xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bind final release authority and expiry

Browse Source
This commit is contained in:
LucaP
2026-09-02 12:07:38 +03:00
parent a8fa09e21e
commit 90137c388c
7 changed files with 123 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/integration/atomic-deploy.test.ts
View File

@@ -252,6 +252,24 @@ describe("fenced atomic Nginx release transaction", () => {
await expect(lstat(join(root, "current"))).rejects.toThrow();
});
test("rechecks trusted time at the final pointer publication boundary", async () => {
const { fixture, root, archive } = await setup(
"portfolio-final-expiry-",
);
const input = transactionInput(root, archive, "tx-a", fixture);
await prepareReleaseForTest(input);
const times = ["2026-09-02T01:00:00Z", fixture.expiresAt];
await expect(
activateReleaseForTest({
...input,
expectedCurrentManifestDigest: null,
expectedFence: 1,
testClock: () => times.shift() ?? fixture.expiresAt,
}),
).rejects.toThrow(/expired.*publication/i);
await expect(lstat(join(root, "current"))).rejects.toThrow();
});
test("rollback requires a fresh signed manifest that binds the selected old artifact closure", async () => {
const { temp, fixture, root, archive } = await setup("portfolio-rollback-");
const inputA = transactionInput(root, archive, "tx-a", fixture);