From 9fc29815c9d37e303deded746a8d57e6676a2903 Mon Sep 17 00:00:00 2001 From: hellno Date: Mon, 29 Jun 2026 22:39:26 +0200 Subject: [PATCH] test: cover the strict daemon resolver's missing-file rejection (#145) The release resolver verify_bundled_binary() already refuses a missing candidate (symlink_metadata errors before any predicate), but mod release_resolver covered accept + world/group-writable file + symlink + world-writable parent (incl. sticky) and never the missing-file case from the issue's reject list. Add that one test so the contract is locked. Default-feature cargo test -p deckard-signerd compiles the strict (not dev-signerd-bin) path, so the test runs in CI's workspace job. Closes #145 --- crates/deckard-signerd/src/supervise.rs | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/crates/deckard-signerd/src/supervise.rs b/crates/deckard-signerd/src/supervise.rs index fc9af8a..8044d47 100644 --- a/crates/deckard-signerd/src/supervise.rs +++ b/crates/deckard-signerd/src/supervise.rs @@ -904,6 +904,19 @@ mod tests { let _ = std::fs::remove_dir_all(&dir); } + #[test] + fn rejects_a_missing_file() { + let dir = fresh_dir("missing"); + std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o755)).unwrap(); + // Never written: the candidate points at a file that does not exist. + let candidate = dir.join("deckard-signerd"); + assert!( + verify_bundled_binary(&candidate).is_err(), + "a missing daemon binary must be refused, never silently resolved" + ); + let _ = std::fs::remove_dir_all(&dir); + } + #[test] fn rejects_a_world_writable_parent_dir() { let dir = fresh_dir("wwdir");