Repository: cli/cli
File: pkg/cmd/attestation/verification/sigstore_test.go (Go)

Code before:
	"github.com/stretchr/testify/require"
)

// Note: Tests that require network access and TUF client initialization
// are in sigstore_integration_test.go with the //go:build integration tag.
// These unit tests focus on testing the logic without requiring network access.

// TestChooseVerifierWithNilPublicGood tests that chooseVerifier returns an error
// when a PGI attestation is encountered but the PGI verifier is nil (failed initialization).
func TestChooseVerifierWithNilPublicGood(t *testing.T) {
	verifier := &LiveSigstoreVerifier{
		Logger:       io.NewTestHandler(),
		NoPublicGood: false,
		PublicGood:   nil, // Simulate failed PGI initialization
		GitHub:       nil, // Not needed for this test
	}

	_, err := verifier.chooseVerifier(PublicGoodIssuerOrg)

	require.Error(t, err)
	require.ErrorContains(t, err, "public good verifier is not available")
}

// TestChooseVerifierWithGitHubIssuer tests that chooseVerifier can select
// GitHub verifier even when PGI verifier is nil.
func TestChooseVerifierWithGitHubIssuer(t *testing.T) {
	// We'll test this scenario with the actual initialization
	// to ensure GitHub verifier is properly created
	t.Skip("This requires integration test with actual TUF client - covered by integration tests")
}

// TestChooseVerifierUnrecognizedIssuer tests that an error is returned
// for unrecognized issuers.
func TestChooseVerifierUnrecognizedIssuer(t *testing.T) {
	verifier := &LiveSigstoreVerifier{
		Logger:       io.NewTestHandler(),
		NoPublicGood: false,
	}

	_, err := verifier.chooseVerifier("unknown-issuer")

	require.Error(t, err)
	require.ErrorContains(t, err, "leaf certificate issuer is not recognized")
}

// TestGetBundleIssuer tests the getBundleIssuer helper function
func TestGetBundleIssuer(t *testing.T) {
	// This test would require setting up a mock bundle
	// For now, we'll just verify it exists and can be called
	// Integration tests cover the actual functionality
	t.Skip("getBundleIssuer requires a valid bundle which needs integration test setup")

Review comment (suggestion):
Let's delete this test and `TestGetBundleIssuer` since it doesn't test anything and always skips. The test file has a note at the top about our Sigstore integration tests.

Code after:
	"github.com/stretchr/testify/require"
)

// Note: Tests that require network access and TUF client initialization
// are in sigstore_integration_test.go with the //go:build integration tag.
// These unit tests focus on testing the logic without requiring network access.

// TestChooseVerifierWithNilPublicGood tests that chooseVerifier returns an error
// when a PGI attestation is encountered but the PGI verifier is nil (failed initialization).
func TestChooseVerifierWithNilPublicGood(t *testing.T) {
	verifier := &LiveSigstoreVerifier{
		Logger:       io.NewTestHandler(),
		NoPublicGood: false,
		PublicGood:   nil, // Simulate failed PGI initialization
		GitHub:       nil, // Not needed for this test
	}

	_, err := verifier.chooseVerifier(PublicGoodIssuerOrg)

	require.Error(t, err)
	require.ErrorContains(t, err, "public good verifier is not available")
}

// TestChooseVerifierUnrecognizedIssuer tests that an error is returned
// for unrecognized issuers.
func TestChooseVerifierUnrecognizedIssuer(t *testing.T) {
	verifier := &LiveSigstoreVerifier{
		Logger:       io.NewTestHandler(),
		NoPublicGood: false,
	}

	_, err := verifier.chooseVerifier("unknown-issuer")

	require.Error(t, err)
	require.ErrorContains(t, err, "leaf certificate issuer is not recognized")
}

func TestLiveSigstoreVerifier_noVerifierSet(t *testing.T) {
	verifier := &LiveSigstoreVerifier{
		Logger:       io.NewTestHandler(),
		NoPublicGood: true,
		PublicGood:   nil,
		GitHub:       nil,
	}

	require.True(t, verifier.noVerifierSet())
}