Initial Dever 0.0.1

test/rust/native/dependency/library/mod.rs

@@ -0,0 +1,182 @@
+//! 自有签名、归档和 Lib 输入验证；不连接生产 deverd 或修改机器缓存。
+
+mod central;
+mod pep517;
+mod pep517_fixture;
+mod python;
+mod python_fixture;
+
+use super::{Fixture, fixture::digest, write};
+use dever::compiler::project::dependency::{
+    library::{Spec, archive},
+    worker::signed::SignedResources,
+};
+use ring::signature::{Ed25519KeyPair, KeyPair};
+use std::io::Write;
+
+#[test]
+fn lib_identities_normalize_extras_and_reject_ranges_and_path_injection() {
+    assert_eq!(
+        "pip:Some_Name[TEST,docs]@1.2.3"
+            .parse::<Spec>()
+            .unwrap()
+            .key(),
+        "pip:some-name[docs,test]@1.2.3"
+    );
+    assert_eq!(
+        "go:example.org/widget@v1.2.3"
+            .parse::<Spec>()
+            .unwrap()
+            .version,
+        "1.2.3"
+    );
+    assert_eq!(
+        "npm:@scope/name@1.2.3".parse::<Spec>().unwrap().name,
+        "@scope/name"
+    );
+    for value in [
+        "npm:thing@^1",
+        "npm:../thing@1.2.3",
+        "pip:thing[]@1",
+        "pip:thing@>=1",
+        "go:../thing@1.2.3",
+        "npm:@scope/../thing@1.2.3",
+    ] {
+        assert!(value.parse::<Spec>().is_err(), "accepted {value}");
+    }
+}
+
+#[test]
+fn installed_resources_require_independent_signature_and_exact_catalog_bytes() {
+    let fixture = Fixture::new(&[]);
+    let root = fixture.directory.0.join("installation");
+    let key = Ed25519KeyPair::from_seed_unchecked(&[91; 32]).unwrap();
+    let hex = |bytes: &[u8]| {
+        bytes
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect::<String>()
+    };
+    write(
+        &root,
+        "state/trusted-release-key",
+        hex(key.public_key().as_ref()),
+    );
+    let bytes = b"signed fixture contents";
+    let path = "runtime/npm/linux-x86_64/runtime.pack";
+    let target = dever::compiler::toolchain::BuildTarget::host().unwrap();
+    let catalog = serde_json::to_vec(&serde_json::json!({"format":"dever-release-v2","version":"0.0.1","platform":target.name(),"artifacts":[{"path":"base.txt","bytes":bytes.len(),"sha256":digest(bytes)}],"extensions":[{"kind":{"type":"runtime","ecosystem":"npm"},"target":"linux-x86_64","artifacts":[{"path":path,"bytes":bytes.len(),"sha256":digest(bytes)}]}]})).unwrap();
+    write(&root, "versions/0.0.1/base.txt", bytes);
+    write(&root, "versions/0.0.1/manifest.json", &catalog);
+    write(
+        &root,
+        "versions/0.0.1/manifest.sig",
+        hex(key.sign(&catalog).as_ref()),
+    );
+    let signed = SignedResources::load(&root, "0.0.1").unwrap();
+    assert_eq!(signed.read("base.txt").unwrap(), bytes);
+    let actual = signed.read_with(path, |version, catalog_hash, extension, artifact| {
+        assert_eq!(version, "0.0.1");
+        assert_eq!(catalog_hash, digest(&catalog));
+        assert_eq!(extension, &serde_json::json!({"kind":{"type":"runtime","ecosystem":"npm"},"target":"linux-x86_64"}));
+        assert_eq!(artifact.path, path);
+        Ok(bytes.to_vec())
+    }).unwrap();
+    assert_eq!(actual, bytes);
+    assert!(
+        signed
+            .read_with(path, |_, _, _, _| Ok(b"changed".to_vec()))
+            .is_err()
+    );
+    write(&root, "versions/0.0.1/base.txt", b"different signed file");
+    assert!(signed.read("base.txt").is_err());
+    write(&root, "versions/0.0.1/manifest.json", b"{}");
+    assert!(SignedResources::load(&root, "0.0.1").is_err());
+}
+
+#[test]
+fn archive_consumption_rejects_links_and_file_directory_collisions() {
+    let make = |entries: &[(&str, &[u8], tar::EntryType)]| {
+        let gzip = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::fast());
+        let mut archive = tar::Builder::new(gzip);
+        for (path, bytes, kind) in entries {
+            let mut header = tar::Header::new_gnu();
