| 1 | import assert from "node:assert/strict"; |
| 2 | import { createHash } from "node:crypto"; |
| 3 | import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; |
| 4 | import { tmpdir } from "node:os"; |
| 5 | import path from "node:path"; |
| 6 | import test from "node:test"; |
| 7 | import { verifyArchive } from "./verify-release-artifact-archive.mjs"; |
| 8 | |
| 9 | test("verifies the exact downloaded archive against GitHub artifact metadata", async t => { |
| 10 | const dir = mkdtempSync(path.join(tmpdir(), "reasonix-artifact-digest-")); |
| 11 | t.after(() => rmSync(dir, { recursive: true, force: true })); |
| 12 | const archive = path.join(dir, "payload.zip"); |
| 13 | writeFileSync(archive, "archive bytes"); |
| 14 | const artifact = { id: 42, expired: false, digest: `sha256:${createHash("sha256").update("archive bytes").digest("hex")}` }; |
| 15 | assert.equal(await verifyArchive(artifact, archive), artifact.digest); |
| 16 | writeFileSync(archive, "substituted"); |
| 17 | await assert.rejects(verifyArchive(artifact, archive), /digest mismatch/); |
| 18 | await assert.rejects(verifyArchive({ ...artifact, digest: undefined }, archive), /trustworthy/); |
| 19 | await assert.rejects(verifyArchive({ ...artifact, expired: true }, archive), /trustworthy/); |
| 20 | }); |
| 21 |