Improve validation of data in ImageEngine.SetTrust

- Also reject public keys with types that don't use them
- Reject unknown trust types
- And add unit tests

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

1 files changed, 32 insertions, 0 deletions

diff --git a/pkg/trust/policy_test.go b/pkg/trust/policy_test.go
index 1f2f585c8..c4781335f 100644
--- a/pkg/trust/policy_test.go
+++ b/pkg/trust/policy_test.go
@@ -25,6 +25,38 @@ func TestAddPolicyEntries(t *testing.T) {
 	err = os.WriteFile(policyPath, minimalPolicyJSON, 0600)
 	require.NoError(t, err)
 
+	// Invalid input:
+	for _, invalid := range []AddPolicyEntriesInput{
+		{
+			Scope:       "default",
+			Type:        "accept",
+			PubKeyFiles: []string{"/does-not-make-sense"},
+		},
+		{
+			Scope:       "default",
+			Type:        "insecureAcceptAnything",
+			PubKeyFiles: []string{"/does-not-make-sense"},
+		},
+		{
+			Scope:       "default",
+			Type:        "reject",
+			PubKeyFiles: []string{"/does-not-make-sense"},
+		},
+		{
+			Scope:       "default",
+			Type:        "signedBy",
+			PubKeyFiles: []string{}, // A key is missing
+		},
+		{
+			Scope:       "default",
+			Type:        "this-is-unknown",
+			PubKeyFiles: []string{},
+		},
+	} {
+		err := AddPolicyEntries(policyPath, invalid)
+		assert.Error(t, err, "%#v", invalid)
+	}
+
 	err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
 		Scope: "default",
 		Type:  "reject",