anodizer_core/

signing.rs

//! Sign / docker-sign config types.
//!
//! Lifted out of the monolithic `crate::config` module. The historical
//! `anodizer_core::config::{SignConfig, DockerSignConfig}` import path
//! is preserved by re-exports at the bottom of `config.rs`.
//!
//! ## Default-resolution policy
//!
//! Both [`SignConfig`] and [`DockerSignConfig`] keep their fields as
//! `Option<T>` so the schema can distinguish "user set this explicitly"
//! from "user left it default" (preserves YAML round-trip identity and
//! lets a future override-resolution step inject values without losing
//! provenance). Stages MUST read defaults through the `resolved_*()`
//! accessors below — no inline `unwrap_or_else(|| "cosign".to_string())`
//! at call sites — so the answer to "what's the default?" lives in one
//! place per stage and a future default change (or override resolution)
//! lands in one place too. This is the lazy-vs-eager defaults policy
//! anodizer uses across stage configs; precedent commit `ff3be47`
//! (stage-checksum).

use crate::config::{StringOrBool, deserialize_string_or_bool_opt};
use schemars::JsonSchema;
use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, Serialize, Deserialize, Default, JsonSchema)]
#[serde(default, deny_unknown_fields)]
pub struct SignConfig {
    /// Unique identifier for this sign config.
    pub id: Option<String>,
    /// Artifact types to sign: "all", "archive", "binary", "checksum", "package", "sbom" (default: "none").
    pub artifacts: Option<String>,
    /// Signing command to invoke (default: "cosign" or "gpg").
    pub cmd: Option<String>,
    /// Arguments passed to the signing command (supports templates with ${artifact} and ${signature}).
    pub args: Option<Vec<String>>,
    /// Signature output filename template (supports templates).
    pub signature: Option<String>,
    /// Content written to the signing command's stdin.
    pub stdin: Option<String>,
    /// Path to a file whose content is written to the signing command's stdin.
    pub stdin_file: Option<String>,
    /// Build IDs filter: only sign artifacts from builds whose `id` is in this list.
    pub ids: Option<Vec<String>>,
    /// Environment variables passed to the signing command.
    #[serde(default)]
    pub env: Option<Vec<String>>,
    /// Certificate file to embed in the signature (Cosign bundle signing).
    pub certificate: Option<String>,
    /// Capture and log stdout/stderr of the signing command.
    /// Accepts bool or template string (e.g., "{{ IsSnapshot }}").
    #[serde(deserialize_with = "deserialize_string_or_bool_opt", default)]
    pub output: Option<StringOrBool>,
    /// Authenticode (Windows PE/MSI) signing backend. When set, this sign
    /// config signs Windows artifacts in place via osslsigncode (Linux/cross)
    /// or signtool (Windows) instead of producing a detached cosign/gpg
    /// signature. The signing command, argv, timestamp URL, and artifact
    /// selector are all derived; supply only the cert (a secret).
    pub authenticode: Option<AuthenticodeConfig>,
    /// Post-sign verification knobs. Verification is ON by default wherever
    /// its inputs are derivable (keyed cosign, keyless cosign on GitHub
    /// Actions, gpg); set `verify: { enabled: false }` to disable, or supply
    /// the keyless certificate identity / issuer when they cannot be derived
    /// from the environment.
    pub verify: Option<SignVerifyConfig>,
    /// Template-conditional: skip this sign config if rendered result is "false" or empty.
    #[serde(rename = "if")]
    pub if_condition: Option<String>,
}

