provenance/tests/real_fixtures.rs
//! Real, public attestations, fetched once on the online side (2026-10-23) and
//! verified here OFFLINE against the pinned Sigstore trust root:
//!
//! * `pypi/`: `sampleproject 4.0.0`'s sdist and its PEP 740 provenance, from
//! `https://pypi.org/integrity/sampleproject/4.0.0/<sdist>/provenance` (the sdist since
//! 2026-10-30: a `.whl` is a binary artifact to OpenSSF Scorecard, a `.tar.gz` of source is
//! not; server-lib's pull-through fixtures keep the one real wheel);
//! * `npm/`: `sigstore 5.0.0`'s tarball and its attestations, from
//! `https://registry.npmjs.org/-/npm/v1/attestations/sigstore@5.0.0`, and the
//! registry's public keys from `https://registry.npmjs.org/-/npm/v1/keys`;
//! * `chainguard/`: `cgr.dev/chainguard/static:latest`'s OCI index (the bytes
//! whose sha256 the image digest is) and its cosign `.sig` and `.att` layers
//! with their annotations, from the registry's `sha256-<digest>.sig|.att` tags;
//! * `sigstore/trusted_root.json`: Sigstore's public-good trust root
//! (`sigstore/root-signing`, `targets/trusted_root.json`).
//!
//! Chainguard's identity is pinned from its documentation ("Verifying Chainguard
//! Containers and metadata signatures with Cosign") AND from the certificate on
//! the fetched layers: issuer `https://token.actions.githubusercontent.com`,
//! subject `https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main`.
use holger_provenance::{
effective, verify_artifact, BuilderRule, Identity, KeyAlg, ProvenanceFloor, ProvenanceGate,
TrustRoot, TrustedKey, Verdict,
};
const FX: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/fixtures");
fn read(p: &str) -> Vec<u8> {
std::fs::read(format!("{FX}/{p}")).unwrap_or_else(|e| panic!("{p}: {e}"))
}
fn trust() -> TrustRoot {
TrustRoot::from_trusted_root_json(&read("sigstore/trusted_root.json"))
.expect("the public-good trust root reads")
}
const GITHUB: &str = "https://token.actions.githubusercontent.com";
const CHAINGUARD_SUBJECT: &str =
"https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main";
fn require(identity: Identity, slsa_min: u8, builders: Vec<BuilderRule>) -> ProvenanceGate {
ProvenanceGate::Require {
identity: Some(identity),
identities: vec![],
builders,
keys: vec![],
apk_keys: vec![],
pgp_keys: vec![],
slsa_min: Some(slsa_min),
}
}
fn material(name: &str) -> Vec<(String, Vec<u8>)> {
vec![(name.to_string(), read(name))]
}
#[test]
fn a_chainguard_image_verifies_offline_under_require_with_chainguards_identity() {
let gate = require(
Identity::exact(GITHUB, CHAINGUARD_SUBJECT),
2,
vec!["https://github.com/chainguard-dev/terraform-provider-apko".into()],
);
let policy = effective(
&ProvenanceFloor {
require_signed: true,
..Default::default()
},
&gate,
);
let r = verify_artifact(
&read("chainguard/static-latest.index.json"),
&material("chainguard/static-latest.cosign.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
// One image signature and three attestations (SLSA provenance, apko config, SPDX).
assert_eq!(r.candidates.len(), 4, "{r:#?}");
assert!(r.candidates.iter().all(|c| c.verified), "{r:#?}");
let slsa = r
.verified_provenance()
.next()
.expect("the SLSA provenance verified");
let s = slsa.slsa.as_ref().unwrap();
assert_eq!(
s.builder_id,
"https://github.com/chainguard-dev/terraform-provider-apko"
);
assert_eq!(s.build_type, "https://apko.dev/slsa-build-type@v1");
assert!(s
.invocation_id
.starts_with("cgr.dev/chainguard/static@sha256:17367e4d"));
// Chainguard's legacy cosign bundle carries a SET and no inclusion proof.
