sigstore / sigstore-go

Go library for Sigstore signing and verification
Apache License 2.0
48 stars 26 forks source link

Add unit tests for online log verification and inclusion proofs #53

Closed haydentherapper closed 4 weeks ago

haydentherapper commented 11 months ago

Description

The mock Sigstore data generates a Rekor log entry with a SignedEntryTimestamp but no inclusion proof (See generateTlogEntry).

Additionally, we don't test the online verification path since we don't have a fake Rekor client. Should be straightforward to add with something like https://github.com/sigstore/rekor-monitor/blob/main/pkg/rekor/mock/mock_rekor_client.go

haydentherapper commented 6 months ago

Additionally, we should either add unit tests for https://github.com/sigstore/sigstore-go/blob/main/pkg/tlog/entry.go or confirm that the unit/integration tests for https://github.com/sigstore/sigstore-go/blob/main/pkg/verify/tlog.go cover entry.go

cmurphy commented 1 month ago

@vishal-chdhry are you still interested in taking this up or should someone else have a go?

vishal-chdhry commented 1 month ago

@cmurphy sure I can take this up, I forgot about it

vishal-chdhry commented 1 month ago

\assign