/// Post-sign verification settings shared by [`SignConfig`] and
/// [`DockerSignConfig`].
///
/// After each signature is produced, the sign stage re-verifies it with the
/// matching verifier (`cosign verify-blob` for detached cosign signatures,
/// `cosign verify` for registry-attached docker signatures, `gpg --verify`
/// for gpg) so "the signer exited 0" is upgraded to "the signature actually
/// verifies". Everything is derived when possible:
///
/// - **keyed cosign** — the public key is derived once per run via
///   `cosign public-key --key <ref>`; nothing to configure.
/// - **keyless cosign** — the certificate identity/issuer are derived from
///   the ambient GitHub Actions OIDC environment
///   (`GITHUB_SERVER_URL`/`GITHUB_WORKFLOW_REF`); outside GitHub Actions,
///   supply them here or verification skips with a named reason.
/// - **gpg** — verified against the same keyring that signed.
///
/// ```yaml
/// signs:
///   - cmd: cosign
///     args: ["sign-blob", "--bundle={{ Signature }}", "--yes", "{{ Artifact }}"]
///     verify:
///       certificate_identity: "https://github.com/acme/app/.github/workflows/release.yml@refs/tags/v1.0.0"
///       certificate_oidc_issuer: "https://token.actions.githubusercontent.com"
/// ```
#[derive(Debug, Clone, Serialize, Deserialize, Default, JsonSchema)]
#[serde(default, deny_unknown_fields)]
pub struct SignVerifyConfig {
    /// Whether to verify each produced signature (default: `true`).
    pub enabled: Option<bool>,
    /// Exact certificate identity (SAN) expected in a keyless signing
    /// certificate (`cosign --certificate-identity`). Overrides the value
    /// derived from the GitHub Actions environment.
    pub certificate_identity: Option<String>,
    /// Regular expression matched against the keyless certificate identity
    /// (`cosign --certificate-identity-regexp`). Ignored when
    /// [`certificate_identity`](Self::certificate_identity) is set.
    pub certificate_identity_regexp: Option<String>,
    /// Expected OIDC issuer of the keyless signing certificate
    /// (`cosign --certificate-oidc-issuer`). Overrides the derived
    /// GitHub Actions issuer.
    pub certificate_oidc_issuer: Option<String>,
}

impl SignVerifyConfig {
    /// Whether verification is enabled (default: `true`).
    pub fn is_enabled(&self) -> bool {
        self.enabled.unwrap_or(true)
    }
}

/// Authenticode (Windows PE/MSI/DLL) signing backend for a [`SignConfig`].
///
/// Unlike the generic cosign/gpg `signs:` path — which produces a *detached*
/// `.sig` next to the artifact — Authenticode signing **embeds** the signature
/// into the PE/MSI container, mutating the artifact in place. Downstream
/// checksums and archives then pick up the signed bytes; no separate signature
/// artifact is registered.
///
/// Everything is derived so the opt-in is minimal — `authenticode: {}` plus a
/// `WINDOWS_CERT_FILE` (and optional `WINDOWS_CERT_PASSWORD`) env var is enough:
///
/// ```yaml
/// signs:
///   - authenticode: {}   # signs every .exe/.msi/.dll via osslsigncode/signtool
/// ```
///
/// A fully-specified config overrides the derived defaults:
///
/// ```yaml
/// signs:
///   - id: authenticode
///     authenticode:
///       cert_file: "{{ .Env.MY_CERT }}"     # or cert_env: MY_CERT_PATH
///       password_env: MY_CERT_PASSWORD
///       timestamp_url: "http://timestamp.sectigo.com"
///       name: "Acme Corp"
///       url: "https://acme.example"
///       tool: osslsigncode
///       artifacts: windows
///       required: true
/// ```
#[derive(Debug, Clone, Serialize, Deserialize, Default, JsonSchema)]
#[serde(default, deny_unknown_fields)]
pub struct AuthenticodeConfig {
    /// Literal path to the PKCS#12 (`.p12` / `.pfx`) cert file. May be a
    /// template (e.g. `"{{ .Env.MY_CERT }}"`). For a non-secret cert path
    /// checked into config; for a secret path prefer [`cert_env`](Self::cert_env).
    pub cert_file: Option<String>,
    /// Name of the env var holding the **path** to the PKCS#12 cert file (never
    /// the cert bytes). Defaults to `WINDOWS_CERT_FILE` when neither this nor
    /// [`cert_file`](Self::cert_file) is set.
    pub cert_env: Option<String>,
    /// Name of the env var holding the cert password. Defaults to
    /// `WINDOWS_CERT_PASSWORD`. The value is read at execution time, passed to
    /// the signer, and redacted from all logs.
    pub password_env: Option<String>,
    /// RFC 3161 timestamp server URL. Defaults to
    /// [`DEFAULT_TIMESTAMP_URL`](AuthenticodeConfig::DEFAULT_TIMESTAMP_URL).
    pub timestamp_url: Option<String>,
    /// Product / publisher name embedded in the signature (osslsigncode `-n`,
    /// signtool `/d`). Templated. Derived from the project name when unset.
    pub name: Option<String>,
    /// Info URL embedded in the signature (osslsigncode `-i`, signtool `/du`).
    /// Omitted when unset.
    pub url: Option<String>,
    /// Override the signer binary. Defaults to `signtool` on a Windows host,
    /// `osslsigncode` elsewhere.
    pub tool: Option<String>,
    /// Artifact selector. Defaults to `"windows"` — Binary/Installer/Library
    /// artifacts whose path ends in `.exe`, `.msi`, or `.dll`.
    pub artifacts: Option<String>,
    /// When `true`, a missing cert HARD-FAILS the sign stage. When `false`
    /// (the default), a missing cert SKIPS gracefully (mirrors the
    /// keyless-cosign-under-harness skip).
    pub required: Option<bool>,
}

