core/test/dever-cli-tests/release_source.rs

use super::super::release::Artifact;
use super::*;
use sha2::{Digest, Sha256};

fn manifest() -> ReleaseManifest {
    ReleaseManifest::new(
        Version::parse("1.2.3").unwrap(),
        vec![Artifact {
            path: "dever-core".into(),
            bytes: 4,
            sha256: super::super::release::hex(&Sha256::digest(b"core")),
        }],
    )
}

fn archive(entries: &[(&str, &[u8])]) -> Vec<u8> {
    let mut archive = tar::Builder::new(Vec::new());
    for (name, contents) in entries {
        let mut header = tar::Header::new_ustar();
        header.set_size(contents.len() as u64);
        header.set_mode(0o644);
        header.set_cksum();
        archive.append_data(&mut header, name, *contents).unwrap();
    }
    archive.into_inner().unwrap()
}

#[test]
fn release_archive_accepts_only_the_exact_signed_regular_files() {
    let root = Download::new(&std::env::temp_dir()).unwrap();
    unpack(
        archive(&[("dever-core", b"core")]).as_slice(),
        &root.0,
        &manifest(),
    )
    .unwrap();
    assert_eq!(fs::read(root.0.join("dever-core")).unwrap(), b"core");
    for entries in [
        vec![
            ("dever-core", b"core".as_slice()),
            ("extra", b"x".as_slice()),
        ],
        vec![
            ("dever-core", b"core".as_slice()),
            ("dever-core", b"core".as_slice()),
        ],
        vec![("dever-core", b"bad".as_slice())],
        vec![],
    ] {
        let root = Download::new(&std::env::temp_dir()).unwrap();
        assert!(unpack(archive(&entries).as_slice(), &root.0, &manifest()).is_err());
    }
}

#[test]
fn release_archive_rejects_links_and_extension_headers() {
    for kind in [
        tar::EntryType::Symlink,
        tar::EntryType::Link,
        tar::EntryType::XGlobalHeader,
    ] {
        let root = Download::new(&std::env::temp_dir()).unwrap();
        let mut archive = tar::Builder::new(Vec::new());
        let mut header = tar::Header::new_ustar();
        header.set_path("dever-core").unwrap();
        header.set_entry_type(kind);
        header.set_size(0);
        header.set_mode(0o644);
        header.set_link_name("/outside").unwrap();
        header.set_cksum();
        archive.append(&header, io::empty()).unwrap();
        assert!(
            unpack(
                archive.into_inner().unwrap().as_slice(),
                &root.0,
                &manifest()
            )
            .is_err()
        );
        assert!(!root.0.join("dever-core").exists());
    }
}

#[test]
fn signed_catalog_paths_and_total_size_are_bounded_before_extraction() {
    for path in [
        "/absolute",
        "../outside",
        "a/../b",
        "./file",
        "a//b",
        "a\\b",
        "C:drive",
        "manifest.json",
        "manifest.sig",
    ] {
        let mut manifest = manifest();
        manifest.artifacts[0].path = path.into();
        assert!(validate_catalog(&manifest).is_err(), "{path}");
    }
    let mut excessive = manifest();
    excessive.artifacts[0].bytes = RELEASE_LIMIT + 1;
    assert!(validate_catalog(&excessive).is_err());
    let mut duplicate = manifest();
    duplicate.artifacts.push(duplicate.artifacts[0].clone());
    assert!(validate_catalog(&duplicate).is_err());
}

#[test]
fn official_redirects_reject_http_credentials_ports_and_foreign_hosts() {
    let current = "https://github.com/shemic/dever-main/releases/latest/download/a";
    assert!(
        redirect(
            current,
            "https://release-assets.githubusercontent.com/asset?token=opaque"
        )
        .is_ok()
    );
    assert!(redirect(current, "/shemic/dever-main/releases/download/v1.2.3/a").is_ok());
    for address in [
        "http://github.com/a",
        "https://evil.example/a",
        "https://github.com.evil.example/a",
        "https://user@github.com/a",
        "https://github.com:444/a",
        "https://github.com/a#fragment",
    ] {
        assert!(redirect(current, address).is_err(), "{address}");
    }
}

#[test]
fn official_asset_names_are_versioned_and_platform_specific() {
    let source = ReleaseSource::official();
    assert_eq!(
        source.asset("latest", "manifest.json"),
        format!(
            "{OFFICIAL_RELEASES}/latest/download/dever-{}.manifest.json",
            platform_identity()
        )
    );
    assert_eq!(
        source.asset("1.2.3", "tar.gz"),
        format!(
            "{OFFICIAL_RELEASES}/download/v1.2.3/dever-{}.tar.gz",
            platform_identity()
        )
    );
}

