diff --git a/crates/registry-evidencectl/src/build.rs b/crates/registry-evidencectl/src/build.rs index 804a68abe..172b1c4bf 100644 --- a/crates/registry-evidencectl/src/build.rs +++ b/crates/registry-evidencectl/src/build.rs @@ -363,7 +363,7 @@ fn runtime_failure(message: &str) -> Result { fn parse_bundle_revision(stdout: &str) -> Result { let revision = stdout .lines() - .find_map(|line| line.strip_prefix("Evidence deployment ")) + .find_map(|line| line.strip_prefix("Evidence bundle ")) .and_then(|line| line.split_whitespace().next()) .filter(|value| { value.len() == 71 @@ -637,12 +637,19 @@ requirements: [] #[test] fn revision_and_secret_reference_parsing_are_closed() { - let revision = format!("Evidence deployment sha256:{}\n", "a".repeat(64)); + let revision = format!( + "Evidence bundle sha256:{} passed check (2 requirements)\n", + "a".repeat(64) + ); assert_eq!( parse_bundle_revision(&revision).expect("revision"), format!("sha256:{}", "a".repeat(64)) ); - assert!(parse_bundle_revision("Evidence deployment sha256:not-a-digest\n").is_err()); + assert!(parse_bundle_revision( + "Evidence deployment sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n" + ) + .is_err()); + assert!(parse_bundle_revision("Evidence bundle sha256:not-a-digest\n").is_err()); let names = secret_references(&json!({ "z": "secret:file/source-token", diff --git a/crates/registry-evidencectl/tests/production_build.rs b/crates/registry-evidencectl/tests/production_build.rs index 56250b1ee..bb9426325 100644 --- a/crates/registry-evidencectl/tests/production_build.rs +++ b/crates/registry-evidencectl/tests/production_build.rs @@ -972,7 +972,7 @@ if [ "$failure" = "fixture:$fixture" ]; then fi if [ -z "$fixture" ]; then - printf '%s\n' 'Evidence deployment sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa / sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb passed check' + printf '%s\n' 'Evidence bundle sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa passed check (2 requirements)' else printf '%s\n' 'Evidence fixture passed (1 evaluated cases)' fi diff --git a/crates/registry-evidencectl/tests/production_handoff.rs b/crates/registry-evidencectl/tests/production_handoff.rs index c1681371a..63a6c9b0f 100644 --- a/crates/registry-evidencectl/tests/production_handoff.rs +++ b/crates/registry-evidencectl/tests/production_handoff.rs @@ -312,6 +312,22 @@ fn production_candidate_accepts_a_token_from_an_independent_real_mint() { ); } +#[test] +#[ignore = "exact gate: runs the real production builder and sibling Evidence bundle check"] +fn production_build_accepts_the_real_bundle_check_revision() { + let fixture = Fixture::new(); + let evidence = evidence_binary(); + fixture.stage_authoring_project(); + fixture.stage_four_shape_project(); + fixture.stage_target(); + fixture.authorize_four_shapes(); + + let output = fixture.build(evidence); + let revision = bundle_revision(&output); + assert!(revision.starts_with("sha256:")); + assert!(fixture.candidate.join("bundle/evidence.yaml").is_file()); +} + #[test] #[ignore = "exact gate: runs the real production builder across all four authoring shapes"] fn production_build_checks_and_evaluates_every_neutral_authoring_shape() {