Initial Dever 0.0.1

test/rust/dependency/go/proofs.rs

@@ -0,0 +1,74 @@
+//! 官方历史签名向量与目录哈希检查，独立于自签测试对端。
+
+use super::*;
+use base64::{Engine, engine::general_purpose::STANDARD};
+use std::io::{Cursor, Write};
+
+#[test]
+fn official_inclusion_and_consistency_vectors_reject_each_tampered_hash() {
+    let evidence: Evidence = serde_json::from_str(include_str!("sumdb_uuid.json")).unwrap();
+    let verified = evidence.verify(&Verifier::official()).unwrap();
+    assert!(verified.contains("github.com/google/uuid", "1.6.0"));
+    assert!(evidence.verify(&fixture::verifier()).is_err());
+    assert_eq!(
+        sumdb::mod_hash(b"module github.com/google/uuid\n"),
+        "h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo="
+    );
+    for index in 0..evidence.records[0].inclusion.len() {
+        let mut changed = evidence.clone();
+        changed.records[0].inclusion[index] = STANDARD.encode([0; 32]);
+        assert!(changed.verify(&Verifier::official()).is_err());
+    }
+    for index in 0..evidence.consistency.len() {
+        let mut changed = evidence.clone();
+        changed.consistency[index] = STANDARD.encode([0; 32]);
+        assert!(changed.verify(&Verifier::official()).is_err());
+    }
+    let mut changed = evidence.clone();
+    changed.records[0].go_mod.push_str("// tampered\n");
+    assert!(changed.verify(&Verifier::official()).is_err());
+    let mut changed = evidence.clone();
+    changed.checkpoint = changed.checkpoint.replace("go.sum", "no.sum");
+    assert!(changed.verify(&Verifier::official()).is_err());
+}
+
+#[test]
+fn hashzip_tracks_directory_names_but_not_compression_or_order() {
+    let archive = |reverse: bool, directory: bool| {
+        let mut zip = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        let mut names = vec!["value.go", "LICENSE"];
+        if reverse {
+            names.reverse();
+        }
+        for name in names {
+            zip.start_file(
+                format!("example.com/Mixed@v1.0.0/{name}"),
+                zip::write::SimpleFileOptions::default().compression_method(if reverse {
+                    zip::CompressionMethod::Deflated
+                } else {
+                    zip::CompressionMethod::Stored
+                }),
+            )
+            .unwrap();
+            zip.write_all(b"same bytes").unwrap();
+        }
+        if directory {
+            zip.add_directory(
+                "example.com/Mixed@v1.0.0/empty/",
+                zip::write::SimpleFileOptions::default(),
+            )
+            .unwrap();
+        }
+        zip.finish().unwrap().into_inner()
+    };
+    let first = sumdb::zip_hash("example.com/Mixed", "1.0.0", &archive(false, false)).unwrap();
+    assert_eq!(
+        first,
+        sumdb::zip_hash("example.com/Mixed", "1.0.0", &archive(true, false)).unwrap()
+    );
+    assert_ne!(
+        first,
+        sumdb::zip_hash("example.com/Mixed", "1.0.0", &archive(false, true)).unwrap()
+    );
+    assert!(sumdb::zip_hash("example.com/mixed", "1.0.0", &archive(false, false)).is_err());
+}