Add unit tests for PhpFrameworkSurface and PhpPharScanner

- Implement comprehensive tests for PhpFrameworkSurface, covering scenarios such as empty surfaces, presence of routes, controllers, middlewares, CLI commands, cron jobs, and event listeners.
- Validate metadata creation for route counts, HTTP methods, protected and public routes, and route patterns.
- Introduce tests for PhpPharScanner, including handling of non-existent files, null or empty paths, invalid PHAR files, and minimal PHAR structures.
- Ensure correct computation of SHA256 for valid PHAR files and validate the properties of PhpPharArchive, PhpPharEntry, and PhpPharScanResult.

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/AttestorSigningServiceTests.cs

@@ -15,6 +15,10 @@ using StellaOps.Attestor.Infrastructure.Submission;
 using StellaOps.Attestor.Tests;
 using StellaOps.Cryptography;
 using StellaOps.Cryptography.Kms;
+using Org.BouncyCastle.Crypto.Generators;
+using Org.BouncyCastle.Crypto.Parameters;
+using Org.BouncyCastle.Crypto.Signers;
+using Org.BouncyCastle.Security;
 using Xunit;
 
 namespace StellaOps.Attestor.Tests;
@@ -210,6 +214,147 @@ public sealed class AttestorSigningServiceTests : IDisposable
         Assert.Equal("signed", auditSink.Records[0].Result);
     }
 
+    [Fact]
+    public async Task SignAsync_Sm2Key_ReturnsValidSignature_WhenGateEnabled()
+    {
+        var originalGate = Environment.GetEnvironmentVariable("SM_SOFT_ALLOWED");
+        try
+        {
+            Environment.SetEnvironmentVariable("SM_SOFT_ALLOWED", "1");
+
+            // Generate SM2 key pair
+            var curve = Org.BouncyCastle.Asn1.GM.GMNamedCurves.GetByName("SM2P256V1");
+            var domain = new ECDomainParameters(curve.Curve, curve.G, curve.N, curve.H, curve.GetSeed());
+            var generator = new ECKeyPairGenerator("EC");
+            generator.Init(new ECKeyGenerationParameters(domain, new SecureRandom()));
+            var keyPair = generator.GenerateKeyPair();
+            var privateDer = Org.BouncyCastle.Pkcs.PrivateKeyInfoFactory.CreatePrivateKeyInfo(keyPair.Private).GetDerEncoded();
+
+            var options = Options.Create(new AttestorOptions
+            {
+                Signing = new AttestorOptions.SigningOptions
+                {
+                    Keys =
+                    {
+                        new AttestorOptions.SigningKeyOptions
+                        {
+                            KeyId = "sm2-1",
+                            Algorithm = SignatureAlgorithms.Sm2,
+                            Mode = "keyful",
+                            Material = Convert.ToBase64String(privateDer),
+                            MaterialFormat = "base64"
+                        }
+                    }
+                }
+            });
+
+            using var metrics = new AttestorMetrics();
+            using var registry = new AttestorSigningKeyRegistry(options, TimeProvider.System, NullLogger<AttestorSigningKeyRegistry>.Instance);
+            var auditSink = new InMemoryAttestorAuditSink();
+            var service = new AttestorSigningService(
+                registry,
+                new DefaultDsseCanonicalizer(),
+                auditSink,
+                metrics,
+                NullLogger<AttestorSigningService>.Instance,
+                TimeProvider.System);
+
+            var payloadBytes = Encoding.UTF8.GetBytes("{}");
+            var request = new AttestationSignRequest
+            {
+                KeyId = "sm2-1",
+                PayloadType = "application/json",
+                PayloadBase64 = Convert.ToBase64String(payloadBytes),
+                Artifact = new AttestorSubmissionRequest.ArtifactInfo
+                {
+                    Sha256 = new string('c', 64),
+                    Kind = "sbom"
+                }
+            };
+
+            var context = new SubmissionContext
+            {
+                CallerSubject = "urn:subject",
+                CallerAudience = "attestor",
+                CallerClientId = "client",
+                CallerTenant = "tenant",
+                MtlsThumbprint = "thumbprint"
+            };
+
+            var result = await service.SignAsync(request, context);
+
+            Assert.NotNull(result);
+            Assert.Equal("sm2-1", result.KeyId);
+            Assert.Equal("keyful", result.Mode);
+            Assert.Equal("cn.sm.soft", result.Provider);
+            Assert.Equal(SignatureAlgorithms.Sm2, result.Algorithm);
+            Assert.False(string.IsNullOrWhiteSpace(result.Meta.BundleSha256));
+            Assert.Single(result.Bundle.Dsse.Signatures);
+
+            // Verify the signature
+            var signature = Convert.FromBase64String(result.Bundle.Dsse.Signatures[0].Signature);
+            var preAuth = DssePreAuthenticationEncoding.Compute(result.Bundle.Dsse.PayloadType, Convert.FromBase64String(result.Bundle.Dsse.PayloadBase64));
+
+            var verifier = new SM2Signer();
+            var userId = Encoding.ASCII.GetBytes("1234567812345678");
+            verifier.Init(false, new ParametersWithID(keyPair.Public, userId));
+            verifier.BlockUpdate(preAuth, 0, preAuth.Length);
+            Assert.True(verifier.VerifySignature(signature));
+
+            Assert.Single(auditSink.Records);
+            Assert.Equal("sign", auditSink.Records[0].Action);
+            Assert.Equal("signed", auditSink.Records[0].Result);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SM_SOFT_ALLOWED", originalGate);
+        }
+    }
+
+    [Fact]
+    public void Sm2Registry_Fails_WhenGateDisabled()
+    {
+        var originalGate = Environment.GetEnvironmentVariable("SM_SOFT_ALLOWED");
+        try
+        {
+            Environment.SetEnvironmentVariable("SM_SOFT_ALLOWED", null);
+
+            // Generate SM2 key pair
+            var curve = Org.BouncyCastle.Asn1.GM.GMNamedCurves.GetByName("SM2P256V1");
+            var domain = new ECDomainParameters(curve.Curve, curve.G, curve.N, curve.H, curve.GetSeed());
+            var generator = new ECKeyPairGenerator("EC");
+            generator.Init(new ECKeyGenerationParameters(domain, new SecureRandom()));
+            var keyPair = generator.GenerateKeyPair();
+            var privateDer = Org.BouncyCastle.Pkcs.PrivateKeyInfoFactory.CreatePrivateKeyInfo(keyPair.Private).GetDerEncoded();
+
+            var options = Options.Create(new AttestorOptions
+            {
+                Signing = new AttestorOptions.SigningOptions
+                {
+                    Keys =
+                    {
+                        new AttestorOptions.SigningKeyOptions
+                        {
+                            KeyId = "sm2-fail",
+                            Algorithm = SignatureAlgorithms.Sm2,
+                            Mode = "keyful",
+                            Material = Convert.ToBase64String(privateDer),
+                            MaterialFormat = "base64"
+                        }
+                    }
+                }
+            });
+
+            // Creating registry should throw because SM_SOFT_ALLOWED is not set
+            Assert.Throws<InvalidOperationException>(() =>
+                new AttestorSigningKeyRegistry(options, TimeProvider.System, NullLogger<AttestorSigningKeyRegistry>.Instance));
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable("SM_SOFT_ALLOWED", originalGate);
+        }
+    }
+
     private string CreateTempDirectory()
     {
         var path = Path.Combine(Path.GetTempPath(), "attestor-signing-tests", Guid.NewGuid().ToString("N"));

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/AttestorVerificationServiceTests.cs

@@ -61,7 +61,7 @@ public sealed class AttestorVerificationServiceTests
         using var metrics = new AttestorMetrics();
         using var activitySource = new AttestorActivitySource();
         var canonicalizer = new DefaultDsseCanonicalizer();
-        var engine = new AttestorVerificationEngine(canonicalizer, options, NullLogger<AttestorVerificationEngine>.Instance);
+        var engine = new AttestorVerificationEngine(canonicalizer, new TestCryptoHash(), options, NullLogger<AttestorVerificationEngine>.Instance);
         var repository = new InMemoryAttestorEntryRepository();
         var dedupeStore = new InMemoryAttestorDedupeStore();
         var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
@@ -149,7 +149,7 @@ public sealed class AttestorVerificationServiceTests
         using var metrics = new AttestorMetrics();
         using var activitySource = new AttestorActivitySource();
         var canonicalizer = new DefaultDsseCanonicalizer();
-        var engine = new AttestorVerificationEngine(canonicalizer, options, NullLogger<AttestorVerificationEngine>.Instance);
+        var engine = new AttestorVerificationEngine(canonicalizer, new TestCryptoHash(), options, NullLogger<AttestorVerificationEngine>.Instance);
         var repository = new InMemoryAttestorEntryRepository();
         var dedupeStore = new InMemoryAttestorDedupeStore();
         var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());
@@ -325,7 +325,7 @@ public sealed class AttestorVerificationServiceTests
         using var metrics = new AttestorMetrics();
         using var activitySource = new AttestorActivitySource();
         var canonicalizer = new DefaultDsseCanonicalizer();
-        var engine = new AttestorVerificationEngine(canonicalizer, options, NullLogger<AttestorVerificationEngine>.Instance);
+        var engine = new AttestorVerificationEngine(canonicalizer, new TestCryptoHash(), options, NullLogger<AttestorVerificationEngine>.Instance);
         var repository = new InMemoryAttestorEntryRepository();
         var rekorClient = new RecordingRekorClient();
 
@@ -388,7 +388,7 @@ public sealed class AttestorVerificationServiceTests
         using var metrics = new AttestorMetrics();
         using var activitySource = new AttestorActivitySource();
         var canonicalizer = new DefaultDsseCanonicalizer();
-        var engine = new AttestorVerificationEngine(canonicalizer, options, NullLogger<AttestorVerificationEngine>.Instance);
+        var engine = new AttestorVerificationEngine(canonicalizer, new TestCryptoHash(), options, NullLogger<AttestorVerificationEngine>.Instance);
         var repository = new InMemoryAttestorEntryRepository();
         var rekorClient = new RecordingRekorClient();
 
@@ -498,7 +498,7 @@ public sealed class AttestorVerificationServiceTests
         using var metrics = new AttestorMetrics();
         using var activitySource = new AttestorActivitySource();
         var canonicalizer = new DefaultDsseCanonicalizer();
-        var engine = new AttestorVerificationEngine(canonicalizer, options, NullLogger<AttestorVerificationEngine>.Instance);
+        var engine = new AttestorVerificationEngine(canonicalizer, new TestCryptoHash(), options, NullLogger<AttestorVerificationEngine>.Instance);
         var repository = new InMemoryAttestorEntryRepository();
         var dedupeStore = new InMemoryAttestorDedupeStore();
         var rekorClient = new StubRekorClient(new NullLogger<StubRekorClient>());

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/StellaOps.Attestor.Tests.csproj

@@ -21,5 +21,6 @@
     <ProjectReference Include="../../../__Libraries/StellaOps.Configuration/StellaOps.Configuration.csproj" />
     <ProjectReference Include="../../../__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj" />
     <ProjectReference Include="..\..\StellaOps.Attestor.Verify\StellaOps.Attestor.Verify.csproj" />
+    <ProjectReference Include="..\..\..\__Libraries\StellaOps.Cryptography.Plugin.SmSoft\StellaOps.Cryptography.Plugin.SmSoft.csproj" />
   </ItemGroup>
 </Project>

src/Attestor/StellaOps.Attestor/StellaOps.Attestor.Tests/TestDoubles.cs

@@ -1,12 +1,15 @@
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
+using System.Security.Cryptography;
 using System.Threading;
 using System.Threading.Tasks;
 using StellaOps.Attestor.Core.Audit;
 using StellaOps.Attestor.Core.Verification;
 using StellaOps.Attestor.Core.Storage;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Attestor.Tests;
 
