replace tuftool with tufcli

[fghanmi]

Assisted with Claude Code.

Description

• Replace tuftool with tufcli across the codebase - client, tests, test fixtures, and CGW name mapping
• Update all CLI invocations to use tufcli's flag-based syntax (--path, --role, --threshold, --output, --key) instead of tuftool's positional arguments
• Add a new goinstall CLI strategy that installs Go-based tools via go install @
• Wire tufcli to use the goinstall strategy directly, since the tufcli binary is not yet available in TAS 1.5

Why

tuftool is being replaced by tufcli. Since TAS 1.5 has not been released yet, tufcli is not available as a pre-built binary through the existing download strategies (cgw, openshift, etc.). As a workaround, we install it from the Go module
github.com/securesign/tufcli via go install. Once TAS 1.5 ships with a tufcli binary, the client can be switched back to PreferredSetupStrategy().

[qodo-for-securesign]

PR Summary by Qodo

Replace tuftool with tufcli and add Go install strategy

✨ Enhancement 🧪 Tests ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Replaces tuftool with tufcli across clients, mappings, fixtures, and TUF repository tests.
• Adds a reusable goinstall strategy for module-version-based CLI provisioning.
• Migrates TUF commands to tufcli's flag-based interface.

Diagram

graph TD
  Tests["TUF Tests"] --> Client["Tufcli Client"] --> Install["Go Install"] --> Toolchain["Go Toolchain"] --> Binary["tufcli Binary"] --> Repo["TUF Repository"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use PreferredSetupStrategy after TAS 1.5

• ➕ Uses the established binary distribution paths
• ➕ Avoids requiring a local Go toolchain
• ➖ Unavailable until TAS 1.5 publishes tufcli binaries
• ➖ Cannot support the immediate migration

2. Pin a tufcli module version

• ➕ Makes test execution reproducible
• ➕ Prevents upstream releases from unexpectedly breaking tests
• ➖ Requires deliberate dependency updates
• ➖ May delay coverage of the latest tufcli behavior

3. Publish a temporary prebuilt artifact

• ➕ Avoids installation-time compilation
• ➕ Provides a controlled binary version
• ➖ Adds artifact publishing and platform maintenance
• ➖ Duplicates the distribution mechanism expected in TAS 1.5

Recommendation: Direct goinstall provisioning is the best transitional approach because tufcli is not yet available through existing binary strategies. Pinning a validated tufcli version would improve reproducibility; once TAS 1.5 publishes binaries, the client should return to PreferredSetupStrategy.

Files changed (12) +138 / -30

Enhancement (2) +65 / -0

tufcli.goIntroduce the tufcli client +19/-0

Introduce the tufcli client

• Adds a tufcli wrapper that installs github.com/securesign/tufcli at setup time. This temporarily bypasses preferred binary strategies until TAS 1.5 provides tufcli artifacts.

pkg/clients/tufcli.go

goinstall.goAdd a Go module installation strategy +46/-0

Add a Go module installation strategy

• Registers a configurable goinstall strategy and exposes direct module-based construction. It executes go install with context and logging, then resolves the installed executable from PATH.

pkg/strategy/goinstall/goinstall.go

Tests (8) +69 / -30

cgw_test.goUpdate content gateway expectations for tufcli +1/-1

Update content gateway expectations for tufcli

• Replaces the tuftool content gateway name case with tufcli to reflect the migrated client.

pkg/strategy/cgw/cgw_test.go

goinstall_test.goTest Go install registration and execution +40/-0

Test Go install registration and execution

• Verifies strategy registration, successful tufcli installation, and error propagation for an invalid module.

pkg/strategy/goinstall/goinstall_test.go

ctfe.pubProvide CT log key fixture for tufcli tests +0/-0

Provide CT log key fixture for tufcli tests

• Places the CT log public key fixture under the renamed tufcli integration-test suite.

test/tufcli/targets/ctfe.pub

fulcio_v1.crt.pemProvide Fulcio certificate fixture for tufcli tests +0/-0

Provide Fulcio certificate fixture for tufcli tests

• Places the Fulcio certificate fixture under the renamed tufcli integration-test suite.

test/tufcli/targets/fulcio_v1.crt.pem

rekor.pubProvide Rekor key fixture for tufcli tests +0/-0

Provide Rekor key fixture for tufcli tests

• Places the Rekor public key fixture under the renamed tufcli integration-test suite.

test/tufcli/targets/rekor.pub

tsa.certchain.pemProvide TSA certificate fixture for tufcli tests +0/-0

Provide TSA certificate fixture for tufcli tests

• Places the TSA certificate-chain fixture under the renamed tufcli integration-test suite.

test/tufcli/targets/tsa.certchain.pem

tufcli_manual_tuf_repo_test.goMigrate manual TUF repository tests to tufcli +27/-28

Migrate manual TUF repository tests to tufcli

• Renames the test package and client references from tuftool to tufcli. Root initialization, expiration, thresholds, key generation, and signing now use tufcli's flag-based arguments while preserving repository validation.

test/tufcli/tufcli_manual_tuf_repo_test.go

tufcli_suite_init_test.goRename the TUF test suite package +1/-1

Rename the TUF test suite package

• Changes the Ginkgo suite package from tuftool to tufcli to match the migrated test directory and client.

test/tufcli/tufcli_suite_init_test.go

Other (2) +4 / -0

values.goAdd Go install strategy configuration keys +3/-0

Add Go install strategy configuration keys

• Defines environment-backed keys for selecting the Go module and optional module version used by the goinstall strategy.

pkg/api/values.go

strategies.goRegister the Go install strategy with clients +1/-0

Register the Go install strategy with clients

• Blank-imports the goinstall package so its strategy factory is registered during client initialization.

pkg/clients/strategies.go

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Installed binary resolved incorrectly ✓ Resolved 🐞 Bug ≡ Correctness

Description

After go install writes the executable to GOBIN or GOPATH/bin, install searches the
inherited PATH instead of returning that installation path. Setup therefore either fails when the
Go bin directory is absent from PATH or selects an older same-named executable earlier on PATH.

Code

pkg/strategy/goinstall/goinstall.go[45]

+	return exec.LookPath(cliName)

Relevance

●●● Strong

Recent history accepts correctness fixes for binary path resolution and lookup gaps in CLI
strategies.

PR-#90
PR-#98
PR-#76

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The strategy invokes go install with the inherited environment and then uses exec.LookPath,
while the strategy contract requires returning the resolved executable path and cli.Setup stores
that returned path for subsequent commands. The positive test only works when the installation
destination is already discoverable through PATH and does not verify that the returned executable is
the one just installed.

pkg/strategy/goinstall/goinstall.go[34-45]
pkg/strategy/strategy.go[15-16]
pkg/clients/cli.go[59-65]
pkg/strategy/goinstall/goinstall_test.go[16-28]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The goinstall strategy resolves `cliName` through `PATH` after installation rather than returning the executable produced by `go install`. This can fail when the install directory is not on `PATH`, or return a stale executable from another directory.

## Issue Context
A strategy must return the executable path consumed by `cli.Setup`. Prefer installing into a controlled temporary `GOBIN` directory and returning the resulting platform-specific path directly.

## Fix Focus Areas
- pkg/strategy/goinstall/goinstall.go[34-45]
- pkg/strategy/goinstall/goinstall_test.go[16-29]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-for-securesign]

Code review by qodo was updated up to the latest commit 3764d50

[sampras343]

If this is alright for this version and the changes would be made after the 1.5 release, then no problems. LGTM.

[sampras343]

lgtm