test: add API test for signature inheritance on OCI index children

[Aloui-Ikram]

Covers the inherited_accessories field added in #23540. The test signs an index with cosign and with notation, then checks that a child of that index reports both signatures as inherited with the index digest as their subject, while owning no accessory of its own and returning nothing extra on a request that does not ask for them.

notation cert generate-test refuses to overwrite an existing key, so generate_cert takes a common name and this test uses one of its own instead of colliding with test_notation_sign_artifact.py in the same suite.

Thank you for contributing to Harbor!

Comprehensive Summary of your change

Issue being fixed

Please indicate you've done the following:

• Well Written Title and Summary of the PR
• Label the PR as needed. "release-note/ignore-for-release, release-note/new-feature, release-note/update, release-note/enhancement, release-note/community, release-note/breaking-change, release-note/docs, release-note/infra, release-note/deprecation"
• Accepted the DCO. Commits without the DCO will delay acceptance.
• Made sure tests are passing and test coverage is added if needed.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.59%. Comparing base (b9b2e8c) to head (e7605ca).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #23707      +/-   ##
==========================================
- Coverage   66.59%   66.59%   -0.01%     
==========================================
  Files        1080     1080              
  Lines      118640   118640              
  Branches     2992     2992              
==========================================
- Hits        79012    79004       -8     
- Misses      35254    35260       +6     
- Partials     4374     4376       +2     

Flag	Coverage Δ
unittests	66.59% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds end-to-end API coverage for OCI index signature inheritance.

Changes:

• Tests cosign and notation signature inheritance.
• Adds inherited-accessory query support to test helpers.
• Allows notation tests to use distinct certificate names.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/robot-cases/Group0-BAT/API_DB.robot	Registers the API test.
tests/apitests/python/test_signature_inheritance.py	Exercises index signature inheritance.
tests/apitests/python/library/notation.py	Parameterizes certificate names.
tests/apitests/python/library/artifact.py	Supports the inherited-accessory query parameter.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wy65701436]

@Aloui-Ikram can you fix the CI failure? I tried to rerun, but cannot have it success.

[Aloui-Ikram]

@Aloui-Ikram can you fix the CI failure? I tried to rerun, but cannot have it success.

@wy65701436 i dont think it comes from this PR , the new case passes in that run :

The failing one is Test Case - Replication From Dockerhub. Harbor gets a 403 from Docker Hub, "pagination offset too large for anonymous requests", because the run passes DOCKER_USER and DOCKER_PWD empty. No replication job succeeds and the test times out, so a rerun will not help , this PR only touches test files, nothing in the replication path.

[Aloui-Ikram]

One more thing, it looks like a real adapter bug and not just a CI setup issue. FetchArtifacts resolves the name filter to a namespace and then lists every repo in it (adapter.go:274 calls getRepos with an empty name). The library namespace has 180 repos, so page 2 is always requested and Docker Hub returns the 403 to anonymous clients.

The listing endpoint already accepts a name and listReposPath already builds it, it is just never passed. Asking for the repo directly stays on one page:

/v2/repositories/library/?name=alpine&page=1&page_size=100  ->  200, count 1

Happy to send that as a separate PR. Passing DOCKER_HUB_USERNAME and DOCKER_HUB_PASSWORD to api_run.sh would also work, but that one needs your side.

[wy65701436]

lgtm

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

tests/apitests/python/test_signature_inheritance.py:129

• This does not verify that the default JSON response contains “nothing extra.” The generated Swagger model defines inherited_accessories and deserializes both an omitted property and an explicit JSON null to None, so this assertion would pass if the API contract regressed by emitting the new key. Assert against the raw response JSON that inherited_accessories is absent.

        child = self.artifact.get_reference_info(TestSignatureInheritance.project_name, self.index_name, child_digest,
                                                 **TestSignatureInheritance.user_client)
        self.assertIsNone(child.inherited_accessories)

tests/apitests/python/test_signature_inheritance.py:98

• This fixed common name makes the new test fail when it is rerun on the same worker: as noted in notation.generate_cert, notation cert generate-test will not overwrite the key left by the first run. Use a per-run value (the generated project name is already unique) so retries and repeated local runs remain reliable.

        notation.generate_cert(common_name = "inherited-signature.io")

[bupd]

/lgtm