fn signed_release() -> (ReleaseManifest, Vec<u8>, Vec<u8>, Vec<u8>) {
    use ring::signature::{Ed25519KeyPair, KeyPair};
    let pair = Ed25519KeyPair::from_seed_unchecked(&[37; 32]).unwrap();
    let mut manifest = manifest();
    manifest.artifacts.push(Artifact {
        path: "skills/dever-language/SKILL.md".into(),
        bytes: 5,
        sha256: super::super::release::hex(&Sha256::digest(b"skill")),
    });
    let bytes = serde_json::to_vec(&manifest).unwrap();
    let signature = super::super::release::hex(pair.sign(&bytes).as_ref()).into_bytes();
    (
        manifest,
        bytes,
        signature,
        pair.public_key().as_ref().to_vec(),
    )
}

fn server(responses: Vec<Vec<u8>>) -> (ReleaseSource, std::thread::JoinHandle<()>) {
    use std::io::BufRead;
    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
    listener.set_nonblocking(true).unwrap();
    let base = format!("http://{}/releases", listener.local_addr().unwrap());
    let worker = std::thread::spawn(move || {
        let deadline = Instant::now() + Duration::from_secs(5);
        for response in responses {
            let mut stream = loop {
                match listener.accept() {
                    Ok((stream, _)) => break stream,
                    Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
                        assert!(
                            Instant::now() < deadline,
                            "expected release request did not arrive"
                        );
                        std::thread::sleep(Duration::from_millis(5));
                    }
                    Err(error) => panic!("{error}"),
                }
            };
            stream
                .set_read_timeout(Some(Duration::from_secs(2)))
                .unwrap();
            let mut reader = io::BufReader::new(stream.try_clone().unwrap());
            let mut request = String::new();
            reader.read_line(&mut request).unwrap();
            assert!(request.starts_with("GET /releases/"));
            loop {
                let mut line = String::new();
                reader.read_line(&mut line).unwrap();
                if line == "\r\n" {
                    break;
                }
            }
            write!(
                stream,
                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
                response.len()
            )
            .unwrap();
            stream.write_all(&response).unwrap();
        }
    });
    (ReleaseSource::new(base), worker)
}

fn compressed_release(core: &[u8]) -> Vec<u8> {
    let bytes = archive(&[
        ("dever-core", core),
        ("skills/dever-language/SKILL.md", b"skill"),
    ]);
    let mut gzip = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::fast());
    gzip.write_all(&bytes).unwrap();
    gzip.finish().unwrap()
}

#[test]
fn explicit_download_verifies_the_complete_bundle_before_publishing_catalog() {
    let root = Download::new(&std::env::temp_dir()).unwrap();
    let layout = Layout::new(root.0.join("machine"));
    layout.initialize().unwrap();
    let (manifest, bytes, signature, key) = signed_release();
    fs::write(
        layout.state().join("trusted-release-key"),
        super::super::release::hex(&key),
    )
    .unwrap();
    let (source, worker) = server(vec![bytes, signature, compressed_release(b"core")]);
    let version = prepare_from(&layout, "latest", &source).unwrap();
    worker.join().unwrap();
    assert_eq!(version, manifest.version);
    let installed = layout.downloads().join(version.as_str());
    MachineManager::verify_package(&installed, Some(&version), &key).unwrap();
    assert_eq!(
        fs::read(installed.join("skills/dever-language/SKILL.md")).unwrap(),
        b"skill"
    );
    assert_eq!(
        fs::read_to_string(layout.downloads().join("latest")).unwrap(),
        "1.2.3\n"
    );
    assert_eq!(fs::read_dir(layout.staging()).unwrap().count(), 0);
}

#[test]
fn bad_signatures_and_corrupt_payloads_preserve_the_previous_catalog_and_active_version() {
    for bad_signature in [true, false] {
        let root = Download::new(&std::env::temp_dir()).unwrap();
        let layout = Layout::new(root.0.join("machine"));
        layout.initialize().unwrap();
        let (_, bytes, signature, key) = signed_release();
        fs::write(
            layout.state().join("trusted-release-key"),
            super::super::release::hex(&key),
        )
        .unwrap();
        fs::write(layout.downloads().join("latest"), "0.9.0\n").unwrap();
        let active = layout.state().join("active-version");
        super::super::release::append_active_version(&active, &Version::parse("0.9.0").unwrap())
            .unwrap();
        let previous = fs::read(&active).unwrap();
        let responses = if bad_signature {
            vec![bytes, vec![b'0'; 128]]
        } else {
            vec![bytes, signature, compressed_release(b"evil")]
        };
        let (source, worker) = server(responses);
        let error = prepare_from(&layout, "latest", &source).unwrap_err();
        worker.join().unwrap();
        assert!(error.contains("verification"), "{error}");
        assert_eq!(fs::read(&active).unwrap(), previous);
        assert_eq!(
            fs::read_to_string(layout.downloads().join("latest")).unwrap(),
            "0.9.0\n"
        );
        assert!(!layout.downloads().join("1.2.3").exists());
        assert_eq!(fs::read_dir(layout.staging()).unwrap().count(), 0);
    }
}