packslip 1.9.0

A vendor-neutral signed release manifest: what shipped, and how to verify it
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

//! The distribution verifier works without any publishing features.

use std::process::Command;

fn run(args: &[&str]) -> std::process::Output {
    Command::new(env!("CARGO_BIN_EXE_packslip"))
        .args(args)
        .output()
        .unwrap()
}

#[test]
fn commands_follow_enabled_features() {
    let output = run(&["usage"]);
    assert!(output.status.success());
    let spec = String::from_utf8(output.stdout).unwrap();
    for command in ["verify", "pin", "show", "completion", "version"] {
        assert!(spec.contains(&format!("cmd {command}")), "{spec}");
    }
    for (command, enabled) in [
        (
            "create",
            cfg!(all(feature = "create", feature = "manifest")),
        ),
        (
            "releases",
            cfg!(all(feature = "create", feature = "manifest")),
        ),
        ("keygen", cfg!(feature = "sign")),
        ("schema", cfg!(feature = "schema")),
        ("install", cfg!(feature = "install-cli")),
    ] {
        assert_eq!(spec.contains(&format!("cmd {command}")), enabled, "{spec}");
    }
}

#[test]
fn verifier_checks_real_historical_bundle_and_repository_pin() {
    let bundle = concat!(
        env!("CARGO_MANIFEST_DIR"),
        "/tests/fixtures/hk-v2.3.0.sigstore.json"
    );
    let output = run(&[
        "verify",
        bundle,
        "--pin",
        "ps1_snirenkjwr7m5ozgcufameodnm",
        "--json",
    ]);
    assert!(
        output.status.success(),
        "{}",
        String::from_utf8_lossy(&output.stderr)
    );
    let report: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
    assert_eq!(report["project"], "github.com/jdx/hk");
    assert_eq!(report["version"], "2.3.0");
    let output = run(&["verify", bundle, "--pin", "ps1_aaaaaaaaaaaaaaaaaaaaaaaaaa"]);
    assert!(!output.status.success());
}

#[test]
fn publishing_commands_follow_their_features() {
    let dir = tempfile::tempdir().unwrap();
    for (command, enabled) in [
        (
            "create",
            cfg!(all(feature = "create", feature = "manifest")),
        ),
        (
            "releases",
            cfg!(all(feature = "create", feature = "manifest")),
        ),
        ("keygen", cfg!(feature = "sign")),
    ] {
        if !enabled {
            let output = Command::new(env!("CARGO_BIN_EXE_packslip"))
                .arg(command)
                .current_dir(dir.path())
                .output()
                .unwrap();
            assert!(!output.status.success(), "{command} unexpectedly available");
        }
    }
}

#[test]
fn pin_and_show_work_without_publishing() {
    let bundle = concat!(
        env!("CARGO_MANIFEST_DIR"),
        "/tests/fixtures/hk-v2.3.0.sigstore.json"
    );
    let output = run(&["pin", bundle]);
    assert!(
        output.status.success(),
        "{}",
        String::from_utf8_lossy(&output.stderr)
    );
    assert_eq!(
        String::from_utf8(output.stdout).unwrap().trim(),
        "ps1_snirenkjwr7m5ozgcufameodnm"
    );
    let output = run(&["show", bundle]);
    assert!(output.status.success());
    let document: serde_json::Value = serde_json::from_slice(&output.stdout).unwrap();
    assert_eq!(document["predicate"]["project"], "github.com/jdx/hk");
}