audit, advisories and doctors/setup work

src/Attestor/__Libraries/__Tests/StellaOps.Attestor.Spdx3.Tests/BuildProfileValidatorTests.cs

@@ -127,7 +127,7 @@ public sealed class BuildProfileValidatorTests
             SpdxId = "https://stellaops.io/spdx/test/build/123",
             BuildType = "https://slsa.dev/provenance/v1",
             BuildId = "build-123",
-            ConfigSourceDigest = ImmutableArray.Create(Spdx3Hash.Sha256("abc123"))
+            ConfigSourceDigest = ImmutableArray.Create(Spdx3BuildHash.Sha256("abc123"))
             // Note: ConfigSourceUri is empty
         };
 
@@ -149,7 +149,7 @@ public sealed class BuildProfileValidatorTests
             BuildType = "https://slsa.dev/provenance/v1",
             BuildId = "build-123",
             ConfigSourceUri = ImmutableArray.Create("https://github.com/test/repo"),
-            ConfigSourceDigest = ImmutableArray.Create(new Spdx3Hash
+            ConfigSourceDigest = ImmutableArray.Create(new Spdx3BuildHash
             {
                 Algorithm = "unknown-algo",
                 HashValue = "abc123"
@@ -183,3 +183,4 @@ public sealed class BuildProfileValidatorTests
         result.ErrorsOnly.Should().Contain(e => e.Field == "spdxId");
     }
 }
+

src/Attestor/__Libraries/__Tests/StellaOps.Attestor.Spdx3.Tests/Integration/BuildProfileIntegrationTests.cs.skip

@@ -32,22 +32,33 @@ public sealed class BuildProfileIntegrationTests
         // Arrange: Create a realistic build attestation payload
         var attestation = new BuildAttestationPayload
         {
-            Type = "https://in-toto.io/Statement/v1",
-            PredicateType = "https://slsa.dev/provenance/v1",
-            Subject = ImmutableArray.Create(new AttestationSubject
+            BuildType = "https://slsa.dev/provenance/v1",
+            Builder = new BuilderInfo
             {
-                Name = "pkg:oci/myapp@sha256:abc123",
+                Id = "https://github.com/stellaops/ci-builder@v1"
+            },
+            Invocation = new BuildInvocation
+            {
+                ConfigSource = new BuildConfigSource
+                {
+                    Uri = "https://github.com/stellaops/repo",
+                    Digest = new Dictionary<string, string>
+                    {
+                        ["sha256"] = "abc123def456"
+                    }.ToImmutableDictionary()
+                }
+            },
+            Materials = ImmutableArray.Create(new BuildMaterial
+            {
+                Uri = "pkg:oci/base-image@sha256:base123",
                 Digest = new Dictionary<string, string>
                 {
-                    ["sha256"] = "abc123def456"
+                    ["sha256"] = "base123abc"
                 }.ToImmutableDictionary()
-            }),
-            Predicate = new BuildPredicate
-            {
-                BuildDefinition = new BuildDefinitionInfo
-                {
-                    BuildType = "https://stellaops.org/build/container-scan/v1",
-                    ExternalParameters = new Dictionary<string, object>
+            })
+        };
+
+        // Remove the Subject and PredicateType as they don't exist in BuildAttestationPayload
                     {
                         ["imageReference"] = "registry.io/myapp:latest"
                     }.ToImmutableDictionary(),
@@ -349,13 +360,13 @@ public sealed class BuildProfileIntegrationTests
         }
 
         public Task<bool> VerifyAsync(
-            byte[] payload,
+            byte[] data,
             byte[] signature,
-            string keyId,
+            DsseVerificationKey key,
             CancellationToken cancellationToken)
         {
             using var hmac = new System.Security.Cryptography.HMACSHA256(TestKey);
-            var expectedSignature = hmac.ComputeHash(payload);
+            var expectedSignature = hmac.ComputeHash(data);
 
             return Task.FromResult(signature.SequenceEqual(expectedSignature));
         }
@@ -380,7 +391,7 @@ file sealed class Spdx3JsonSerializer : ISpdx3Serializer
         return JsonSerializer.SerializeToUtf8Bytes(document, Options);
     }
 
-    public Spdx3Document? DeserializeFromBytes(byte[] bytes)
+    public Spdx3Document? Deserialize(byte[] bytes)
     {
         return JsonSerializer.Deserialize<Spdx3Document>(bytes, Options);
     }