assert!(
slsa.tlog[0].set_verified && !slsa.tlog[0].inclusion_verified,
"{:?}",
slsa.tlog
);
assert!(
slsa.checked.iter().any(|c| c.contains("SCT")),
"{:?}",
slsa.checked
);
}
#[test]
fn a_chainguard_image_under_another_identity_is_refused_by_name() {
let gate = require(
Identity::regex(
"https://issuer.enforce.dev",
"https://issuer\\.enforce\\.dev/.+",
),
2,
vec![],
);
let policy = effective(&ProvenanceFloor::default(), &gate);
let r = verify_artifact(
&read("chainguard/static-latest.index.json"),
&material("chainguard/static-latest.cosign.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Block);
assert_eq!(
r.code.as_deref(),
Some("holger-provenance-5"),
"{}",
r.detail
);
}
#[test]
fn chainguard_attestations_do_not_vouch_for_other_bytes() {
let gate = require(Identity::exact(GITHUB, CHAINGUARD_SUBJECT), 2, vec![]);
let policy = effective(&ProvenanceFloor::default(), &gate);
let r = verify_artifact(
b"some other manifest",
&material("chainguard/static-latest.cosign.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Block);
assert_eq!(
r.code.as_deref(),
Some("holger-provenance-2"),
"{}",
r.detail
);
}
#[test]
fn a_pypi_pep740_attestation_verifies_offline() {
let id = Identity::exact(
GITHUB,
"https://github.com/pypa/sampleproject/.github/workflows/release.yml@refs/heads/main",
);
let policy = effective(&ProvenanceFloor::default(), &require(id, 2, vec![]));
let sdist = read("pypi/sampleproject-4.0.0.tar.gz");
let r = verify_artifact(
&sdist,
&material("pypi/sampleproject-4.0.0.tar.gz.provenance.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
let c = &r.candidates[0];
assert!(c.is_provenance && c.predicate_type == "https://docs.pypi.org/attestations/publish/v1");
assert!(
c.tlog[0].set_verified && c.tlog[0].inclusion_verified,
"{:?}",
c.tlog
);
assert!(
c.checked.iter().any(|x| x.contains("SCT")),
"{:?}",
c.checked
);
}
#[test]
fn a_pypi_source_under_prefer_warns_when_nothing_came_with_the_sdist() {
let policy = effective(&ProvenanceFloor::default(), &ProvenanceGate::Prefer);
let r = verify_artifact(
&read("pypi/sampleproject-4.0.0.tar.gz"),
&[],
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Warn);
assert_eq!(r.code.as_deref(), Some("holger-provenance-1"));
// …and passes, recorded, when the attestation came along, signed by anyone the Sigstore root vouches for.
let policy = effective(
&ProvenanceFloor {
identities: vec![Identity::regex(GITHUB, "https://github.com/pypa/.+")],
..Default::default()
},
&ProvenanceGate::Prefer,
);
let r = verify_artifact(
&read("pypi/sampleproject-4.0.0.tar.gz"),
&material("pypi/sampleproject-4.0.0.tar.gz.provenance.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
}
fn npm_key() -> TrustedKey {
let keys: serde_json::Value = serde_json::from_slice(&read("npm/npm-keys.json")).unwrap();
let k = keys["keys"]
.as_array()
.unwrap()
.iter()
.find(|k| k["expires"].is_null())
.unwrap();
TrustedKey {
id: k["keyid"].as_str().unwrap().into(),
alg: KeyAlg::EcdsaP256,
public_key: k["key"].as_str().unwrap().into(),
}
}
#[test]
fn an_npm_provenance_and_its_registry_publish_attestation_verify_offline() {
let floor = ProvenanceFloor {
identities: vec![Identity::exact(
GITHUB,
"https://github.com/sigstore/sigstore-js/.github/workflows/release.yml@refs/heads/main",
)],
keys: vec![npm_key()],
builders: vec!["https://github.com/actions/runner/github-hosted".into()],
..Default::default()
};
let gate = ProvenanceGate::Require {
identity: None,
identities: vec![],
builders: vec![],
keys: vec![],
apk_keys: vec![],
pgp_keys: vec![],
slsa_min: Some(2),
};
let policy = effective(&floor, &gate);
let r = verify_artifact(
&read("npm/sigstore-5.0.0.tgz"),
&material("npm/sigstore-5.0.0.attestations.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Pass, "{r:#?}");
assert_eq!(r.candidates.len(), 2);
assert!(r.candidates.iter().all(|c| c.verified), "{r:#?}");
let prov = r.verified_provenance().next().unwrap();
let s = prov.slsa.as_ref().unwrap();
assert_eq!(
s.build_type,
"https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1"
);
assert_eq!(s.resolved_dependencies.len(), 1);
// The npm publish attestation is signed by the registry's key, not keyless.
