refactor: load collection signer from config in collectionsign package

Move validation and NewSignerFromFiles wiring out of main for clearer
composition: main only handles fatal errors and passes ControllerOption.

Co-authored-by: Wolfgang Reithmeier <w.reithmeier@gmail.com>

Author: cursoragent

collectionsign/from_config.go

@@ -0,0 +1,28 @@
+package collectionsign
+
+import (
+	"errors"
+	"fmt"
+
+	"OpenSPMRegistry/config"
+)
+
+// LoadSignerForPackageCollections returns a Signer when package collections and signing are enabled in config.
+// It returns (nil, nil) when signing is disabled. It returns an error if signing is enabled but misconfigured
+// or if loading keys/certs fails.
+func LoadSignerForPackageCollections(pc config.PackageCollectionsConfig) (*Signer, error) {
+	if !pc.Signing.Enabled {
+		return nil, nil
+	}
+	if !pc.Enabled {
+		return nil, errors.New("packageCollections.signing.enabled requires packageCollections.enabled")
+	}
+	if len(pc.Signing.CertChain) == 0 || pc.Signing.PrivateKey == "" {
+		return nil, errors.New("packageCollections.signing.enabled requires certChain (non-empty) and privateKey")
+	}
+	s, err := NewSignerFromFiles(pc.Signing.CertChain, pc.Signing.PrivateKey)
+	if err != nil {
+		return nil, fmt.Errorf("package collection signing: %w", err)
+	}
+	return s, nil
+}

collectionsign/from_config_test.go

@@ -0,0 +1,42 @@
+package collectionsign
+
+import (
+	"testing"
+
+	"OpenSPMRegistry/config"
+)
+
+func TestLoadSignerForPackageCollections_Disabled(t *testing.T) {
+	s, err := LoadSignerForPackageCollections(config.PackageCollectionsConfig{
+		Enabled: true,
+		Signing: config.PackageCollectionsSigningConfig{Enabled: false},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s != nil {
+		t.Fatal("expected nil signer")
+	}
+}
+
+func TestLoadSignerForPackageCollections_SigningWithoutCollections(t *testing.T) {
+	_, err := LoadSignerForPackageCollections(config.PackageCollectionsConfig{
+		Enabled: false,
+		Signing: config.PackageCollectionsSigningConfig{Enabled: true},
+	})
+	if err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestLoadSignerForPackageCollections_MissingPaths(t *testing.T) {
+	_, err := LoadSignerForPackageCollections(config.PackageCollectionsConfig{
+		Enabled: true,
+		Signing: config.PackageCollectionsSigningConfig{
+			Enabled: true,
+		},
+	})
+	if err == nil {
+		t.Fatal("expected error")
+	}
+}

main.go

@@ -102,16 +102,12 @@ func main() {
 	}
 	a := middleware.NewAuthentication(authenticator.CreateAuthenticator(serverConfig.Server), registryMux)
 
+	signer, err := collectionsign.LoadSignerForPackageCollections(serverConfig.Server.PackageCollections)
+	if err != nil {
+		log.Fatal(err)
+	}
 	var collOpts []controller.ControllerOption
-	pc := serverConfig.Server.PackageCollections
-	if pc.Enabled && pc.Signing.Enabled {
-		if len(pc.Signing.CertChain) == 0 || pc.Signing.PrivateKey == "" {
-			log.Fatal("packageCollections.signing.enabled requires certChain (non-empty) and privateKey")
-		}
-		signer, err := collectionsign.NewSignerFromFiles(pc.Signing.CertChain, pc.Signing.PrivateKey)
-		if err != nil {
-			log.Fatalf("package collection signing: %v", err)
-		}
+	if signer != nil {
 		collOpts = append(collOpts, controller.WithCollectionSigner(signer))
 		slog.Info("Package collection JWS signing enabled")
 	}