]]) -> Tree {
    Tree {
        entries: names.iter().copied().map(entry).collect(),
    }
}

fn make_transport(server: &Server) -> HttpTransport {
    // `HttpTransport::connect` parses the `mkit+http://` form and
    // validates loopback for plain http; mockito always binds on
    // 127.0.0.1, so this is the production code path.
    let url = format!("mkit+{}/myproj", server.url());
    HttpTransport::connect(&url).expect("connect to mockito")
}

fn sparse_path(tree: &Hash) -> String {
    format!("/myproj/trees/{}/sparse", to_hex(tree))
}

#[test]
fn http_sparse_fetch_round_trip_verifies() {
    let tree = tree_for(&[b"a", b"b", b"c"]);
    let th = tree_hash(&tree);
    let filter = vec![PathBuf::from("a")];
    let fh = hash_filter(&filter);

    // Server-side: build the sparse response just like the
    // Cloudflare Worker reference impl would.
    let response = build_sparse(&tree, &filter).unwrap();
    let body = encode_sparse_response(&response).unwrap();

    let mut server = Server::new();
    let path = sparse_path(&th);
    let query = format!("sparse={}", to_hex(&fh));
    let _m = server
        .mock("POST", path.as_str())
        .match_query(Matcher::Exact(query))
        .match_header("content-type", "application/json")
        .with_status(200)
        .with_header("content-type", "application/x-mkit-sparse")
        .with_body(body)
        .create();

    let tx = make_transport(&server);
    let resp = tx
        .fetch_sparse_tree(&th, &filter)
        .expect("HTTP sparse fetch must succeed");

    // The transport returns the selection derived from the verified witness.
    assert_eq!(resp.manifest.tree_hash, th);
    assert_eq!(resp.manifest.filter_hash, fh);
    assert_eq!(resp.entries.len(), 1);
    assert_eq!(resp.entries[0].name, b"a");
}

#[test]
fn http_sparse_fetch_rejects_tampered_witness() {
    let tree = tree_for(&[b"a", b"b", b"c"]);
    let th = tree_hash(&tree);
    let filter = vec![PathBuf::from("a")];

    // Alter the encoded witness; the transport must reject it.
    let response = build_sparse(&tree, &filter).unwrap();
    let mut body = encode_sparse_response(&response).unwrap();

    body[73] ^= 2;
    let mut server = Server::new();
    let path = sparse_path(&th);
    let _m = server
        .mock("POST", path.as_str())
        .match_query(Matcher::Any)
        .with_status(200)
        .with_header("content-type", "application/x-mkit-sparse")
        .with_body(body)
        .create();

    let tx = make_transport(&server);
    // Decode and requested-root verification reject the altered witness.
    assert!(tx.fetch_sparse_tree(&th, &filter).is_err());
}

#[test]
fn http_sparse_fetch_404_is_pack_not_found() {
    let tree = tree_for(&[b"a"]);
    let th = tree_hash(&tree);
    let filter = vec![PathBuf::from("a")];

    let mut server = Server::new();
    let _m = server
        .mock("POST", sparse_path(&th).as_str())
        .match_query(Matcher::Any)
        .with_status(404)
        .create();

    let tx = make_transport(&server);
    let err = tx.fetch_sparse_tree(&th, &filter).unwrap_err();
    assert!(
        matches!(err, mkit_core::protocol::TransportError::PackNotFound),
        "404 must surface as PackNotFound, got {err:?}"
    );
}

#[test]
fn http_sparse_fetch_garbage_body_is_invalid_response() {
    let tree = tree_for(&[b"a"]);
    let th = tree_hash(&tree);
    let filter = vec![PathBuf::from("a")];

    let mut server = Server::new();
    let _m = server
        .mock("POST", sparse_path(&th).as_str())
        .match_query(Matcher::Any)
        .with_status(200)
        .with_body(b"this is not a sparse envelope")
        .create();

    let tx = make_transport(&server);
    let err = tx.fetch_sparse_tree(&th, &filter).unwrap_err();
    assert!(
        matches!(err, mkit_core::protocol::TransportError::InvalidResponse),
        "bad envelope must surface as InvalidResponse, got {err:?}"
    );
}