Release Repro Tools 0.1.0

tests/browser/app.spec.ts

@@ -0,0 +1,59 @@
+import { expect, test } from "@playwright/test";
+import { Buffer } from "node:buffer";
+
+for (const path of ["/", "/deep/nested/repro/"]) {
+  test(`builds a manifest locally at ${path}`, async ({ page }) => {
+    const external: string[] = [];
+    page.on("request", (request) => {
+      if (!request.url().startsWith("http://127.0.0.1:4182"))
+        external.push(request.url());
+    });
+    await page.goto(path);
+    await expect(
+      page.getByRole("heading", { name: "Make a file set verifiable." }),
+    ).toBeVisible();
+    await page
+      .locator('input[type="file"]')
+      .first()
+      .setInputFiles({
+        name: "hello.txt",
+        mimeType: "text/plain",
+        buffer: Buffer.from("hello"),
+      });
+    await page.getByRole("button", { name: "Build manifest" }).click();
+    await expect(page.getByLabel("Generated manifest")).toHaveValue(
+      /hello\.txt/u,
+    );
+    await page
+      .getByRole("button", { name: "Generate one-time key and sign" })
+      .click();
+    await expect(page.getByLabel("Signature envelope")).toHaveValue(
+      /ECDSA-P256-SHA256/u,
+    );
+    await page.getByRole("button", { name: "Verify envelope" }).click();
+    await expect(
+      page.getByText(
+        "Signature is valid for this exact manifest and public key.",
+      ),
+    ).toBeVisible();
+    expect(external).toEqual([]);
+  });
+}
+
+test("keeps the installed application available offline", async ({
+  page,
+  context,
+}) => {
+  await page.goto("/");
+  await page.evaluate(async () => navigator.serviceWorker.ready);
+  await page.reload();
+  await context.setOffline(true);
+  try {
+    await page.reload();
+    await expect(
+      page.getByRole("heading", { name: "Make a file set verifiable." }),
+    ).toBeVisible();
+  } finally {
+    await context.setOffline(false);
+  }
+});

tests/components/workbench.test.tsx

@@ -0,0 +1,30 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it } from "vitest";
+import { Workbench } from "../../src/components/Workbench";
+
+describe("Workbench", () => {
+  it("builds a local manifest for selected files", async () => {
+    const user = userEvent.setup();
+    render(<Workbench />);
+    const input = document.querySelector('input[type="file"]');
+    expect(input).not.toBeNull();
+    await user.upload(
+      input as HTMLInputElement,
+      new File(["Ada"], "ada.txt", { type: "text/plain" }),
+    );
+    await user.click(screen.getByRole("button", { name: "Build manifest" }));
+    expect(await screen.findByText(/Manifest ready/u)).toBeVisible();
+    expect(
+      (screen.getByLabelText("Generated manifest") as HTMLTextAreaElement)
+        .value,
+    ).toContain('"path": "ada.txt"');
+  });
+
+  it("starts with timestamping disabled", () => {
+    render(<Workbench />);
+    expect(
+      screen.getByRole("checkbox", { name: /current timestamp/u }),
+    ).not.toBeChecked();
+  });
+});

tests/core/repro.test.ts

@@ -0,0 +1,118 @@
+import { unzipSync } from "fflate";
+import { describe, expect, it } from "vitest";
+import {
+  buildManifest,
+  collectSelection,
+  compareManifests,
+  deterministicZip,
+  normalizePath,
+  parseManifest,
+  serializeManifest,
+} from "../../src/core/repro";
+
+function files() {
+  const first = new File(["alpha"], "a.txt");
+  const second = new File(["beta"], "b.txt");
+  return [
+    { file: second, path: "b.txt" },
+    { file: first, path: "a.txt" },
+  ];
+}
+
+describe("reproducible manifests", () => {
+  it("hashes in deterministic path order", async () => {
+    const manifest = await buildManifest(files(), ["SHA-512", "SHA-256"]);
+    expect(manifest.files.map((entry) => entry.path)).toEqual([
+      "a.txt",
+      "b.txt",
+    ]);
+    expect(manifest.operation.algorithms).toEqual(["SHA-256", "SHA-512"]);
+    expect(manifest.operation.recordedAt).toBeNull();
+    expect(parseManifest(serializeManifest(manifest))).toEqual(manifest);
+  });
+
+  it("reports changed, missing and unexpected files", async () => {
+    const reference = await buildManifest(files(), ["SHA-256"]);
+    const actual = await buildManifest(
+      [
+        { file: new File(["changed"], "a.txt"), path: "a.txt" },
+        { file: new File(["new"], "c.txt"), path: "c.txt" },
+      ],
+      ["SHA-256"],
+    );
+    expect(
+      compareManifests(reference, actual).map((item) => item.status),
+    ).toEqual(["changed", "missing", "unexpected"]);
+  });
+
+  it("creates byte-identical sorted ZIP files", async () => {
+    const manifest = await buildManifest(files(), ["SHA-256"]);
+    const first = await deterministicZip(files(), manifest);
+    const second = await deterministicZip(files(), manifest);
+    expect(first).toEqual(second);
+    expect(Object.keys(unzipSync(first))).toEqual([
+      "REPRODUCIBILITY.json",
+      "a.txt",
+      "b.txt",
+    ]);
+  });
+
+  it("rejects unsafe and duplicate paths", () => {
+    expect(() => normalizePath("../secret")).toThrow(/Unsafe/u);
+    expect(() =>
+      collectSelection(
+        [new File(["a"], "same"), new File(["b"], "same")],
+        false,
+      ),
+    ).toThrow(/Duplicate/u);
+  });
+
+  it("rejects ZIP and untrusted-manifest path collisions", async () => {
+    await expect(
+      deterministicZip([
+        { file: new File(["a"], "same"), path: "same" },
+        { file: new File(["b"], "same"), path: "same" },
+      ]),
+    ).rejects.toThrow(/Duplicate/u);
+
+    const manifest = await buildManifest(files(), ["SHA-256"]);
+    await expect(
+      deterministicZip(
+        [
+          {
+            file: new File(["user data"], "REPRODUCIBILITY.json"),
+            path: "REPRODUCIBILITY.json",
+          },
+        ],
+        manifest,
+      ),
+    ).rejects.toThrow(/reserved/u);
+
+    const duplicateManifest = {
+      ...manifest,
+      files: [manifest.files[0]!, manifest.files[0]!],
+    };
+    expect(() => parseManifest(JSON.stringify(duplicateManifest))).toThrow(
+      /duplicate path/u,
+    );
+  });
+
+  it("validates manifest metadata, totals and digests", async () => {
+    const manifest = await buildManifest(files(), ["SHA-256"]);
+    expect(() =>
+      parseManifest(JSON.stringify({ ...manifest, totalBytes: 999 })),
+    ).toThrow(/totalBytes/u);
+    expect(() =>
+      parseManifest(
+        JSON.stringify({
+          ...manifest,
+          files: [
+            { ...manifest.files[0], digests: { "sha-256": "not-a-hash" } },
+            manifest.files[1],
+          ],
+        }),
+      ),
+    ).toThrow(/invalid digests/u);
+    expect(() => normalizePath("a".repeat(4_097))).toThrow(/4096/u);
+  });
+});