From e1557e7f211f8293a778bf6c74f16865f0c1cf8b Mon Sep 17 00:00:00 2001 From: Rogee Date: Sat, 22 Aug 2026 04:35:33 +0800 Subject: [PATCH] test(HH-468): reject tampered promoted attestations (#98) Co-authored-by: Rogee --- .github/scripts/test_release_promotion.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/scripts/test_release_promotion.sh b/.github/scripts/test_release_promotion.sh index 44462df0..65d558ec 100755 --- a/.github/scripts/test_release_promotion.sh +++ b/.github/scripts/test_release_promotion.sh @@ -253,6 +253,21 @@ must_reject_verify sbom-predicate must_reject_verify sbom-subject must_reject_verify malformed-output +must_reject_promoted() { + local tamper=$1 + if MOCK_TAMPER=$tamper "$attestation" verify-promoted \ + "$identity" "$source_uri" "$source_ref" "$commit" "$builder" "$invocation" \ + "${promotion_targets[@]}" > /dev/null 2>&1; then + echo "Promotion verify accepted $tamper attestation output" >&2 + exit 1 + fi +} +must_reject_promoted builder +must_reject_promoted invocation +must_reject_promoted sbom-predicate +must_reject_promoted sbom-subject +must_reject_promoted malformed-output + if "$attestation" verify-images "https://github.com/owner/other/.github/workflows/ci.yml@refs/tags/v1.2.3" \ "$source_uri" "$source_ref" "$commit" "$builder" "$invocation" "$gochat" > /dev/null 2>&1; then echo "Production verify accepted wrong certificate identity" >&2