Testing Chef cookbook failure

I'm writing a cookbook with custom resource that (among other things) validates SSH keys through ssh-keygen. I need to test scenario in which user feeds in invalid input and resource should raise according exception, so i'm searching for a way to verify that 'given following input ... Chef run fails'.

If i understand everything correctly, Test Kitchen implies that every converge ends in success, and ChefSpec implies that resources are never really executed (so my ssh-keygen calls will never be invoked at all).

Are there any conventional ways to test such a case?

To test the inner bits of a custom_resource your have to tell ChefSpec to step_into it. You're right ChefSpec doesn't execute providers in normal case.

To get a proper test on a failure, you should expect(:chef_run).to raise_error as describe here in the documentation

Quote of the documentation for step_into:

In order to run the actions exposed by your LWRP, you have to explicitly tell the Runner to step into it:

require 'chefspec'

describe 'foo::default' do
  let(:chef_run) do
    ChefSpec::SoloRunner.new(step_into: ['my_lwrp']).converge('foo::default')
  end

  it 'installs the foo package through my_lwrp' do
    expect(chef_run).to install_package('foo')
  end
end

NOTE: If your cookbook exposes LWRPs, it is highly recommended you also create a libraries/matchers.rb file as outlined below in the "Packaging Custom Matchers" section. You should never step_into an LWRP unless you are testing it. Never step_into an LWRP from another cookbook!