chore(deps): update qualification host source

renovate.json

@@ -15,6 +15,20 @@
         "ruff_text_size"
       ],
       "groupName": "Ruff components"
+    },
+    {
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchFileNames": [
+        "tools/extension-qualification/Cargo.toml"
+      ],
+      "matchPackageNames": [
+        "morphir-extension-sdk",
+        "morphir-host",
+        "morphir-host-native"
+      ],
+      "groupName": "qualification host source"
     }
   ]
 }

tests/unit/test_qualification_host_source.py

@@ -0,0 +1,24 @@
+"""Qualification receipts must identify the host source actually built."""
+
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_qualification_receipt_matches_one_host_dependency_revision() -> None:
+    """Prevent mixed host types and falsely attributed qualification reports."""
+    tool = ROOT / "tools" / "extension-qualification"
+    dependencies = tomllib.loads((tool / "Cargo.toml").read_text())["dependencies"]
+    names = ("morphir-extension-sdk", "morphir-host", "morphir-host-native")
+    sources = {(dependencies[name]["git"], dependencies[name]["rev"]) for name in names}
+    assert len(sources) == 1, "Qualification host dependencies must share one source"
+    _, revision = sources.pop()
+    assert re.fullmatch(r"[0-9a-f]{40}", revision)
+    source = (tool / "src" / "main.rs").read_text()
+    declared = re.search(r'const HOST_SOURCE: &str = "([0-9a-f]{40})";', source)
+    assert declared is not None
+    assert declared.group(1) == revision, "Receipt source must match built dependencies"

tools/extension-qualification/Cargo.toml

@@ -13,9 +13,9 @@ publish = false
 anyhow = "1"
 async-trait = "0.1"
 hex = "0.4"
-morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" }
-morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" }
-morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" }
+morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" }
+morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" }
+morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" }
 serde_json = { version = "1", features = ["arbitrary_precision"] }
 serde = { version = "1", features = ["derive"] }
 sha2 = "0.11"

tools/extension-qualification/README.md

@@ -2,7 +2,7 @@
 
 This developer-only executable exercises the actual WASM and native process
 guest bytes through `morphir-host` and `morphir-host-native` at
-`d51daa8aea7ae09ae295ff254d72b27770c64104`. It uses the upstream Extism and
+`945486e1320385e22986ef937db82e344b179d05`. It uses the upstream Extism and
 process channels directly. Process launches have an empty environment and do
 not use Python or a Rust launcher.
 

tools/extension-qualification/src/main.rs

@@ -26,7 +26,7 @@ use std::{
 };
 use tokio::sync::Mutex;
 
-const HOST_SOURCE: &str = "d51daa8aea7ae09ae295ff254d72b27770c64104";
+const HOST_SOURCE: &str = "945486e1320385e22986ef937db82e344b179d05";
 const ID: &str = "morphir-python";
 const TYPES_SOURCE: &str =
     "from dataclasses import dataclass\n@dataclass(frozen=True)\nclass Box:\n    value: int\n";