test(HH-468): reject tampered promoted attestations (#98)

Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-22 04:35:33 +08:00
parent fccfa85c3a
commit e1557e7f21
1 changed files with 15 additions and 0 deletions
@@ -253,6 +253,21 @@ must_reject_verify sbom-predicate
 must_reject_verify sbom-subject
 must_reject_verify malformed-output

+must_reject_promoted() {
+  local tamper=$1
+  if MOCK_TAMPER=$tamper "$attestation" verify-promoted \
+    "$identity" "$source_uri" "$source_ref" "$commit" "$builder" "$invocation" \
+    "${promotion_targets[@]}" > /dev/null 2>&1; then
+    echo "Promotion verify accepted $tamper attestation output" >&2
+    exit 1
+  fi
+}
+must_reject_promoted builder
+must_reject_promoted invocation
+must_reject_promoted sbom-predicate
+must_reject_promoted sbom-subject
+must_reject_promoted malformed-output
+
 if "$attestation" verify-images "https://github.com/owner/other/.github/workflows/ci.yml@refs/tags/v1.2.3" \
  "$source_uri" "$source_ref" "$commit" "$builder" "$invocation" "$gochat" > /dev/null 2>&1; then
  echo "Production verify accepted wrong certificate identity" >&2