lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

package_boundary.rs (2817B)

      1 const SERVICE_SOURCE: &str = include_str!("../src/service.rs");
      2 const SERVICE_ARTIFACT_SOURCE: &str = include_str!("../src/service_artifact.rs");
      3 const RESOLVER_SOURCE: &str = include_str!("../src/resolve.rs");
      4 const ROOT_SOURCE: &str = include_str!("../src/lib.rs");
      5 const SERVICE_FIXTURE: &str = include_str!("fixtures/hardened_service_targets.v1.toml");
      6 
      7 #[test]
      8 fn hardened_service_artifacts_are_closed_metadata_without_runtime_authority() {
      9     for forbidden in [
     10         "artifact_adapter",
     11         "default_channel",
     12         "[[runtime]]",
     13         "qualified",
     14     ] {
     15         assert!(
     16             !SERVICE_ARTIFACT_SOURCE.contains(forbidden) && !SERVICE_FIXTURE.contains(forbidden),
     17             "hardened service artifact metadata contains forbidden authority `{forbidden}`"
     18         );
     19     }
     20 
     21     for forbidden in [
     22         "std::fs",
     23         "std::process",
     24         "tokio",
     25         "hyper",
     26         "reqwest",
     27         "UnixListener",
     28         "TcpListener",
     29     ] {
     30         assert!(
     31             !SERVICE_SOURCE.contains(forbidden) && !SERVICE_ARTIFACT_SOURCE.contains(forbidden),
     32             "service metadata owns forbidden runtime behavior `{forbidden}`"
     33         );
     34     }
     35 
     36     for required in [
     37         "service_artifacts.myc",
     38         "service_artifacts.rhi",
     39         "binary.tar.gz",
     40         "artifact-manifest.v1.json",
     41         "SHA256SUMS",
     42         "service-source.tar.gz",
     43         "sbom.cdx.json",
     44         "provenance-input.v1.json",
     45     ] {
     46         assert!(SERVICE_FIXTURE.contains(required), "missing `{required}`");
     47     }
     48     assert!(ROOT_SOURCE.contains("mod service_artifact;"));
     49     assert!(!ROOT_SOURCE.contains("pub mod service_artifact;"));
     50 }
     51 
     52 #[test]
     53 fn contract_parser_is_bounded_before_toml_admission() {
     54     assert!(
     55         RESOLVER_SOURCE.contains("if raw.len() > RUNTIME_DISTRIBUTION_CONTRACT_MAX_UTF8_BYTES")
     56     );
     57     let bound = RESOLVER_SOURCE
     58         .find("if raw.len() > RUNTIME_DISTRIBUTION_CONTRACT_MAX_UTF8_BYTES")
     59         .expect("pre-parser bound");
     60     let parser = RESOLVER_SOURCE
     61         .find("toml::from_str::<RadrootsRuntimeDistributionContract>(raw)")
     62         .expect("TOML parser");
     63     assert!(
     64         bound < parser,
     65         "contract size must be checked before parsing"
     66     );
     67 }
     68 
     69 #[test]
     70 fn distribution_test_rows_use_only_neutral_fixture_identities() {
     71     for required in [
     72         "fixture-desktop-bundle",
     73         "fixture_desktop_bundle",
     74         "fixture-mobile-package",
     75         "fixture_mobile_package",
     76     ] {
     77         assert!(
     78             ROOT_SOURCE.contains(required),
     79             "missing `{required}` fixture"
     80         );
     81     }
     82 
     83     let retired_product_name = ["radroots_", "studio_app"].concat();
     84     assert!(
     85         !ROOT_SOURCE.contains(&retired_product_name),
     86         "active distribution source retained a retired product fixture"
     87     );
     88 }