chore: pr comments

pkg/tuf/mock.go

@@ -4,6 +4,8 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"github.com/docker/attest/internal/util"
 )
 
 type MockTufClient struct {
@@ -25,7 +27,8 @@ func NewMockTufClient(srcPath string, dstPath string) *MockTufClient {
 }
 
 func (dc *MockTufClient) DownloadTarget(target string, filePath string) (file *TargetFile, err error) {
-	src, err := os.Open(filepath.Join(dc.srcPath, target))
+	targetPath := filepath.Join(dc.srcPath, target)
+	src, err := os.Open(targetPath)
 	if err != nil {
 		return nil, err
 	}
@@ -56,7 +59,7 @@ func (dc *MockTufClient) DownloadTarget(target string, filePath string) (file *T
 		return nil, err
 	}
 
-	return &TargetFile{ActualFilePath: dstFilePath, Data: b}, nil
+	return &TargetFile{ActualFilePath: dstFilePath, TargetURI: targetPath, Data: b, Digest: util.SHA256Hex(b)}, nil
 }
 
 type MockVersionChecker struct {

pkg/tuf/tuf.go

@@ -129,6 +129,8 @@ func NewClient(initialRoot []byte, tufPath, metadataSource, targetsSource string
 func (t *Client) generateTargetURI(target *metadata.TargetFiles, digest string) (string, error) {
 	targetBaseURL := ensureTrailingSlash(t.cfg.RemoteTargetsURL)
 	targetRemotePath := target.Path
+	// if PrefixTargetsWithHash is set, we need to prefix the target name with the hash and handle subdirectories
+	// similar logic to https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/updater/updater.go#L227-L247
 	if t.cfg.PrefixTargetsWithHash {
 		baseName := filepath.Base(targetRemotePath)
 		dirName, ok := strings.CutSuffix(targetRemotePath, "/"+baseName)