impl AuthenticodeConfig {
    /// Default env var naming the cert **path** when neither `cert_file` nor
    /// `cert_env` is set (`"WINDOWS_CERT_FILE"`).
    pub const DEFAULT_CERT_ENV: &'static str = "WINDOWS_CERT_FILE";

    /// Default env var holding the cert password (`"WINDOWS_CERT_PASSWORD"`).
    pub const DEFAULT_PASSWORD_ENV: &'static str = "WINDOWS_CERT_PASSWORD";

    /// Default RFC 3161 timestamp server (`"http://timestamp.digicert.com"`).
    pub const DEFAULT_TIMESTAMP_URL: &'static str = "http://timestamp.digicert.com";

    /// Default artifact selector (`"windows"`).
    pub const DEFAULT_ARTIFACTS: &'static str = "windows";

    /// Signer binary on a Windows host (`"signtool"`).
    pub const DEFAULT_TOOL_WINDOWS: &'static str = "signtool";

    /// Signer binary on a non-Windows host (`"osslsigncode"`).
    pub const DEFAULT_TOOL_UNIX: &'static str = "osslsigncode";

    /// Resolve the env var naming the cert path, falling back to
    /// [`DEFAULT_CERT_ENV`](Self::DEFAULT_CERT_ENV).
    pub fn resolved_cert_env(&self) -> &str {
        self.cert_env.as_deref().unwrap_or(Self::DEFAULT_CERT_ENV)
    }

    /// Resolve the env var holding the cert password, falling back to
    /// [`DEFAULT_PASSWORD_ENV`](Self::DEFAULT_PASSWORD_ENV).
    pub fn resolved_password_env(&self) -> &str {
        self.password_env
            .as_deref()
            .unwrap_or(Self::DEFAULT_PASSWORD_ENV)
    }

    /// Resolve the RFC 3161 timestamp URL, falling back to
    /// [`DEFAULT_TIMESTAMP_URL`](Self::DEFAULT_TIMESTAMP_URL).
    pub fn resolved_timestamp_url(&self) -> &str {
        self.timestamp_url
            .as_deref()
            .unwrap_or(Self::DEFAULT_TIMESTAMP_URL)
    }

    /// Resolve the artifact selector, falling back to
    /// [`DEFAULT_ARTIFACTS`](Self::DEFAULT_ARTIFACTS).
    pub fn resolved_artifacts(&self) -> &str {
        self.artifacts.as_deref().unwrap_or(Self::DEFAULT_ARTIFACTS)
    }

    /// Resolve the signer binary, falling back to the host-appropriate default
    /// (`signtool` on Windows, `osslsigncode` elsewhere).
    pub fn resolved_tool(&self) -> &str {
        self.tool.as_deref().unwrap_or({
            if cfg!(windows) {
                Self::DEFAULT_TOOL_WINDOWS
            } else {
                Self::DEFAULT_TOOL_UNIX
            }
        })
    }

    /// Whether a missing cert HARD-FAILS (`true`) versus skips gracefully
    /// (`false`, the default).
    pub fn is_required(&self) -> bool {
        self.required.unwrap_or(false)
    }
}

impl SignConfig {
    /// Default `id` when a sign config has none (`"default"`). Used to
    /// label log lines and uniqueness-error messages.
    pub const DEFAULT_ID: &'static str = "default";

