test(signer): unit tests for signserver signer package

[matiasinsaurralde]

Summary

Adds unit tests for pkg/attestation/signer/signserver, bringing coverage from 0% to 75.2%.

All pure functions (ParseKeyReference, certFromPem, privateKeyFromPem) and option constructors are fully covered. SignMessage is tested via httptest.NewTLSServer for the success path, non-200 responses, network errors, and missing CA file.

The mTLS client-cert path in SignMessage is intentionally excluded — it requires a full mutual TLS handshake and is a better fit for an integration test.

One behavioral note documented in tests: ParseKeyReference does not validate the scheme prefix; that responsibility belongs to the caller (GetSigner).

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/signer/signserver/signserver_test.go">

<violation number="1" location="pkg/attestation/signer/signserver/signserver_test.go:207">
P2: Do not ignore `io.ReadAll` errors in the success-path test; assert the read succeeds to avoid false positives.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}