@scalebun-release/react-native 2.5.0

package/ios/OtaTests/ScaleBunOtaVerifierTests.swift

@@ -0,0 +1,548 @@
+import Foundation
+import XCTest
+@testable import scalebun_react_native
+
+/**
+ * SB-OTA-RSA-SHA256-V1 — iOS verifier conformance (PROMPT §23).
+ *
+ * Runs against the SHARED committed fixtures in `packages/ota-protocol/fixtures`:
+ * the same bytes the Node codec, the backend, the JVM parity harness
+ * (`tools/rsa-ota-parity/RsaOtaParity.java`) and the Android instrumented test
+ * consume. Nothing here is transcribed from those files — every constant is READ
+ * from them at run time, so a fixture regeneration the iOS side has not followed
+ * fails this suite instead of passing it against stale copies. That is what makes
+ * "Android and iOS agree" a claim with evidence behind it, rather than two suites
+ * that happen to be green at the same time.
+ *
+ * The case list deliberately mirrors the JVM harness (modulus policy via the
+ * registry, genuine verify, payload mutation, signature mutation, bounds-checked
+ * parse, truncation at every boundary, trailing byte) plus the policy checks only
+ * the verifier performs: key resolution, project/application/platform binding and
+ * the anti-downgrade floor.
+ *
+ * HOW IT RUNS
+ *   • CI / locally on a Mac:  `swift test`  from the repo root (Package.swift).
+ *     No Xcode project, no scheme, no simulator — the verifier is pure
+ *     Foundation/Security/CommonCrypto.
+ *   • In a host app's XCTest target (device or simulator): add this file to the
+ *     target and point `SB_OTA_FIXTURES` at a copy of the fixtures directory.
+ *     Without fixtures the suite FAILS; it never skips, because a silent skip is
+ *     indistinguishable from a pass in a CI log.
+ */
+
+// MARK: - Shared fixtures
+
+private enum FixtureError: Error, CustomStringConvertible {
+    case rootNotFound
+    case fileUnreadable(String)
+    case field(String, String)
+
+    var description: String {
+        switch self {
+        case .rootNotFound:
+            return "Could not locate packages/ota-protocol/fixtures. Set SB_OTA_FIXTURES to its path "
+                + "(expected when running inside a host app, where the repository is not on disk)."
+        case .fileUnreadable(let p):
+            return "fixture not readable: \(p)"
+        case .field(let file, let f):
+            return "\(file): field missing or of the wrong type: \(f)"
+        }
+    }
+}
+
+/// One `vectors/<name>.json` conformance vector, exactly as it exists on disk.
+private struct OtaVector {
+    let name: String
+    let keyId: String
+    let spkiPem: String
+    let fingerprint: String
+    let signedPayloadB64: String
+    let signedPayloadHex: String
+    let signedPayloadLength: Int
+    let signatureB64: String
+    let payloadBytes: [UInt8]
+    let signatureBytes: [UInt8]
+    let decoded: [String: Any]
+
+    func string(_ key: String) throws -> String {
+        guard let v = decoded[key] as? String else { throw FixtureError.field(name, "decoded.\(key)") }
+        return v
+    }
+
+    /// JSONSerialization hands back NSNumber; go through `int64Value` rather than
+    /// a conditional cast so a large `releaseSequence` cannot quietly stop matching.
+    func int64(_ key: String) throws -> Int64 {
+        guard let v = (decoded[key] as? NSNumber)?.int64Value else {
+            throw FixtureError.field(name, "decoded.\(key)")
+        }
+        return v
+    }
+}
+
+private enum OtaFixtures {
+    /// `$SB_OTA_FIXTURES` wins; otherwise walk up from this source file until a
+    /// directory is found that holds the fixtures. `#filePath` is an absolute path
+    /// baked in at compile time — exactly right for `swift test` on a checkout, and
+    /// exactly wrong on a device, which is what the environment override is for.
