Minor code cleanup in PackageSigning (#6462)

- Remove macOS 11 check since macOS 12 is required now
- Add test

Author: yim-lee

Sources/PackageSigning/SigningIdentity.swift

@@ -52,15 +52,7 @@ public struct SwiftSigningIdentity: SigningIdentity {
         do {
             switch privateKeyType {
             case .p256:
-                #if canImport(Security)
-                if #available(macOS 11.0, iOS 14.0, watchOS 7.0, tvOS 14.0, *) {
-                    self.privateKey = try Certificate.PrivateKey(P256.Signing.PrivateKey(derRepresentation: privateKey))
-                } else {
-                    throw StringError("Unsupported platform")
-                }
-                #else
                 self.privateKey = try Certificate.PrivateKey(P256.Signing.PrivateKey(derRepresentation: privateKey))
-                #endif
             }
         } catch let error as StringError {
             throw error
@@ -104,7 +96,7 @@ public struct SigningIdentityStore {
         return certificates.compactMap { secCertificate in
             var identity: SecIdentity?
             let status = SecIdentityCreateWithCertificate(nil, secCertificate, &identity)
-            guard status == errSecSuccess, let identity = identity else {
+            guard status == errSecSuccess, let identity else {
                 self.observabilityScope
                     .emit(
                         warning: "Failed to create SecIdentity from SecCertificate[\(secCertificate)]: status \(status)"

Tests/PackageSigningTests/SigningTests.swift

@@ -648,6 +648,69 @@ final class SigningTests: XCTestCase {
         }
     }
 
+    func testCMSEndToEndWithECKeyADPCertificate() async throws {
+        #if ENABLE_REAL_SIGNING_IDENTITY_TEST
+        #else
+        try XCTSkipIf(true)
+        #endif
+
+        let keyAndCertChain = try tsc_await { ecADPKeyAndCertChain(callback: $0) }
+        let signingIdentity = SwiftSigningIdentity(
+            certificate: try Certificate(keyAndCertChain.leafCertificate),
+            privateKey: try Certificate
+                .PrivateKey(P256.Signing.PrivateKey(derRepresentation: keyAndCertChain.privateKey))
+        )
+        let content = Array("per aspera ad astra".utf8)
+
+        let cmsProvider = CMSSignatureProvider(signatureAlgorithm: .ecdsaP256)
+        let signature = try cmsProvider.sign(
+            content: content,
+            identity: signingIdentity,
+            intermediateCertificates: keyAndCertChain.intermediateCertificates,
+            observabilityScope: ObservabilitySystem.NOOP
+        )
+
+        let verifierConfiguration = VerifierConfiguration(
+            trustedRoots: [keyAndCertChain.rootCertificate],
+            includeDefaultTrustStore: true,
+            certificateExpiration: .enabled(validationTime: nil),
+            certificateRevocation: .strict(validationTime: nil)
+        )
+
+        let status = try await cmsProvider.status(
+            signature: signature,
+            content: content,
+            verifierConfiguration: verifierConfiguration,
+            observabilityScope: ObservabilitySystem.NOOP
+        )
+
+        guard case .valid = status else {
+            return XCTFail("Expected signature status to be .valid but got \(status)")
+        }
+
+        func ecADPKeyAndCertChain(callback: (Result<KeyAndCertChain, Error>) -> Void) {
+            do {
+                try fixture(name: "Signing", createGitRepo: false) { fixturePath in
+                    let privateKey = try readFileContents(
+                        in: fixturePath,
+                        pathComponents: "Certificates", "swift_package_key.p8"
+                    )
+                    let certificate = try readFileContents(
+                        in: fixturePath,
+                        pathComponents: "Certificates", "swift_package.cer"
+                    )
+
+                    callback(.success(KeyAndCertChain(
+                        privateKey: privateKey,
+                        certificateChain: [certificate]
+                    )))
+                }
+            } catch {
+                callback(.failure(error))
+            }
+        }
+    }
+
     #if os(macOS)
     func testCMS1_0_0EndToEndWithADPSigningIdentityFromKeychain() async throws {
         #if ENABLE_REAL_SIGNING_IDENTITY_TEST