Skip to content

tests: add unit tests for sigstore verifier and signer logic#1299

Open
pushkarscripts wants to merge 4 commits into
gittuf:mainfrom
pushkarscripts:sigstore-tests
Open

tests: add unit tests for sigstore verifier and signer logic#1299
pushkarscripts wants to merge 4 commits into
gittuf:mainfrom
pushkarscripts:sigstore-tests

Conversation

@pushkarscripts

@pushkarscripts pushkarscripts commented Apr 24, 2026

Copy link
Copy Markdown
Contributor

Description

Related to #1259

Adds unit tests to improve coverage for Sigstore verifier and signer logic in internal/signerverifier/sigstore.

The tests cover:

  • Verifier behavior (KeyID, ExpectedExtensionKind, SetExtension)
  • Verifier construction via NewVerifierFromIdentityAndIssuer (default, with options, and edge cases)
  • Signer behavior, including option propagation and KeyID
  • Metadata key generation (MetadataKey)
  • Basic workflow-level coverage for Sign and Verify

The tests now attempt to move closer to the actual signing and verification workflow. Since Sigstore depends on external services (e.g., Rekor/Fulcio), these tests currently validate expected failure behavior in this setup rather than full end-to-end verification.

AI Usage

  • I did not use generative AI at all in making the content of this pull
    request.
  • I did use generative AI in some form in making the content of this
    pull request. I have described my use of AI below.

I used generative AI for general guidance while structuring tests and thinking about coverage. All code and tests were written, reviewed, and understood by me before submission.

Contributor Checklist

  • I have manually reviewed all content submitted to gittuf in this pull
    request.
  • I fully understand the content I am submitting.
  • The changes introduced are documented and have tests included if
    applicable.
  • My changes do not infringe on copyright/trademarks/etc.
  • All commits in this pull request include a DCO
    Signoff
    .
  • By submitting this pull request, I agree to follow the gittuf Code of
    Conduct
    .

Signed-off-by: Pushkar Singh <pushkarkumarsingh1970@gmail.com>

@patzielinski patzielinski left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if this meaningfully tests our Sigstore workflow. The main concern I have is that we don't test any kind of signing or verification, which is done for other methods, e.g. GPG: https://github.com/gittuf/gittuf/blob/main/internal/signerverifier/gpg/gpg_test.go.

This is what I was referring to in the issue about using Sigstore's package to possibly mock the API or just spin up a Rekor server here.

@pushkarscripts

Copy link
Copy Markdown
Contributor Author

I’ve updated the patch to move a bit closer to the signing and verification workflow by exercising Sign and Verify. Since Sigstore depends on external services, the current tests mostly cover the expected failure paths in this setup.

I’ll spend some time next looking into mocking Sigstore interactions or using a local Rekor instance so the full signing and verification flow can be tested more realistically.

@pushkarscripts

Copy link
Copy Markdown
Contributor Author

@patzielinski @adityasaky just checking in on this PR. Would appreciate any feedback. Thanks!

Comment thread internal/signerverifier/sigstore/options/signer/signer.go Outdated
Comment thread internal/signerverifier/sigstore/sigstore_test.go Outdated

// 1. Test Verification with externally signed artifact
t.Run("Verify externally signed artifact", func(t *testing.T) {
entity, err := virtualSigstore.Sign(identity, issuer, data)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of calling virtualSigstore.Sign, call gittuf's Signer.Sign. This should also fix the extension issue and let you actually be able to verify.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of calling virtualSigstore.Sign, call gittuf's Signer.Sign. This should also fix the extension issue and let you actually be able to verify.

I've been looking into this but got a bit stuck.

VirtualSigstore implements root.TrustedMaterial, but I don't see a way to use it directly with Signer.Sign() since it doesn't implement sign.CertificateProvider or sign.Transparency.

Am I missing something, or should I add test-only wrappers for those interfaces?

Comment thread internal/signerverifier/sigstore/options/signer/signer.go Outdated
@pushkarscripts pushkarscripts force-pushed the sigstore-tests branch 2 times, most recently from 9be5977 to 25c1124 Compare June 3, 2026 20:48
Remove the unused IDTokenGetter dependency injection plumbing,
document that injected Fulcio and Rekor implementations take
precedence over configured URLs, and drop the redundant mock-based
signer workflow test.

Signed-off-by: Pushkar Singh <pushkarkumarsingh1970@gmail.com>
@pushkarscripts

Copy link
Copy Markdown
Contributor Author

Thanks @wlynch for the review!

I've addressed the comments about the unused ID token injection support and added documentation clarifying that the injected Fulcio/Rekor implementations take precedence over the configured URLs. I also removed the redundant signer mock test.

I'm still working through the remaining feedback about using gittuf's Signer.Sign() instead of virtualSigstore.Sign() for the workflow test and will follow up with an update there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants