Test ML-DSA keytypes

clients/go-tuf/go-tuf.xfails

@@ -2,3 +2,5 @@
 
 # Example: (commented out since the XFAIL is not needed with current go-tuf)
 # test_keytype_and_scheme[rsa/rsassa-pss-sha256]
+
+test_mldsa_keytype_and_scheme

clients/python-tuf/python_tuf.py

@@ -10,8 +10,18 @@
 import shutil
 import sys
 
+from securesystemslib.signer import KEY_FOR_TYPE_AND_SCHEME, SSlibKey
 from tuf.ngclient import Updater
 
+# ML-DSA is not enable yet: enable to test the test suite
+KEY_FOR_TYPE_AND_SCHEME.update(
+    {
+        ("ml-dsa", "ml-dsa-44/1"): SSlibKey,
+        ("ml-dsa", "ml-dsa-65/1"): SSlibKey,
+        ("ml-dsa", "ml-dsa-87/1"): SSlibKey,
+    }
+)
+
 
 def init(metadata_dir: str, trusted_root: str) -> None:
     """Initialize local trusted metadata"""

pyproject.toml

@@ -39,4 +39,5 @@ lint.select = ["ANN", "DTZ", "E", "F", "FA", "I", "N", "PIE", "PL", "PYI", "RET"
 lint.ignore = [
     "S101",             # assert is fine in pytest tests
     "PLR2004",          # magic values are ok in a test suite
+    "PLR0913",          # too many arguments
 ]

tuf_conformance/_internal/repository_simulator.py

@@ -74,6 +74,15 @@
     ("ed25519", "ed25519"): [
         CryptoSigner.generate_ed25519() for _ in range(NUM_SIGNERS)
     ],
+    ("ml-dsa", "ml-dsa-44/1"): [
+        CryptoSigner.generate_mldsa(scheme="ml-dsa-44/1") for _ in range(NUM_SIGNERS)
+    ],
+    ("ml-dsa", "ml-dsa-65/1"): [
+        CryptoSigner.generate_mldsa(scheme="ml-dsa-65/1") for _ in range(NUM_SIGNERS)
+    ],
+    ("ml-dsa", "ml-dsa-87/1"): [
+        CryptoSigner.generate_mldsa(scheme="ml-dsa-87/1") for _ in range(NUM_SIGNERS)
+    ],
 }
 
 

tuf_conformance/conftest.py

@@ -98,9 +98,7 @@ def read_xfails(pytestconfig: pytest.Config) -> list[str]:
 
 
 @pytest.fixture(autouse=True)
-def conformance_xfail(
-    pytestconfig: pytest.Config, request: pytest.FixtureRequest
-) -> None:
+def conformance_(pytestconfig: pytest.Config, request: pytest.FixtureRequest) -> None:
     xfails = read_xfails(pytestconfig)
 
     if request.node.originalname in xfails or request.node.name in xfails: