return err when an unsupported hash alg is provided

Signed-off-by: Meredith Lancaster <malancas@github.com>

pkg/cmd/attestation/artifact/digest/digest.go

@@ -14,7 +14,10 @@ const (
 	SHA512DigestAlgorithm = "sha512"
 )
 
-var validDigestAlgorithms = [...]string{SHA256DigestAlgorithm, SHA512DigestAlgorithm}
+var (
+	errUnsupportedAlgorithm = fmt.Errorf("unsupported digest algorithm")
+	validDigestAlgorithms   = [...]string{SHA256DigestAlgorithm, SHA512DigestAlgorithm}
+)
 
 // IsValidDigestAlgorithm returns true if the provided algorithm is supported
 func IsValidDigestAlgorithm(alg string) bool {
@@ -39,7 +42,7 @@ func CalculateDigestWithAlgorithm(r io.Reader, alg string) (string, error) {
 	case SHA512DigestAlgorithm:
 		h = sha512.New()
 	default:
-		h = sha256.New()
+		return "", errUnsupportedAlgorithm
 	}
 
 	if _, err := io.Copy(h, r); err != nil {

pkg/cmd/attestation/artifact/digest/digest_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestArtifactDigestWithAlgorithm(t *testing.T) {
@@ -25,6 +26,13 @@ func TestArtifactDigestWithAlgorithm(t *testing.T) {
 		assert.Nil(t, err)
 		assert.Equal(t, sha512TestDigest, digest)
 	})
+
+	t.Run("fail with sha384", func(t *testing.T) {
+		reader := strings.NewReader(testString)
+		_, err := CalculateDigestWithAlgorithm(reader, "sha384")
+		require.Error(t, err)
+		require.ErrorAs(t, err, &errUnsupportedAlgorithm)
+	})
 }
 
 func TestValidDigestAlgorithms(t *testing.T) {