secure validation cache reuse

src/storage/tests.rs

@@ -284,6 +284,28 @@ fn sample_vcir(manifest_rsync_uri: &str) -> ValidatedCaInstanceResult {
     }
 }
 
+fn roa_cache_projection_context(vcir: &ValidatedCaInstanceResult) -> RoaCacheProjectionContext {
+    let roa_output = vcir
+        .local_outputs
+        .iter()
+        .find(|output| {
+            output.output_type == VcirOutputType::Vrp
+                && output.source_object_type == VcirSourceObjectType::Roa
+        })
+        .expect("sample VCIR has a ROA output");
+    RoaCacheProjectionContext {
+        parent_context_digest: [0x31; 32],
+        policy_fingerprint: [0x32; 32],
+        object_meta: vec![RoaCacheObjectMeta {
+            source_object_uri: roa_output.source_object_uri.clone(),
+            source_object_hash: roa_output.source_object_hash,
+            ee_serial: vec![0x01],
+            crl_uri: vcir.current_crl_rsync_uri.clone(),
+            earliest_safe_reuse_time: vcir.last_successful_validation_time.clone(),
+        }],
+    }
+}
+
 #[test]
 fn vcir_ccr_manifest_projection_validate_accepts_valid_projection() {
     let projection = sample_ccr_manifest_projection(
@@ -332,7 +354,8 @@ fn vcir_ccr_manifest_projection_validate_rejects_invalid_fields() {
 #[test]
 fn roa_cache_projection_from_vcir_keeps_only_roa_vrp_outputs() {
     let vcir = sample_vcir("rsync://example.test/repo/current.mft");
-    let projection = RoaCacheProjection::from_vcir(&vcir)
+    let context = roa_cache_projection_context(&vcir);
+    let projection = RoaCacheProjection::from_vcir_with_context(&vcir, Some(&context))
         .expect("projection build")
         .expect("projection exists");
 
@@ -366,7 +389,8 @@ fn roa_cache_projection_groups_multiple_outputs_by_roa_uri() {
     vcir.local_outputs.push(second);
     vcir.summary.local_vrp_count = 2;
 
-    let projection = RoaCacheProjection::from_vcir(&vcir)
+    let context = roa_cache_projection_context(&vcir);
+    let projection = RoaCacheProjection::from_vcir_with_context(&vcir, Some(&context))
         .expect("projection build")
         .expect("projection exists");
 
@@ -748,7 +772,8 @@ fn roa_cache_projection_rejects_duplicate_uri_with_different_hash() {
     vcir.local_outputs.push(duplicate);
     vcir.summary.local_vrp_count = 2;
 
-    let err = RoaCacheProjection::from_vcir(&vcir)
+    let context = roa_cache_projection_context(&vcir);
+    let err = RoaCacheProjection::from_vcir_with_context(&vcir, Some(&context))
         .expect_err("same ROA URI with different hash must fail");
     assert!(err.to_string().contains("source object hash mismatch"));
 }