+            header.set_entry_type(*kind);
+            header.set_size(bytes.len() as u64);
+            header.set_mode(0o755);
+            header.set_cksum();
+            archive.append_data(&mut header, path, *bytes).unwrap();
+        }
+        archive.into_inner().unwrap().finish().unwrap()
+    };
+    let bytes = make(&[(
+        "package/main.js",
+        b"export const value = 42;",
+        tar::EntryType::Regular,
+    )]);
+    assert_eq!(archive::files(&bytes, false).unwrap().len(), 1);
+    assert!(archive::entries(&bytes, false).unwrap()["package/main.js"].1);
+    let bytes = make(&[("package/main.js", b"", tar::EntryType::Symlink)]);
+    assert!(archive::files(&bytes, false).unwrap_err().contains("links"));
+    let bytes = make(&[
+        ("package", b"not a directory", tar::EntryType::Regular),
+        ("package/main.js", b"", tar::EntryType::Regular),
+    ]);
+    assert!(
+        archive::files(&bytes, false)
+            .unwrap_err()
+            .contains("collision")
+    );
+    let mut zip = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    zip.start_file("../escape", zip::write::SimpleFileOptions::default())
+        .unwrap();
+    zip.write_all(b"bad").unwrap();
+    assert!(archive::files(&zip.finish().unwrap().into_inner(), true).is_err());
+}
+
+#[test]
+fn lib_zip_rejects_duplicate_central_paths() {
+    let mut zip = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    for name in ["package/first", "package/other"] {
+        zip.start_file(
+            name,
+            zip::write::SimpleFileOptions::default().unix_permissions(0o755),
+        )
+        .unwrap();
+        zip.write_all(name.as_bytes()).unwrap();
+    }
+    let mut bytes = zip.finish().unwrap().into_inner();
+    let files = archive::entries(&bytes, true).unwrap();
+    assert_eq!(files.len(), 2);
+    assert!(files["package/first"].1);
+    let mut cursor = 0;
+    while cursor + 5 <= bytes.len() {
+        if &bytes[cursor..cursor + 5] == b"other" {
+            bytes[cursor..cursor + 5].copy_from_slice(b"first");
+        }
+        cursor += 1;
+    }
+    assert!(
+        archive::entries(&bytes, true)
+            .unwrap_err()
+            .contains("duplicate or inconsistent")
+    );
+}
+
+#[test]
+fn python_wheel_identity_abi_and_dependency_edges_are_checked_before_installation() {
+    let bytes = python_fixture::wheel("tiny", "1.0.0", "");
+    let lib = serde_json::from_value(serde_json::json!({"spec":{"ecosystem":"pip","name":"tiny","version":"1.0.0"},"dependencies":[],"runtime":{"name":"python","version":"3.12.1","sha256":"0".repeat(64)},"artifacts":[],"schema":"pypi-wheel-v1"})).unwrap();
+    let markers = serde_json::json!({"implementation_name":"cpython","implementation_version":"3.12.1","os_name":"posix","platform_machine":"x86_64","platform_python_implementation":"CPython","platform_release":"","platform_system":"Linux","platform_version":"","python_full_version":"3.12.1","python_version":"3.12","sys_platform":"linux"});
+    let mut runtime = serde_json::from_value::<dever::compiler::project::dependency::library::runtime::Manifest>(serde_json::json!({"format":"dever-worker-runtime-v1","ecosystem":"pip","target":"linux-x86_64","executable":"bin/python3","arguments":["-I","-S","-B"],"python_wheel_tags":["py3-none-any"],"python_extension_suffixes":[".so"],"python_markers":markers})).unwrap();
+    let files =
+        dever::compiler::project::dependency::library::python::install(&lib, &bytes, &runtime, &[])
+            .unwrap();
+    assert_eq!(files["tiny/__init__.py"], b"VALUE = 42\n");
+    runtime.python_wheel_tags.clear();
+    assert!(
+        dever::compiler::project::dependency::library::python::install(&lib, &bytes, &runtime, &[])
+            .unwrap_err()
+            .contains("tags")
+    );
+}