added integration test and fixed verify (#209)

Signed-off-by: Gareth Healy <garethahealy@gmail.com>

.github/workflows/ci.yml

@@ -27,6 +27,9 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
 
+      - name: Setup Bats and bats libs
+        uses: bats-core/bats-action@e4efaa4edd28f6c43ea5bd55c0a23bdd62360100 # v1.5.4
+
       - name: Verify go.mod is sane
         run: go mod tidy && git diff --no-patch --exit-code
 
@@ -38,3 +41,18 @@ jobs:
 
       - name: Test
         run: make test
+
+      - name: Create Integration Pre-Reqs
+        run: ./scripts/generate-test-chart.sh
+
+      - name: Upload helm-sigstore-test-0.1.0.tgz
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
+        with:
+          name: helm-sigstore-test-0.1.0.tgz
+          path: |
+            helm-sigstore-test-0.1.0.tgz
+            helm-sigstore-test-0.1.0.tgz.prov
+            .gnupg/sigstore-secring.gpg
+
+      - name: Integration Test
+        run: make integration

.gitignore

@@ -20,4 +20,9 @@ dist
 
 # OSX
 .DS_Store
-.vscode
+.vscode
+.idea
+
+helm-sigstore-test/
+helm-sigstore-test-0.1.0.tgz
+.gnupg/

Makefile

@@ -69,6 +69,10 @@ lint: golangci-lint ## Runs golangci-lint linter
 test: ## Runs go tests
 	go test ./...
 
+integration: ## Runs integration tests
+	command -v bats &> /dev/null || { echo >&2 'ERROR: bats not installed; see: https://bats-core.readthedocs.io/en/stable/installation.html - Aborting'; exit 1; }
+	bats --verbose-run tests/integration.sh
+
 ##################
 # release section
 ##################

cmd/verify.go

@@ -91,7 +91,7 @@ func NewVerifyCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
-			eimpl, err := rekortypes.CreateVersionedEntry(pe)
+			eimpl, err := rekortypes.UnmarshalEntry(pe)
 			if err != nil {
 				return err
 			}

pkg/rekor/rekor.go

@@ -90,6 +90,9 @@ func (r *Rekor) Upload(request *UploadRequest) (*UploadResponse, error) {
 	re.HelmObj.Chart.Provenance.Content = strfmt.Base64(request.Provenance)
 	re.HelmObj.PublicKey = &models.HelmV001SchemaPublicKey{}
 	re.HelmObj.PublicKey.Content = (*strfmt.Base64)(&request.PublicKey)
+	if ok, err := re.Insertable(); !ok {
+		return nil, err
+	}
 
 	entry := models.Helm{}
 	entry.APIVersion = swag.String(re.APIVersion())

scripts/generate-test-chart.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Copyright 2024 The Sigstore Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+echo "Creating throw away key..."
+mkdir -p .gnupg
+gpg --batch --passphrase '' --quick-generate-key "helm-sigstore-test"
+gpg --export-secret-keys > .gnupg/sigstore-secring.gpg
+
+echo "Creating, packaging and signing chart temp chart..."
+helm create helm-sigstore-test
+helm package --sign --key 'helm-sigstore-test' --keyring .gnupg/sigstore-secring.gpg helm-sigstore-test
+cat helm-sigstore-test-0.1.0.tgz.prov

tests/integration.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bats
+
+#
+# Copyright 2024 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+@test "print help" {
+  cmd="bin/helm-sigstore help"
+  run ${cmd}
+
+  echo "${cmd} : ${status} : ${output}"
+  [ "$status" -eq 0 ]
+}
+
+@test "print version" {
+  cmd="bin/helm-sigstore version"
+  run ${cmd}
+
+  echo "${cmd} : ${status} : ${output}"
+  [ "$status" -eq 0 ]
+}
+
+@test "upload packaged chart" {
+  cmd="bin/helm-sigstore upload helm-sigstore-test-0.1.0.tgz --keyring .gnupg/sigstore-secring.gpg"
+  run ${cmd}
+
+  echo "${cmd} : ${status} : ${output}"
+  [ "$status" -eq 0 ]
+}
+
+@test "search packaged chart" {
+  cmd="bin/helm-sigstore search helm-sigstore-test-0.1.0.tgz"
+  run ${cmd}
+
+  echo "${cmd} : ${status} : ${output}"
+  [ "$status" -eq 0 ]
+}
+
+@test "verify packaged chart" {
+  cmd="bin/helm-sigstore verify helm-sigstore-test-0.1.0.tgz --keyring .gnupg/sigstore-secring.gpg"
+  run ${cmd}
+
+  echo "${cmd} : ${status} : ${output}"
+  [ "$status" -eq 0 ]
+}