pkgwatch/src/config.rs

use anyhow::{Context, Result};
use serde::Deserialize;
use std::collections::HashMap;
use std::path::Path;

#[derive(Debug, Deserialize)]
struct PackageFile {
    package: HashMap<String, Package>,
}

#[derive(Debug, Deserialize, Clone)]
pub struct Package {
    pub repo: String,
    /// Exact GitHub release asset name (still not a glob — see
    /// SPEC.md > Architecture > Fetcher), optionally containing a
    /// `{version}` placeholder for projects whose asset names embed the
    /// version (e.g. `scaleway-cli_{version}_linux_amd64`). Substituted via
    /// `checker::version_from_tag` before matching.
    pub asset_pattern: String,
    pub verification: Verification,
}

#[derive(Debug, Deserialize, Clone)]
#[serde(tag = "method", rename_all = "kebab-case")]
pub enum Verification {
    /// Tier 4: proves transport integrity only, not authorship. See
    /// SPEC.md > Verification trust tiers. `checksum_asset_pattern` may
    /// also contain a `{version}` placeholder, same as `asset_pattern`.
    SameOriginSha256 { checksum_asset_pattern: String },
    /// Tier 2: GitHub build-provenance attestation, verified via `gh
    /// attestation verify` rather than reimplementing sigstore in Rust.
    GithubAttestation,
}

impl Verification {
    pub fn tier(&self) -> u8 {
        match self {
            Verification::SameOriginSha256 { .. } => 4,
            Verification::GithubAttestation => 2,
        }
    }
}

/// Loads every `*.toml` file in `dir` (the `packages.d/` layout from
/// SPEC.md > Scaling to many packages), keyed by package name.
pub fn load_packages_dir(dir: &Path) -> Result<Vec<(String, Package)>> {
    let mut out = Vec::new();
    for entry in std::fs::read_dir(dir).with_context(|| format!("reading {}", dir.display()))? {
        let path = entry?.path();
        if path.extension().and_then(|e| e.to_str()) != Some("toml") {
            continue;
        }
        let text = std::fs::read_to_string(&path)
            .with_context(|| format!("reading {}", path.display()))?;
        let file: PackageFile =
            toml::from_str(&text).with_context(|| format!("parsing {}", path.display()))?;
        out.extend(file.package);
    }
    Ok(out)
}

#[cfg(test)]
mod tests {
    use super::*;

    fn write(dir: &Path, name: &str, contents: &str) {
        std::fs::write(dir.join(name), contents).unwrap();
    }

    #[test]
    fn tier_matches_verification_method() {
        assert_eq!(
            Verification::SameOriginSha256 {
                checksum_asset_pattern: "x".to_string()
            }
            .tier(),
            4
        );
        assert_eq!(Verification::GithubAttestation.tier(), 2);
    }

    #[test]
    fn loads_same_origin_sha256_package() {
        let dir = tempfile::tempdir().unwrap();
        write(
            dir.path(),
            "pkg.toml",
            r#"
            [package.pkg]
            repo = "o/r"
            asset_pattern = "pkg_{version}_linux_amd64"

            [package.pkg.verification]
            method = "same-origin-sha256"
            checksum_asset_pattern = "SHA256SUMS"
            "#,
        );

        let packages = load_packages_dir(dir.path()).unwrap();
        assert_eq!(packages.len(), 1);
        let (name, pkg) = &packages[0];
        assert_eq!(name, "pkg");
        assert_eq!(pkg.repo, "o/r");
        assert_eq!(pkg.asset_pattern, "pkg_{version}_linux_amd64");
        assert_eq!(pkg.verification.tier(), 4);
    }

    #[test]
    fn loads_github_attestation_package() {
        let dir = tempfile::tempdir().unwrap();
        write(
            dir.path(),
            "pkg.toml",
            r#"
            [package.pkg]
            repo = "o/r"
            asset_pattern = "pkg-x86_64.tar.gz"

            [package.pkg.verification]
            method = "github-attestation"
            "#,
        );

        let packages = load_packages_dir(dir.path()).unwrap();
        assert_eq!(packages[0].1.verification.tier(), 2);
    }

    #[test]
    fn loads_multiple_files_and_ignores_non_toml() {
        let dir = tempfile::tempdir().unwrap();
        write(
            dir.path(),
            "a.toml",
            r#"
            [package.a]
            repo = "o/a"
            asset_pattern = "a.tar.gz"
            [package.a.verification]
            method = "github-attestation"
            "#,
        );
        write(
            dir.path(),
            "b.toml",
            r#"
            [package.b]
            repo = "o/b"
            asset_pattern = "b.tar.gz"
            [package.b.verification]
            method = "github-attestation"
            "#,
        );
        write(dir.path(), "README.md", "not a package file");

        let mut names: Vec<String> = load_packages_dir(dir.path())
            .unwrap()
            .into_iter()
            .map(|(name, _)| name)
            .collect();
        names.sort();
        assert_eq!(names, vec!["a", "b"]);
    }

    #[test]
    fn errors_on_invalid_toml() {
        let dir = tempfile::tempdir().unwrap();
        write(dir.path(), "bad.toml", "not valid toml [[[");
        assert!(load_packages_dir(dir.path()).is_err());
    }

    #[test]
    fn empty_dir_yields_empty_list() {
        let dir = tempfile::tempdir().unwrap();
        assert!(load_packages_dir(dir.path()).unwrap().is_empty());
    }
}