Regenerate expired TUF test fixtures

[nellshamrell]

Summary

The TUF test fixtures across three packages shared a baked-in expiry of 2026-07-18T08:24:13Z, which has now passed. Any test run after that date fails to construct a TUF client with final root.json is expired, reddening CI on main and every open PR.

Fixes #1999.

Affected packages / tests

• pkg/reconciler/trustroot — TestReconcile/With_repository and the trusted_root.json variant (embedded testdata/*).
• pkg/apis/policy/v1alpha1 — TestTrustRootValidation (inline base64 blobs).
• pkg/tuf — TestDownloadTargetFromSerializedMirror and TestClientFromSerializedMirror (inline base64 blobs, byte-identical to the v1alpha1 ones). This third package was not listed in the original issue; found while preparing the fix.

Changes

• Regenerated pkg/reconciler/trustroot/testdata/* via make generate-testdata.
• Replaced the inline validRepository / rootJSON blobs in pkg/tuf and pkg/apis/policy/v1alpha1 with the freshly generated tufRepo.tar and root.json (base64-encoded). All three fixtures now chain to the same fresh trust anchor.
• Refreshed the stale next expiration comments and replaced the manual kind-cluster generation notes with a pointer to make generate-testdata.

Validation

• go test ./pkg/tuf/... ./pkg/apis/policy/v1alpha1/... ./pkg/reconciler/trustroot/... — pass
• go test ./... — pass
• gofmt / go vet — clean

Note

The scaffolding repo builder hardcodes a 6-month expiry, so these fixtures will need periodic regeneration (next: 2027-01-28). A longer-lived or clock-injectable fixture would avoid the recurrence; happy to follow up separately if maintainers prefer that direction.

[nellshamrell]

Filed #2001 as a follow-up to address the recurring 6-month expiry so this stops needing periodic regeneration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.73%. Comparing base (675921f) to head (d5811ee).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2000   +/-   ##
=======================================
  Coverage   30.73%   30.73%           
=======================================
  Files         122      122           
  Lines        7409     7409           
=======================================
  Hits         2277     2277           
  Misses       4897     4897           
  Partials      235      235           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nellshamrell]

Note on the failing e2e checks

The failing jobs on this PR are all e2e, and they fail at the Install policy-controller build step (before any test runs), in make ko-policy-controller:

tarring kodata: kodata symlink ".../cmd/webhook/kodata/HEAD"
resolves to ".../.git/HEAD" which is outside the kodata root
make: *** [Makefile:141: ko-policy-controller] Error 1

This is a pre-existing, repo-wide infrastructure failure, not caused by this change:

• This PR only modifies _test.go files and testdata/ binaries — nothing in the build path.
• The identical error occurs on unrelated PRs (e.g. Refactor TestGetAuthorities into table-driven subtests #1997 and the open dependabot PRs).
• The cmd/webhook/kodata/{HEAD,refs} symlinks point into .git/ and date from 2022 (unchanged). A newer ko now rejects symlinks that resolve outside the kodata root, which breaks ko resolve for the whole repo.

The unit-test layer this PR targets is green (Run unit tests, gofmt, goimports, codegen, lint, DCO all pass). The e2e breakage needs a separate infra fix (the ko/kodata symlinks); I'll open a separate PR for that and link it here.

[nellshamrell]

Follow-up: I've opened #2002 to fix the repo-wide e2e/build CI breakage referenced above. The failures on this PR (tarring kodata: ... resolves to .git/HEAD which is outside the kodata root) come from ko v0.19.0's new kodata-symlink check (ko-build/ko#1619) combined with setup-ko defaulting to latest-release; #2002 pins ko to v0.18.1 until the upstream relaxation (ko-build/ko#1699) is released. Once #2002 merges, re-running e2e here should get past ko resolve.

[nellshamrell]

Closing in favor of pulling these changes into #2002