Align AOC tasks for Excititor and Concelier

src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/StellaOps.Excititor.Attestation.Tests.csproj

@@ -1,19 +1,19 @@
-<?xml version='1.0' encoding='utf-8'?>
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <LangVersion>preview</LangVersion>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <UseConcelierTestInfra>false</UseConcelierTestInfra>
-  </PropertyGroup>
-  <ItemGroup>
-    <Compile Remove="..\..\..\StellaOps.Concelier.Tests.Shared\AssemblyInfo.cs" />
-    <Compile Remove="..\..\..\StellaOps.Concelier.Tests.Shared\MongoFixtureCollection.cs" />
-  </ItemGroup>
-  <ItemGroup>
-    <ProjectReference Include="../../__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj" />
-    <ProjectReference Include="../../__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj" />
-  </ItemGroup>
-</Project>
+<?xml version='1.0' encoding='utf-8'?>
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <LangVersion>preview</LangVersion>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <UseConcelierTestInfra>false</UseConcelierTestInfra>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Remove="..\..\..\StellaOps.Concelier.Tests.Shared\AssemblyInfo.cs" />
+    <Compile Remove="..\..\..\StellaOps.Concelier.Tests.Shared\MongoFixtureCollection.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../../__Libraries/StellaOps.Excititor.Attestation/StellaOps.Excititor.Attestation.csproj" />
+    <ProjectReference Include="../../__Libraries/StellaOps.Excititor.Core/StellaOps.Excititor.Core.csproj" />
+  </ItemGroup>
+</Project>

src/Excititor/__Tests/StellaOps.Excititor.Attestation.Tests/VexAttestationVerifierTests.cs

@@ -1,54 +1,57 @@
 using System.Collections.Immutable;
+using System.Text;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using StellaOps.Cryptography;
 using StellaOps.Excititor.Attestation.Dsse;
 using StellaOps.Excititor.Attestation.Signing;
 using StellaOps.Excititor.Attestation.Transparency;
 using StellaOps.Excititor.Attestation.Verification;
 using StellaOps.Excititor.Core;
-
-namespace StellaOps.Excititor.Attestation.Tests;
-
-public sealed class VexAttestationVerifierTests : IDisposable
-{
-    private readonly VexAttestationMetrics _metrics = new();
-
-    [Fact]
-    public async Task VerifyAsync_ReturnsValid_WhenEnvelopeMatches()
-    {
-        var (request, metadata, envelope) = await CreateSignedAttestationAsync();
-        var verifier = CreateVerifier(options => options.RequireTransparencyLog = false);
-
-        var verification = await verifier.VerifyAsync(
-            new VexAttestationVerificationRequest(request, metadata, envelope),
-            CancellationToken.None);
-
-        Assert.True(verification.IsValid);
-        Assert.Equal("valid", verification.Diagnostics["result"]);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_ReturnsInvalid_WhenDigestMismatch()
-    {
-        var (request, metadata, envelope) = await CreateSignedAttestationAsync();
-        var verifier = CreateVerifier(options => options.RequireTransparencyLog = false);
-
-        var tamperedMetadata = new VexAttestationMetadata(
-            metadata.PredicateType,
-            metadata.Rekor,
-            "sha256:deadbeef",
-            metadata.SignedAt);
-
-        var verification = await verifier.VerifyAsync(
-            new VexAttestationVerificationRequest(request, tamperedMetadata, envelope),
-            CancellationToken.None);
-
-        Assert.False(verification.IsValid);
-        Assert.Equal("invalid", verification.Diagnostics["result"]);
-        Assert.Equal("sha256:deadbeef", verification.Diagnostics["metadata.envelopeDigest"]);
-    }
-
-    [Fact]
+
+namespace StellaOps.Excititor.Attestation.Tests;
+
+public sealed class VexAttestationVerifierTests : IDisposable
+{
+    private readonly VexAttestationMetrics _metrics = new();
+
+    [Fact]
+    public async Task VerifyAsync_ReturnsValid_WhenEnvelopeMatches()
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync();
+        var verifier = CreateVerifier(options => options.RequireTransparencyLog = false);
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(request, metadata, envelope),
+            CancellationToken.None);
+
+        Assert.True(verification.IsValid);
+        Assert.Equal("valid", verification.Diagnostics["result"]);
+    }
+
+    [Fact]
+    public async Task VerifyAsync_ReturnsInvalid_WhenDigestMismatch()
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync();
+        var verifier = CreateVerifier(options => options.RequireTransparencyLog = false);
+
+        var tamperedMetadata = new VexAttestationMetadata(
+            metadata.PredicateType,
+            metadata.Rekor,
+            "sha256:deadbeef",
+            metadata.SignedAt);
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(request, tamperedMetadata, envelope),
+            CancellationToken.None);
+
+        Assert.False(verification.IsValid);
+        Assert.Equal("invalid", verification.Diagnostics["result"]);
+        Assert.Equal("sha256:deadbeef", verification.Diagnostics["metadata.envelopeDigest"]);
+    }
+
+    [Fact]
     public async Task VerifyAsync_AllowsOfflineTransparency_WhenConfigured()
     {
         var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: true);
@@ -65,48 +68,122 @@ public sealed class VexAttestationVerifierTests : IDisposable
 
