feat: add deployment foundation and cross-device handoff

internal/aptrepo/signature_linux_test.go

@@ -0,0 +1,105 @@
+package aptrepo
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"server-deploy/internal/installplan"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestStagingRejectsLinksAndFIFO(t *testing.T) {
+	dir := t.TempDir()
+	for _, name := range []string{"docker.asc", "Release", "Release.gpg", "Packages"} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte("metadata"), 0600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	link := filepath.Join(t.TempDir(), "link")
+	if err := os.Symlink(dir, link); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readStaging(link + "/"); err == nil {
+		t.Fatal("root symlink accepted")
+	}
+	if err := os.Remove(filepath.Join(dir, "Release")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(filepath.Join(dir, "Packages"), filepath.Join(dir, "Release")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readStaging(dir); err == nil {
+		t.Fatal("file symlink accepted")
+	}
+	if err := os.Remove(filepath.Join(dir, "Release")); err != nil {
+		t.Fatal(err)
+	}
+	if err := syscall.Mkfifo(filepath.Join(dir, "Release"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readStaging(dir); err == nil {
+		t.Fatal("FIFO accepted")
+	}
+}
+
+func TestGPGFailureRedactsDiagnostics(t *testing.T) {
+	if _, err := runGPG(t.TempDir(), "/nonexistent/signature-tool-secret"); err == nil || err.Error() != "repository signature tool failed" {
+		t.Fatal("unredacted or absent error", err)
+	}
+}
+
+func TestOutputBound(t *testing.T) {
+	var b cappedOutput
+	if _, err := b.Write(make([]byte, 65536)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.Write([]byte{1}); err == nil {
+		t.Fatal("output limit missing")
+	}
+	if b.Len() != 65536 {
+		t.Fatal("buffer grew beyond limit")
+	}
+}
+
+func TestStagedSignatureIntegration(t *testing.T) {
+	// Explicit opt-in public fixture, downloaded by the metadata-only probe.
+	dir := os.Getenv("DEPLOYCTL_REPOSITORY_FIXTURE")
+	if dir == "" {
+		t.Skip("public signed fixture not supplied; run repository probe for real signature evidence")
+	}
+	files, err := readStaging(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := authenticate(files, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	// Result comes from the successful real CLI invocation. Recheck the exact
+	// fixture versions before making a semantically valid signature mutation.
+	var response struct {
+		Lock installplan.Lock `json:"lock"`
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, "result.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = json.Unmarshal(raw, &response); err != nil {
+		t.Fatal(err)
+	}
+	versions := make(map[string]string)
+	for _, p := range response.Lock.Packages {
+		versions[p.Name] = p.Version
+	}
+	// Unknown Release extension remains valid metadata; only its signature
+	// should reject it. This catches a bypass hidden by syntax failures.
+	files["Release"] = append(bytes.TrimRight(files["Release"], "\n"), []byte("\nX-Verification-Probe: changed\n")...)
+	if _, err := Resolve(files["Release"], files["Packages"], response.Lock.Suite, response.Lock.Architecture, versions, time.Now()); err != nil {
+		t.Fatal("mutation masked by metadata rejection", err)
+	}
+	if err := authenticate(files, time.Now()); err == nil {
+		t.Fatal("tampered signature accepted")
+	}
+}