+    static func root() throws -> URL {
+        if let env = ProcessInfo.processInfo.environment["SB_OTA_FIXTURES"], !env.isEmpty {
+            return URL(fileURLWithPath: env, isDirectory: true)
+        }
+        var dir = URL(fileURLWithPath: #filePath).deletingLastPathComponent()
+        for _ in 0..<12 {
+            let candidate = dir
+                .appendingPathComponent("packages", isDirectory: true)
+                .appendingPathComponent("ota-protocol", isDirectory: true)
+                .appendingPathComponent("fixtures", isDirectory: true)
+            let probe = candidate
+                .appendingPathComponent("vectors", isDirectory: true)
+                .appendingPathComponent("full.json")
+            if FileManager.default.fileExists(atPath: probe.path) { return candidate }
+            let parent = dir.deletingLastPathComponent()
+            if parent.path == dir.path { break }
+            dir = parent
+        }
+        throw FixtureError.rootNotFound
+    }
+
+    static func text(_ components: [String]) throws -> String {
+        var url = try root()
+        for c in components { url = url.appendingPathComponent(c) }
+        guard let data = FileManager.default.contents(atPath: url.path),
+              let s = String(data: data, encoding: .utf8) else {
+            throw FixtureError.fileUnreadable(url.path)
+        }
+        // Line endings are a checkout setting, not a fact about the fixture.
+        return s.replacingOccurrences(of: "\r\n", with: "\n")
+    }
+
+    static func vector(_ name: String) throws -> OtaVector {
+        let raw = try text(["vectors", "\(name).json"])
+        guard let data = raw.data(using: .utf8),
+              let root = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            throw FixtureError.field(name, "<root object>")
+        }
+        func str(_ k: String) throws -> String {
+            guard let v = root[k] as? String else { throw FixtureError.field(name, k) }
+            return v
+        }
+        guard let decoded = root["decoded"] as? [String: Any] else {
+            throw FixtureError.field(name, "decoded")
+        }
+        guard let length = (root["signedPayloadLength"] as? NSNumber)?.intValue else {
+            throw FixtureError.field(name, "signedPayloadLength")
+        }
+        let payloadB64 = try str("signedPayloadBase64")
+        let signatureB64 = try str("signatureBase64")
+        guard let payload = Data(base64Encoded: payloadB64) else {
+            throw FixtureError.field(name, "signedPayloadBase64 (not base64)")
+        }
+        guard let signature = Data(base64Encoded: signatureB64) else {
+            throw FixtureError.field(name, "signatureBase64 (not base64)")
+        }
+        return OtaVector(
+            name: name,
+            keyId: try str("keyId"),
+            spkiPem: try str("publicKeySpkiPem"),
+            fingerprint: try str("publicKeyFingerprintSha256"),
+            signedPayloadB64: payloadB64,
+            signedPayloadHex: try str("signedPayloadHex"),
+            signedPayloadLength: length,
+            signatureB64: signatureB64,
+            payloadBytes: [UInt8](payload),
+            signatureBytes: [UInt8](signature),
+            decoded: decoded
+        )
+    }
+}
+
+// MARK: - Tests
+
+final class ScaleBunOtaVerifierTests: XCTestCase {
+
+    // MARK: helpers
+
+    /// Builds the trusted-key JSON the registry consumes through JSONSerialization
+    /// rather than string interpolation — a PEM carries newlines, and hand-escaping
+    /// them is how a harness acquires a bug that presents as a crypto failure.