         Assert.True(verification.IsValid);
         Assert.Equal("offline", verification.Diagnostics["rekor.state"]);
+        Assert.Equal("degraded", verification.Diagnostics["result"]);
     }
 
     [Fact]
     public async Task VerifyAsync_ReturnsInvalid_WhenTransparencyRequiredAndMissing()
-    {
-        var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: false);
-        var verifier = CreateVerifier(options =>
-        {
-            options.RequireTransparencyLog = true;
-            options.AllowOfflineTransparency = false;
-        });
-
-        var verification = await verifier.VerifyAsync(
-            new VexAttestationVerificationRequest(request, metadata, envelope),
-            CancellationToken.None);
-
-        Assert.False(verification.IsValid);
-        Assert.Equal("missing", verification.Diagnostics["rekor.state"]);
-        Assert.Equal("invalid", verification.Diagnostics["result"]);
-    }
-
-    [Fact]
-    public async Task VerifyAsync_ReturnsInvalid_WhenTransparencyUnavailableAndOfflineDisallowed()
-    {
-        var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: true);
-        var transparency = new ThrowingTransparencyLogClient();
-        var verifier = CreateVerifier(options =>
-        {
-            options.RequireTransparencyLog = true;
-            options.AllowOfflineTransparency = false;
-        }, transparency);
-
-        var verification = await verifier.VerifyAsync(
-            new VexAttestationVerificationRequest(request, metadata, envelope),
-            CancellationToken.None);
-
-        Assert.False(verification.IsValid);
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: false);
+        var verifier = CreateVerifier(options =>
+        {
+            options.RequireTransparencyLog = true;
+            options.AllowOfflineTransparency = false;
+        });
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(request, metadata, envelope),
+            CancellationToken.None);
+
+        Assert.False(verification.IsValid);
+        Assert.Equal("missing", verification.Diagnostics["rekor.state"]);
+        Assert.Equal("invalid", verification.Diagnostics["result"]);
+    }
+
+    [Fact]
+    public async Task VerifyAsync_ReturnsInvalid_WhenTransparencyUnavailableAndOfflineDisallowed()
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: true);
+        var transparency = new ThrowingTransparencyLogClient();
+        var verifier = CreateVerifier(options =>
+        {
+            options.RequireTransparencyLog = true;
+            options.AllowOfflineTransparency = false;
+        }, transparency);
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(request, metadata, envelope),
+            CancellationToken.None);
+
+        Assert.False(verification.IsValid);
         Assert.Equal("unreachable", verification.Diagnostics["rekor.state"]);
         Assert.Equal("invalid", verification.Diagnostics["result"]);
     }
 
