Add test_sign_metadata__update__finalize

Signed-off-by: Lukas Puehringer <[email protected]>

tests/unit/tuf_repository_service_worker/test_repository.py

@@ -3406,3 +3406,81 @@ def fake_get_fresh(key):
         assert test_repo.write_repository_settings.calls == [
             pretend.call("ROOT_SIGNING", "fake")
         ]
+
+    def test_sign_metadata__update__finalize(
+        self, test_repo, monkeypatch, mocked_datetime
+    ):
+        fake_datetime = mocked_datetime
+
+        def fake_get_fresh(key):
+            if key == "BOOTSTRAP":
+                return "<task-id>"
+            if key == "ROOT_SIGNING":
+                return {"metadata": "fake"}
+
+        fake_settings = pretend.stub(
+            get_fresh=pretend.call_recorder(fake_get_fresh),
+        )
+
+        monkeypatch.setattr(
+            repository,
+            "get_repository_settings",
+            lambda *a, **kw: fake_settings,
+        )
+
+        fake_signature = pretend.stub(keyid="fake_sig")
+        repository.Signature.from_dict = pretend.call_recorder(
+            lambda *a: fake_signature
+        )
+        test_repo._validate_signature = pretend.call_recorder(lambda *a: True)
+        test_repo._validate_threshold = pretend.call_recorder(lambda *a: True)
+        test_repo.write_repository_settings = pretend.call_recorder(
+            lambda *a: None
+        )
+        test_repo._root_metadata_update = pretend.call_recorder(
+            lambda *a: "fake_result"
+        )
+
+        fake_trusted_root = repository.Metadata(
+            signed=repository.Root(version=1)
+        )
+        test_repo._storage_backend.get = pretend.call_recorder(
+            lambda r: fake_trusted_root
+        )
+        fake_new_root = repository.Metadata(signed=repository.Root(version=2))
+        repository.Metadata.from_dict = pretend.call_recorder(
+            lambda *a: fake_new_root
+        )
+
+        payload = {
+            "role": "root",
+            "signature": {"keyid": "keyid2", "sig": "sig2"},
+        }
+        result = test_repo.sign_metadata(payload)
+
+        assert result == {
+            "task": "sign_metadata",
+            "status": True,
+            "last_update": fake_datetime.now(),
+            "details": {
+                "message": "Signature Processed",
+                "update": "Metadata update finished",
+            },
+        }
+        assert fake_settings.get_fresh.calls == [
+            pretend.call("ROOT_SIGNING"),
+            pretend.call("BOOTSTRAP"),
+        ]
+        assert repository.Metadata.from_dict.calls == [
+            pretend.call({"metadata": "fake"})
+        ]
+        assert test_repo._validate_signature.calls == [
+            pretend.call(fake_new_root, fake_signature, fake_trusted_root),
+            pretend.call(fake_new_root, fake_signature),
+        ]
+        assert test_repo._root_metadata_update.calls == [
+            pretend.call(fake_new_root)
+        ]
+        assert test_repo.write_repository_settings.calls == [
+            pretend.call("ROOT_SIGNING", None)
+        ]