Source code missing for test/data/helloworld binary

[jas4711]

Hi. I am packaging in-toto-golang for Debian.

We noticed that the test/data/helloworld is a binary executable that is stored in the git repository, and is used during self-tests. Where is the source code to generate that binary? Debian does not want to ship binaries that cannot be rebuilt from source code.

I tried replacing it with another binary that I built myself, but I see hard-coded SHA checksums in in_toto/runlib_test of the helloworld binary, and I'm not sure if there are other properties this binary must have in order for the self-tests to work. Can you help me? I will disable the self-tests that depend in this binary in order to proceed with inclusion into Debian.

Thanks,
Simon

[jas4711]

For reference, here is the patch we use to disable the helloworld self-test:

https://salsa.debian.org/go-team/packages/in-toto-golang/-/blob/1c7eac08f9cc1659e49fc74c57f7959a11133cf0/debian/patches/0001-Disable-test-that-require-sourceless-test-data-hello.patch

/Simon

[adityasaky]

IIRC it's only the hash but I can take another look. FWIW, we're evaluating the future of in-toto-golang and how it may be merged with github.com/in-toto/witness / go-witness, so perhaps it's best to hit pause on packaging this one? Is this for a specific Debian-based use case?

[jas4711]

Thanks for quick response!

IIRC it's only the hash but I can take another look.

The binary test/data/helloworld is in the git repository. We are pruning that file, and applying the previous patch to avoid test failures.

FWIW, we're evaluating the future of in-toto-golang and how it may be merged with github.com/in-toto/witness / go-witness, so perhaps it's best to hit pause on packaging this one? Is this for a specific Debian-based use case?

I need (parts of) in-toto for sigstore's rekor. Are your plans likely to be implemented in the next few weeks and rekor updated? If not I think it is okay to continue package in-toto-golang since it is necessary for rekor.

/Simon

[adityasaky]

No, the consolidation effort will likely take longer than that.