-    private async Task<(VexAttestationRequest Request, VexAttestationMetadata Metadata, string Envelope)> CreateSignedAttestationAsync(bool includeRekor = false)
+    [Fact]
+    public async Task VerifyAsync_HandlesDuplicateSourceProviders()
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync(
+            includeRekor: false,
+            sourceProviders: ImmutableArray.Create("provider-a", "provider-a"));
+
+        var normalizedRequest = request with { SourceProviders = ImmutableArray.Create("provider-a") };
+        var verifier = CreateVerifier(options => options.RequireTransparencyLog = false);
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(normalizedRequest, metadata, envelope),
+            CancellationToken.None);
+
+        Assert.True(verification.IsValid);
+        Assert.Equal("valid", verification.Diagnostics["result"]);
+    }
+
+    [Fact]
+    public async Task VerifyAsync_ReturnsValid_WhenTrustedSignerConfigured()
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: false);
+        var registry = new StubCryptoProviderRegistry(success: true);
+        var verifier = CreateVerifier(options =>
+        {
+            options.RequireTransparencyLog = false;
+            options.RequireSignatureVerification = true;
+            options.TrustedSigners = ImmutableDictionary<string, VexAttestationVerificationOptions.TrustedSignerOptions>.Empty.Add(
+                "key",
+                new VexAttestationVerificationOptions.TrustedSignerOptions
+                {
+                    Algorithm = StubCryptoProviderRegistry.Algorithm,
+                    KeyReference = StubCryptoProviderRegistry.KeyReference
+                });
+        }, transparency: null, registry: registry);
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(request, metadata, envelope),
+            CancellationToken.None);
+
+        Assert.True(verification.IsValid);
+        Assert.Equal("verified", verification.Diagnostics["signature.state"]);
+    }
+
+    [Fact]
+    public async Task VerifyAsync_ReturnsInvalid_WhenSignatureFailsAndRequired()
+    {
+        var (request, metadata, envelope) = await CreateSignedAttestationAsync(includeRekor: false);
+        var registry = new StubCryptoProviderRegistry(success: false);
+        var verifier = CreateVerifier(options =>
+        {
+            options.RequireTransparencyLog = false;
+            options.RequireSignatureVerification = true;
+            options.TrustedSigners = ImmutableDictionary<string, VexAttestationVerificationOptions.TrustedSignerOptions>.Empty.Add(
+                "key",
+                new VexAttestationVerificationOptions.TrustedSignerOptions
+                {
+                    Algorithm = StubCryptoProviderRegistry.Algorithm,
+                    KeyReference = StubCryptoProviderRegistry.KeyReference
+                });
+        }, transparency: null, registry: registry);
+
+        var verification = await verifier.VerifyAsync(
+            new VexAttestationVerificationRequest(request, metadata, envelope),
+            CancellationToken.None);
+
+        Assert.False(verification.IsValid);
+        Assert.Equal("error", verification.Diagnostics["signature.state"]);
+        Assert.Equal("verification_failed", verification.Diagnostics["signature.reason"]);
+    }
+
+    private async Task<(VexAttestationRequest Request, VexAttestationMetadata Metadata, string Envelope)> CreateSignedAttestationAsync(
+        bool includeRekor = false,
+        ImmutableArray<string>? sourceProviders = null)
     {
         var signer = new FakeSigner();
         var builder = new VexDsseBuilder(signer, NullLogger<VexDsseBuilder>.Instance);
@@ -115,13 +192,14 @@ public sealed class VexAttestationVerifierTests : IDisposable
         var verifier = CreateVerifier(options => options.RequireTransparencyLog = false);
         var client = new VexAttestationClient(builder, options, NullLogger<VexAttestationClient>.Instance, verifier, transparency);
 
+        var providers = sourceProviders ?? ImmutableArray.Create("provider-a");
         var request = new VexAttestationRequest(
             ExportId: "exports/unit-test",
             QuerySignature: new VexQuerySignature("filters"),
             Artifact: new VexContentAddress("sha256", "cafebabe"),
             Format: VexExportFormat.Json,
             CreatedAt: DateTimeOffset.UtcNow,
-            SourceProviders: ImmutableArray.Create("provider-a"),
+            SourceProviders: providers,
             Metadata: ImmutableDictionary<string, string>.Empty);
 
         var response = await client.SignAsync(request, CancellationToken.None);
@@ -129,7 +207,10 @@ public sealed class VexAttestationVerifierTests : IDisposable
         return (request, response.Attestation, envelope);
     }
 
-    private VexAttestationVerifier CreateVerifier(Action<VexAttestationVerificationOptions>? configureOptions = null, ITransparencyLogClient? transparency = null)
+    private VexAttestationVerifier CreateVerifier(
+        Action<VexAttestationVerificationOptions>? configureOptions = null,
+        ITransparencyLogClient? transparency = null,
+        ICryptoProviderRegistry? registry = null)
     {
         var options = new VexAttestationVerificationOptions();
         configureOptions?.Invoke(options);
@@ -137,7 +218,8 @@ public sealed class VexAttestationVerifierTests : IDisposable
             NullLogger<VexAttestationVerifier>.Instance,
             transparency,
             Options.Create(options),
-            _metrics);
+            _metrics,
+            registry);
     }
 
     public void Dispose()
@@ -147,25 +229,93 @@ public sealed class VexAttestationVerifierTests : IDisposable
 
