53 lines
2.1 KiB
C#
53 lines
2.1 KiB
C#
using System.Text;
|
|
using System.Collections.Generic;
|
|
using FluentAssertions;
|
|
using System.Threading.Tasks;
|
|
using StellaOps.Provenance.Attestation;
|
|
using Xunit;
|
|
|
|
namespace StellaOps.Provenance.Attestation.Tests;
|
|
|
|
public class PromotionAttestationBuilderTests
|
|
{
|
|
[Fact]
|
|
public void Produces_canonical_json_for_predicate()
|
|
{
|
|
var predicate = new PromotionPredicate(
|
|
ImageDigest: "sha256:img",
|
|
SbomDigest: "sha256:sbom",
|
|
VexDigest: "sha256:vex",
|
|
PromotionId: "prom-1",
|
|
RekorEntry: "uuid",
|
|
// Intentionally shuffled input order; canonical JSON must be sorted.
|
|
Metadata: new Dictionary<string, string> { { "env", "prod" }, { "region", "us-east" } });
|
|
|
|
var bytes = PromotionAttestationBuilder.CreateCanonicalJson(predicate);
|
|
var json = Encoding.UTF8.GetString(bytes);
|
|
|
|
json.Should().Be("{\"ImageDigest\":\"sha256:img\",\"Metadata\":{\"env\":\"prod\",\"region\":\"us-east\"},\"PromotionId\":\"prom-1\",\"RekorEntry\":\"uuid\",\"SbomDigest\":\"sha256:sbom\",\"VexDigest\":\"sha256:vex\"}");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task BuildAsync_adds_predicate_claim_and_signs_payload()
|
|
{
|
|
var predicate = new PromotionPredicate(
|
|
ImageDigest: "sha256:img",
|
|
SbomDigest: "sha256:sbom",
|
|
VexDigest: "sha256:vex",
|
|
PromotionId: "prom-1");
|
|
|
|
var key = new InMemoryKeyProvider("kid-1", Encoding.UTF8.GetBytes("secret"));
|
|
var signer = new HmacSigner(key);
|
|
|
|
var attestation = await PromotionAttestationBuilder.BuildAsync(
|
|
predicate,
|
|
signer,
|
|
claims: new Dictionary<string, string> { { "traceId", "abc123" } });
|
|
|
|
attestation.Payload.Should().BeEquivalentTo(PromotionAttestationBuilder.CreateCanonicalJson(predicate));
|
|
attestation.Signature.KeyId.Should().Be("kid-1");
|
|
attestation.Signature.Claims.Should().ContainKey("predicateType").WhoseValue.Should().Be(PromotionAttestationBuilder.PredicateType);
|
|
attestation.Signature.Claims.Should().ContainKey("traceId").WhoseValue.Should().Be("abc123");
|
|
}
|
|
}
|