tests: update trustroot before offline test

Current test assets require a trust root which is newer
than the one embedded in sigstore-python: Update the trust roots
before running offline tests.

Move the whole offline-test setup into Makefile to make it a little
easier to manage.

Author: jku

.github/workflows/tests.yml

@@ -61,6 +61,4 @@ jobs:
         run: sudo apt-get install -y firejail
 
       - name: run tests offline
-        run: |
-          make dev INSTALL_EXTRA=test
-          firejail --noprofile --net=none --env=TEST_OFFLINE=1 make test-nocoverage
+        run: make test-offline INSTALL_EXTRA=test

Makefile

@@ -75,6 +75,15 @@ test-nocoverage: $(VENV)/pyvenv.cfg
 	. $(VENV_BIN)/activate && \
 		pytest $(T) $(TEST_ARGS)
 
+# test-offline requires firejail
+.PHONY: test-offline
+test-offline: $(VENV)/pyvenv.cfg
+	# ensure trust root is updated, then run tests inside no-network firejail
+	. $(VENV_BIN)/activate && \
+		python -m sigstore plumbing update-trust-root && \
+		python -m sigstore --staging plumbing update-trust-root && \
+		firejail --noprofile --net=none --env=TEST_OFFLINE=1 pytest $(T) $(TEST_ARGS)
+
 .PHONY: doc
 doc: $(VENV)/pyvenv.cfg
 	. $(VENV_BIN)/activate && \