    /// Default `artifacts` filter for top-level `signs:[]`. Mirrors
    /// the canonical `artifacts = "none"` — by default
    /// nothing is signed unless the user opts in.
    pub const DEFAULT_ARTIFACTS: &'static str = "none";

    /// Default `artifacts` filter for `binary_signs:[]`. The binary-only
    /// driver always restricts the artifact-kind filter to binaries even
    /// when the user leaves `artifacts:` unset. Anodize-specific helper
    /// (anodizer-specific — distinct config type for
    /// binary signing) but kept on `SignConfig` because anodize unifies
    /// `signs[]` and `binary_signs[]` into one struct.
    pub const DEFAULT_ARTIFACTS_BINARY: &'static str = "binary";

    /// Default `signature` template for top-level `signs:[]`. Mirrors
    /// the canonical `signature = "${artifact}.sig"`.
    /// Anodize uses Tera-style `{{ .Artifact }}` placeholders that the
    /// arg-resolver rewrites to the same path at execution time.
    pub const DEFAULT_SIGNATURE_TEMPLATE: &'static str = "{{ .Artifact }}.sig";

    /// Default `signature` template for `binary_signs:[]`.
    ///
    /// Intentional **divergence** from the binary-sign default: the upstream
    /// stores binaries under per-target subdirectories
    /// (`dist/linux_amd64/binname`), so its template appends `_{{ .Os }}_{{ .Arch }}`
    /// to the bare binary name without collision. Anodize uses a flat `dist/`
    /// layout where stage-build already names binaries with the platform
    /// suffix (`myapp_linux_amd64`, `myapp_darwin_arm64`, etc.). Appending
    /// Os/Arch again would produce `myapp_linux_amd64_linux_amd64` with no
    /// `.sig` extension — a double-suffix bug.
    ///
    /// The correct default for anodize's layout is `{{ .Artifact }}.sig` —
    /// identical to `DEFAULT_SIGNATURE_TEMPLATE`. Binary names are already
    /// unique per target, so no collision risk exists. Users who want an
    /// explicit per-target suffix can set `signature:` in `binary_signs:`.
    pub const DEFAULT_BINARY_SIGNATURE_TEMPLATE: &'static str = "{{ .Artifact }}.sig";

    /// Default `args` for top-level `signs:[]`
    /// (`["--output", "$signature", "--detach-sig", "$artifact"]`).
    /// Anodize substitutes `$signature` / `$artifact` for `{{ .Signature }}`
    /// / `{{ .Artifact }}` Tera placeholders that the arg-resolver
    /// rewrites; the wire-level invocation is unchanged.
    pub const DEFAULT_ARGS: &[&'static str] = &[
        "--output",
        "{{ .Signature }}",
        "--detach-sig",
        "{{ .Artifact }}",
    ];

    /// Resolve the sign-config id, falling back to `"default"`.
    pub fn resolved_id(&self) -> &str {
        self.id.as_deref().unwrap_or(Self::DEFAULT_ID)
    }

    /// Resolve the `artifacts` filter, falling back to the supplied
    /// `fallback` (`Self::DEFAULT_ARTIFACTS` for `signs[]`,
    /// `Self::DEFAULT_ARTIFACTS_BINARY` for `binary_signs[]`).
    pub fn resolved_artifacts<'a>(&'a self, fallback: &'a str) -> &'a str {
        self.artifacts.as_deref().unwrap_or(fallback)
    }

    /// Resolve the `signature` template, falling back to the supplied
    /// `default` (`Self::DEFAULT_SIGNATURE_TEMPLATE` for `signs[]`,
    /// `Self::DEFAULT_BINARY_SIGNATURE_TEMPLATE` for `binary_signs[]`).
    pub fn resolved_signature_template<'a>(&'a self, default: &'a str) -> &'a str {
        self.signature.as_deref().unwrap_or(default)
    }

    /// Resolve `args`, materializing the [`Self::DEFAULT_ARGS`] const into
    /// a `Vec<String>` when the user left `args:` unset. Returns a clone
    /// of the user-supplied list otherwise.
    pub fn resolved_args(&self) -> Vec<String> {
        self.args.clone().unwrap_or_else(|| {
            Self::DEFAULT_ARGS
                .iter()
                .map(|s| (*s).to_string())
                .collect()
        })
    }

    /// Whether post-sign verification is enabled (default: `true`; an
    /// absent `verify:` block means "verify with derived inputs").
    pub fn verify_enabled(&self) -> bool {
        self.verify
            .as_ref()
            .is_none_or(SignVerifyConfig::is_enabled)
    }

    /// `true` when this sign config will invoke gpg.
    ///
    /// The top-level `signs:` driver defaults to gpg when `cmd:` is unset
    /// (see `stage-sign::helpers::default_sign_cmd` which falls back to
    /// `git config gpg.program` then to literal `"gpg"`). We treat any
    /// cmd whose basename starts with `gpg` (e.g., `gpg`, `gpg2`,
    /// `/usr/local/bin/gpg`) as a gpg invocation. A cmd of `"cosign"`,
    /// `"notation"`, etc. returns false.
    ///
    /// Entries with `artifacts: "none"` (the default for top-level
    /// `signs:`) are treated as not-configured — the loop never fires.
    pub fn is_gpg(&self) -> bool {
        // Effectively-disabled entries don't count as configured.
        let artifacts = self.resolved_artifacts(Self::DEFAULT_ARTIFACTS);
        if artifacts == "none" {
            return false;
        }
        match self.cmd.as_deref() {
            None => true, // default cmd is gpg
            Some(cmd) => is_gpg_command(cmd),
        }
    }
}

/// True when `cmd` names a gpg binary: its basename starts with `gpg`,
/// so `gpg`, `gpg2`, `gpg.exe`, and absolute paths thereto all qualify
/// while `cosign`, `notation`, etc. do not.
///
/// The single gpg-detection predicate: every site that branches on
/// "is this signing command gpg" (config classification, signature
/// verification arg derivation, deterministic-timestamp injection)
/// must route through it so a `gpg2`/absolute-path cmd behaves like
/// plain `gpg` everywhere.
pub fn is_gpg_command(cmd: &str) -> bool {
    std::path::Path::new(cmd)
        .file_name()
        .and_then(|s| s.to_str())
        .unwrap_or(cmd)
        .starts_with("gpg")
}

#[derive(Debug, Clone, Serialize, Deserialize, Default, JsonSchema)]
#[serde(default, deny_unknown_fields)]
pub struct DockerSignConfig {
    /// Unique identifier for this docker sign config.
    pub id: Option<String>,
    /// Docker artifact types to sign: "all", "image", or "manifest" (default: "none").
    pub artifacts: Option<String>,
    /// Signing command to invoke (default: "cosign").
    pub cmd: Option<String>,
    /// Arguments passed to the signing command (supports templates).
    pub args: Option<Vec<String>>,
    /// Signature output filename template (supports templates).
    pub signature: Option<String>,
    /// Certificate file to embed in the signature (Cosign bundle signing).
    pub certificate: Option<String>,
    /// Docker config IDs filter: only sign images from configs whose `id` is in this list.
    pub ids: Option<Vec<String>>,
    /// Content written to the signing command's stdin.
    pub stdin: Option<String>,
    /// Path to a file whose content is written to the signing command's stdin.
    pub stdin_file: Option<String>,
    /// Environment variables passed to the signing command.
    #[serde(default)]
    pub env: Option<Vec<String>>,
    /// Capture and log stdout/stderr of the docker signing command.
    #[serde(deserialize_with = "deserialize_string_or_bool_opt", default)]
    pub output: Option<StringOrBool>,
    /// Post-sign verification knobs — see [`SignVerifyConfig`]. Docker
    /// signatures are verified with `cosign verify` against the registry
    /// the sign just pushed to.
    pub verify: Option<SignVerifyConfig>,
    /// Template-conditional: skip this docker sign config if rendered result is "false" or empty.
    #[serde(rename = "if")]
    pub if_condition: Option<String>,
}

impl DockerSignConfig {
    /// Default `id` when a docker-sign config has none (`"default"`).
    pub const DEFAULT_ID: &'static str = "default";

