fix(tests): Support hardened verify_archive in smoke and contract tests

- test-bootstrap-contract: Generate signed manifest.json with cosign test key
- systemd smoke tests: Pass SMM_ALLOW_UNSIGNED=1 fallback when manifest is missing (for CI PR runs)

tests/bootstrap/run-native-systemd-smoke.sh

@@ -8,6 +8,13 @@ port="${SMM_SMOKE_PORT:-17443}"
 system_bootstrap="/usr/local/sbin/ochenstarik-server-monitor-manager.sh"
 probe_dir=""
 
+# If manifest+sig are not shipped alongside the archive (CI-only builds),
+# allow unsigned verification via .sha256 fallback.
+archive_dir="$(dirname "$archive")"
+if [[ ! -f "$archive_dir/server-monitor-manager-manifest.json" || ! -f "$archive_dir/server-monitor-manager-manifest.sig" ]]; then
+    export SMM_ALLOW_UNSIGNED=1
+fi
+
 cleanup() {
     if [[ -n "$probe_dir" ]]; then
         rm -rf -- "$probe_dir"

tests/bootstrap/run-systemd-container-smoke.sh

@@ -46,13 +46,23 @@ docker cp "$archive" "$name:$remote_archive"
 docker cp "${archive}.sha256" "$name:${remote_archive}.sha256"
 docker cp "$bootstrap" "$name:$remote_bootstrap"
 docker exec "$name" chmod 0700 "$remote_bootstrap"
+
+# Copy manifest+sig if available; otherwise install-control will need SMM_ALLOW_UNSIGNED
+archive_dir="$(dirname "$archive")"
+smm_env=()
+if [[ -f "$archive_dir/server-monitor-manager-manifest.json" && -f "$archive_dir/server-monitor-manager-manifest.sig" ]]; then
+    docker cp "$archive_dir/server-monitor-manager-manifest.json" "$name:$smoke_dir/server-monitor-manager-manifest.json"
+    docker cp "$archive_dir/server-monitor-manager-manifest.sig" "$name:$smoke_dir/server-monitor-manager-manifest.sig"
+else
+    smm_env=(env SMM_ALLOW_UNSIGNED=1)
+fi
 docker exec "$name" "$remote_bootstrap" preflight
-docker exec "$name" "$remote_bootstrap" install-control \
+docker exec "$name" "${smm_env[@]}" "$remote_bootstrap" install-control \
     "$remote_archive" 127.0.0.1 "$port"
 docker exec "$name" curl --fail --silent --show-error --retry 15 --retry-all-errors --retry-delay 1 \
     --cacert /etc/ochenstarik-server-monitor-manager/control-ca.crt \
     "https://127.0.0.1:$port/healthz"
-docker exec "$name" "$remote_bootstrap" install-control \
+docker exec "$name" "${smm_env[@]}" "$remote_bootstrap" install-control \
     "$remote_archive" 127.0.0.1 "$port"
 
 docker restart "$name" >/dev/null

tests/bootstrap/test-bootstrap-contract.sh

@@ -780,12 +780,55 @@ install -m 0644 "$root/deploy/ochenstarik-smm-firewall.service" "$fixture/payloa
 install -m 0755 "$bootstrap" "$fixture/payload/bootstrap/ochenstarik-server-monitor-manager.sh"
 tar -C "$fixture/payload" -czf "$fixture/release.tar.gz" agent control provisioning-helper deploy bootstrap
 sha256sum "$fixture/release.tar.gz" >"$fixture/release.tar.gz.sha256"
-bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
 
-printf '%064d  %s\n' 0 release.tar.gz >"$fixture/release.tar.gz.sha256"
+# Create a signed manifest for verify-release (required by hardened verify_archive)
-if bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
+release_hash="$(sha256sum "$fixture/release.tar.gz" | awk '{ print $1 }')"
+cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
+{
+  "version": "v0.0.0-test",
+  "hashes": {
+    "release.tar.gz": "$release_hash"
+  }
+}
+MEOF
+
+if command -v cosign &>/dev/null; then
+    COSIGN_PASSWORD="" cosign generate-key-pair --output-key-prefix="$fixture/contract-test"
+    COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \
+        --output-signature "$fixture/server-monitor-manager-manifest.sig" \
+        "$fixture/server-monitor-manager-manifest.json"
+    SMM_TEST_PUBKEY="$fixture/contract-test.pub" \
+        bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
+else
+    # Cosign unavailable — fall back to SMM_ALLOW_UNSIGNED for contract test only
+    SMM_ALLOW_UNSIGNED=1 bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
+fi
+
+# Corrupt the manifest hash and verify rejection
+cat >"$fixture/server-monitor-manager-manifest.json" <<MEOF
+{
+  "version": "v0.0.0-test",
+  "hashes": {
+    "release.tar.gz": "$(printf '%064d' 0)"
+  }
+}
+MEOF
+if command -v cosign &>/dev/null; then
+    COSIGN_PASSWORD="" cosign sign-blob --yes --key "$fixture/contract-test.key" \
+        --output-signature "$fixture/server-monitor-manager-manifest.sig" \
+        "$fixture/server-monitor-manager-manifest.json"
+    if SMM_TEST_PUBKEY="$fixture/contract-test.pub" \
+        bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
         printf '%s\n' "corrupt release checksum unexpectedly succeeded" >&2
         exit 1
     fi
+else
+    printf '%064d  %s\n' 0 release.tar.gz >"$fixture/release.tar.gz.sha256"
+    if SMM_ALLOW_UNSIGNED=1 bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
+        printf '%s\n' "corrupt release checksum unexpectedly succeeded" >&2
+        exit 1
+    fi
+fi
 
 printf '%s\n' "BOOTSTRAP_CONTRACT=PASS"
+