72 lines
2.7 KiB
Python
72 lines
2.7 KiB
Python
"""Tests for M9.5 supply chain attestation."""
|
|
|
|
from cmdforge.attestation import (
|
|
Attestation,
|
|
generate_keypair,
|
|
sign_tool,
|
|
verify_attestation,
|
|
verify_content_hash,
|
|
verify_trusted_attestation,
|
|
)
|
|
from cmdforge.tool import Tool
|
|
|
|
|
|
class TestSignTool:
|
|
def test_creates_attestation(self):
|
|
private, public = generate_keypair()
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", private)
|
|
assert att.tool_name == "mytool"
|
|
assert att.version == "1.0.0"
|
|
assert att.content_hash == "abc123"
|
|
assert att.signer == "alice"
|
|
assert len(att.signature) == 88
|
|
assert att.algorithm == "ed25519"
|
|
assert verify_attestation(att, public)
|
|
|
|
def test_different_keys_different_signatures(self):
|
|
key1, _ = generate_keypair()
|
|
key2, _ = generate_keypair()
|
|
att1 = sign_tool("tool", "1.0.0", "hash", "alice", key1)
|
|
att2 = sign_tool("tool", "1.0.0", "hash", "alice", key2)
|
|
assert att1.signature != att2.signature
|
|
|
|
|
|
class TestVerifyAttestation:
|
|
def test_valid_signature(self):
|
|
private, public = generate_keypair()
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", private)
|
|
assert verify_attestation(att, public)
|
|
|
|
def test_wrong_key_fails(self):
|
|
private, _ = generate_keypair()
|
|
_, wrong_public = generate_keypair()
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", private)
|
|
assert not verify_attestation(att, wrong_public)
|
|
|
|
def test_tampered_content_fails(self):
|
|
from dataclasses import replace
|
|
private, public = generate_keypair()
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", private)
|
|
att = replace(att, content_hash="tampered")
|
|
assert not verify_attestation(att, public)
|
|
|
|
def test_tampered_signer_fails(self):
|
|
from dataclasses import replace
|
|
private, public = generate_keypair()
|
|
att = sign_tool("mytool", "1.0.0", "abc123", "alice", private)
|
|
att = replace(att, signer="eve")
|
|
assert not verify_attestation(att, public)
|
|
|
|
def test_timestamp_and_algorithm_are_signed(self):
|
|
from dataclasses import replace
|
|
private, public = generate_keypair()
|
|
att = sign_tool("tool", "1.0.0", "hash", "alice", private)
|
|
assert not verify_attestation(replace(att, signed_at="tomorrow"), public)
|
|
assert not verify_attestation(replace(att, algorithm="hmac-sha256"), public)
|
|
|
|
def test_requires_trusted_publisher_mapping(self):
|
|
private, public = generate_keypair()
|
|
att = sign_tool("tool", "1.0.0", "hash", "alice", private)
|
|
assert verify_trusted_attestation(att, {"alice": public})
|
|
assert not verify_trusted_attestation(att, {"mallory": public})
|