Add standalone Gradle Kotlin consumer test for m2repo

.github/workflows/release.yml

@@ -39,6 +39,10 @@ jobs:
         env:
           REF_NAME: ${{ github.ref_name }}
         run: ./gradlew -PkeyAttestationReleaseVersion="$REF_NAME" publishAllPublicationsToLocalDirRepository
+      - name: Test Maven repo
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: ./gradlew -p testapp -PkeyAttestationReleaseVersion="$REF_NAME" test
 
       - name: Upload
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

testapp/build.gradle.kts

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+plugins {
+  id("com.adarshr.test-logger") version "4.0.0"
+  id("org.jetbrains.kotlin.jvm") version "2.2.0"
+}
+
+repositories {
+  val repoDir =
+    findProperty("KeyAttestationMavenRepo") as? String
+      ?: layout.projectDirectory.dir("../build/keyattestation_m2repo").asFile.absolutePath
+  maven { url = uri(repoDir) }
+  mavenCentral()
+  google()
+}
+
+val keyAttestationVersion =
+  (findProperty("keyAttestationReleaseVersion") as? String)?.removePrefix("v") ?: "+"
+
+dependencies {
+  implementation("com.android.keyattestation:keyattestation:$keyAttestationVersion")
+
+  testImplementation(kotlin("test"))
+  testImplementation("com.google.truth:truth:1.4.4")
+
+  // Required to run JUnit 4 tests.
+  testRuntimeOnly("org.junit.vintage:junit-vintage-engine")
+}
+
+java { toolchain { languageVersion = JavaLanguageVersion.of(21) } }
+
+tasks {
+  test {
+    workingDir = layout.projectDirectory.dir("..").asFile
+    useJUnitPlatform()
+    testLogging { exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL }
+  }
+}

testapp/settings.gradle.kts

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+plugins { id("org.gradle.toolchains.foojay-resolver-convention") version "0.8.0" }
+
+rootProject.name = "keyattestation-testapp"

testapp/src/test/kotlin/M2RepoTest.kt

@@ -0,0 +1,51 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.keyattestation.verifier.testapp
+
+import com.android.keyattestation.verifier.GoogleTrustAnchors
+import com.android.keyattestation.verifier.SecurityLevel
+import com.android.keyattestation.verifier.VerificationResult
+import com.android.keyattestation.verifier.VerifiedBootState
+import com.android.keyattestation.verifier.Verifier
+import com.android.keyattestation.verifier.testing.TestUtils
+import com.google.common.truth.Truth.assertThat
+import kotlin.test.assertIs
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.junit.runners.JUnit4
+
+@RunWith(JUnit4::class)
+class M2RepoTest {
+  @Test
+  fun verify_validChainFromM2Repo_returnsSuccess() {
+    val certs = TestUtils.readCertList("tegu/sdk36/TEE_EC_2026_ROOT.pem")
+    val notBefore = certs[1].notBefore.toInstant()
+    val notAfter = certs[1].notAfter.toInstant()
+    val validTime = notBefore.plusMillis((notAfter.toEpochMilli() - notBefore.toEpochMilli()) / 2)
+
+    val verifier =
+      Verifier(
+        trustAnchorsSource = GoogleTrustAnchors,
+        revokedSerialsSource = { emptySet() },
+        instantSource = { validTime },
+      )
+    val result = assertIs<VerificationResult.Success>(verifier.verify(certs))
+
+    assertThat(result.securityLevel).isEqualTo(SecurityLevel.TRUSTED_ENVIRONMENT)
+    assertThat(result.verifiedBootState).isEqualTo(VerifiedBootState.VERIFIED)
+  }
+}