M9.2-M9.5: Add improvement pipeline, community workflow, transitive integrity, and supply chain attestation

tests/test_attestation.py

@@ -0,0 +1,45 @@
+"""Tests for M9.5 supply chain attestation."""
+
+from cmdforge.attestation import (
+    Attestation,
+    sign_tool,
+    verify_attestation,
+    verify_content_hash,
+)
+from cmdforge.tool import Tool
+
+
+class TestSignTool:
+    def test_creates_attestation(self):
+        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
+        assert att.tool_name == "mytool"
+        assert att.version == "1.0.0"
+        assert att.content_hash == "abc123"
+        assert att.signer == "alice"
+        assert len(att.signature) == 64  # SHA256 hex
+        assert att.algorithm == "hmac-sha256"
+
+    def test_different_keys_different_signatures(self):
+        att1 = sign_tool("tool", "1.0.0", "hash", "alice", "key1")
+        att2 = sign_tool("tool", "1.0.0", "hash", "alice", "key2")
+        assert att1.signature != att2.signature
+
+
+class TestVerifyAttestation:
+    def test_valid_signature(self):
+        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
+        assert verify_attestation(att, "secret-key")
+
+    def test_wrong_key_fails(self):
+        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
+        assert not verify_attestation(att, "wrong-key")
+
+    def test_tampered_content_fails(self):
+        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
+        att.content_hash = "tampered"
+        assert not verify_attestation(att, "secret-key")
+
+    def test_tampered_signer_fails(self):
+        att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
+        att.signer = "eve"
+        assert not verify_attestation(att, "secret-key")