Lint tests too

Makefile

@@ -8,7 +8,7 @@ fmt:
 
 .PHONY: lint
 lint:
-	cargo clippy --workspace -- -D warnings
+	cargo clippy --all-targets -- -D warnings
 
 .PHONY: doc
 doc:

clippy.toml

@@ -0,0 +1,2 @@
+allow-unwrap-in-tests = true
+allow-panic-in-tests = true

src/cosign/mod.rs

@@ -337,7 +337,7 @@ TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ
     const SIGNED_IMAGE: &str = "busybox:1.34";
 
     pub(crate) fn get_fulcio_cert_pool() -> CertificatePool {
-        fn pem_to_der<'a>(input: &'a str) -> CertificateDer<'a> {
+        fn pem_to_der(input: &str) -> CertificateDer<'_> {
             let pem_cert = pem::parse(input).unwrap();
             assert_eq!(pem_cert.tag(), "CERTIFICATE");
             CertificateDer::from(pem_cert.into_contents())

src/cosign/signature_layers.rs

@@ -693,10 +693,7 @@ JsB89BPhZYch0U0hKANx5TY+ncrm0s8bfJxxHoenAEFhwhuXeb4PqIrtoQ==
         )
         .expect_err("Didn't get an error");
 
-        let found = match error {
-            SigstoreError::SigstoreMediaTypeNotFoundError => true,
-            _ => false,
-        };
+        let found = matches!(error, SigstoreError::SigstoreMediaTypeNotFoundError);
         assert!(found, "Got a different error type: {}", error);
     }
 
@@ -725,10 +722,7 @@ JsB89BPhZYch0U0hKANx5TY+ncrm0s8bfJxxHoenAEFhwhuXeb4PqIrtoQ==
         )
         .expect_err("Didn't get an error");
 
-        let found = match error {
-            SigstoreError::SigstoreMediaTypeNotFoundError => true,
-            _ => false,
-        };
+        let found = matches!(error, SigstoreError::SigstoreMediaTypeNotFoundError);
         assert!(found, "Got a different error type: {}", error);
     }
 
@@ -758,10 +752,7 @@ JsB89BPhZYch0U0hKANx5TY+ncrm0s8bfJxxHoenAEFhwhuXeb4PqIrtoQ==
         )
         .expect_err("Didn't get an error");
 
-        let found = match error {
-            SigstoreError::SigstoreLayerDigestMismatchError => true,
-            _ => false,
-        };
+        let found = matches!(error, SigstoreError::SigstoreLayerDigestMismatchError);
         assert!(found, "Got a different error type: {}", error);
     }
 

src/crypto/certificate.rs

@@ -351,10 +351,10 @@ mod tests {
         let cert = x509_cert::Certificate::from_der(pem.contents())?;
 
         let err = verify_key_usages(&cert).expect_err("Was supposed to return an error");
-        let found = match err {
-            SigstoreError::CertificateWithoutDigitalSignatureKeyUsage => true,
-            _ => false,
-        };
+        let found = matches!(
+            err,
+            SigstoreError::CertificateWithoutDigitalSignatureKeyUsage
+        );
         assert!(found, "Didn't get expected error, got {:?} instead", err);
 
         Ok(())
@@ -376,10 +376,7 @@ mod tests {
         let cert = x509_cert::Certificate::from_der(pem.contents())?;
 
         let err = verify_key_usages(&cert).expect_err("Was supposed to return an error");
-        let found = match err {
-            SigstoreError::CertificateWithoutCodeSigningKeyUsage => true,
-            _ => false,
-        };
+        let found = matches!(err, SigstoreError::CertificateWithoutCodeSigningKeyUsage);
         assert!(found, "Didn't get expected error, got {:?} instead", err);
 
         Ok(())
@@ -402,10 +399,10 @@ mod tests {
         let cert = x509_cert::Certificate::from_der(pem.contents())?;
 
         let error = verify_has_san(&cert).expect_err("Didn't get an error");
-        let found = match error {
-            SigstoreError::CertificateWithoutSubjectAlternativeName => true,
-            _ => false,
-        };
+        let found = matches!(
+            error,
+            SigstoreError::CertificateWithoutSubjectAlternativeName
+        );
         assert!(found, "Didn't get the expected error: {}", error);
 
         Ok(())
@@ -446,10 +443,7 @@ mod tests {
         let cert = x509_cert::Certificate::from_der(pem.contents())?;
 
         let err = verify_validity(&cert).expect_err("Was expecting an error");
-        let found = match err {
-            SigstoreError::CertificateValidityError(_) => true,
-            _ => false,
-        };
+        let found = matches!(err, SigstoreError::CertificateValidityError(_));
         assert!(found, "Didn't get expected error, got {:?} instead", err);
 
         Ok(())
@@ -508,13 +502,13 @@ mod tests {
 
         let err = verify_expiration(&cert, integrated_time.timestamp())
             .expect_err("Was expecting an error");
-        let found = match err {
+        let found = matches!(
+            err,
             SigstoreError::CertificateIssuedAfterSignaturesSubmittedToRekor {
                 integrated_time: _,
                 not_after: _,
-            } => true,
-            _ => false,
-        };
+            }
+        );
         assert!(found, "Didn't get expected error, got {:?} instead", err);
 
         Ok(())

src/crypto/keyring.rs

@@ -129,7 +129,7 @@ mod tests {
 
         // Generate the key id.
         let mut hasher = sha2::Sha256::new();
-        hasher.write(pub_key.as_slice()).unwrap();
+        hasher.write_all(pub_key.as_slice()).unwrap();
         let key_id: [u8; 32] = hasher.finalize().into();
 
         // Check for success.

src/crypto/verification_key.rs

@@ -331,7 +331,7 @@
 
     /// Verify the signature provided has been actually generated by the given key
     /// when signing the provided prehashed message.
     pub(crate) fn verify_prehash(&self, signature: Signature, msg: &[u8]) -> Result<()> {
         let sig = match signature {
             Signature::Raw(data) => data.to_owned(),
             Signature::Base64Encoded(data) => BASE64_STD_ENGINE.decode(data)?,
@@ -425,10 +425,7 @@
         let err = verification_key
             .verify_signature(signature, msg.as_bytes())
             .expect_err("Was expecting an error");
-        let found = match err {
-            SigstoreError::PublicKeyVerificationError => true,
-            _ => false,
-        };
+        let found = matches!(err, SigstoreError::PublicKeyVerificationError);
         assert!(found, "Didn't get expected error, got {:?} instead", err);
     }
 
@@ -443,10 +440,7 @@
         let err = verification_key
             .verify_signature(signature, msg.as_bytes())
             .expect_err("Was expecting an error");
-        let found = match err {
-            SigstoreError::Base64DecodeError(_) => true,
-            _ => false,
-        };
+        let found = matches!(err, SigstoreError::Base64DecodeError(_));
         assert!(found, "Didn't get expected error, got {:?} instead", err);
     }
 
@@ -468,10 +462,7 @@
         let err = verification_key
             .verify_signature(signature, msg.as_bytes())
             .expect_err("Was expecting an error");
-        let found = match err {
-            SigstoreError::PublicKeyVerificationError => true,
-            _ => false,
-        };
+        let found = matches!(err, SigstoreError::PublicKeyVerificationError);
         assert!(found, "Didn't get expected error, got {:?} instead", err);
     }