sigstore-python-conformance

#!/usr/bin/env python3

"""
A wrapper to convert `sigstore-conformance` CLI protocol invocations to match `sigstore-python`.
"""

import os
import sys

SUBCMD_REPLACEMENTS = {
    "sign-bundle": "sign",
    "verify-bundle": "verify",
}

ARG_REPLACEMENTS = {
    "--certificate-identity": "--cert-identity",
    "--certificate-oidc-issuer": "--cert-oidc-issuer",
}

# Trim the script name.
fixed_args = sys.argv[1:]

# Substitute incompatible subcommands.
subcmd = fixed_args[0]
if subcmd in SUBCMD_REPLACEMENTS:
    fixed_args[0] = SUBCMD_REPLACEMENTS[subcmd]

# Build base command with optional staging argument
command = ["sigstore"]
if "--staging" in fixed_args:
    command.append("--staging")
    fixed_args.remove("--staging")

# Fix-up the subcommand: the conformance suite uses `verify`, but
# `sigstore` requires `verify identity` for identity based verifications.
subcommand, *fixed_args = fixed_args
if subcommand == "sign":
    command.append("sign")
elif subcommand == "verify":
    command.extend(["verify", "identity"])
else:
    raise ValueError(f"unsupported subcommand: {subcommand}")

# Replace incompatible flags.
command.extend(ARG_REPLACEMENTS[arg] if arg in ARG_REPLACEMENTS else arg for arg in fixed_args)

os.execvp("sigstore", command)