ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions 2

test(release): add certificate fixture material

Browse source 
Keep local signatures out of Rekor and satisfy the fail-closed certificate contract.
This commit is contained in:
Ochenstarik 2026-08-13 14:37:31 +07:00
parent e1359b1b5f
commit 55cfdcffac
2 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
tests/bootstrap/test-bootstrap-contract.sh
View file

@ -791,10 +791,11 @@ cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
} }
} }
MEOF MEOF
printf '%s\n' 'test-key certificate placeholder' >"$fixture/server-monitor-manager-manifest.pem"
if command -v cosign &>/dev/null; then if command -v cosign &>/dev/null; then
COSIGN_PASSWORD="" cosign generate-key-pair --output-key-prefix="$fixture/contract-test" COSIGN_PASSWORD="" cosign generate-key-pair --output-key-prefix="$fixture/contract-test"
COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \ COSIGN_PASSWORD="" cosign sign-blob --yes --tlog-upload=false --key "$fixture/contract-test.key" \
--output-signature "$fixture/server-monitor-manager-manifest.sig" \ --output-signature "$fixture/server-monitor-manager-manifest.sig" \
"$fixture/server-monitor-manager-manifest.json" "$fixture/server-monitor-manager-manifest.json"
SMM_TEST_PUBKEY="$fixture/contract-test.pub" \ SMM_TEST_PUBKEY="$fixture/contract-test.pub" \
@ -814,7 +815,7 @@ cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
} }
MEOF MEOF
if command -v cosign &>/dev/null; then if command -v cosign &>/dev/null; then
COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \ COSIGN_PASSWORD="" cosign sign-blob --yes --tlog-upload=false --key "$fixture/contract-test.key" \
--output-signature "$fixture/server-monitor-manager-manifest.sig" \ --output-signature "$fixture/server-monitor-manager-manifest.sig" \
"$fixture/server-monitor-manager-manifest.json" "$fixture/server-monitor-manager-manifest.json"
if SMM_TEST_PUBKEY="$fixture/contract-test.pub" \ if SMM_TEST_PUBKEY="$fixture/contract-test.pub" \

2
tests/bootstrap/test-release-contract.sh
View file

@ -65,6 +65,8 @@ grep -Fq 'server-monitor-manager-bootstrap-manifest.json' "$manifest_test"
grep -Fq 'SMM_ALLOW_UNSIGNED=1' "$manifest_test" grep -Fq 'SMM_ALLOW_UNSIGNED=1' "$manifest_test"
grep -Fq 'SMM_ALLOW_UNSIGNED=0' "$manifest_test" grep -Fq 'SMM_ALLOW_UNSIGNED=0' "$manifest_test"
grep -Fq -- '--tlog-upload=false' "$manifest_test" grep -Fq -- '--tlog-upload=false' "$manifest_test"
grep -Fq -- '--tlog-upload=false' "$root/tests/bootstrap/test-bootstrap-contract.sh"
grep -Fq 'server-monitor-manager-manifest.pem' "$root/tests/bootstrap/test-bootstrap-contract.sh"
grep -Fq -- '--insecure-ignore-tlog' "$root/deploy/ochenstarik-server-monitor-manager.sh" grep -Fq -- '--insecure-ignore-tlog' "$root/deploy/ochenstarik-server-monitor-manager.sh"
grep -Fq 'verify_args=(--certificate "$certificate" --certificate-oidc-issuer "$COSIGN_ISSUER" --certificate-identity-regexp "$COSIGN_IDENTITY_REGEXP")' "$root/deploy/ochenstarik-server-monitor-manager.sh" grep -Fq 'verify_args=(--certificate "$certificate" --certificate-oidc-issuer "$COSIGN_ISSUER" --certificate-identity-regexp "$COSIGN_IDENTITY_REGEXP")' "$root/deploy/ochenstarik-server-monitor-manager.sh"
grep -Fq 'verify-manifest MANIFEST SIGNATURE CERTIFICATE' "$root/deploy/ochenstarik-server-monitor-manager.sh" grep -Fq 'verify-manifest MANIFEST SIGNATURE CERTIFICATE' "$root/deploy/ochenstarik-server-monitor-manager.sh"