added integration test and fixed verify

[garethahealy]

Summary

Attempting to add integration tests #208

Release Note

None

Documentation

None

[garethahealy]

@sabre1041 ; when I try to verify the packaged and uploaded chart, I get the below error:

entry not insertable into log: missing provenance content

which comes from:

• https://github.com/sigstore/rekor/blob/main/pkg/types/helm/v0.0.1/entry.go#L384-L386

any ideas what I am doing wrong? or have a I hit a bug

[garethahealy]

this works against v0.2.0 - so presume there's a bug on main or rekor API change that's broken this plugin (i'd guess this)

$ bin/helm-sigstore verify helm-sigstore-test-0.1.0.tgz --keyring .gnupg/sigstore-secring.gpg
Chart Verified Successfully From Helm entry:

Rekor Server: https://rekor.sigstore.dev
Rekor Index: 61347294
Rekor UUID: 24296fb24b8ad77ac1f281392de9110d81aae830454c03035403d9b77f9803f3be641793719f921f

error happens from >= https://github.com/sigstore/rekor/releases/tag/v1.2.1
related to change: sigstore/rekor#1410

[garethahealy]

after a bit of digging, i found:

• https://github.com/sigstore/rekor/blob/main/pkg/types/entries.go#L74-L77

have switched CreateVersionedEntry for UnmarshalEntry and verify works now

tested on my fork:

• https://github.com/garethahealy/helm-sigstore/actions/runs/7410567314/job/20163171539

[cpanato]

thanks, some comments

[garethahealy]

updated with suggested changes and tested @ https://github.com/garethahealy/helm-sigstore/actions/runs/7420076759/job/20190765226

[cpanato]

some comments, thanks for working on this

[cpanato]

thanks