Release Repro Tools 0.2.0

tests/browser/app.spec.ts

@@ -1,5 +1,6 @@
 import { expect, test } from "@playwright/test";
 import { Buffer } from "node:buffer";
+import { strToU8, zipSync } from "fflate";
 
 for (const path of ["/", "/deep/nested/repro/"]) {
   test(`builds a manifest locally at ${path}`, async ({ page }) => {
@@ -57,3 +58,38 @@ test("keeps the installed application available offline", async ({
     await context.setOffline(false);
   }
 });
+
+test("compares expanded ZIP evidence and recognizes CycloneDX locally", async ({
+  page,
+}) => {
+  await page.goto("/");
+  const zip = zipSync({ "inside.txt": strToU8("same content") });
+  await page.locator('input[accept="application/zip,.zip"]').setInputFiles({
+    name: "sample.zip",
+    mimeType: "application/zip",
+    buffer: Buffer.from(zip),
+  });
+  await expect(page.getByLabel("Archive content manifest")).toHaveValue(
+    /inside\.txt/u,
+  );
+
+  await page
+    .locator('input[type="file"]')
+    .first()
+    .setInputFiles({
+      name: "bom.cdx.json",
+      mimeType: "application/json",
+      buffer: Buffer.from(
+        JSON.stringify({
+          bomFormat: "CycloneDX",
+          specVersion: "1.6",
+          components: [{ name: "demo" }],
+        }),
+      ),
+    });
+  await page.getByRole("button", { name: "Build manifest" }).click();
+  await page.getByRole("button", { name: "Build provenance evidence" }).click();
+  await expect(
+    page.getByRole("cell", { name: "CycloneDX JSON" }),
+  ).toBeVisible();
+});

tests/browser/responsive.spec.ts

@@ -0,0 +1,18 @@
+import { expect, test } from "@playwright/test";
+
+test("keeps the primary workspace inside a narrow viewport", async ({
+  page,
+}) => {
+  await page.goto("/deep/nested/repro/");
+  await expect(page.locator("main").first()).toBeVisible();
+  await expect(
+    page.locator("main .loading, main .workbench-loading"),
+  ).toHaveCount(0);
+
+  const widths = await page.evaluate(() => ({
+    content: document.documentElement.scrollWidth,
+    viewport: document.documentElement.clientWidth,
+  }));
+  expect(widths.viewport).toBeLessThanOrEqual(430);
+  expect(widths.content).toBeLessThanOrEqual(widths.viewport + 1);
+});

tests/core/repro.test.ts

@@ -2,13 +2,22 @@ import { unzipSync } from "fflate";
 import { describe, expect, it } from "vitest";
 import {
   buildManifest,
+  buildArchiveContentManifest,
   collectSelection,
+  compareArchiveContentManifests,
   compareManifests,
   deterministicZip,
   normalizePath,
   parseManifest,
   serializeManifest,
+  serializeArchiveContentManifest,
+  parseArchiveContentManifest,
 } from "../../src/core/repro";
+import {
+  createProvenanceStatement,
+  createReproEvidence,
+  inspectSbomDocuments,
+} from "../../src/core/evidence";
 
 function files() {
   const first = new File(["alpha"], "a.txt");
@@ -19,6 +28,12 @@ function files() {
   ];
 }
 
+function ownedBuffer(input: Uint8Array): ArrayBuffer {
+  const owned = new Uint8Array(input.byteLength);
+  owned.set(input);
+  return owned.buffer;
+}
+
 describe("reproducible manifests", () => {
   it("hashes in deterministic path order", async () => {
     const manifest = await buildManifest(files(), ["SHA-512", "SHA-256"]);
@@ -115,4 +130,70 @@ describe("reproducible manifests", () => {
     ).toThrow(/invalid digests/u);
     expect(() => normalizePath("a".repeat(4_097))).toThrow(/4096/u);
   });
+
+  it("streams bounded ZIP contents into comparable content manifests", async () => {
+    const firstBytes = await deterministicZip([
+      { path: "nested/a.txt", file: new File(["alpha"], "a.txt") },
+      { path: "b.txt", file: new File(["beta"], "b.txt") },
+    ]);
+    const secondBytes = await deterministicZip([
+      { path: "nested/a.txt", file: new File(["changed"], "a.txt") },
+      { path: "c.txt", file: new File(["new"], "c.txt") },
+    ]);
+    const first = await buildArchiveContentManifest(
+      new File([ownedBuffer(firstBytes)], "first.zip"),
+      ["SHA-256"],
+    );
+    const second = await buildArchiveContentManifest(
+      new File([ownedBuffer(secondBytes)], "second.zip"),
+      ["SHA-256"],
+    );
+    expect(first.files.map((entry) => entry.path)).toEqual([
+      "b.txt",
+      "nested/a.txt",
+    ]);
+    expect(first.files[0]?.crc32).toMatch(/^[0-9a-f]{8}$/u);
+    expect(
+      parseArchiveContentManifest(serializeArchiveContentManifest(first)),
+    ).toEqual(first);
+    expect(
+      compareArchiveContentManifests(first, second).map((item) => item.status),
+    ).toEqual(["missing", "unexpected", "changed"]);
+  });
+
+  it("recognizes SBOM evidence and makes a non-conformance provenance statement", async () => {
+    const selected = [
+      {
+        path: "bom.cdx.json",
+        file: new File(
+          [
+            JSON.stringify({
+              bomFormat: "CycloneDX",
+              specVersion: "1.6",
+              serialNumber: "urn:uuid:test",
+              metadata: { component: { name: "demo" } },
+              components: [{ name: "library" }],
+              dependencies: [{ ref: "demo" }],
+            }),
+          ],
+          "bom.cdx.json",
+        ),
+      },
+    ];
+    const manifest = await buildManifest(selected, ["SHA-256"]);
+    const materials = await inspectSbomDocuments(selected);
+    expect(materials[0]).toMatchObject({
+      status: "recognized",
+      format: "CycloneDX JSON",
+      specificationVersion: "1.6",
+      componentCount: 1,
+    });
+    const provenance = createProvenanceStatement(manifest, materials);
+    expect(provenance.predicate.metadata.conformanceClaim).toBeNull();
+    expect(provenance.predicate.materials).toEqual(materials);
+    expect(createReproEvidence(manifest, materials)).toMatchObject({
+      contractVersion: 1,
+      provenance: { execution: "local-browser", networkRequired: false },
+    });
+  });
 });