replace tuftool with tufcli

[fghanmi]

On-hold until tufcli is published to CGW.

[qodo-for-securesign]

PR Summary by Qodo

Replace tuftool client/tests with tufcli

✨ Enhancement 🧪 Tests 🕐 20-40 Minutes

AI Description

• Rename the TUF CLI client wrapper to use the new tufcli binary name.
• Update manual TUF repository e2e test to use tufcli flag-based commands.
• Add TUF target certificate/public-key fixtures used by the manual repo test.

Diagram

graph TD
A(["Ginkgo TUF tests"]) --> B["clients.Tufcli"] --> C["cli.Setup"] --> D{{"Setup strategy"}} --> E["tufcli binary"] --> F[("TUF repo workdir")] --> G["Workdir verifier"]
H["Target cert fixtures"] --> F
subgraph Legend
  direction LR
  _t(["Test"]) ~~~ _c["Component"] ~~~ _d{{"Decision"}} ~~~ _w[("Filesystem")]
end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Introduce a generic CLI client constructor (e.g., NewCLI(name))

• ➕ Eliminates per-tool wrapper structs and reduces churn for future renames
• ➕ Makes it easier to parameterize tool selection in tests
• ➖ Loses some type clarity/discoverability vs dedicated clients (Cosign/Rekorcli/Tufcli, etc.)
• ➖ May require broader refactors across existing call sites expecting typed clients

2. Keep a compatibility alias (type Tuftool = Tufcli) temporarily

• ➕ Avoids breaking downstream/internal packages that might still import Tuftool
• ➕ Allows incremental migration if multiple suites/scripts reference the old name
• ➖ Carries deprecated naming longer and can confuse which binary is expected
• ➖ May hide needed CLI-flag differences if behavior diverges further

3. Make the manual repo test support both CLIs via feature detection

• ➕ Allows running tests against mixed environments (old tuftool vs new tufcli)
• ➖ Adds branching logic and doubles the surface area for test maintenance
• ➖ Can mask failures that should be caught by a clean cutover

Recommendation: The PR’s direct cutover is appropriate if tuftool is no longer supported/available in target environments, and it keeps the codebase consistent with a single expected binary and argument shape. Consider adding a short-lived type alias only if there are known external consumers of clients.Tuftool; otherwise, the clean rename + test updates are the lowest-maintenance option.

Files changed (8) +33 / -34 · 4 not counted

Enhancement (1) +4 / -4

tufcli.goRename Tuftool client wrapper to Tufcli and switch binary name +4/-4

Rename Tuftool client wrapper to Tufcli and switch binary name

• Renames the client type and constructor from Tuftool/NewTuftool to Tufcli/NewTufcli. Updates the underlying CLI name used for setup/lookup from "tuftool" to "tufcli".

pkg/clients/tufcli.go

Tests (7) +29 / -30

cgw_test.goUpdate ContentGatewayName test case for tufcli +1/-1

Update ContentGatewayName test case for tufcli

• Adjusts the table-driven test to expect "tufcli" instead of "tuftool". This preserves coverage for the no-override passthrough behavior of ContentGatewayName.

pkg/strategy/cgw/cgw_test.go

ctfe.pubAdd CT log public key fixture for tufcli manual repo test _{not counted}

Add CT log public key fixture for tufcli manual repo test

• Adds a public key fixture used when generating rhtas target metadata during the manual TUF repository test.

test/tufcli/targets/ctfe.pub

fulcio_v1.crt.pemAdd Fulcio certificate fixture for tufcli manual repo test _{not counted}

Add Fulcio certificate fixture for tufcli manual repo test

• Adds a Fulcio certificate fixture referenced by the manual TUF repo test when creating rhtas targets.

test/tufcli/targets/fulcio_v1.crt.pem

rekor.pubAdd Rekor public key fixture for tufcli manual repo test _{not counted}

Add Rekor public key fixture for tufcli manual repo test

• Adds a Rekor public key fixture referenced by the manual TUF repo test when creating rhtas targets.

test/tufcli/targets/rekor.pub

tsa.certchain.pemAdd TSA certificate chain fixture for tufcli manual repo test _{not counted}

Add TSA certificate chain fixture for tufcli manual repo test

• Adds a TSA certificate chain fixture referenced by the manual TUF repo test when creating rhtas targets.

test/tufcli/targets/tsa.certchain.pem

tufcli_manual_tuf_repo_test.goPort manual TUF repo e2e test from tuftool to tufcli CLI syntax +27/-28

Port manual TUF repo e2e test from tuftool to tufcli CLI syntax

• Renames the test package and switches the client from clients.Tuftool to clients.Tufcli. Updates command invocations to match tufcli’s flag-based interface (e.g., --path/--role/--threshold/--output/--key) while keeping the same repository creation and verification intent.

test/tufcli/tufcli_manual_tuf_repo_test.go

tufcli_suite_init_test.goRename Ginkgo suite package to tufcli +1/-1

Rename Ginkgo suite package to tufcli

• Updates the suite init file’s package name to match the new tufcli test package.

test/tufcli/tufcli_suite_init_test.go

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}