open-standards/.github/wai-conformance/verifiers/project.sh

# step: the project: wai.lock, wai check and wai build · wai-rs and project_verify.py
# order: 770
# independent: project trust python3 -I project-conformance/project_verify.py vectors project-conformance/vectors.json
# independent: project-selftest trust python3 -I project-conformance/project_verify.py selftest project-conformance/vectors.json
#
# wai lock, wai check and wai build through the binary (tests/cli_project.rs): a lock's bytes are
# the corpus's (wai/project-conformance/), the same in two directories at two times, from CRLF
# project files and through a checkout with core.autocrlf=true; a stale lock, a lock edited by
# hand and a member the reader does not know are refused by all three and nothing is written;
# wai check reports every finding, and what it could not run says not checked and exits 5, never
# 0; wai build gives the same tree in two directories at two times, with the reference packager
# too, and its record names the digests of wai.json and wai.lock. First in the archive's build,
# where wai app check is not there and an app is not checked, then with the feature app, where it
# runs inside wai check. And, in the step of every independent verifier above, the corpus's
# second reader, project_verify.py, written from
# wai/schema/README.md and sharing no code with wai-rs (it takes the policy's digest from
# pack-conformance/pack_verify.py): the tests run it on what the binary wrote, and there it reads
# the corpus's bytes, then drops each of its own rules in turn and requires the corpus to catch
# it. Standard library only, run isolated (-I).
set -euo pipefail
out() { (cd "$1" && cargo metadata --format-version 1 --no-deps --locked | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])'); }
# wai-pack is a workspace of its own that builds wai with other features: a target directory shared
# with wai-rs (CARGO_TARGET_DIR set) has been seen to give it a wai built without them, so it
# builds in one of its own.
pack_target=$(out wai-pack)
if [ -n "${CARGO_TARGET_DIR:-}" ]; then pack_target="$CARGO_TARGET_DIR/wai-pack"; fi
(cd wai-pack && CARGO_TARGET_DIR="$pack_target" cargo build --locked --bin wai-pack)
WAI_PACK_BIN="$pack_target/debug/wai-pack"
export WAI_PACK_BIN
(cd wai-rs && cargo test --locked --no-default-features --features quickstart --test cli_project)
(cd wai-rs && cargo test --locked --no-default-features --features quickstart,app --test cli_project)
# The receipts of the toolchain's writes (tests/cli_receipts.rs): wai create, lock, build, decode,
# wrap, unwrap, generate and key create|rotate|revoke|export each leave one that wai verify reads,
# naming the digest of wai.json; a changed output and a receipt of another project are refused; a
# generation's origin claim is read by wai verify and by synthesis_verify.py claim.
(cd wai-rs && cargo test --locked --no-default-features --features quickstart,generate,synthesis --test cli_receipts)