test(materials): add CSAF and SPDX annotation coverage for empty values

Add test for CSAF tool annotation assertions and SPDX empty tool name
case to cover the new guards added in the previous commit.

Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Author: jiparis

pkg/attestation/crafter/materials/csaf_test.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -99,11 +99,13 @@ func TestNewCSAFCrafter(t *testing.T) {
 
 func TestCSAFCraft(t *testing.T) {
 	testCases := []struct {
-		name     string
-		filePath string
-		wantErr  string
-		digest   string
-		schema   *contractAPI.CraftingSchema_Material
+		name              string
+		filePath          string
+		wantErr           string
+		digest            string
+		schema            *contractAPI.CraftingSchema_Material
+		annotations       map[string]string
+		absentAnnotations []string
 	}{
 		{
 			name:     "non-expected json file",
@@ -167,6 +169,10 @@ func TestCSAFCraft(t *testing.T) {
 				Name: "test",
 				Type: contractAPI.CraftingSchema_Material_CSAF_VEX,
 			},
+			annotations: map[string]string{
+				"chainloop.material.tool.name":    "Secvisogram",
+				"chainloop.material.tool.version": "1.11.0",
+			},
 		},
 		{
 			name:     "2.0 security advisory",
@@ -252,6 +258,15 @@ func TestCSAFCraft(t *testing.T) {
 			assert.Equal(&attestationApi.Attestation_Material_Artifact{
 				Id: "test", Digest: tc.digest, Name: strings.Split(tc.filePath, "/")[2],
 			}, got.GetArtifact())
+
+			for k, v := range tc.annotations {
+				assert.Equal(v, got.Annotations[k])
+			}
+
+			for _, k := range tc.absentAnnotations {
+				_, exists := got.Annotations[k]
+				assert.False(exists, "annotation %q should not be present", k)
+			}
 		})
 	}
 }

pkg/attestation/crafter/materials/spdxjson_test.go

@@ -100,6 +100,16 @@ func TestSPDXJSONCraft(t *testing.T) {
 				"chainloop.material.tools":        `["syft@0.73.0"]`,
 			},
 		},
+		{
+			name:         "tool with empty name",
+			filePath:     "./testdata/sbom-spdx-empty-tool-name.json",
+			wantDigest:   "sha256:bbc5c2f78c7b05f2e80295e1bf827f24623394dafcd56a4a14f0591b835d28fa",
+			wantFilename: "sbom-spdx-empty-tool-name.json",
+			absentAnnotations: []string{
+				"chainloop.material.tool.name",
+				"chainloop.material.tool.version",
+			},
+		},
 		{
 			name:         "tool without version",
 			filePath:     "./testdata/sbom-spdx-no-tool-version.json",

pkg/attestation/crafter/materials/testdata/sbom-spdx-empty-tool-name.json

@@ -0,0 +1,26 @@
+{
+ "spdxVersion": "SPDX-2.3",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "test-empty-tool-name",
+ "documentNamespace": "https://example.com/test/empty-tool-name",
+ "creationInfo": {
+  "licenseListVersion": "3.20",
+  "creators": [
+   "Organization: Example Corp",
+   "Tool: "
+  ],
+  "created": "2024-01-01T10:00:00Z"
+ },
+ "packages": [
+  {
+   "name": "example-package",
+   "SPDXID": "SPDXRef-Package-example",
+   "versionInfo": "1.0.0",
+   "downloadLocation": "NOASSERTION",
+   "licenseConcluded": "MIT",
+   "licenseDeclared": "MIT",
+   "copyrightText": "NOASSERTION"
+  }
+ ]
+}