From be6a8af4bd502695438e97a78af927ce105a42db Mon Sep 17 00:00:00 2001
From: Rodney Osodo <socials@rodneyosodo.com>
Date: Mon, 3 Aug 2026 16:28:42 +0300
Subject: [PATCH] feat(spec): add WASM media types and encryption test

Signed-off-by: Rodney Osodo <socials@rodneyosodo.com>
---
 encryption_test.go | 57 ++++++++++++++++++++++++++++++++++++++++++++++
 spec/spec.go       |  4 ++++
 2 files changed, 61 insertions(+)

diff --git a/encryption_test.go b/encryption_test.go
index f76de5d..e02bb6d 100644
--- a/encryption_test.go
+++ b/encryption_test.go
@@ -23,6 +23,7 @@ import (
 	"testing"
 
 	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/spec"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
@@ -141,3 +142,59 @@ func TestEncryptLayer(t *testing.T) {
 		t.Fatalf("Expected %v, got %v", data, decLayer)
 	}
 }
+
+func TestWasmMediaTypeEncryption(t *testing.T) {
+	if spec.MediaTypeWasmEnc != spec.MediaTypeWasmLayer+"+encrypted" {
+		t.Fatalf("Expected encrypted WASM media type %q, got %q", spec.MediaTypeWasmLayer+"+encrypted", spec.MediaTypeWasmEnc)
+	}
+
+	data := []byte("This is WASM module data!")
+	desc := ocispec.Descriptor{
+		Digest:    digest.FromBytes(data),
+		Size:      int64(len(data)),
+		MediaType: spec.MediaTypeWasmLayer,
+	}
+
+	dataReader := bytes.NewReader(data)
+
+	encLayerReader, encLayerFinalizer, err := EncryptLayer(ec, dataReader, desc)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	encLayer := make([]byte, 1024)
+	encsize, err := encLayerReader.Read(encLayer)
+	if err != io.EOF {
+		t.Fatal("Expected EOF")
+	}
+	encLayerReaderAt := bytes.NewReader(encLayer[:encsize])
+
+	annotations, err := encLayerFinalizer()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(annotations) == 0 {
+		t.Fatal("No keys created for annotations")
+	}
+
+	newDesc := ocispec.Descriptor{
+		Annotations: annotations,
+		MediaType:   spec.MediaTypeWasmEnc,
+	}
+
+	decLayerReader, _, err := DecryptLayer(dc, encLayerReaderAt, newDesc, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	decLayer := make([]byte, 1024)
+	decsize, err := decLayerReader.Read(decLayer)
+	if err != nil && err != io.EOF {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(decLayer[:decsize], data) {
+		t.Fatalf("Expected %v, got %v", data, decLayer)
+	}
+}
diff --git a/spec/spec.go b/spec/spec.go
index c0c1718..e8b49e2 100644
--- a/spec/spec.go
+++ b/spec/spec.go
@@ -17,4 +17,8 @@ const (
 	//
 	// Deprecated: Use [MediaTypeLayerNonDistributableZstdEnc].
 	MediaTypeLayerNonDistributableZsdtEnc = MediaTypeLayerNonDistributableZstdEnc
+	// MediaTypeWasmLayer is MIME type used for WASM layers.
+	MediaTypeWasmLayer = "application/vnd.wasm.content.layer.v1+wasm"
+	// MediaTypeWasmEnc is MIME type used for encrypted WASM layers.
+	MediaTypeWasmEnc = MediaTypeWasmLayer + "+encrypted"
 )