46 lines
1.6 KiB
Python
46 lines
1.6 KiB
Python
"""Tests for M9.5 supply chain attestation."""
|
|
|
|
from cmdforge.attestation import (
|
|
Attestation,
|
|
sign_tool,
|
|
verify_attestation,
|
|
verify_content_hash,
|
|
)
|
|
from cmdforge.tool import Tool
|
|
|
|
|
|
class TestSignTool:
|
|
def test_creates_attestation(self):
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
|
|
assert att.tool_name == "mytool"
|
|
assert att.version == "1.0.0"
|
|
assert att.content_hash == "abc123"
|
|
assert att.signer == "alice"
|
|
assert len(att.signature) == 64 # SHA256 hex
|
|
assert att.algorithm == "hmac-sha256"
|
|
|
|
def test_different_keys_different_signatures(self):
|
|
att1 = sign_tool("tool", "1.0.0", "hash", "alice", "key1")
|
|
att2 = sign_tool("tool", "1.0.0", "hash", "alice", "key2")
|
|
assert att1.signature != att2.signature
|
|
|
|
|
|
class TestVerifyAttestation:
|
|
def test_valid_signature(self):
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
|
|
assert verify_attestation(att, "secret-key")
|
|
|
|
def test_wrong_key_fails(self):
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
|
|
assert not verify_attestation(att, "wrong-key")
|
|
|
|
def test_tampered_content_fails(self):
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
|
|
att.content_hash = "tampered"
|
|
assert not verify_attestation(att, "secret-key")
|
|
|
|
def test_tampered_signer_fails(self):
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", "secret-key")
|
|
att.signer = "eve"
|
|
assert not verify_attestation(att, "secret-key")
|