Function TestValidateImageCommand_VSAFormat_DSSE

cmd/validate/image_test.go:1638–1689

(t *testing.T)

}

func TestValidateImageCommand_VSAFormat_DSSE(t *testing.T) {
	// Test that --attestation-format=dsse generates DSSE envelopes (existing behavior)
	t.Setenv("COSIGN_PASSWORD", "")

	// Mock the expensive loadPrivateKey operation
	originalLoadPrivateKey := vsa.LoadPrivateKey
	defer func() { vsa.LoadPrivateKey = originalLoadPrivateKey }()

	vsa.LoadPrivateKey = func(keyBytes, password []byte, _ *[]signature.LoadOption) (signature.SignerVerifier, error) {
		return &simpleFakeSigner{}, nil
	}

	validateImageCmd := validateImageCmd(happyValidator())
	cmd := setUpCobra(validateImageCmd)

	fs := afero.NewMemMapFs()
	ctx := utils.WithFS(context.Background(), fs)

	// Create a test VSA signing key
	err := afero.WriteFile(fs, "/tmp/vsa-key.pem", []byte(testECKey), 0o600)
	require.NoError(t, err)

	client := fake.FakeClient{}
	commonMockClient(&client)

	// Add ResolveDigest expectation for VSA processing
	digest, _ := name.NewDigest(testImageDigest)
	client.On("ResolveDigest", mock.Anything).Return(digest.String(), nil)

	ctx = oci.WithClient(ctx, &client)
	cmd.SetContext(ctx)

	cmd.SetArgs([]string{
		"validate", "image",
		"--image", "registry/image:tag",
		"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
		"--vsa",
		"--attestation-format", "dsse",
		"--vsa-signing-key", "/tmp/vsa-key.pem",
		"--vsa-upload", "local@/tmp/vsa-test",
	})

	var out bytes.Buffer
	cmd.SetOut(&out)

	utils.SetTestRekorPublicKey(t)

	// Execute - the command should attempt to generate DSSE envelopes
	_ = cmd.Execute()
	// We don't assert no error because VSA generation might fail in test environment,
	// but we're testing that the DSSE code path is executed
}

func TestValidateImageCommand_VSAFormat_Predicate(t *testing.T) {
	// Test that --attestation-format=predicate generates raw predicates