Feature: The TUF Composer plugin validates TUF metadata.

@composer-plugin @php-tuf @satis @tuf @rugged @tuf-metadata @slow @composer-install
Feature: The TUF Composer plugin validates TUF metadata.
  In order to securely install PHP codebases
  As a site builder
  I need Composer to validate TUF metadata.

  Background:
    Given I rebuild fixtures
    And I register the Rugged repo with Composer
    And I use the "rugged-composer.json" Composer file
    And I am in the "d9-site" directory
    And I run "rm -rf web/modules/contrib/token/"
    And I run "composer clear-cache"
    And I run "rm -rf vendor/composer/tuf/http---packages.ddev.site/"

  @composer-install
  Scenario: When a repo is TUF-enabled, it will not emit a warning that TUF will not be verified.
    When I try to run "composer install -vvv"
    Then I should get:
      """
      TUF integration enabled.
      """
    And I should not get:
      """
      Authenticity of packages from http://packages.ddev.site are not verified by TUF.
      """
    When I use the "tuf-off-composer.json" Composer file
    And I try to run "composer install -vvv"
    Then I should get:
      """
      TUF integration enabled.
      Authenticity of packages from http://packages.ddev.site are not verified by TUF.
      """
    And I should not get:
      """
      [TUF] Root metadata for http://packages.ddev.site loaded from persistent storage.
      [TUF] Packages from http://packages.ddev.site are verified with base URL http://packages.ddev.site/targets
      """

  @composer-install
  Scenario: When a project uses a TUF-enabled repo, it must have initial root metadata available in the project.
    Given the file "tuf/packages.ddev.site.json" exists
    When I try to run "composer install -vvv"
    Then I should not get:
      """
      No TUF root metadata was found for repository http://packages.ddev.site
      """
    And the following files should exist:
      """
      web/modules/contrib/token/token.info.yml
      """

  @composer-install
  Scenario: When a TUF-enabled project does not have initial root metadata, the Composer TUF plugin refuses to download packages during install.
    When I run "rm tuf/packages.ddev.site.json"
    And I run "composer clear-cache"
    And I run "rm -rf vendor/composer/tuf/http---packages.ddev.site/"
    And I try to run "composer install -vvv"
    Then I should get:
      """
      No TUF root metadata was found for repository http://packages.ddev.site
      """
    And the following files should not exist:
      """
      web/modules/contrib/token/token.info.yml
      """

  @composer-install
  Scenario: When all TUF metadata is present, Composer TUF plugin does not emit errors during install.
    When I run "composer install -vvv"
    Then I should get:
      """
      TUF integration enabled.
      """
    Then I should not get:
      """
      [Tuf\Exception\NotFoundException]
      Target not found: include/all
      No TUF root metadata was found for repository http://packages.ddev.site
      [Tuf\Exception\RepoFileNotFound]
      /metadata/timestamp.json not found
      /metadata/snapshot.json not found
      /metadata/targets.json not found
      """

  @composer-install
  Scenario: When all TUF metadata is present, Composer TUF plugin downloads packages during install.
    When I run "composer install -vvv"
    And the following files should exist:
      """
      web/modules/contrib/token/token.info.yml
      """

5 scenarios (5 passed)
57 steps (57 passed)

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Rugged TUF Server is a trademark of Consensus Enterprises.