    /// Default signing `cmd`
    /// (`cfg.Cmd = "cosign"`). Unlike top-level `signs:[]` (which falls
    /// back to git's `gpg.program` config), docker signing only ever
    /// targets cosign, so the default is a static literal.
    pub const DEFAULT_CMD: &'static str = "cosign";

    /// Default `artifacts` filter when unset. Empty string is treated by
    /// the docker-sign driver as "DockerImageV2 only" (post-buildx
    /// canonical case). An empty `artifacts` is treated identically.
    pub const DEFAULT_ARTIFACTS: &'static str = "";

    /// Default `args` for `docker_signs:[]`
    /// (`["sign", "--key=cosign.key",
    /// "${artifact}@${digest}", "--yes"]`). Anodize substitutes
    /// `${artifact}@${digest}` for the Tera-rewritten
    /// `{{ .Artifact }}@{{ .Digest }}` placeholders.
    pub const DEFAULT_ARGS: &[&'static str] = &[
        "sign",
        "--key=cosign.key",
        "{{ .Artifact }}@{{ .Digest }}",
        "--yes",
    ];

    /// Resolve the docker-sign id, falling back to `"default"`.
    pub fn resolved_id(&self) -> &str {
        self.id.as_deref().unwrap_or(Self::DEFAULT_ID)
    }

    /// Resolve the signing command, falling back to `"cosign"`.
    pub fn resolved_cmd(&self) -> &str {
        self.cmd.as_deref().unwrap_or(Self::DEFAULT_CMD)
    }

    /// Resolve the `artifacts` filter, falling back to `""` (DockerImageV2 only).
    pub fn resolved_artifacts(&self) -> &str {
        self.artifacts.as_deref().unwrap_or(Self::DEFAULT_ARTIFACTS)
    }

    /// Resolve `args`, materializing the [`Self::DEFAULT_ARGS`] const into
    /// a `Vec<String>` when the user left `args:` unset.
    pub fn resolved_args(&self) -> Vec<String> {
        self.args.clone().unwrap_or_else(|| {
            Self::DEFAULT_ARGS
                .iter()
                .map(|s| (*s).to_string())
                .collect()
        })
    }

    /// Whether post-sign verification is enabled (default: `true`).
    pub fn verify_enabled(&self) -> bool {
        self.verify
            .as_ref()
            .is_none_or(SignVerifyConfig::is_enabled)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    // ---- SignConfig::resolved_*() (lazy-defaults policy) ----

    #[test]
    fn sign_resolved_id_default() {
        assert_eq!(SignConfig::default().resolved_id(), "default");
    }

    #[test]
    fn sign_resolved_id_user_value_wins() {
        let cfg = SignConfig {
            id: Some("cosign".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_id(), "cosign");
    }

    #[test]
    fn sign_resolved_artifacts_falls_back_to_supplied_default() {
        let cfg = SignConfig::default();
        assert_eq!(
            cfg.resolved_artifacts(SignConfig::DEFAULT_ARTIFACTS),
            "none"
        );
        assert_eq!(
            cfg.resolved_artifacts(SignConfig::DEFAULT_ARTIFACTS_BINARY),
            "binary"
        );
    }

    #[test]
    fn sign_resolved_artifacts_user_value_wins_over_fallback() {
        let cfg = SignConfig {
            artifacts: Some("checksum".to_string()),
            ..Default::default()
        };
        assert_eq!(
            cfg.resolved_artifacts(SignConfig::DEFAULT_ARTIFACTS),
            "checksum"
        );
        assert_eq!(
            cfg.resolved_artifacts(SignConfig::DEFAULT_ARTIFACTS_BINARY),
            "checksum"
        );
    }

    #[test]
    fn sign_resolved_signature_template_default_paths() {
        let cfg = SignConfig::default();
        assert_eq!(
            cfg.resolved_signature_template(SignConfig::DEFAULT_SIGNATURE_TEMPLATE),
            "{{ .Artifact }}.sig"
        );
        // Binary default now equals the simple .sig template — flat layout means
        // binary names already carry the platform suffix.
        assert_eq!(
            cfg.resolved_signature_template(SignConfig::DEFAULT_BINARY_SIGNATURE_TEMPLATE),
            "{{ .Artifact }}.sig"
        );
    }

