fix: recompute local promotion evidence

scripts/check-supply-chain-provider-fixtures.ts

@@ -1,5 +1,5 @@
 import { createHash, generateKeyPairSync, sign } from "node:crypto";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -9,12 +9,35 @@ import {
   createReleaseCandidateManifest,
   RELEASE_CANDIDATE_EVIDENCE_PATHS,
   RELEASE_CANDIDATE_MANIFEST_PATH,
+  releaseCandidateManifestSchema,
 } from "./lib/release-candidate.ts";
 
 const fixtureRoot = await mkdtemp(
   path.join(tmpdir(), "supply-chain-provider-fixture-"),
 );
 try {
+  const repositoryRoot = process.cwd();
+  const actualCandidate = releaseCandidateManifestSchema.parse(
+    JSON.parse(
+      await readFile(
+        path.join(repositoryRoot, RELEASE_CANDIDATE_MANIFEST_PATH),
+        "utf8",
+      ),
+    ) as unknown,
+  );
+  const actualProviderEnvironment = absoluteProviderEnvironment(
+    fixtureRoot,
+    await writeProviderEnvironment(
+      fixtureRoot,
+      "actual",
+      actualCandidate.distSha256,
+      actualCandidate.lockfileSha256,
+    ),
+  );
+  const actualDefaultVerifier = await verifyPromotionInputs({
+    environment: actualProviderEnvironment,
+  });
+
   const rawLockfile = "lockfileVersion: '9.0'\n";
   const lockfileSha256 = createHash("sha256")
     .update(rawLockfile)
@@ -86,6 +109,7 @@ try {
   });
 
   const passed =
+    actualDefaultVerifier.status === "PASS" &&
     fixtures.validImmutable.status === "PASS" &&
     fixtures.absent.status === "FAIL_UNVERIFIED" &&
     fixtures.wrongDigest.status === "FAIL_UNVERIFIED" &&
@@ -96,6 +120,10 @@ try {
     `${JSON.stringify(
       {
         schemaVersion: 1,
+        actualDefaultVerifier: {
+          status: actualDefaultVerifier.status,
+          failures: actualDefaultVerifier.failures,
+        },
         fixtures: Object.fromEntries(
           Object.entries(fixtures).map(([name, result]) => [
             name,
@@ -118,13 +146,30 @@ try {
     process.exitCode = 1;
   } else {
     process.stdout.write(
-      "Supply-chain provider fixtures: only the valid immutable fixture PASS\n",
+      "Supply-chain provider fixtures: actual default verifier and valid immutable fixture PASS\n",
     );
   }
 } finally {
   await rm(fixtureRoot, { recursive: true, force: true });
 }
 
+function absoluteProviderEnvironment(
+  repositoryRoot: string,
+  environment: NodeJS.ProcessEnv,
+): NodeJS.ProcessEnv {
+  const absolute = { ...environment };
+  for (const key of [
+    "VULNERABILITY_REPORT_PATH",
+    "PROVENANCE_ATTESTATION_PATH",
+    "VULNERABILITY_PUBLIC_KEY_PATH",
+    "PROVENANCE_PUBLIC_KEY_PATH",
+  ] as const) {
+    const value = absolute[key];
+    if (value) absolute[key] = path.join(repositoryRoot, value);
+  }
+  return absolute;
+}
+
 async function writeProviderEnvironment(
   repositoryRoot: string,
   name: string,