add tests for the e2e repository (#78)

Signed-off-by: Asra Ali <asraa@google.com>

main.go

@@ -36,36 +36,33 @@ func verify(ctx context.Context,
 		return err
 	}
 
-	// Get Rekor entries corresponding to the binary artifact in the provenance.
-	uuids, err := pkg.GetRekorEntries(rClient, artifactHash)
-	if err != nil {
-		return err
-	}
-
-	env, err := pkg.EnvelopeFromBytes(provenance)
-	if err != nil {
-		return err
-	}
-
-	// Verify the provenance and return the signing certificate.
-	cert, err := pkg.FindSigningCertificate(ctx, uuids, *env, rClient)
+	/* Verify signature on the intoto attestation. */
+	env, cert, err := pkg.VerifyProvenanceSignature(ctx, rClient, provenance, artifactHash)
 	if err != nil {
 		return err
 	}
 
+	/* Verify properties of the signing identity. */
 	// Get the workflow info given the certificate information.
 	workflowInfo, err := pkg.GetWorkflowInfoFromCertificate(cert)
 	if err != nil {
 		return err
 	}
 
-	// Unpack and verify info in the provenance, including the Subject Digest.
-	if err := pkg.VerifyProvenance(env, artifactHash); err != nil {
+	b, err := json.MarshalIndent(workflowInfo, "", "\t")
+	if err != nil {
+		return err
+	}
+	fmt.Fprintf(os.Stderr, "verified signature on SLSA provenance produced at \n %s\n", b)
+
+	/* Verify properties of the SLSA provenance. */
+	// Verify the workflow identity.
+	if err := pkg.VerifyWorkflowIdentity(workflowInfo, source); err != nil {
 		return err
 	}
 
-	// Verify the workflow identity.
-	if err := pkg.VerifyWorkflowIdentity(workflowInfo, source); err != nil {
+	// Unpack and verify info in the provenance, including the Subject Digest.
+	if err := pkg.VerifyProvenance(env, artifactHash); err != nil {
 		return err
 	}
 
@@ -88,13 +85,6 @@ func verify(ctx context.Context,
 		}
 	}
 
-	b, err := json.MarshalIndent(workflowInfo, "", "\t")
-	if err != nil {
-		return err
-	}
-
-	fmt.Fprintf(os.Stderr, "verified SLSA provenance produced at \n %s\n", b)
-
 	// Print verified provenance to stdout.
 	pyld, err := base64.StdEncoding.DecodeString(env.Payload)
 	if err != nil {

main_test.go

@@ -285,12 +285,11 @@ func Test_runVerify(t *testing.T) {
 			pversiontag: pString("v3.1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
-		// TODO(laurent): add tests for special cases of buidlers' ref.
 		{
-			name:     "rekor upload bypassed",
-			artifact: "./testdata/binary-linux-amd64-no-tlog-upload",
-			source:   "github.com/asraa/slsa-on-github-test",
-			err:      pkg.ErrorRekorSearch,
+			name:     "e2e test repository verified with builder at head",
+			artifact: "./testdata/binary-linux-amd64-e2e-builder-repo",
+			source:   "github.com/slsa-framework/example-package",
+			branch:   "main",
 		},
 		{
 			name:     "malicious: untrusted builder",

pkg/provenance.go

@@ -300,6 +300,29 @@ func extractCert(e *models.LogEntryAnon) (*x509.Certificate, error) {
 	return certs[0], err
 }
 
+// VerifyProvenanceSignature returns the verified DSSE envelope containing the provenance
+// and the signing certificate given the provenance and artifact hash.
+func VerifyProvenanceSignature(ctx context.Context, rClient *client.Rekor, provenance []byte, artifactHash string) (*dsselib.Envelope, *x509.Certificate, error) {
+	// Get Rekor entries corresponding to the binary artifact in the provenance.
+	uuids, err := GetRekorEntries(rClient, artifactHash)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	env, err := EnvelopeFromBytes(provenance)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Verify the provenance and return the signing certificate.
+	cert, err := FindSigningCertificate(ctx, uuids, *env, rClient)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return env, cert, nil
+}
+
 // FindSigningCertificate finds and verifies a matching signing certificate from a list of Rekor entry UUIDs.
 func FindSigningCertificate(ctx context.Context, uuids []string, dssePayload dsselib.Envelope, rClient *client.Rekor) (*x509.Certificate, error) {
 	attBytes, err := cjson.MarshalCanonical(dssePayload)