feat: publish Dever core with project scaffolding and versioned AI skills

test/dever-cli-tests/release_source.rs

@@ -0,0 +1,289 @@
+use super::super::release::Artifact;
+use super::*;
+use sha2::{Digest, Sha256};
+
+fn manifest() -> ReleaseManifest {
+    ReleaseManifest::new(
+        Version::parse("1.2.3").unwrap(),
+        vec![Artifact {
+            path: "dever-core".into(),
+            bytes: 4,
+            sha256: super::super::release::hex(&Sha256::digest(b"core")),
+        }],
+    )
+}
+
+fn archive(entries: &[(&str, &[u8])]) -> Vec<u8> {
+    let mut archive = tar::Builder::new(Vec::new());
+    for (name, contents) in entries {
+        let mut header = tar::Header::new_ustar();
+        header.set_size(contents.len() as u64);
+        header.set_mode(0o644);
+        header.set_cksum();
+        archive.append_data(&mut header, name, *contents).unwrap();
+    }
+    archive.into_inner().unwrap()
+}
+
+#[test]
+fn release_archive_accepts_only_the_exact_signed_regular_files() {
+    let root = Download::new(&std::env::temp_dir()).unwrap();
+    unpack(
+        archive(&[("dever-core", b"core")]).as_slice(),
+        &root.0,
+        &manifest(),
+    )
+    .unwrap();
+    assert_eq!(fs::read(root.0.join("dever-core")).unwrap(), b"core");
+    for entries in [
+        vec![
+            ("dever-core", b"core".as_slice()),
+            ("extra", b"x".as_slice()),
+        ],
+        vec![
+            ("dever-core", b"core".as_slice()),
+            ("dever-core", b"core".as_slice()),
+        ],
+        vec![("dever-core", b"bad".as_slice())],
+        vec![],
+    ] {
+        let root = Download::new(&std::env::temp_dir()).unwrap();
+        assert!(unpack(archive(&entries).as_slice(), &root.0, &manifest()).is_err());
+    }
+}
+
+#[test]
+fn release_archive_rejects_links_and_extension_headers() {
+    for kind in [
+        tar::EntryType::Symlink,
+        tar::EntryType::Link,
+        tar::EntryType::XGlobalHeader,
+    ] {
+        let root = Download::new(&std::env::temp_dir()).unwrap();
+        let mut archive = tar::Builder::new(Vec::new());
+        let mut header = tar::Header::new_ustar();
+        header.set_path("dever-core").unwrap();
+        header.set_entry_type(kind);
+        header.set_size(0);
+        header.set_mode(0o644);
+        header.set_link_name("/outside").unwrap();
+        header.set_cksum();
+        archive.append(&header, io::empty()).unwrap();
+        assert!(
+            unpack(
+                archive.into_inner().unwrap().as_slice(),
+                &root.0,
+                &manifest()
+            )
+            .is_err()
+        );
+        assert!(!root.0.join("dever-core").exists());
+    }
+}
+
+#[test]
+fn signed_catalog_paths_and_total_size_are_bounded_before_extraction() {
+    for path in [
+        "/absolute",
+        "../outside",
+        "a/../b",
+        "./file",
+        "a//b",
+        "a\\b",
+        "C:drive",
+        "manifest.json",
+        "manifest.sig",
+    ] {
+        let mut manifest = manifest();
+        manifest.artifacts[0].path = path.into();
+        assert!(validate_catalog(&manifest).is_err(), "{path}");
+    }
+    let mut excessive = manifest();
+    excessive.artifacts[0].bytes = RELEASE_LIMIT + 1;
+    assert!(validate_catalog(&excessive).is_err());
+    let mut duplicate = manifest();
+    duplicate.artifacts.push(duplicate.artifacts[0].clone());
+    assert!(validate_catalog(&duplicate).is_err());
+}
+
+#[test]
+fn official_redirects_reject_http_credentials_ports_and_foreign_hosts() {
+    let current = "https://github.com/shemic/dever-main/releases/latest/download/a";
+    assert!(
+        redirect(
+            current,
+            "https://release-assets.githubusercontent.com/asset?token=opaque"
+        )
+        .is_ok()
+    );
+    assert!(redirect(current, "/shemic/dever-main/releases/download/v1.2.3/a").is_ok());
+    for address in [
+        "http://github.com/a",
+        "https://evil.example/a",
+        "https://github.com.evil.example/a",
+        "https://user@github.com/a",
+        "https://github.com:444/a",
+        "https://github.com/a#fragment",
+    ] {
+        assert!(redirect(current, address).is_err(), "{address}");
+    }
+}
+
+#[test]
+fn official_asset_names_are_versioned_and_platform_specific() {
+    let source = ReleaseSource::official();
+    assert_eq!(
+        source.asset("latest", "manifest.json"),
+        format!(
+            "{OFFICIAL_RELEASES}/latest/download/dever-{}.manifest.json",
+            platform_identity()
+        )
+    );
+    assert_eq!(
+        source.asset("1.2.3", "tar.gz"),
+        format!(
+            "{OFFICIAL_RELEASES}/download/v1.2.3/dever-{}.tar.gz",
+            platform_identity()
+        )
+    );
+}
+
+fn signed_release() -> (ReleaseManifest, Vec<u8>, Vec<u8>, Vec<u8>) {
+    use ring::signature::{Ed25519KeyPair, KeyPair};
+    let pair = Ed25519KeyPair::from_seed_unchecked(&[37; 32]).unwrap();
+    let mut manifest = manifest();
+    manifest.artifacts.push(Artifact {
+        path: "skills/dever-language/SKILL.md".into(),
+        bytes: 5,
+        sha256: super::super::release::hex(&Sha256::digest(b"skill")),
