add e2e test

Signed-off-by: Hayden <[email protected]>

Author: haydentherapper

test/e2e_test.go

@@ -2804,7 +2804,7 @@ func TestSignBlobNewBundle(t *testing.T) {
 	must(verifyBlobCmd.Exec(ctx, blobPath), t)
 }
 
-func TestSignBlobNewBundleNonSHA256(t *testing.T) {
+func TestSignBlobNewBundleManagedKeyNonDefaultAlgorithm(t *testing.T) {
 	td1 := t.TempDir()
 
 	blob := "someblob"
@@ -2817,30 +2817,109 @@ func TestSignBlobNewBundleNonSHA256(t *testing.T) {
 
 	ctx := context.Background()
 
-	// Generate ecdsa-p521 key
-	_, privKeyPath, pubKeyPath := keypairWithAlgorithm(t, td1, v1.PublicKeyDetails_PKIX_ECDSA_P521_SHA_512)
+	tts := []struct {
+		algo v1.PublicKeyDetails
+	}{
+		{v1.PublicKeyDetails_PKIX_ECDSA_P384_SHA_384},
+		{v1.PublicKeyDetails_PKIX_ECDSA_P521_SHA_512},
+		{v1.PublicKeyDetails_PKIX_RSA_PKCS1V15_2048_SHA256},
+		{v1.PublicKeyDetails_PKIX_RSA_PKCS1V15_3072_SHA256},
+		{v1.PublicKeyDetails_PKIX_RSA_PKCS1V15_4096_SHA256},
+		{v1.PublicKeyDetails_PKIX_ED25519_PH}, // Only prehash variant is supported
+	}
+	for _, tt := range tts {
+		_, privKeyPath, pubKeyPath := keypairWithAlgorithm(t, td1, tt.algo)
 
-	ko := options.KeyOpts{
-		KeyRef:          privKeyPath,
-		PassFunc:        passFunc,
-		BundlePath:      bundlePath,
-		NewBundleFormat: true,
+		ko := options.KeyOpts{
+			KeyRef:          privKeyPath,
+			PassFunc:        passFunc,
+			BundlePath:      bundlePath,
+			NewBundleFormat: true,
+		}
+		if _, err := sign.SignBlobCmd(ro, ko, blobPath, true, "", "", false); err != nil {
+			t.Fatal(err)
+		}
+		algDetails, err := signature.GetAlgorithmDetails(tt.algo)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		ko1 := options.KeyOpts{
+			KeyRef:          pubKeyPath,
+			BundlePath:      bundlePath,
+			NewBundleFormat: true,
+		}
+		verifyBlobCmd := cliverify.VerifyBlobCmd{
+			KeyOpts:       ko1,
+			IgnoreTlog:    true,
+			HashAlgorithm: algDetails.GetHashType(),
+		}
+		must(verifyBlobCmd.Exec(ctx, blobPath), t)
 	}
-	if _, err := sign.SignBlobCmd(ro, ko, blobPath, true, "", "", false); err != nil {
+}
+
+func TestAttestBlobNewBundleManagedKeyNonDefaultAlgorithm(t *testing.T) {
+	td := t.TempDir()
+	blob := "someblob"
+	bp := filepath.Join(td, blob)
+	if err := os.WriteFile(bp, []byte(blob), 0600); err != nil {
 		t.Fatal(err)
 	}
+	// Sign an attestation
+	statement := `{"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"someblob","digest":{"alg":"7e9b6e7ba2842c91cf49f3e214d04a7a496f8214356f41d81a6e6dcad11f11e3"}}],"predicateType":"something","predicate":{}}`
+	attestDir := t.TempDir()
+	statementPath := filepath.Join(attestDir, "statement")
+	if err := os.WriteFile(statementPath, []byte(statement), 0644); err != nil {
+		t.Fatal(err)
+	}
+	attBundlePath := filepath.Join(attestDir, "attest.bundle.json")
 
-	ko1 := options.KeyOpts{
-		KeyRef:          pubKeyPath,
-		BundlePath:      bundlePath,
-		NewBundleFormat: true,
+	ctx := context.Background()
+
+	tts := []struct {
+		algo v1.PublicKeyDetails
+	}{
+		{v1.PublicKeyDetails_PKIX_ECDSA_P384_SHA_384},
+		{v1.PublicKeyDetails_PKIX_ECDSA_P521_SHA_512},
+		{v1.PublicKeyDetails_PKIX_RSA_PKCS1V15_2048_SHA256},
+		{v1.PublicKeyDetails_PKIX_RSA_PKCS1V15_3072_SHA256},
+		{v1.PublicKeyDetails_PKIX_RSA_PKCS1V15_4096_SHA256},
+		{v1.PublicKeyDetails_PKIX_ED25519}, // Only pure variant is supported
 	}
-	verifyBlobCmd := cliverify.VerifyBlobCmd{
-		KeyOpts:       ko1,
-		IgnoreTlog:    true,
-		HashAlgorithm: crypto.SHA512,
+	for _, tt := range tts {
+		_, privKeyPath, pubKeyPath := keypairWithAlgorithm(t, td, tt.algo)
+
+		ko := options.KeyOpts{
+			KeyRef:          privKeyPath,
+			PassFunc:        passFunc,
+			BundlePath:      attBundlePath,
+			NewBundleFormat: true,
+		}
+
+		algDetails, err := signature.GetAlgorithmDetails(tt.algo)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		attestBlobCmd := attest.AttestBlobCommand{
+			KeyOpts:        ko,
+			RekorEntryType: "dsse",
+			StatementPath:  statementPath,
+		}
+		must(attestBlobCmd.Exec(ctx, bp), t)
+
+		// Verify an attestation
+		ko.KeyRef = pubKeyPath
+		verifyBlobAttestationCmd := cliverify.VerifyBlobAttestationCommand{
+			KeyOpts:             ko,
+			UseSignedTimestamps: true,
+			Digest:              "7e9b6e7ba2842c91cf49f3e214d04a7a496f8214356f41d81a6e6dcad11f11e3",
+			DigestAlg:           "alg",
+			CheckClaims:         true,
+			HashAlgorithm:       algDetails.GetHashType(),
+		}
+		must(verifyBlobAttestationCmd.Exec(ctx, ""), t)
 	}
-	must(verifyBlobCmd.Exec(ctx, blobPath), t)
 }
 
 func TestSignBlobNewBundleNonDefaultAlgorithm(t *testing.T) {