Skip to content

Commit cdd6de2

Browse files
ramonpetgrave64ramonpetgrave64
committed
add cli test for v2, using local rekorv2
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
1 parent 2d50e48 commit cdd6de2

File tree

2 files changed

+180
-1
lines changed

2 files changed

+180
-1
lines changed

‎test/assets/integration/trust_config/config.v1.rekorv2_local.json

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
{
2+
"trustedRoot": {
3+
"mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
4+
"tlogs": [
5+
{
6+
"hashAlgorithm": "SHA2_256",
7+
"publicKey": {
8+
"rawBytes": "MCowBQYDK2VwAyEAREvJyNZGjX6B3DAIuD3BTg9rIwV00GY8Xg5FU+IFDUQ=",
9+
"keyDetails": "PKIX_ED25519",
10+
"validFor": {
11+
"start": "1970-01-01T00:00:00Z"
12+
}
13+
},
14+
"logId": {
15+
"keyId": "tAlACZWkUrif9Z9sOIrpk1ak1I8loRNufk79N6l1SNg="
16+
}
17+
}
18+
],
19+
"certificateAuthorities": [
20+
{
21+
"subject": {
22+
"organization": "sigstore.dev",
23+
"commonName": "sigstore"
24+
},
25+
"certChain": {
26+
"certificates": [
27+
{
28+
"rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
29+
},
30+
{
31+
"rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
32+
}
33+
]
34+
},
35+
"validFor": {
36+
"start": "2021-10-07T13:56:59Z"
37+
}
38+
}
39+
],
40+
"ctlogs": [
41+
{
42+
"hashAlgorithm": "SHA2_256",
43+
"publicKey": {
44+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbbQiLx6GKy6ivhc11wJGbQjc2VX/mnuk5d670MTXR3p+LIAcxd5MhqIHpLmyYJ5mDKLEoZ/pC0nPuje3JueBcA==",
45+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
46+
"validFor": {
47+
"start": "1970-01-01T00:00:00Z"
48+
}
49+
},
50+
"logId": {
51+
"keyId": "ekJiz/ZpG+UEn5w/GaIr6+awI+RKfkpt/V9Teu7va1k="
52+
}
53+
},
54+
{
55+
"baseUrl": "https://ctfe.sigstore.dev/2022",
56+
"hashAlgorithm": "SHA2_256",
57+
"publicKey": {
58+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==",
59+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
60+
"validFor": {
61+
"start": "2022-10-20T00:00:00.000Z"
62+
}
63+
},
64+
"logId": {
65+
"keyId": "3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="
66+
}
67+
}
68+
],
69+
"timestampAuthorities": [
70+
{
71+
"subject": {
72+
"organization": "sigstore.dev",
73+
"commonName": "sigstore-tsa-selfsigned"
74+
},
75+
"certChain": {
76+
"certificates": [
77+
{
78+
"rawBytes": "MIICDzCCAZagAwIBAgIUCjWhBmHV4kFzxomWp/J98n4DfKcwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTAzMjgwOTE0MDZaFw0zNTAzMjYwODE0MDZaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEx1v5F3HpD9egHuknpBFlRz7QBRDJu4aeVzt9zJLRY0lvmx1lF7WBM2c9AN8ZGPQsmDqHlJN2R/7+RxLkvlLzkc19IOx38t7mGGEcB7agUDdCF/Ky3RTLSK0Xo/0AgHQdo2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFKj8ZPYo3i7mO3NPVIxSxOGc3VOlMB8GA1UdIwQYMBaAFDsgRlletTJNRzDObmPuc3RH8gR9MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2cAMGQCMESvVS6GGtF33+J19TfwENWJXjRv4i0/HQFwLUSkX6TfV7g0nG8VnqNHJLvEpAtOjQIwUD3uywTXorQP1DgbV09rF9Yen+CEqs/iEpieJWPst280SSOZ5Na+dyPVk9/8SFk6"
79+
},
80+
{
81+
"rawBytes": "MIIB9zCCAXygAwIBAgIUCPExEFKiQh0dP4sp5ltmSYSSkFUwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTAzMjgwOTE0MDZaFw0zNTAzMjYwODE0MDZaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATt0tIDWyo4ARfL9BaSo0W5bJQEbKJTU/u7llvdjSI5aTkOAJa8tixn2+LEfPG4dMFdsMPtsIuU1qn2OqFiuMk6vHv/c+az25RQVY1oo50iMb0jIL3N4FgwhPFpZnCbQPOjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQ7IEZZXrUyTUcwzm5j7nN0R/IEfTAKBggqhkjOPQQDAwNpADBmAjEA2MI1VXgbf3dUOSc95hSRypBKOab18eh2xzQtxUsHvWeY+1iFgyMluUuNR6taoSmFAjEA31m2czguZhKYX+4JSKu5pRYhBTXAd8KKQ3xdPRX/qCaLvT2qJAEQ1YQM3EJRrtI7"
82+
}
83+
]
84+
},
85+
"validFor": {
86+
"start": "2025-03-28T09:14:06Z"
87+
}
88+
}
89+
]
90+
},
91+
"signingConfig": {
92+
"mediaType": "application/vnd.dev.sigstore.signingconfig.v0.2+json",
93+
"caUrls": [
94+
{
95+
"url": "https://fulcio.sigstore.dev",
96+
"majorApiVersion": 1,
97+
"validFor": {
98+
"start": "2023-04-14T21:38:40Z"
99+
}
100+
}
101+
],
102+
"oidcUrls": [
103+
{
104+
"url": "https://accounts.google.com",
105+
"majorApiVersion": 1,
106+
"validFor": {
107+
"start": "2025-04-16T00:00:00Z"
108+
}
109+
}
110+
],
111+
"rekorTlogUrls": [
112+
{
113+
"url": "http://localhost:3003",
114+
"majorApiVersion": 2,
115+
"validFor": {
116+
"start": "2021-01-12T11:53:27Z"
117+
}
118+
}
119+
],
120+
"tsaUrls": [
121+
{
122+
"url": "https://timestamp.sigstage.dev/api/v1/timestamp",
123+
"majorApiVersion": 1,
124+
"validFor": {
125+
"start": "2025-04-09T00:00:00Z"
126+
}
127+
}
128+
],
129+
"rekorTlogConfig": {
130+
"selector": "ANY"
131+
},
132+
"tsaConfig": {
133+
"selector": "ANY"
134+
}
135+
},
136+
"mediaType": "application/vnd.dev.sigstore.clienttrustconfig.v0.1+json"
137+
}

