sigstore: verifySignedArtifacts func

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

__tests__/sigstore/sigstore.test.itg.ts

@@ -14,10 +14,11 @@
  * limitations under the License.
  */
 
-import {describe, expect, jest, it} from '@jest/globals';
+import {describe, expect, jest, it, beforeAll} from '@jest/globals';
 import fs from 'fs';
 import * as path from 'path';
 
+import {Install as CosignInstall} from '../../src/cosign/install';
 import {Sigstore} from '../../src/sigstore/sigstore';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
@@ -27,6 +28,12 @@ const maybe = process.env.GITHUB_ACTIONS && process.env.GITHUB_ACTIONS === 'true
 // needs current GitHub repo info
 jest.unmock('@actions/github');
 
+beforeAll(async () => {
+  const cosignInstall = new CosignInstall();
+  const cosignBinPath = await cosignInstall.download('v3.0.2', true);
+  await cosignInstall.install(cosignBinPath);
+}, 100000);
+
 maybe('signProvenanceBlobs', () => {
   it('single platform', async () => {
     const sigstore = new Sigstore();
@@ -60,3 +67,26 @@ maybe('signProvenanceBlobs', () => {
     }
   });
 });
+
+maybe('verifySignedArtifacts', () => {
+  it('sign and verify', async () => {
+    const sigstore = new Sigstore();
+    const signResults = await sigstore.signProvenanceBlobs({
+      localExportDir: path.join(fixturesDir, 'sigstore', 'multi')
+    });
+    expect(Object.keys(signResults).length).toEqual(2);
+
+    const verifyResults = await sigstore.verifySignedArtifacts(
+      {
+        certificateIdentityRegexp: `^https://github.com/docker/actions-toolkit/.github/workflows/test.yml.*$`
+      },
+      signResults
+    );
+    expect(Object.keys(verifyResults).length).toEqual(2);
+    for (const [artifactPath, res] of Object.entries(verifyResults)) {
+      expect(fs.existsSync(artifactPath)).toBe(true);
+      expect(res.bundlePath).toBeDefined();
+      expect(res.cosignArgs).toBeDefined();
+    }
+  });
+});