Release Repro Tools 0.2.0

tests/core/repro.test.ts

@@ -2,13 +2,22 @@ import { unzipSync } from "fflate";
 import { describe, expect, it } from "vitest";
 import {
   buildManifest,
+  buildArchiveContentManifest,
   collectSelection,
+  compareArchiveContentManifests,
   compareManifests,
   deterministicZip,
   normalizePath,
   parseManifest,
   serializeManifest,
+  serializeArchiveContentManifest,
+  parseArchiveContentManifest,
 } from "../../src/core/repro";
+import {
+  createProvenanceStatement,
+  createReproEvidence,
+  inspectSbomDocuments,
+} from "../../src/core/evidence";
 
 function files() {
   const first = new File(["alpha"], "a.txt");
@@ -19,6 +28,12 @@ function files() {
   ];
 }
 
+function ownedBuffer(input: Uint8Array): ArrayBuffer {
+  const owned = new Uint8Array(input.byteLength);
+  owned.set(input);
+  return owned.buffer;
+}
+
 describe("reproducible manifests", () => {
   it("hashes in deterministic path order", async () => {
     const manifest = await buildManifest(files(), ["SHA-512", "SHA-256"]);
@@ -115,4 +130,70 @@ describe("reproducible manifests", () => {
     ).toThrow(/invalid digests/u);
     expect(() => normalizePath("a".repeat(4_097))).toThrow(/4096/u);
   });
+
+  it("streams bounded ZIP contents into comparable content manifests", async () => {
+    const firstBytes = await deterministicZip([
+      { path: "nested/a.txt", file: new File(["alpha"], "a.txt") },
+      { path: "b.txt", file: new File(["beta"], "b.txt") },
+    ]);
+    const secondBytes = await deterministicZip([
+      { path: "nested/a.txt", file: new File(["changed"], "a.txt") },
+      { path: "c.txt", file: new File(["new"], "c.txt") },
+    ]);
+    const first = await buildArchiveContentManifest(
+      new File([ownedBuffer(firstBytes)], "first.zip"),
+      ["SHA-256"],
+    );
+    const second = await buildArchiveContentManifest(
+      new File([ownedBuffer(secondBytes)], "second.zip"),
+      ["SHA-256"],
+    );
+    expect(first.files.map((entry) => entry.path)).toEqual([
+      "b.txt",
+      "nested/a.txt",
+    ]);
+    expect(first.files[0]?.crc32).toMatch(/^[0-9a-f]{8}$/u);
+    expect(
+      parseArchiveContentManifest(serializeArchiveContentManifest(first)),
+    ).toEqual(first);
+    expect(
+      compareArchiveContentManifests(first, second).map((item) => item.status),
+    ).toEqual(["missing", "unexpected", "changed"]);
+  });
+
+  it("recognizes SBOM evidence and makes a non-conformance provenance statement", async () => {
+    const selected = [
+      {
+        path: "bom.cdx.json",
+        file: new File(
+          [
+            JSON.stringify({
+              bomFormat: "CycloneDX",
+              specVersion: "1.6",
+              serialNumber: "urn:uuid:test",
+              metadata: { component: { name: "demo" } },
+              components: [{ name: "library" }],
+              dependencies: [{ ref: "demo" }],
+            }),
+          ],
+          "bom.cdx.json",
+        ),
+      },
+    ];
+    const manifest = await buildManifest(selected, ["SHA-256"]);
+    const materials = await inspectSbomDocuments(selected);
+    expect(materials[0]).toMatchObject({
+      status: "recognized",
+      format: "CycloneDX JSON",
+      specificationVersion: "1.6",
+      componentCount: 1,
+    });
+    const provenance = createProvenanceStatement(manifest, materials);
+    expect(provenance.predicate.metadata.conformanceClaim).toBeNull();
+    expect(provenance.predicate.materials).toEqual(materials);
+    expect(createReproEvidence(manifest, materials)).toMatchObject({
+      contractVersion: 1,
+      provenance: { execution: "local-browser", networkRequired: false },
+    });
+  });
 });