Function TestVerifyPluginBadSignature

internal/plugin/verify_test.go:124–181

(t *testing.T)

}

func TestVerifyPluginBadSignature(t *testing.T) {
	tempDir := t.TempDir()

	// Create a plugin tarball
	pluginDir := filepath.Join(tempDir, "bad-plugin")
	if err := os.MkdirAll(pluginDir, 0755); err != nil {
		t.Fatal(err)
	}

	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
		t.Fatal(err)
	}

	tarballPath := filepath.Join(tempDir, "bad-plugin.tar.gz")
	tarFile, err := os.Create(tarballPath)
	if err != nil {
		t.Fatal(err)
	}

	if err := CreatePluginTarball(pluginDir, "test-plugin", tarFile); err != nil {
		tarFile.Close()
		t.Fatal(err)
	}
	tarFile.Close()

	// Create a bad signature (just some text)
	badSig := `-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

This is not a real signature
-----BEGIN PGP SIGNATURE-----

InvalidSignatureData

-----END PGP SIGNATURE-----`

	provFile := tarballPath + ".prov"
	if err := os.WriteFile(provFile, []byte(badSig), 0644); err != nil {
		t.Fatal(err)
	}

	// Read the files
	archiveData, err := os.ReadFile(tarballPath)
	if err != nil {
		t.Fatal(err)
	}

	provData, err := os.ReadFile(provFile)
	if err != nil {
		t.Fatal(err)
	}

	// Try to verify - should fail
	_, err = VerifyPlugin(archiveData, provData, filepath.Base(tarballPath), testPubFile)
	if err == nil {
		t.Error("Expected verification to fail with bad signature")
	}
}