‎test/integration/cli/test_sign.py

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
import pytest
1818

19+
from sigstore._internal.trust import ClientTrustConfig
1920
from sigstore.models import Bundle
2021
from sigstore.verify import Verifier
2122
from sigstore.verify.policy import UnsafeNoOp
@@ -29,8 +30,12 @@ def get_cli_params(
2930
bundle_path: Optional[Path] = None,
3031
signature_path: Optional[Path] = None,
3132
certificate_path: Optional[Path] = None,
33+
trust_config_path: Optional[Path] = None,
3234
) -> list[str]:
33-
cli_params = ["--staging", "sign"]
35+
if trust_config_path is not None:
36+
cli_params = ["--trust-config", str(trust_config_path), "sign"]
37+
else:
38+
cli_params = ["--staging", "sign"]
3439
if output_directory is not None:
3540
cli_params.extend(["--output-directory", str(output_directory)])
3641
if bundle_path is not None:
@@ -81,6 +86,43 @@ def test_sign_success_default_output_bundle(capsys, sigstore, asset_integration)
8186
)
8287

8388

89+
@pytest.mark.ambient_oidc
90+
def test_sign_success_default_output_bundle_with_trust_config(capsys, sigstore, asset_integration):
91+
artifact = asset_integration("a.txt")
92+
expected_output_bundle = artifact.with_name("a.txt.sigstore.json")
93+
94+
trust_config = asset_integration(
95+
"trust_config/config.v1.rekorv2_local.json")
96+
97+
assert not expected_output_bundle.exists()
98+
sigstore(
99+
*get_cli_params(
100+
artifact_paths=[artifact],
101+
trust_config_path=trust_config
102+
)
103+
)
104+
105+
assert expected_output_bundle.exists()
106+
verifier = Verifier._from_trust_config(ClientTrustConfig.from_json(
107+
trust_config.read_text()
108+
))
109+
with (
110+
open(expected_output_bundle, "r") as bundle_file,
111+
open(artifact, "rb") as input_file,
112+
):
113+
bundle = Bundle.from_json(bundle_file.read())
114+
verifier.verify_artifact(
115+
input_=input_file.read(), bundle=bundle, policy=UnsafeNoOp()
116+
)
117+
118+
expected_output_bundle.unlink()
119+
120+
captures = capsys.readouterr()
121+
assert captures.out.endswith(
122+
f"Sigstore bundle written to {expected_output_bundle}\n"
123+
)
124+
125+
84126
@pytest.mark.staging
85127
@pytest.mark.ambient_oidc
86128
def test_sign_success_custom_outputs(capsys, sigstore, asset_integration, tmp_path):

0 commit comments

Comments
 (0)