+    private func registryJson(projectId: String, keys: [(keyId: String, pem: String)]) throws -> String {
+        let obj: [String: Any] = [
+            "projectId": projectId,
+            "keys": keys.map { ["keyId": $0.keyId, "publicKey": $0.pem] },
+        ]
+        let data = try JSONSerialization.data(withJSONObject: obj)
+        return try XCTUnwrap(String(data: data, encoding: .utf8))
+    }
+
+    private func registry(for vector: OtaVector, projectIdOverride: String? = nil) throws -> ScaleBunOtaKeyRegistry {
+        let projectId: String
+        if let override = projectIdOverride {
+            projectId = override
+        } else {
+            projectId = try vector.string("projectId")
+        }
+        let json = try registryJson(
+            projectId: projectId,
+            keys: [(keyId: vector.keyId, pem: vector.spkiPem)]
+        )
+        return try ScaleBunOtaKeyRegistry.fromJson(json)
+    }
+
+    private func emptyRegistry(for vector: OtaVector) throws -> ScaleBunOtaKeyRegistry {
+        let projectId = try vector.string("projectId")
+        let json = try registryJson(projectId: projectId, keys: [])
+        return try ScaleBunOtaKeyRegistry.fromJson(json)
+    }
+
+    /// The device context the vector is supposed to satisfy, taken FROM the vector
+    /// so a regenerated fixture cannot silently stop being checked.
+    private func context(
+        for vector: OtaVector,
+        currentSequence: Int64 = 0,
+        applicationIdOverride: String? = nil,
+        platformOverride: String? = nil
+    ) throws -> ExpectedContext {
+        let applicationId: String
+        if let override = applicationIdOverride {
+            applicationId = override
+        } else {
+            applicationId = try vector.string("applicationId")
+        }
+        let platform: String
+        if let override = platformOverride {
+            platform = override
+        } else {
+            platform = try vector.string("platform")
+        }
+        // Just after the vector's issuedAt. Both committed vectors carry
+        // expiresAt == 0, so the RELEASE_EXPIRED branch is not reachable from
+        // these fixtures and is deliberately not asserted here.
+        let now = try vector.int64("issuedAtEpochSeconds") + 60
+        return ExpectedContext(
+            projectId: try vector.string("projectId"),
+            applicationId: applicationId,
+            currentSequence: currentSequence,
+            nowEpochSeconds: now,
+            platform: platform
+        )
+    }
+
+    private func envelope(
+        _ vector: OtaVector,
+        payloadB64: String? = nil,
+        signatureB64: String? = nil,
+        keyId: String? = nil,
+        protocolName: String? = nil
+    ) throws -> String {
+        let obj: [String: Any] = [
+            "protocol": protocolName ?? OtaProtocol.signatureAlgorithm,
+            "keyId": keyId ?? vector.keyId,
+            "signedPayload": payloadB64 ?? vector.signedPayloadB64,
+            "signature": signatureB64 ?? vector.signatureB64,
+        ]
+        let data = try JSONSerialization.data(withJSONObject: obj)
+        return try XCTUnwrap(String(data: data, encoding: .utf8))
+    }
+
+    // MARK: the fixtures are present, and describe one key
+
+    func testFixturesResolveAndAgreeWithTheKeyFiles() throws {
+        let full = try OtaFixtures.vector("full")
+        let patch = try OtaFixtures.vector("patch")
+
+        let pem = try OtaFixtures.text(["keys", "test-public-spki.pem"])
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+        let fingerprint = try OtaFixtures.text(["keys", "test-public-fingerprint.txt"])
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+
+        // The JVM harness reads keys/test-public-spki.pem; the vectors embed their
+        // own copy. If those ever diverge the two sides prove different things.
+        XCTAssertEqual(full.spkiPem.trimmingCharacters(in: .whitespacesAndNewlines), pem)
+        XCTAssertEqual(patch.spkiPem.trimmingCharacters(in: .whitespacesAndNewlines), pem)
+        XCTAssertEqual(full.fingerprint, fingerprint)
+        XCTAssertEqual(patch.fingerprint, fingerprint)
+        XCTAssertEqual(full.keyId, patch.keyId)
+    }
+
+    // MARK: the codec, against each vector's own declared fields
+
+    func testFullVectorParsesToItsDeclaredFields() throws {
+        try assertParseMatchesDecoded(OtaFixtures.vector("full"))
+    }
+
+    func testPatchVectorParsesToItsDeclaredFields() throws {
+        try assertParseMatchesDecoded(OtaFixtures.vector("patch"))
+    }
+
+    private func assertParseMatchesDecoded(_ v: OtaVector) throws {
+        // The strict decoder must accept the committed base64 as canonical and
+        // produce exactly the bytes the fixture says it does.
