Release v2.0.0

src-tauri/tests/authenticode_tests.rs

@@ -0,0 +1,81 @@
+use std::path::PathBuf;
+
+#[cfg(windows)]
+use proxywarden_lib::process::AuthenticodePublisher;
+use proxywarden_lib::process::{verify_authenticode, AuthenticodeError};
+
+#[cfg(windows)]
+#[test]
+fn bundled_windows_packet_filter_has_expected_trusted_publisher() {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("bundled/components/windows-packet-filter/Windows.Packet.Filter.3.6.2.1.x64.msi");
+
+    let verification = verify_authenticode(path).expect("bundled MSI should be verifiable");
+
+    assert!(verification.is_trusted);
+    assert_eq!(
+        verification.publisher,
+        Some(AuthenticodePublisher {
+            common_name: "The Anti-Cloud Corporation".to_owned(),
+            organization: "The Anti-Cloud Corporation".to_owned(),
+        })
+    );
+    assert_eq!(verification.status_code, 0);
+}
+
+#[cfg(windows)]
+#[test]
+fn unsigned_regular_file_is_not_trusted() {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("Cargo.toml");
+
+    let verification = verify_authenticode(path).expect("regular file should be inspectable");
+
+    assert!(!verification.is_trusted);
+    assert_eq!(verification.publisher, None);
+    assert_ne!(verification.status_code, 0);
+}
+
+#[cfg(windows)]
+#[test]
+fn reparse_target_is_rejected_when_symlink_creation_is_available() {
+    use std::{fs, os::windows::fs::symlink_file};
+
+    let root = std::env::temp_dir().join(format!(
+        "proxywarden-authenticode-test-{}",
+        uuid::Uuid::new_v4().simple()
+    ));
+    fs::create_dir(&root).expect("test root should be creatable");
+    let link = root.join("linked-target.exe");
+    let target = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("Cargo.toml");
+    if let Err(error) = symlink_file(target, &link) {
+        fs::remove_dir(&root).expect("test root should be removable");
+        if error.raw_os_error() == Some(1314) {
+            eprintln!("skipping reparse probe because this process lacks symlink privilege");
+            return;
+        }
+        panic!("test symlink creation failed: {error}");
+    }
+
+    let result = verify_authenticode(&link);
+    fs::remove_file(&link).expect("test symlink should be removable");
+    fs::remove_dir(&root).expect("test root should be removable");
+
+    assert_eq!(result, Err(AuthenticodeError::UnsafeTarget));
+}
+
+#[test]
+fn missing_target_fails_closed() {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("missing-signature-target.exe");
+
+    #[cfg(windows)]
+    assert_eq!(
+        verify_authenticode(path),
+        Err(AuthenticodeError::InvalidTarget)
+    );
+
+    #[cfg(not(windows))]
+    assert_eq!(
+        verify_authenticode(path),
+        Err(AuthenticodeError::UnsupportedPlatform)
+    );
+}