104 lines
4.4 KiB
TypeScript
104 lines
4.4 KiB
TypeScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { generateKeyPairSync } from 'node:crypto';
|
|
import {
|
|
assertRegisteredTrustedManifestSigner,
|
|
parseTrustedManifestSignerRegistry,
|
|
resolveTrustedManifestSigner,
|
|
} from './trusted-signer-registry.js';
|
|
|
|
const COMMIT = 'd'.repeat(40);
|
|
const SOURCE = {
|
|
repositoryId: 'REPO-012',
|
|
sourceCommit: COMMIT,
|
|
sourceUrl: 'https://guanghulab.com/code/bingshuo/guanghu-ice-heart',
|
|
} as const;
|
|
const publicKeyPem = generateKeyPairSync('ed25519').publicKey
|
|
.export({ format: 'pem', type: 'spki' }).toString();
|
|
|
|
function registry(signers: unknown[] = []) {
|
|
return {
|
|
registryId: 'GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001',
|
|
schema: 'gh-aios.trusted-domain-manifest-signers/v1',
|
|
signers,
|
|
state: 'CURRENT',
|
|
version: '1.0.0',
|
|
};
|
|
}
|
|
|
|
function signer(overrides: Record<string, unknown> = {}) {
|
|
return {
|
|
algorithm: 'Ed25519',
|
|
domainIds: ['DOM-FIFTH-0001'],
|
|
publicKeyPem,
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
status: 'ACTIVE',
|
|
...overrides,
|
|
};
|
|
}
|
|
|
|
test('an empty current registry is safe and trusts no signer', () => {
|
|
const parsed = parseTrustedManifestSignerRegistry(registry(), SOURCE);
|
|
assert.equal(parsed.signers.length, 0);
|
|
assert.equal(resolveTrustedManifestSigner(parsed, {
|
|
domainId: 'DOM-FIFTH-0001',
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
}), null);
|
|
});
|
|
|
|
test('an active Ed25519 SPKI signer resolves only for its exact domain and repository', () => {
|
|
const parsed = parseTrustedManifestSignerRegistry(registry([signer()]), SOURCE);
|
|
const trusted = resolveTrustedManifestSigner(parsed, {
|
|
domainId: 'DOM-FIFTH-0001',
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
});
|
|
assert.ok(trusted);
|
|
assert.equal(assertRegisteredTrustedManifestSigner(trusted), trusted);
|
|
assert.equal(resolveTrustedManifestSigner(parsed, {
|
|
domainId: 'DOMAIN-OTHER',
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
}), null);
|
|
});
|
|
|
|
test('copied signer fields do not cross the parsed-registry trust boundary', () => {
|
|
const parsed = parseTrustedManifestSignerRegistry(registry([signer()]), SOURCE);
|
|
const trusted = resolveTrustedManifestSigner(parsed, {
|
|
domainId: 'DOM-FIFTH-0001',
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
});
|
|
assert.ok(trusted);
|
|
assert.throws(() => assertRegisteredTrustedManifestSigner({ ...trusted }), /trusted_manifest_signer_unregistered/);
|
|
});
|
|
|
|
test('revoked signers stay parseable for history but never resolve', () => {
|
|
const parsed = parseTrustedManifestSignerRegistry(registry([signer({ status: 'REVOKED' })]), SOURCE);
|
|
assert.equal(resolveTrustedManifestSigner(parsed, {
|
|
domainId: 'DOM-FIFTH-0001',
|
|
repositoryId: 'REPO-014',
|
|
signerId: 'GH-LIGHTHOUSE-001',
|
|
}), null);
|
|
});
|
|
|
|
test('duplicates, unknown fields and unsupported algorithms fail closed', () => {
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer(), signer()]), SOURCE), /trusted_signer_registry_invalid/);
|
|
assert.throws(() => parseTrustedManifestSignerRegistry({ ...registry(), extra: true }, SOURCE), /trusted_signer_registry_invalid/);
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ algorithm: 'RSA' })]), SOURCE), /trusted_signer_registry_invalid/);
|
|
});
|
|
|
|
test('private keys and malformed public keys fail closed', () => {
|
|
const privateKeyPem = generateKeyPairSync('ed25519').privateKey
|
|
.export({ format: 'pem', type: 'pkcs8' }).toString();
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ publicKeyPem: privateKeyPem })]), SOURCE), /trusted_signer_registry_invalid/);
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry([signer({ publicKeyPem: 'not-a-key' })]), SOURCE), /trusted_signer_registry_invalid/);
|
|
});
|
|
|
|
test('registry source provenance requires exact Guanghu HTTPS and a full commit', () => {
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceCommit: 'short' }), /trusted_signer_registry_source_invalid/);
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceUrl: 'https://example.com/registry.json' }), /trusted_signer_registry_source_invalid/);
|
|
assert.throws(() => parseTrustedManifestSignerRegistry(registry(), { ...SOURCE, sourceUrl: 'https://user:pass@guanghulab.com/registry.json' }), /trusted_signer_registry_source_invalid/);
|
|
});
|