     private sealed class FakeSigner : IVexSigner
     {
+        internal static readonly string SignatureBase64 = Convert.ToBase64String(Encoding.UTF8.GetBytes("signature"));
+
         public ValueTask<VexSignedPayload> SignAsync(ReadOnlyMemory<byte> payload, CancellationToken cancellationToken)
-            => ValueTask.FromResult(new VexSignedPayload("signature", "key"));
+            => ValueTask.FromResult(new VexSignedPayload(SignatureBase64, "key"));
     }
 
     private sealed class FakeTransparencyLogClient : ITransparencyLogClient
     {
         public ValueTask<TransparencyLogEntry> SubmitAsync(DsseEnvelope envelope, CancellationToken cancellationToken)
-            => ValueTask.FromResult(new TransparencyLogEntry(Guid.NewGuid().ToString(), "https://rekor.example/entries/123", "42", null));
-
-        public ValueTask<bool> VerifyAsync(string entryLocation, CancellationToken cancellationToken)
-            => ValueTask.FromResult(true);
-    }
-
-    private sealed class ThrowingTransparencyLogClient : ITransparencyLogClient
-    {
-        public ValueTask<TransparencyLogEntry> SubmitAsync(DsseEnvelope envelope, CancellationToken cancellationToken)
-            => throw new NotSupportedException();
-
+            => ValueTask.FromResult(new TransparencyLogEntry(Guid.NewGuid().ToString(), "https://rekor.example/entries/123", "42", null));
+
+        public ValueTask<bool> VerifyAsync(string entryLocation, CancellationToken cancellationToken)
+            => ValueTask.FromResult(true);
+    }
+
+    private sealed class ThrowingTransparencyLogClient : ITransparencyLogClient
+    {
+        public ValueTask<TransparencyLogEntry> SubmitAsync(DsseEnvelope envelope, CancellationToken cancellationToken)
+            => throw new NotSupportedException();
+
         public ValueTask<bool> VerifyAsync(string entryLocation, CancellationToken cancellationToken)
             => throw new HttpRequestException("rekor unavailable");
     }
+
+    private sealed class StubCryptoProviderRegistry : ICryptoProviderRegistry
+    {
+        public const string Algorithm = "ed25519";
+        public const string KeyReference = "stub-key";
+
+        private readonly StubCryptoSigner _signer;
+        private readonly IReadOnlyCollection<ICryptoProvider> _providers = Array.Empty<ICryptoProvider>();
+
+        public StubCryptoProviderRegistry(bool success)
+        {
+            _signer = new StubCryptoSigner("key", Algorithm, success);
+        }
+
+        public IReadOnlyCollection<ICryptoProvider> Providers => _providers;
+
+        public bool TryResolve(string preferredProvider, out ICryptoProvider provider)
+        {
+            provider = null!;
+            return false;
+        }
+
+        public ICryptoProvider ResolveOrThrow(CryptoCapability capability, string algorithmId)
+            => throw new NotSupportedException();
+
+        public CryptoSignerResolution ResolveSigner(
+            CryptoCapability capability,
+            string algorithmId,
+            CryptoKeyReference keyReference,
+            string? preferredProvider = null)
+        {
+            if (!string.Equals(keyReference.KeyId, _signer.KeyId, StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException($"Unknown key '{keyReference.KeyId}'.");
+            }
+
+            return new CryptoSignerResolution(_signer, "stub");
+        }
+    }
+
+    private sealed class StubCryptoSigner : ICryptoSigner
+    {
+        private readonly bool _success;
+        private readonly byte[] _expectedSignature;
+
+        public StubCryptoSigner(string keyId, string algorithmId, bool success)
+        {
+            KeyId = keyId;
+            AlgorithmId = algorithmId;
+            _success = success;
+            _expectedSignature = Convert.FromBase64String(FakeSigner.SignatureBase64);
+        }
+
+        public string KeyId { get; }
+
+        public string AlgorithmId { get; }
+
+        public ValueTask<byte[]> SignAsync(ReadOnlyMemory<byte> data, CancellationToken cancellationToken = default)
+            => throw new NotSupportedException();
+
+        public ValueTask<bool> VerifyAsync(ReadOnlyMemory<byte> data, ReadOnlyMemory<byte> signature, CancellationToken cancellationToken = default)
+            => ValueTask.FromResult(_success && signature.Span.SequenceEqual(_expectedSignature.Span));
+
+        public JsonWebKey ExportPublicJsonWebKey()
+            => new JsonWebKey();
+    }
 }