// EmptyCryptoServiceInterfaceBehaviorTests tests expected behavior for
// an empty signed.CryptoService:
// 1. Getting the public key of a key that doesn't exist should fail
// 2. Listing an empty cryptoservice returns no keys
// 3. Removing a non-existent key succeeds (no-op)
func EmptyCryptoServiceInterfaceBehaviorTests(t *testing.T, empty signed.CryptoService) {
for _, role := range append(data.BaseRoles, "targets/delegation", "invalid") {
keys := empty.ListKeys(role)
require.Len(t, keys, 0)
}
keys := empty.ListAllKeys()
require.Len(t, keys, 0)
require.NoError(t, empty.RemoveKey("nonexistent"))
require.Nil(t, empty.GetKey("nonexistent"))
k, role, err := empty.GetPrivateKey("nonexistent")
require.Error(t, err)
require.Nil(t, k)
require.Equal(t, "", role)
}
func testGetKey(t *testing.T, cs signed.CryptoService, expectedRolesToKeys map[string]string, algo string) {
for role, keyID := range expectedRolesToKeys {
pubKey := cs.GetKey(keyID)
require.NotNil(t, pubKey)
require.Equal(t, keyID, pubKey.ID())
require.Equal(t, algo, pubKey.Algorithm())
privKey, gotRole, err := cs.GetPrivateKey(keyID)
require.NoError(t, err)
require.NotNil(t, privKey)
require.Equal(t, keyID, privKey.ID())
require.Equal(t, algo, privKey.Algorithm())
require.Equal(t, role, gotRole)
require.NoError(t, cs.RemoveKey(keyID))
require.Nil(t, cs.GetKey(keyID))
}
}