Initial commit: AetherForge Linux (forge-mesh) v0.1.0-dev

cmd/agent/update_test.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"forge-mesh/internal/forge"
+)
+
+func TestSelfUpdateSignatureCheck(t *testing.T) {
+	dir := t.TempDir()
+	keyPath := filepath.Join(dir, "signing.key")
+
+	kp, err := forge.LoadOrCreateKey(keyPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	artifact := []byte("forge-mesh-agent-linux-amd64-test-artifact")
+	sig := kp.Sign(artifact)
+
+	if !verifyAgentUpdate(kp.PublicKeyHex(), artifact, sig) {
+		t.Fatal("valid artifact signature rejected")
+	}
+
+	tampered := append([]byte(nil), artifact...)
+	tampered[0] ^= 0xff
+	if verifyAgentUpdate(kp.PublicKeyHex(), tampered, sig) {
+		t.Fatal("tampered artifact should not verify")
+	}
+
+	if verifyAgentUpdate("not-a-valid-pubkey", artifact, sig) {
+		t.Fatal("invalid pubkey should not verify")
+	}
+}
+
+func TestSelfUpdateChecksumMatchesArtifact(t *testing.T) {
+	dir := t.TempDir()
+	artifactPath := filepath.Join(dir, "forge-mesh-agent-linux-amd64")
+	content := []byte("binary-payload-for-checksum-test")
+	if err := os.WriteFile(artifactPath, content, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	sum := sha256.Sum256(content)
+	expected := hex.EncodeToString(sum[:])
+
+	data, err := os.ReadFile(artifactPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := sha256.Sum256(data)
+	if hex.EncodeToString(got[:]) != expected {
+		t.Fatalf("checksum mismatch: got %s want %s", hex.EncodeToString(got[:]), expected)
+	}
+
+	kp, err := forge.LoadOrCreateKey(filepath.Join(dir, "signing.key"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !verifyAgentUpdate(kp.PublicKeyHex(), data, kp.Sign(data)) {
+		t.Fatal("checksum-stable artifact failed signature verification")
+	}
+}