    #[test]
    fn sign_resolved_signature_template_user_value_wins() {
        let cfg = SignConfig {
            signature: Some("custom-{{ .Artifact }}.asc".to_string()),
            ..Default::default()
        };
        assert_eq!(
            cfg.resolved_signature_template(SignConfig::DEFAULT_SIGNATURE_TEMPLATE),
            "custom-{{ .Artifact }}.asc"
        );
    }

    #[test]
    fn sign_resolved_args_default_matches_goreleaser() {
        let cfg = SignConfig::default();
        assert_eq!(
            cfg.resolved_args(),
            vec![
                "--output".to_string(),
                "{{ .Signature }}".to_string(),
                "--detach-sig".to_string(),
                "{{ .Artifact }}".to_string(),
            ]
        );
    }

    #[test]
    fn sign_resolved_args_user_value_wins() {
        let custom = vec!["sign".to_string(), "--key=k".to_string()];
        let cfg = SignConfig {
            args: Some(custom.clone()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_args(), custom);
    }

    // ---- DockerSignConfig::resolved_*() ----

    #[test]
    fn docker_sign_resolved_id_default() {
        assert_eq!(DockerSignConfig::default().resolved_id(), "default");
    }

    #[test]
    fn docker_sign_resolved_id_user_value_wins() {
        let cfg = DockerSignConfig {
            id: Some("custom".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_id(), "custom");
    }

    #[test]
    fn docker_sign_resolved_cmd_default() {
        assert_eq!(DockerSignConfig::default().resolved_cmd(), "cosign");
    }

    #[test]
    fn docker_sign_resolved_cmd_user_value_wins() {
        let cfg = DockerSignConfig {
            cmd: Some("notation".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_cmd(), "notation");
    }

    #[test]
    fn docker_sign_resolved_artifacts_default() {
        assert_eq!(DockerSignConfig::default().resolved_artifacts(), "");
    }

    #[test]
    fn docker_sign_resolved_artifacts_user_value_wins() {
        let cfg = DockerSignConfig {
            artifacts: Some("manifests".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_artifacts(), "manifests");
    }

    #[test]
    fn docker_sign_resolved_args_default_matches_goreleaser() {
        assert_eq!(
            DockerSignConfig::default().resolved_args(),
            vec![
                "sign".to_string(),
                "--key=cosign.key".to_string(),
                "{{ .Artifact }}@{{ .Digest }}".to_string(),
                "--yes".to_string(),
            ]
        );
    }

    #[test]
    fn docker_sign_resolved_args_user_value_wins() {
        let custom = vec!["verify".to_string(), "--cert=c".to_string()];
        let cfg = DockerSignConfig {
            args: Some(custom.clone()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_args(), custom);
    }
    // ---- SignConfig::is_gpg() ---------------------------------------

    #[test]
    fn is_gpg_default_cmd_with_signing_artifacts_is_true() {
        // No cmd set + artifacts set to something other than "none" =
        // default gpg invocation, treated as gpg-configured.
        let cfg = SignConfig {
            artifacts: Some("all".to_string()),
            ..Default::default()
        };
        assert!(cfg.is_gpg());
    }

    #[test]
    fn is_gpg_default_artifacts_none_is_false() {
        // Default artifacts filter is "none" — entry is effectively
        // disabled, so it does not count as gpg-configured.
        let cfg = SignConfig::default();
        assert!(!cfg.is_gpg());
    }

    #[test]
    fn is_gpg_cosign_cmd_is_false() {
        let cfg = SignConfig {
            artifacts: Some("all".to_string()),
            cmd: Some("cosign".to_string()),
            ..Default::default()
        };
        assert!(!cfg.is_gpg());
    }

    #[test]
    fn is_gpg_gpg2_cmd_is_true() {
        let cfg = SignConfig {
            artifacts: Some("checksum".to_string()),
            cmd: Some("gpg2".to_string()),
            ..Default::default()
        };
        assert!(cfg.is_gpg());
    }

    #[test]
    fn is_gpg_absolute_gpg_path_is_true() {
        let cfg = SignConfig {
            artifacts: Some("binary".to_string()),
            cmd: Some("/usr/local/bin/gpg".to_string()),
            ..Default::default()
        };
        assert!(cfg.is_gpg());
    }

