fix tests. new product advisories enhancements

2026-01-25 19:11:36 +02:00
parent c70e83719e
commit 6e687b523a
504 changed files with 40610 additions and 3785 deletions
--- a/devops/trust-repo-template/scripts/add-target.sh
+++ b/devops/trust-repo-template/scripts/add-target.sh
@@ -0,0 +1,150 @@
+#!/bin/bash
+# -----------------------------------------------------------------------------
+# add-target.sh
+# Sprint: SPRINT_20260125_001_Attestor_tuf_trust_foundation
+# Task: TUF-006 - Create TUF repository structure template
+# Description: Add a new target file to the TUF repository
+# -----------------------------------------------------------------------------
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+usage() {
+    echo "Usage: $0 <source-file> <target-name> [options]"
+    echo ""
+    echo "Add a target file to the TUF repository."
+    echo ""
+    echo "Options:"
+    echo "  --repo DIR         Repository directory (default: current directory)"
+    echo "  --custom-hash HASH Override SHA256 hash (for testing only)"
+    echo "  -h, --help         Show this help message"
+    echo ""
+    echo "Example:"
+    echo "  $0 /path/to/rekor-key.pub rekor-key-v1"
+    echo "  $0 /path/to/services.json sigstore-services-v1 --repo /var/lib/tuf"
+    exit 1
+}
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+
+SOURCE_FILE=""
+TARGET_NAME=""
+REPO_DIR="."
+CUSTOM_HASH=""
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --repo)
+            REPO_DIR="$2"
+            shift 2
+            ;;
+        --custom-hash)
+            CUSTOM_HASH="$2"
+            shift 2
+            ;;
+        -h|--help)
+            usage
+            ;;
+        *)
+            if [[ -z "$SOURCE_FILE" ]]; then
+                SOURCE_FILE="$1"
+            elif [[ -z "$TARGET_NAME" ]]; then
+                TARGET_NAME="$1"
+            else
+                log_error "Unknown argument: $1"
+                usage
+            fi
+            shift
+            ;;
+    esac
+done
+
+if [[ -z "$SOURCE_FILE" ]] || [[ -z "$TARGET_NAME" ]]; then
+    log_error "Source file and target name are required"
+    usage
+fi
+
+if [[ ! -f "$SOURCE_FILE" ]]; then
+    log_error "Source file not found: $SOURCE_FILE"
+    exit 1
+fi
+
+if [[ ! -f "$REPO_DIR/targets.json" ]]; then
+    log_error "Not a TUF repository: $REPO_DIR (targets.json not found)"
+    exit 1
+fi
+
+# Calculate file hash and size
+FILE_SIZE=$(stat -f%z "$SOURCE_FILE" 2>/dev/null || stat -c%s "$SOURCE_FILE")
+if [[ -n "$CUSTOM_HASH" ]]; then
+    FILE_HASH="$CUSTOM_HASH"
+else
+    FILE_HASH=$(openssl dgst -sha256 -hex "$SOURCE_FILE" | awk '{print $2}')
+fi
+
+log_info "Adding target: $TARGET_NAME"
+log_info "  Source: $SOURCE_FILE"
+log_info "  Size: $FILE_SIZE bytes"
+log_info "  SHA256: $FILE_HASH"
+
+# Copy file to targets directory
+TARGETS_DIR="$REPO_DIR/targets"
+mkdir -p "$TARGETS_DIR"
+cp "$SOURCE_FILE" "$TARGETS_DIR/$TARGET_NAME"
+
+# Update targets.json
+# This is a simplified implementation - production should use proper JSON manipulation
+TARGETS_JSON="$REPO_DIR/targets.json"
+
+# Read current version
+CURRENT_VERSION=$(grep -o '"version"[[:space:]]*:[[:space:]]*[0-9]*' "$TARGETS_JSON" | head -1 | grep -o '[0-9]*')
+NEW_VERSION=$((CURRENT_VERSION + 1))
+
+# Calculate new expiry (30 days from now)
+NEW_EXPIRES=$(date -u -d "+30 days" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v+30d +%Y-%m-%dT%H:%M:%SZ)
+
+log_info "Updating targets.json (version $CURRENT_VERSION -> $NEW_VERSION)"
+
+# Create new targets entry
+python3 - "$TARGETS_JSON" "$TARGET_NAME" "$FILE_SIZE" "$FILE_HASH" "$NEW_VERSION" "$NEW_EXPIRES" << 'PYTHON_SCRIPT'
+import json
+import sys
+
+targets_file = sys.argv[1]
+target_name = sys.argv[2]
+file_size = int(sys.argv[3])
+file_hash = sys.argv[4]
+new_version = int(sys.argv[5])
+new_expires = sys.argv[6]
+
+with open(targets_file, 'r') as f:
+    data = json.load(f)
+
+data['signed']['version'] = new_version
+data['signed']['expires'] = new_expires
+data['signed']['targets'][target_name] = {
+    'length': file_size,
+    'hashes': {
+        'sha256': file_hash
+    }
+}
+
+# Clear signatures (need to re-sign)
+data['signatures'] = []
+
+with open(targets_file, 'w') as f:
+    json.dump(data, f, indent=2)
+
+print(f"Updated {targets_file}")
+PYTHON_SCRIPT
+
+log_info ""
+log_info "Target added successfully!"
+log_warn "IMPORTANT: targets.json signatures have been cleared."
+log_warn "Run the signing script to re-sign metadata before publishing."