+        let bytes = try OtaProtocol.decodeBase64Strict(
+            v.signedPayloadB64, OtaProtocol.maxSignedPayloadBytes, "signedPayload"
+        )
+        XCTAssertEqual(bytes, v.payloadBytes, "\(v.name): strict decode disagrees with Foundation's")
+        XCTAssertEqual(bytes.count, v.signedPayloadLength, "\(v.name): signedPayloadLength")
+        XCTAssertEqual(OtaProtocol.toHex(bytes), v.signedPayloadHex, "\(v.name): signedPayloadHex")
+
+        XCTAssertEqual(try OtaProtocol.peekKeyId(bytes), v.keyId, "\(v.name): peekKeyId")
+
+        let p = try OtaProtocol.parse(bytes)
+        XCTAssertEqual(p.signatureAlgorithm, try v.string("signatureAlgorithm"))
+        XCTAssertEqual(p.hashAlgorithm, try v.string("hashAlgorithm"))
+        XCTAssertEqual(p.keyId, try v.string("keyId"))
+        XCTAssertEqual(p.projectId, try v.string("projectId"))
+        XCTAssertEqual(p.applicationId, try v.string("applicationId"))
+        XCTAssertEqual(p.releaseId, try v.string("releaseId"))
+        XCTAssertEqual(p.bundleId, try v.string("bundleId"))
+        XCTAssertEqual(p.platform, try v.string("platform"))
+        XCTAssertEqual(p.artifactType, try v.string("artifactType"))
+        XCTAssertEqual(p.targetAppVersion, try v.string("targetAppVersion"))
+        XCTAssertEqual(p.targetRuntimeVersion, try v.string("targetRuntimeVersion"))
+        XCTAssertEqual(p.minimumSdkVersion, try v.string("minimumSdkVersion"))
+        XCTAssertEqual(p.releaseSequence, try v.int64("releaseSequence"))
+        XCTAssertEqual(p.issuedAtEpochSeconds, try v.int64("issuedAtEpochSeconds"))
+        XCTAssertEqual(p.expiresAtEpochSeconds, try v.int64("expiresAtEpochSeconds"))
+        XCTAssertEqual(p.artifactSize, try v.int64("artifactSize"))
+        XCTAssertEqual(p.artifactSha256, try v.string("artifactSha256"))
+        XCTAssertEqual(p.baseBundleId, try v.string("baseBundleId"))
+        XCTAssertEqual(p.baseArtifactSha256, try v.string("baseArtifactSha256"))
+        XCTAssertEqual(p.resultArtifactSha256, try v.string("resultArtifactSha256"))
+    }
+
+    /// JVM harness case 6 — a short read throws at every boundary, and never
+    /// returns a half-parsed record.
+    func testTruncationAtEveryBoundaryRejected() throws {
+        for name in ["full", "patch"] {
+            let v = try OtaFixtures.vector(name)
+            for cut in 0..<v.payloadBytes.count {
+                XCTAssertThrowsError(
+                    try OtaProtocol.parse(Array(v.payloadBytes[0..<cut])),
+                    "\(name): payload truncated to \(cut) bytes parsed instead of throwing"
+                )
+            }
+        }
+    }
+
+    /// JVM harness case 7 — trailing bytes are a parse failure, not slack.
+    func testTrailingByteRejected() throws {
+        for name in ["full", "patch"] {
+            let v = try OtaFixtures.vector(name)
+            XCTAssertThrowsError(try OtaProtocol.parse(v.payloadBytes + [0x00]), "\(name): trailing byte")
+        }
+    }
+
+    /// The strict-base64 gate: same decoded bytes, non-canonical encoding. A
+    /// permissive decoder would let an attacker mint distinct envelope strings for
+    /// one signed payload, which is what the canonicality check exists to stop.
