Authenticate selective catalog base pairs

tests/test_release_source_provenance.py

@@ -19,9 +19,12 @@ if str(RELEASE_ROOT) not in sys.path:
     sys.path.insert(0, str(RELEASE_ROOT))
 
 from govoplan_release.publisher import publish_catalog_candidate  # noqa: E402
+from govoplan_release.catalog import canonical_hash  # noqa: E402
 from govoplan_release.selective_catalog import (  # noqa: E402
     build_selective_catalog_candidate,
     enforce_selected_source_provenance,
+    public_key_base64,
+    signature,
 )
 from govoplan_release.source_provenance import (  # noqa: E402
     catalog_source_selection,
@@ -117,23 +120,37 @@ class ReleaseSourceProvenanceTests(unittest.TestCase):
         core, _ = make_repo(self.workspace, self.root, "govoplan-core", "1.2.3")
         git(core, "tag", "-a", "v1.2.3", "-m", "Core 1.2.3")
         git(core, "push", "origin", "refs/tags/v1.2.3")
-        base_catalog = self.root / "base.json"
-        base_catalog.write_text(
-            json.dumps(
-                {
-                    "channel": "stable",
-                    "sequence": 1,
-                    "core_release": {
-                        "version": "1.2.2",
-                        "python_ref": "govoplan-core @ git+ssh://git@example.test/acme/govoplan-core.git@v1.2.2",
-                    },
-                    "modules": [],
-                    "release": {"version": "1.2.2", "tag": "v1.2.2"},
-                }
-            ),
-            encoding="utf-8",
-        )
         private_key = Ed25519PrivateKey.generate()
+        keyring = {
+            "keys": [
+                {
+                    "key_id": "test-key",
+                    "status": "active",
+                    "public_key": public_key_base64(private_key),
+                }
+            ]
+        }
+        base_keyring = self.root / "base-keyring.json"
+        base_keyring.write_text(json.dumps(keyring), encoding="utf-8")
+        base_catalog = self.root / "base.json"
+        base_payload = {
+            "channel": "stable",
+            "sequence": 1,
+            "core_release": {
+                "version": "1.2.2",
+                "python_ref": "govoplan-core @ git+ssh://git@example.test/acme/govoplan-core.git@v1.2.2",
+            },
+            "modules": [],
+            "release": {
+                "version": "1.2.2",
+                "tag": "v1.2.2",
+                "keyring_sha256": canonical_hash(keyring),
+            },
+        }
+        base_payload["signatures"] = [
+            signature(base_payload, key_id="test-key", private_key=private_key)
+        ]
+        base_catalog.write_text(json.dumps(base_payload), encoding="utf-8")
         key_path = self.root / "release.pem"
         key_path.write_bytes(
             private_key.private_bytes(
@@ -153,6 +170,7 @@ class ReleaseSourceProvenanceTests(unittest.TestCase):
                 workspace_root=self.workspace,
                 output_dir=output,
                 base_catalog=base_catalog,
+                base_keyring=base_keyring,
                 signing_keys=(f"test-key={key_path}",),
                 check_public=False,
             )