+    });
+    let bytes = serde_json::to_vec(&manifest).unwrap();
+    let signature = super::super::release::hex(pair.sign(&bytes).as_ref()).into_bytes();
+    (
+        manifest,
+        bytes,
+        signature,
+        pair.public_key().as_ref().to_vec(),
+    )
+}
+
+fn server(responses: Vec<Vec<u8>>) -> (ReleaseSource, std::thread::JoinHandle<()>) {
+    use std::io::BufRead;
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    listener.set_nonblocking(true).unwrap();
+    let base = format!("http://{}/releases", listener.local_addr().unwrap());
+    let worker = std::thread::spawn(move || {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        for response in responses {
+            let mut stream = loop {
+                match listener.accept() {
+                    Ok((stream, _)) => break stream,
+                    Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
+                        assert!(
+                            Instant::now() < deadline,
+                            "expected release request did not arrive"
+                        );
+                        std::thread::sleep(Duration::from_millis(5));
+                    }
+                    Err(error) => panic!("{error}"),
+                }
+            };
+            stream
+                .set_read_timeout(Some(Duration::from_secs(2)))
+                .unwrap();
+            let mut reader = io::BufReader::new(stream.try_clone().unwrap());
+            let mut request = String::new();
+            reader.read_line(&mut request).unwrap();
+            assert!(request.starts_with("GET /releases/"));
+            loop {
+                let mut line = String::new();
+                reader.read_line(&mut line).unwrap();
+                if line == "\r\n" {
+                    break;
+                }
+            }
+            write!(
+                stream,
+                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                response.len()
+            )
+            .unwrap();
+            stream.write_all(&response).unwrap();
+        }
+    });
+    (ReleaseSource::new(base), worker)
+}
+
+fn compressed_release(core: &[u8]) -> Vec<u8> {
+    let bytes = archive(&[
+        ("dever-core", core),
+        ("skills/dever-language/SKILL.md", b"skill"),
+    ]);
+    let mut gzip = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::fast());
+    gzip.write_all(&bytes).unwrap();
+    gzip.finish().unwrap()
+}
+
+#[test]
+fn explicit_download_verifies_the_complete_bundle_before_publishing_catalog() {
+    let root = Download::new(&std::env::temp_dir()).unwrap();
+    let layout = Layout::new(root.0.join("machine"));
+    layout.initialize().unwrap();
+    let (manifest, bytes, signature, key) = signed_release();
+    fs::write(
+        layout.state().join("trusted-release-key"),
+        super::super::release::hex(&key),
+    )
+    .unwrap();
+    let (source, worker) = server(vec![bytes, signature, compressed_release(b"core")]);
+    let version = prepare_from(&layout, "latest", &source).unwrap();
+    worker.join().unwrap();
+    assert_eq!(version, manifest.version);
+    let installed = layout.downloads().join(version.as_str());
+    MachineManager::verify_package(&installed, Some(&version), &key).unwrap();
+    assert_eq!(
+        fs::read(installed.join("skills/dever-language/SKILL.md")).unwrap(),
+        b"skill"
+    );
+    assert_eq!(
+        fs::read_to_string(layout.downloads().join("latest")).unwrap(),
+        "1.2.3\n"
+    );
+    assert_eq!(fs::read_dir(layout.staging()).unwrap().count(), 0);
+}
+
+#[test]
+fn bad_signatures_and_corrupt_payloads_preserve_the_previous_catalog_and_active_version() {
+    for bad_signature in [true, false] {
+        let root = Download::new(&std::env::temp_dir()).unwrap();
+        let layout = Layout::new(root.0.join("machine"));
+        layout.initialize().unwrap();
+        let (_, bytes, signature, key) = signed_release();
+        fs::write(
+            layout.state().join("trusted-release-key"),
+            super::super::release::hex(&key),
+        )
+        .unwrap();
+        fs::write(layout.downloads().join("latest"), "0.9.0\n").unwrap();
+        let active = layout.state().join("active-version");
+        super::super::release::append_active_version(&active, &Version::parse("0.9.0").unwrap())
+            .unwrap();
+        let previous = fs::read(&active).unwrap();
+        let responses = if bad_signature {
+            vec![bytes, vec![b'0'; 128]]
+        } else {
+            vec![bytes, signature, compressed_release(b"evil")]
+        };
+        let (source, worker) = server(responses);
+        let error = prepare_from(&layout, "latest", &source).unwrap_err();
+        worker.join().unwrap();
+        assert!(error.contains("verification"), "{error}");
+        assert_eq!(fs::read(&active).unwrap(), previous);
+        assert_eq!(
+            fs::read_to_string(layout.downloads().join("latest")).unwrap(),
+            "0.9.0\n"
+        );
+        assert!(!layout.downloads().join("1.2.3").exists());
+        assert_eq!(fs::read_dir(layout.staging()).unwrap().count(), 0);
+    }
+}