nordisk/heimdall

crates/heimdall-core/tests/common/mod.rs

// SPDX-License-Identifier: AGPL-3.0-only
// Copyright (C) 2026 Ignalina ApS and Vetra Automation AB

//! Shared fixtures for heimdall-core tests. Heimdall is a defensive sandbox;
//! these tests exercise only its own result signing and checking.
#![allow(dead_code)]

use heimdall_core::*;

pub const SEED_A: [u8; 32] = [7u8; 32];
pub const SEED_B: [u8; 32] = [9u8; 32];
pub const BOOT_A: BootId = BootId([0xA1; 16]);
pub const BOOT_B: BootId = BootId([0xB2; 16]);

pub fn key_a() -> BootKey {
    BootKey::from_seed(SEED_A, BOOT_A)
}

pub fn key_b() -> BootKey {
    BootKey::from_seed(SEED_B, BOOT_B)
}

pub fn ticket() -> JobTicket {
    JobTicket {
        job_id: JobId([0x11; 16]),
        nonce: Nonce([0x22; 32]),
    }
}

pub fn sample_result() -> JobResult {
    let t = ticket();
    JobResult {
        job_id: t.job_id,
        nonce: t.nonce,
        verdict: Verdict::Accepted,
        outputs: vec![
            Output::of("report.json", b"{\"ok\":true}"),
            Output::of("index.bin", &[0u8, 1, 2, 3, 255]),
        ],
        events: vec![
            BrokerEvent {
                at_ms: 3,
                call: "emit-file".into(),
                args: vec!["report.json".into(), "11".into()],
                decision: Decision::Allowed,
            },
            BrokerEvent {
                at_ms: 9,
                call: "openat".into(),
                args: vec!["/etc/passwd".into(), "O_RDONLY".into()],
                decision: Decision::Refused,
            },
        ],
        exit: ExitInfo::exited(0),
        started_unix: 1_793_000_000,
        finished_unix: 1_793_000_002,
        runner: sample_features(),
    }
}

pub fn refused_result() -> JobResult {
    JobResult {
        verdict: Verdict::Refused {
            code: "heimdall-wasm-1".into(),
            reason: "guest trapped (out of fuel)".into(),
        },
        outputs: vec![],
        ..sample_result()
    }
}

pub fn signed_wire() -> Vec<u8> {
    key_a().sign(sample_result()).unwrap().to_bytes()
}

pub fn verifier_a() -> Verifier {
    Verifier::new(key_a().pinned()).unwrap()
}

pub fn sample_features() -> Features {
    Features {
        runner: "heimdall-wasm".into(),
        container: false,
        seccomp: Protection::None,
        landlock: false,
        broker: false,
        wasm: true,
        image_verified_each_start: true,
    }
}

/// Features with every flag off and an empty runner name.
pub fn min_features() -> Features {
    Features {
        runner: String::new(),
        container: false,
        seccomp: Protection::None,
        landlock: false,
        broker: false,
        wasm: false,
        image_verified_each_start: false,
    }
}

/// sha256 of `signed_wire()`: pins the whole v1 wire byte for byte.
pub const GOLDEN_WIRE_SHA256: &str =
    "f74fae0f3e572e6080391659ac0fe8344c5acce0fb474995e10c30e188388596";