| 1 | import assert from "node:assert/strict"; |
| 2 | import test from "node:test"; |
| 3 | import { fingerprintFiles, outsideSigningContract } from "./verify-candidate-signing-repair.mjs"; |
| 4 | |
| 5 | const original = `jobs:\n resolve:\n runs-on: ubuntu-latest\n signing-contract:\n steps:\n - run: original gate\n build:\n runs-on: macos-latest\n publish:\n runs-on: ubuntu-latest\n`; |
| 6 | |
| 7 | test("a control repair may change the signing gate but not build or publication", () => { |
| 8 | const repaired = original.replace("original gate", "verified candidate gate"); |
| 9 | assert.equal(outsideSigningContract(original), outsideSigningContract(repaired)); |
| 10 | assert.notEqual(outsideSigningContract(original), outsideSigningContract(repaired.replace("macos-latest", "windows-latest"))); |
| 11 | assert.throws(() => outsideSigningContract("jobs:\n signing-contract:\n"), /boundaries/); |
| 12 | }); |
| 13 | |
| 14 | test("the fingerprint file list must include the Desktop workflow", () => { |
| 15 | assert.deepEqual(fingerprintFiles("fingerprint_files:\n - .github/workflows/release-desktop.yml\n - scripts/sign-certum.ps1\n"), |
| 16 | [".github/workflows/release-desktop.yml", "scripts/sign-certum.ps1"]); |
| 17 | assert.throws(() => fingerprintFiles("fingerprint_files:\n - scripts/sign-certum.ps1\n"), /absent/); |
| 18 | }); |
| 19 |