From df542b3f800bf3fadec0e67231eb2991cb3c1105 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Mon, 9 Feb 2026 16:56:52 -0800
Subject: [PATCH] policy: add testcases for !hasProvenance and sha256 git

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 policy/validate_test.go | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/policy/validate_test.go b/policy/validate_test.go
index 4a79fa1ee..6930e2fe9 100644
--- a/policy/validate_test.go
+++ b/policy/validate_test.go
@@ -377,6 +377,14 @@ func TestSourceToInputWithLogger(t *testing.T) {
 				"input.image.workingDir",
 				"input.image.env",
 			},
+			assert: func(t *testing.T, inp Input, unknowns []string, err error) {
+				t.Helper()
+				require.NoError(t, err)
+				require.NotNil(t, inp.Image)
+				require.False(t, inp.Image.HasProvenance)
+				require.NotContains(t, unknowns, "input.image.hasProvenance")
+				require.NotContains(t, unknowns, "input.image.signatures")
+			},
 		},
 		{
 			name: "image-source-with-config-and-no-attestation-chain",
@@ -671,6 +679,28 @@ func TestSourceToInputWithLogger(t *testing.T) {
 			},
 			expUnk: []string{"input.git.commit", "input.git.tag"},
 		},
+		{
+			name: "git-meta-sha256-checksum-sets-is-sha256",
+			src: &gwpb.ResolveSourceMetaResponse{
+				Source: &pb.SourceOp{
+					Identifier: "git://github.com/docker/buildx.git",
+				},
+				Git: &gwpb.ResolveSourceGitResponse{
+					Checksum: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+				},
+			},
+			expInput: Input{
+				Git: &Git{
+					Schema:         "https",
+					Host:           "github.com",
+					Remote:         "https://github.com/docker/buildx.git",
+					Checksum:       "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+					CommitChecksum: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+					IsSHA256:       true,
+				},
+			},
+			expUnk: []string{"input.git.commit", "input.git.tag"},
+		},
 		{
 			name: "git-meta-checksum-ne-commit-checksum-sets-annotated-tag",
 			src: &gwpb.ResolveSourceMetaResponse{