import { createHash } from 'node:crypto' import { describe, expect, it } from 'vitest' import { PINNED, SUBDIRS, resolveDownloadUrl, resolveVersion, verifyArchiveDigest, verifyBinaryDigest} from './fetch-micromamba.mjs' describe('micromamba pinning', () => { it('pins a concrete version, never `latest`', () => { expect(PINNED.version).toMatch(/^\d+\.\d+\.\d+$/) expect(PINNED.version).not.toBe('latest') }) it('has a valid sha256 for every supported subdir', () => { for (const subdir of SUBDIRS) { expect(PINNED.sha256[subdir], `missing digest for ${subdir}`).toMatch(/^[0-9a-f]{64}$/) } }) it('downloads the pinned archive from the matching official GitHub release', () => { expect(resolveDownloadUrl('osx-arm64')).toBe( 'https://github.com/mamba-org/micromamba-releases/releases/download/2.8.1-1/micromamba-osx-arm64.tar.bz2' ) }) it('pins a separately built Windows compatibility runner and both of its digests', () => { expect(PINNED.compatibility).toMatchObject({ version: '1.5.12', releaseTag: '1.5.12-0' }) expect(PINNED.compatibility.sha256['win-64']).toMatch(/^[0-9a-f]{64}$/) expect(PINNED.compatibility.binarySha256['win-64']).toMatch(/^[0-9a-f]{64}$/) expect(resolveDownloadUrl('win-64', 'compatibility')).toBe( 'https://github.com/mamba-org/micromamba-releases/releases/download/1.5.12-0/micromamba-win-64.tar.bz2' ) expect(() => resolveDownloadUrl('linux-64', 'compatibility')).toThrow(/no pinned sha256/) })}) describe('verifyArchiveDigest', () => { it('accepts a buffer whose sha256 matches the pinned digest', () => { const buf = Buffer.from('micromamba archive bytes') // Register a temporary subdir pinned to this buffer's real hash, then verify it passes. const fake = '__test-match__' PINNED.sha256[fake] = createHash('sha256').update(buf).digest('hex') try { expect(() => verifyArchiveDigest(buf, fake)).not.toThrow() } finally { delete PINNED.sha256[fake] } }) it('throws on a digest mismatch before any copy', () => { expect(() => verifyArchiveDigest(Buffer.from('tampered'), 'linux-64')).toThrow( /sha256 mismatch/ ) }) it('throws when a subdir has no pinned digest', () => { expect(() => verifyArchiveDigest(Buffer.from('x'), 'nonexistent-subdir')).toThrow( /no pinned sha256/ ) })}) describe('resolveVersion', () => { it('uses the pinned version when MICROMAMBA_VERSION is unset', () => { expect(resolveVersion({})).toBe(PINNED.version) }) it('allows an override equal to the pinned version', () => { expect(resolveVersion({ MICROMAMBA_VERSION: PINNED.version })).toBe(PINNED.version) }) it('fails fast on an override that differs from the pinned version', () => { // The digests only cover PINNED.version, so a different version can never verify — reject it // BEFORE any fetch, with actionable guidance instead of a confusing sha256 mismatch. expect(() => resolveVersion({ MICROMAMBA_VERSION: '9.9.9' })).toThrow( /does not match the pinned .* update scripts\/micromamba-versions\.json/s ) })}) describe('verifyBinaryDigest', () => { it('accepts extracted bytes matching the selected pin', () => { const buf = Buffer.from('compatibility executable bytes') const fake = '__test-binary-match__' PINNED.compatibility.binarySha256[fake] = createHash('sha256').update(buf).digest('hex') try { expect(() => verifyBinaryDigest(buf, fake, 'compatibility')).not.toThrow() } finally { delete PINNED.compatibility.binarySha256[fake] } }) it('rejects an extracted compatibility executable whose digest differs', () => { expect(() => verifyBinaryDigest(Buffer.from('tampered'), 'win-64', 'compatibility')).toThrow( /binary sha256 mismatch/ ) })})