+    func testNonCanonicalBase64Rejected() throws {
+        let v = try OtaFixtures.vector("full")
+        // 296 bytes ≡ 2 (mod 3), so the encoding ends in exactly one '=' and the
+        // final significant character carries two unused bits that must be zero.
+        XCTAssertTrue(v.signedPayloadB64.hasSuffix("="))
+        XCTAssertFalse(v.signedPayloadB64.hasSuffix("=="))
+
+        let alphabet = Array("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/")
+        var chars = Array(v.signedPayloadB64)
+        let idx = try XCTUnwrap(chars.lastIndex(where: { $0 != "=" }))
+        let sextet = try XCTUnwrap(alphabet.firstIndex(of: chars[idx]))
+        chars[idx] = alphabet[(sextet & ~0b11) | 0b01] // set an unused bit
+        let mutated = String(chars)
+
+        XCTAssertNotEqual(mutated, v.signedPayloadB64)
+        XCTAssertNotNil(
+            Data(base64Encoded: mutated),
+            "Foundation still decodes it — the strict gate is what has to refuse it"
+        )
+        XCTAssertThrowsError(
+            try OtaProtocol.decodeBase64Strict(mutated, OtaProtocol.maxSignedPayloadBytes, "signedPayload")
+        )
+    }
+
+    // MARK: the verifier — the question a security questionnaire actually asks
+
+    func testGenuineFullReleaseVerifies() throws {
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v),
+            registry: try registry(for: v)
+        )
+        XCTAssertTrue(verdict.ok, "expected ok, got \(String(describing: verdict.code)): \(verdict.message ?? "")")
+        XCTAssertEqual(verdict.payload?.bundleId, try v.string("bundleId"))
+        XCTAssertEqual(verdict.payload?.releaseSequence, try v.int64("releaseSequence"))
+        XCTAssertEqual(verdict.payload?.platform, try v.string("platform"))
+        // A full release names its own artifact as the result.
+        XCTAssertEqual(verdict.payload?.artifactSha256, verdict.payload?.resultArtifactSha256)
+    }
+
+    /// The fingerprint is SHA-256 over the full SPKI DER, and is what the backend,
+    /// the CLI and Android all report. Equality with the committed value is the
+    /// strongest cross-language check available here: it proves the SPKI→PKCS#1
+    /// unwrap fed `SecKeyCreateWithData` the right key, and that this platform
+    /// names that key the way every other one does.
+    func testTrustedKeyFingerprintMatchesTheSharedFixture() throws {
+        let v = try OtaFixtures.vector("full")
+        let reg = try registry(for: v)
+        let key = try XCTUnwrap(reg.get(v.keyId), "the fixture key was not admitted to the registry")
+        XCTAssertEqual(key.fingerprint, v.fingerprint)
+
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v),
+            registry: reg
+        )
+        XCTAssertEqual(verdict.fingerprint, v.fingerprint)
+    }
+
+    /// JVM harness case 3 — one flipped payload byte, re-encoded canonically on
+    /// purpose so the rejection has to come from the signature check and cannot be
+    /// the base64 gate catching it first.
+    func testOneBytePayloadMutationRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        var bytes = v.payloadBytes
+        bytes[bytes.count - 1] ^= 0x01
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v, payloadB64: Data(bytes).base64EncodedString()),
+            expected: try context(for: v),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .INVALID_SIGNATURE)
+    }
+
+    /// JVM harness case 4 — one flipped signature byte.
+    func testOneByteSignatureMutationRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        var sig = v.signatureBytes
+        sig[sig.count - 1] ^= 0x01
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v, signatureB64: Data(sig).base64EncodedString()),
+            expected: try context(for: v),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .INVALID_SIGNATURE)
+    }
+
+    func testUnknownKeyRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v),
+            registry: try emptyRegistry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .UNKNOWN_KEY_ID)
+    }
+
+    /// The envelope's keyId is unauthenticated metadata; disagreement with the
+    /// signed payload is rejected before any key is resolved.