    // ---- is_gpg_command() -------------------------------------------

    #[test]
    fn is_gpg_command_matches_gpg_variants() {
        for cmd in [
            "gpg",
            "gpg2",
            "gpg.exe",
            "/usr/bin/gpg",
            "/usr/local/bin/gpg2",
        ] {
            assert!(is_gpg_command(cmd), "{cmd} must classify as gpg");
        }
    }

    #[test]
    fn is_gpg_command_rejects_non_gpg() {
        for cmd in [
            "cosign",
            "notation",
            "/usr/bin/cosign",
            "mygpg-wrapper/cosign",
        ] {
            assert!(!is_gpg_command(cmd), "{cmd} must not classify as gpg");
        }
    }

    // ---- AuthenticodeConfig::resolved_*() (lazy-defaults policy) ----

    #[test]
    fn authenticode_resolved_cert_env_default() {
        assert_eq!(
            AuthenticodeConfig::default().resolved_cert_env(),
            "WINDOWS_CERT_FILE"
        );
        assert_eq!(AuthenticodeConfig::DEFAULT_CERT_ENV, "WINDOWS_CERT_FILE");
    }

    #[test]
    fn authenticode_resolved_cert_env_user_value_wins() {
        let cfg = AuthenticodeConfig {
            cert_env: Some("MY_CERT_PATH".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_cert_env(), "MY_CERT_PATH");
    }

    #[test]
    fn authenticode_resolved_password_env_default() {
        assert_eq!(
            AuthenticodeConfig::default().resolved_password_env(),
            "WINDOWS_CERT_PASSWORD"
        );
        assert_eq!(
            AuthenticodeConfig::DEFAULT_PASSWORD_ENV,
            "WINDOWS_CERT_PASSWORD"
        );
    }

    #[test]
    fn authenticode_resolved_password_env_user_value_wins() {
        let cfg = AuthenticodeConfig {
            password_env: Some("CERT_PW".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_password_env(), "CERT_PW");
    }

    #[test]
    fn authenticode_resolved_timestamp_url_default() {
        assert_eq!(
            AuthenticodeConfig::default().resolved_timestamp_url(),
            "http://timestamp.digicert.com"
        );
        assert_eq!(
            AuthenticodeConfig::DEFAULT_TIMESTAMP_URL,
            "http://timestamp.digicert.com"
        );
    }

    #[test]
    fn authenticode_resolved_timestamp_url_user_value_wins() {
        let cfg = AuthenticodeConfig {
            timestamp_url: Some("http://timestamp.sectigo.com".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_timestamp_url(), "http://timestamp.sectigo.com");
    }

    #[test]
    fn authenticode_resolved_artifacts_default() {
        assert_eq!(
            AuthenticodeConfig::default().resolved_artifacts(),
            "windows"
        );
        assert_eq!(AuthenticodeConfig::DEFAULT_ARTIFACTS, "windows");
    }

    #[test]
    fn authenticode_resolved_artifacts_user_value_wins() {
        let cfg = AuthenticodeConfig {
            artifacts: Some("binary".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_artifacts(), "binary");
    }

    #[test]
    fn authenticode_resolved_tool_host_default() {
        // The host-derived default is signtool on Windows, osslsigncode
        // elsewhere — assert whichever this build targets.
        let expected = if cfg!(windows) {
            "signtool"
        } else {
            "osslsigncode"
        };
        assert_eq!(AuthenticodeConfig::default().resolved_tool(), expected);
    }

    #[test]
    fn authenticode_resolved_tool_user_value_wins() {
        let cfg = AuthenticodeConfig {
            tool: Some("osslsigncode".to_string()),
            ..Default::default()
        };
        assert_eq!(cfg.resolved_tool(), "osslsigncode");
    }

    #[test]
    fn authenticode_is_required_default_false() {
        assert!(!AuthenticodeConfig::default().is_required());
    }

    #[test]
    fn authenticode_is_required_user_value_wins() {
        let cfg = AuthenticodeConfig {
            required: Some(true),
            ..Default::default()
        };
        assert!(cfg.is_required());
    }
}