import { createHash } from 'node:crypto'
import { describe, expect, it } from 'vitest'
import {
PINNED,
SUBDIRS,
resolveDownloadUrl,
resolveVersion,
verifyArchiveDigest,
verifyBinaryDigest
} from './fetch-micromamba.mjs'
describe('micromamba pinning', () => {
it('pins a concrete version, never `latest`', () => {
expect(PINNED.version).toMatch(/^\d+\.\d+\.\d+$/)
expect(PINNED.version).not.toBe('latest')
})
it('has a valid sha256 for every supported subdir', () => {
for (const subdir of SUBDIRS) {
expect(PINNED.sha256[subdir], `missing digest for ${subdir}`).toMatch(/^[0-9a-f]{64}$/)
}
})
it('downloads the pinned archive from the matching official GitHub release', () => {
expect(resolveDownloadUrl('osx-arm64')).toBe(
'https://github.com/mamba-org/micromamba-releases/releases/download/2.8.1-1/micromamba-osx-arm64.tar.bz2'
)
})
it('pins a separately built Windows compatibility runner and both of its digests', () => {
expect(PINNED.compatibility).toMatchObject({
version: '1.5.12',
releaseTag: '1.5.12-0'
})
expect(PINNED.compatibility.sha256['win-64']).toMatch(/^[0-9a-f]{64}$/)
expect(PINNED.compatibility.binarySha256['win-64']).toMatch(/^[0-9a-f]{64}$/)
expect(resolveDownloadUrl('win-64', 'compatibility')).toBe(
'https://github.com/mamba-org/micromamba-releases/releases/download/1.5.12-0/micromamba-win-64.tar.bz2'
)
expect(() => resolveDownloadUrl('linux-64', 'compatibility')).toThrow(/no pinned sha256/)
})
})
describe('verifyArchiveDigest', () => {
it('accepts a buffer whose sha256 matches the pinned digest', () => {
const buf = Buffer.from('micromamba archive bytes')
// Register a temporary subdir pinned to this buffer's real hash, then verify it passes.
const fake = '__test-match__'
PINNED.sha256[fake] = createHash('sha256').update(buf).digest('hex')
try {
expect(() => verifyArchiveDigest(buf, fake)).not.toThrow()
} finally {
delete PINNED.sha256[fake]
}
})
it('throws on a digest mismatch before any copy', () => {
expect(() => verifyArchiveDigest(Buffer.from('tampered'), 'linux-64')).toThrow(
/sha256 mismatch/
)
})
it('throws when a subdir has no pinned digest', () => {
expect(() => verifyArchiveDigest(Buffer.from('x'), 'nonexistent-subdir')).toThrow(
/no pinned sha256/
)
})
})
describe('resolveVersion', () => {
it('uses the pinned version when MICROMAMBA_VERSION is unset', () => {
expect(resolveVersion({})).toBe(PINNED.version)
})
it('allows an override equal to the pinned version', () => {
expect(resolveVersion({ MICROMAMBA_VERSION: PINNED.version })).toBe(PINNED.version)
})
it('fails fast on an override that differs from the pinned version', () => {
// The digests only cover PINNED.version, so a different version can never verify — reject it
// BEFORE any fetch, with actionable guidance instead of a confusing sha256 mismatch.
expect(() => resolveVersion({ MICROMAMBA_VERSION: '9.9.9' })).toThrow(
/does not match the pinned .* update scripts\/micromamba-versions\.json/s
)
})
})
describe('verifyBinaryDigest', () => {
it('accepts extracted bytes matching the selected pin', () => {
const buf = Buffer.from('compatibility executable bytes')
const fake = '__test-binary-match__'
PINNED.compatibility.binarySha256[fake] = createHash('sha256').update(buf).digest('hex')
try {
expect(() => verifyBinaryDigest(buf, fake, 'compatibility')).not.toThrow()
} finally {
delete PINNED.compatibility.binarySha256[fake]
}
})
it('rejects an extracted compatibility executable whose digest differs', () => {
expect(() => verifyBinaryDigest(Buffer.from('tampered'), 'win-64', 'compatibility')).toThrow(
/binary sha256 mismatch/
)
})
})