58 lines
2.6 KiB
JavaScript
58 lines
2.6 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import { readFile } from 'node:fs/promises'
|
|
import test from 'node:test'
|
|
import { parseOfficialDshPolicy } from '../lib/contracts.mjs'
|
|
import { verifyOfficialDshCandidate } from '../stage0/lib/official-dsh.mjs'
|
|
import { officialDshPolicy, registryCandidate, registryKeyPair } from './helpers.mjs'
|
|
|
|
const candidate = {
|
|
schema: 1,
|
|
name: '@deepseek-ai/dsh',
|
|
version: '0.1.0-rc.7',
|
|
dist: {
|
|
integrity: 'sha512-ZceDCJ8FAywih+USW/OMk9jEhunlvJBGEz4kqrhau23hPzbciOazZrywH0nBRsaalSeAJ1JGBmjtw4OSjToStw==',
|
|
tarball: 'https://registry.npmjs.org/@deepseek-ai/dsh/-/dsh-0.1.0-rc.7.tgz',
|
|
signatures: [{
|
|
keyid: 'SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U',
|
|
sig: 'MEUCIQD2wLkZaghGyVZ5rWsOZdS2ue69pTRoGlnAEXvOk/zyOwIgRG6dOCTpAaSYCoYR7PXG6bB/O5ET57rGkBWJSVpvBkQ=',
|
|
}],
|
|
},
|
|
}
|
|
|
|
test('verifies the official npm Registry signature delegated by Stable metadata', async () => {
|
|
const policy = parseOfficialDshPolicy(JSON.parse(await readFile(
|
|
new URL('../../../release/official-dsh-policy.json', import.meta.url),
|
|
)))
|
|
assert.equal(verifyOfficialDshCandidate(candidate, candidate.version, policy).version, candidate.version)
|
|
assert.throws(() => verifyOfficialDshCandidate({
|
|
...candidate,
|
|
dist: { ...candidate.dist, integrity: candidate.dist.integrity.replace('Zce', 'Ace') },
|
|
}, candidate.version, policy), { code: 'TRUST_UNKNOWN_KEY' })
|
|
assert.throws(() => verifyOfficialDshCandidate(
|
|
candidate, candidate.version, { ...policy, keys: [] },
|
|
), { code: 'TRUST_UNKNOWN_KEY' })
|
|
})
|
|
|
|
test('accepts an exact requested version and rejects noncanonical npm tarball origins', async () => {
|
|
const policy = parseOfficialDshPolicy(JSON.parse(await readFile(
|
|
new URL('../../../release/official-dsh-policy.json', import.meta.url),
|
|
)))
|
|
assert.equal(verifyOfficialDshCandidate(candidate, candidate.version, policy).version, candidate.version)
|
|
assert.throws(() => verifyOfficialDshCandidate(candidate, '0.1.0-rc.8', policy), /different version/)
|
|
assert.throws(() => verifyOfficialDshCandidate({
|
|
...candidate,
|
|
dist: { ...candidate.dist, tarball: 'https://mirror.example/dsh.tgz' },
|
|
}, candidate.version, policy), /canonical/)
|
|
})
|
|
|
|
test('rejects candidates after a delegated npm Registry key expires', () => {
|
|
const registry = registryKeyPair()
|
|
const policy = parseOfficialDshPolicy(officialDshPolicy(registry, '2026-08-18T00:00:00.000Z'))
|
|
assert.throws(() => verifyOfficialDshCandidate(
|
|
registryCandidate(registry),
|
|
'0.1.0-rc.8',
|
|
policy,
|
|
new Date('2026-08-19T00:00:00.000Z'),
|
|
), { code: 'TRUST_UNKNOWN_KEY' })
|
|
})
|