nordisk/znippy

znippy-common/tests/dsse_fulcio_chain.rs

//! A real cosign attestation (Chainguard's `cgr.dev/chainguard/python`, fetched
//! 2026-10-23 for Holger's intake bench, `bench-scenarios/fixtures/intake/
//! chainguard-python`): the DSSE envelope, the Fulcio leaf certificate
//! (`dev.sigstore.cosign/certificate`) and the chain it carries
//! (`dev.sigstore.cosign/chain`: the Sigstore intermediate, then the root).
//!
//! The envelope is P-256 over the PAE; the leaf is signed by the intermediate
//! with ECDSA SHA-384 over a P-384 key; the intermediate by the P-384 root. So a
//! verify that knows P-256/SHA-256 alone, or that chains only one hop, refuses
//! every Chainguard attestation ("does not chain to any trusted root", found by
//! the bench lane 2026-10-24).
#![cfg(feature = "sign")]

use der::Encode as _;
use x509_cert::Certificate;
use znippy_common::sign::{dsse_verify, CertStore, DsseEnvelope};

const FX: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/fixtures/chainguard-attestation");

fn pems(name: &str) -> Vec<Vec<u8>> {
    let text = std::fs::read(format!("{FX}/{name}")).unwrap();
    Certificate::load_pem_chain(&text).unwrap().iter().map(|c| c.to_der().unwrap()).collect()
}

fn envelope() -> DsseEnvelope {
    DsseEnvelope::from_json(&std::fs::read_to_string(format!("{FX}/envelope.json")).unwrap()).unwrap()
}

#[test]
fn a_chainguard_attestation_chains_through_the_fulcio_intermediate_to_the_root() {
    let leaf = pems("certificate.pem");
    let chain = pems("chain.pem");
    assert_eq!((leaf.len(), chain.len()), (1, 2), "one leaf, intermediate + root");
    // The store holds the intermediate and the root: the leaf walks both links.
    let store = CertStore::from_der_certs(&chain).unwrap();
    let v = dsse_verify(&envelope(), &leaf, &store).unwrap();
    assert_eq!(v.len(), 1);
    // The root alone is not enough: the leaf was issued by the intermediate,
    // and an intermediate that is not in the store cannot be invented.
    let root_only = CertStore::from_der_certs(&chain[1..]).unwrap();
    let e = dsse_verify(&envelope(), &leaf, &root_only).unwrap_err().to_string();
    assert!(e.contains("does not chain"), "{e}");
    // The intermediate alone is an anchor of its own (a store of bare CAs).
    let inter_only = CertStore::from_der_certs(&chain[..1]).unwrap();
    assert!(dsse_verify(&envelope(), &leaf, &inter_only).is_ok());
}

#[test]
fn a_tampered_chainguard_envelope_or_a_foreign_root_is_refused() {
    let leaf = pems("certificate.pem");
    let chain = pems("chain.pem");
    let store = CertStore::from_der_certs(&chain).unwrap();
    let mut bad = envelope();
    bad.payload[0] ^= 1;
    assert!(dsse_verify(&bad, &leaf, &store).is_err());
    let (_, rogue) = znippy_common::sign::dev::mint_ca("rogue").unwrap();
    let rogue = CertStore::from_der_certs(&[rogue]).unwrap();
    assert!(dsse_verify(&envelope(), &leaf, &rogue).is_err());
}