From 71dcf613dd87f27cb118f805cc7fce1a94555d59 Mon Sep 17 00:00:00 2001 From: Brian Charbonneau Date: Sun, 9 Aug 2026 02:41:34 -0700 Subject: [PATCH 1/2] test(cli): certify private CA websocket trust Signed-off-by: Brian Charbonneau --- Cargo.lock | 2 +- crates/buzz-cli/src/lib.rs | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/Cargo.lock b/Cargo.lock index c5b10dc1a2a..3ff205512ae 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9869,11 +9869,11 @@ dependencies = [ "futures-util", "log", "rustls", + "rustls-native-certs", "rustls-pki-types", "tokio", "tokio-rustls", "tungstenite 0.29.0", - "webpki-roots 0.26.11", ] [[package]] diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs index 4841236bd4f..2fe57c31fdd 100644 --- a/crates/buzz-cli/src/lib.rs +++ b/crates/buzz-cli/src/lib.rs @@ -2028,6 +2028,22 @@ async fn run(cli: Cli) -> Result<(), CliError> { #[cfg(test)] mod tests { use super::*; + + #[tokio::test] + #[ignore = "requires BUZZ_TEST_WSS_URL and network access"] + async fn configured_wss_trusts_native_platform_roots() { + let _ = rustls::crypto::ring::default_provider().install_default(); + let url = std::env::var("BUZZ_TEST_WSS_URL") + .expect("BUZZ_TEST_WSS_URL must name the WSS endpoint to verify"); + + let connection = buzz_ws_client::NostrWsConnection::connect(&url) + .await + .expect("configured WSS endpoint should trust the platform certificate store"); + connection + .disconnect() + .await + .expect("configured WSS endpoint should close cleanly"); + } use clap::CommandFactory; /// Raw shorthand `[auth,hex,,hex]` normalizes to strict JSON; the empty From 0f4742d47a95a64491db98b00afe702925136cfa Mon Sep 17 00:00:00 2001 From: Brian Charbonneau Date: Sun, 9 Aug 2026 03:01:29 -0700 Subject: [PATCH 2/2] test(desktop): avoid passphrase separator collisions Signed-off-by: Brian Charbonneau --- desktop/src-tauri/src/key_backup_tests.rs | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/desktop/src-tauri/src/key_backup_tests.rs b/desktop/src-tauri/src/key_backup_tests.rs index b9713201e17..4e83672a45c 100644 --- a/desktop/src-tauri/src/key_backup_tests.rs +++ b/desktop/src-tauri/src/key_backup_tests.rs @@ -211,12 +211,16 @@ fn generated_passphrase_respects_word_count_and_separator() { #[test] fn generated_passphrase_clamps_word_count() { + // Use a separator that cannot appear in the EFF wordlist so a generated + // word such as "yo-yo" cannot be mistaken for two words. + const SEPARATOR: &str = "|"; + // Below the floor: clamped up to MIN_PASSPHRASE_WORDS, never shorter. - let phrase = generate_passphrase(1, "-").unwrap(); - assert_eq!(phrase.split('-').count(), MIN_PASSPHRASE_WORDS); + let phrase = generate_passphrase(1, SEPARATOR).unwrap(); + assert_eq!(phrase.split(SEPARATOR).count(), MIN_PASSPHRASE_WORDS); // Above the ceiling: clamped down to MAX_PASSPHRASE_WORDS. - let phrase = generate_passphrase(50, "-").unwrap(); - assert_eq!(phrase.split('-').count(), MAX_PASSPHRASE_WORDS); + let phrase = generate_passphrase(50, SEPARATOR).unwrap(); + assert_eq!(phrase.split(SEPARATOR).count(), MAX_PASSPHRASE_WORDS); } #[test]