@@ -210,3 +213,66 @@ internal sealed class InMemoryAttestorArchiveStore : IAttestorArchiveStore
         return Task.FromResult<AttestorArchiveBundle?>(null);
     }
 }
+
+internal sealed class TestCryptoHash : ICryptoHash
+{
+    public byte[] ComputeHash(ReadOnlySpan<byte> data, string? algorithmId = null)
+    {
+        using var algorithm = CreateAlgorithm(algorithmId);
+        return algorithm.ComputeHash(data.ToArray());
+    }
+
+    public string ComputeHashHex(ReadOnlySpan<byte> data, string? algorithmId = null)
+        => Convert.ToHexString(ComputeHash(data, algorithmId)).ToLowerInvariant();
+
+    public string ComputeHashBase64(ReadOnlySpan<byte> data, string? algorithmId = null)
+        => Convert.ToBase64String(ComputeHash(data, algorithmId));
+
+    public async ValueTask<byte[]> ComputeHashAsync(Stream stream, string? algorithmId = null, CancellationToken cancellationToken = default)
+    {
+        using var algorithm = CreateAlgorithm(algorithmId);
+        await using var buffer = new MemoryStream();
+        await stream.CopyToAsync(buffer, cancellationToken).ConfigureAwait(false);
+        return algorithm.ComputeHash(buffer.ToArray());
+    }
+
+    public async ValueTask<string> ComputeHashHexAsync(Stream stream, string? algorithmId = null, CancellationToken cancellationToken = default)
+    {
+        var bytes = await ComputeHashAsync(stream, algorithmId, cancellationToken).ConfigureAwait(false);
+        return Convert.ToHexString(bytes).ToLowerInvariant();
+    }
+
+    public byte[] ComputeHashForPurpose(ReadOnlySpan<byte> data, string purpose)
+        => ComputeHash(data, HashAlgorithms.Sha256);
+
+    public string ComputeHashHexForPurpose(ReadOnlySpan<byte> data, string purpose)
+        => ComputeHashHex(data, HashAlgorithms.Sha256);
+
+    public string ComputeHashBase64ForPurpose(ReadOnlySpan<byte> data, string purpose)
+        => ComputeHashBase64(data, HashAlgorithms.Sha256);
+
+    public ValueTask<byte[]> ComputeHashForPurposeAsync(Stream stream, string purpose, CancellationToken cancellationToken = default)
+        => ComputeHashAsync(stream, HashAlgorithms.Sha256, cancellationToken);
+
+    public ValueTask<string> ComputeHashHexForPurposeAsync(Stream stream, string purpose, CancellationToken cancellationToken = default)
+        => ComputeHashHexAsync(stream, HashAlgorithms.Sha256, cancellationToken);
+
+    public string GetAlgorithmForPurpose(string purpose)
+        => HashAlgorithms.Sha256;
+
+    public string GetHashPrefix(string purpose)
+        => "sha256:";
+
+    public string ComputePrefixedHashForPurpose(ReadOnlySpan<byte> data, string purpose)
+        => $"{GetHashPrefix(purpose)}{ComputeHashHexForPurpose(data, purpose)}";
+
+    private static HashAlgorithm CreateAlgorithm(string? algorithmId)
+    {
+        return algorithmId?.ToUpperInvariant() switch
+        {
+            null or "" or HashAlgorithms.Sha256 => SHA256.Create(),
+            HashAlgorithms.Sha512 => SHA512.Create(),
+            _ => throw new NotSupportedException($"Test crypto hash does not support algorithm {algorithmId}.")
+        };
+    }
+}