+    func testEnvelopeKeyIdDisagreeingWithPayloadRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v, keyId: "some-other-key"),
+            expected: try context(for: v),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .INVALID_ENVELOPE)
+    }
+
+    func testDowngradeRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let floor = try v.int64("releaseSequence") + 1
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v, currentSequence: floor),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .RELEASE_DOWNGRADE_REJECTED)
+    }
+
+    func testPlatformMismatchRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let vectorPlatform = try v.string("platform")
+        let other = (vectorPlatform == "ios") ? "android" : "ios"
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v, platformOverride: other),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .PLATFORM_MISMATCH)
+    }
+
+    func testProjectMismatchRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v),
+            registry: try registry(for: v, projectIdOverride: "proj_someone_else")
+        )
+        XCTAssertEqual(verdict.code, .PROJECT_MISMATCH)
+    }
+
+    func testApplicationMismatchRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v, applicationIdOverride: "com.someone.else"),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .APPLICATION_MISMATCH)
+    }
+
+    func testUnsupportedProtocolRejected() throws {
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v, protocolName: "SB-OTA-ED25519-V1"),
+            expected: try context(for: v),
+            registry: try registry(for: v)
+        )
+        XCTAssertEqual(verdict.code, .UNSUPPORTED_PROTOCOL)
+    }
+
+    /// The patch vector is genuinely signed and `OtaProtocol.parse` accepts it, but
+    /// this entry point only admits full releases, so it must stop at the
+    /// artifactType check. Reaching INVALID_SIGNED_PAYLOAD rather than
+    /// INVALID_SIGNATURE is what proves the patch signature verified on the way in.
+    func testGenuinePatchRejectedByTheFullReleaseEntryPoint() throws {
+        let v = try OtaFixtures.vector("patch")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v),
+            registry: try registry(for: v)
+        )
+        XCTAssertFalse(verdict.ok)
+        XCTAssertEqual(verdict.code, .INVALID_SIGNED_PAYLOAD)
+        XCTAssertEqual(verdict.message, "signed payload is not a full release")
+    }
+
+    /// An absent trusted-key resource must fail CLOSED. `fromBundle` on a bundle
+    /// with no ScaleBunOtaKeys.json returns an EMPTY registry, and an empty
+    /// registry can only ever answer UNKNOWN_KEY_ID — never "no keys, so allow it".
+    func testMissingTrustedKeyResourceFailsClosed() throws {
+        let reg = ScaleBunOtaKeyRegistry.fromBundle(Bundle.main, resource: "NoSuchTrustedKeyResource")
+        XCTAssertTrue(reg.isEmpty)
+        XCTAssertTrue(reg.projectId.isEmpty)
+
+        let v = try OtaFixtures.vector("full")
+        let verdict = ScaleBunOtaReleaseVerifier.verify(
+            envelopeJson: try envelope(v),
+            expected: try context(for: v),
+            registry: reg
+        )
+        XCTAssertEqual(verdict.code, .UNKNOWN_KEY_ID)
+    }
+
+    /// A malformed trusted-key config is a hard error at load, not a silently
+    /// empty registry — the difference between "this app trusts nothing" and
+    /// "this app's key file has a typo" must be visible.
+    func testMalformedTrustedKeyConfigRejected() throws {
+        XCTAssertThrowsError(try ScaleBunOtaKeyRegistry.fromJson("{\"projectId\":\"p\"}"))
+        XCTAssertThrowsError(try ScaleBunOtaKeyRegistry.fromJson("not json"))
+
+        let v = try OtaFixtures.vector("full")
+        // Duplicate keyIds are rejected rather than last-one-wins.
+        let dupes = try registryJson(
+            projectId: v.string("projectId"),
+            keys: [(keyId: v.keyId, pem: v.spkiPem), (keyId: v.keyId, pem: v.spkiPem)]
+        )
+        XCTAssertThrowsError(try ScaleBunOtaKeyRegistry.fromJson(dupes))
+    }
+}