Public release release-e47f9c27bbeb

Source commit: e47f9c27bbebe6759f6b6fe7b12fd00bb20d116d

Public tree identity: sha256:4c1af1dfd67d3f2b5088531ea8727b11124b013d2251a4d5088f51a6424c0196

scripts/hostile-input-contract-smoke.js

@@ -3,9 +3,53 @@
 const assert = require("assert");
 const fs = require("fs");
 const path = require("path");
+const {
+  agentIdentity,
+  signedAgentWorkflowRequest,
+} = require("./agent-signing");
+const {
+  nodeIdentity,
+  signedNodeHeartbeat,
+} = require("./node-signing");
 
 const repo = path.resolve(__dirname, "..");
 
+const signingInstrumentAgent = agentIdentity(
+  "hostile-input-contract-agent",
+  "agent-hostile-input-contract"
+);
+const explicitlyEmptyAgentNonce = signedAgentWorkflowRequest(
+  signingInstrumentAgent,
+  {
+    type: "start_process",
+    tenant: "tenant",
+    project: "project",
+    actor_agent: "agent-hostile-input-contract",
+    process: "process",
+    launch_attempt: "attempt",
+    restart: false,
+  },
+  { nonce: "" }
+);
+assert.strictEqual(
+  explicitlyEmptyAgentNonce.agent_signature.nonce,
+  "",
+  "Agent signing instrument replaced an explicitly empty hostile nonce"
+);
+const signingInstrumentNode = nodeIdentity(
+  "hostile-input-contract-node",
+  "node-hostile-input-contract"
+);
+assert.strictEqual(
+  signedNodeHeartbeat(
+    "node-hostile-input-contract",
+    signingInstrumentNode,
+    { nonce: "" }
+  ).nonce,
+  "",
+  "Node signing instrument replaced an explicitly empty hostile nonce"
+);
+
 function read(relativePath) {
   return fs.readFileSync(path.join(repo, relativePath), "utf8");
 }