let publish = r.candidates.iter().find(|c| !c.is_provenance).unwrap();
assert!(
matches!(
publish.signer,
Some(holger_provenance::SignerInfo::Key { .. })
),
"{publish:?}"
);
}
#[test]
fn an_npm_provenance_from_a_builder_not_allowed_is_refused() {
let floor = ProvenanceFloor {
identities: vec![Identity::regex(GITHUB, "https://github.com/sigstore/.+")],
builders: vec!["https://example.invalid/hardened-builder".into()],
..Default::default()
};
let policy = effective(
&floor,
&ProvenanceGate::Require {
identity: None,
identities: vec![],
builders: vec![],
keys: vec![],
apk_keys: vec![],
pgp_keys: vec![],
slsa_min: None,
},
);
let r = verify_artifact(
&read("npm/sigstore-5.0.0.tgz"),
&material("npm/sigstore-5.0.0.attestations.json"),
&policy,
Some(&trust()),
);
assert_eq!(r.verdict, Verdict::Block);
assert_eq!(
r.code.as_deref(),
Some("holger-provenance-6"),
"{}",
r.detail
);
}
#[test]
fn keyless_without_the_trust_root_is_refused_not_passed() {
let id = Identity::exact(
GITHUB,
"https://github.com/pypa/sampleproject/.github/workflows/release.yml@refs/heads/main",
);
let policy = effective(&ProvenanceFloor::default(), &require(id, 0, vec![]));
let r = verify_artifact(
&read("pypi/sampleproject-4.0.0.tar.gz"),
&material("pypi/sampleproject-4.0.0.tar.gz.provenance.json"),
&policy,
None,
);
assert_eq!(r.verdict, Verdict::Block);
assert_eq!(
r.code.as_deref(),
Some("holger-provenance-10"),
"{}",
r.detail
);
}
/// `sigstore 5.0.0`'s `dist.signatures` from its packument
/// (`https://registry.npmjs.org/sigstore`, fetched 2026-10-24): the registry's ECDSA
/// P-256 signature over `<name>@<version>:<integrity>`, verified offline with the
/// registry's published key.
fn npm_registry_signatures(integrity: &str) -> Vec<(String, Vec<u8>)> {
let doc = serde_json::json!({
"schema": holger_provenance::material::NPM_REGISTRY_SIGNATURES_SCHEMA,
"name": "sigstore",
"version": "5.0.0",
"integrity": integrity,
"signatures": [{
"keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
"sig": "MEUCIGIJh+4RKmp1wBB1Oh2HPPl+OFV2V3T/51C2IV3Wuaa4AiEA+vjXhMpx2l/O73LLM4XpGwvCgNiBTlNAHzry/lPSAhU="
}]
});
vec![(
"sigstore-5.0.0.registry-signatures.json".into(),
serde_json::to_vec(&doc).unwrap(),
)]
}
const SIGSTORE_INTEGRITY: &str = "sha512-hJqJfoG/e4qFQaauQL00c6J6FrHLBGKtkFvW3JbTSIEFOhLrSjdSM/gWd/yUOfYo/gsERehTXGC1VZWX+9X4Dg==";
#[test]
fn an_npm_registry_signature_verifies_offline_with_the_registrys_key() {
let floor = ProvenanceFloor {
require_signed: true,
keys: vec![npm_key()],
..Default::default()
};
let policy = effective(&floor, &ProvenanceGate::Prefer);
let r = verify_artifact(
&read("npm/sigstore-5.0.0.tgz"),
&npm_registry_signatures(SIGSTORE_INTEGRITY),
&policy,
None,
);
assert_eq!(r.candidates.len(), 1, "{r:#?}");
assert!(r.candidates[0].verified, "{r:#?}");
assert!(matches!(
r.candidates[0].signer,
Some(holger_provenance::SignerInfo::Key { .. })
));
assert_ne!(r.verdict, Verdict::Block, "{r:#?}");
}
#[test]
fn an_npm_registry_signature_over_other_bytes_or_by_another_key_is_refused() {
let floor = ProvenanceFloor {
require_signed: true,
keys: vec![npm_key()],
..Default::default()
};
let policy = effective(&floor, &ProvenanceGate::Prefer);
// Another tarball under the same signature: the integrity is not these bytes'.
let r = verify_artifact(
b"not the tarball",
&npm_registry_signatures(SIGSTORE_INTEGRITY),
&policy,
None,
);
assert_eq!(r.verdict, Verdict::Block);
assert_eq!(
r.code.as_deref(),
Some("holger-provenance-2"),
"{}",
r.detail
);
// No configured key for the keyid: the signer is untrusted.
let nokey = effective(
&ProvenanceFloor {
require_signed: true,
..Default::default()
},
&ProvenanceGate::Prefer,
);
let r = verify_artifact(
&read("npm/sigstore-5.0.0.tgz"),
&npm_registry_signatures(SIGSTORE_INTEGRITY),
&nokey,
None,
);
assert_eq!(r.verdict, Verdict::Block);
assert_eq!(
r.code.as_deref(),
Some("holger-provenance-4"),
"{}",
r.detail
);
}