Add support for sigstoreSigned in (podman image trust set)

NOTE: This does not edit the use-sigstore-attachments value
in registries.d, similarly to how (podman image trust set) didn't
set the lookaside paths for simple signing.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

1 files changed, 22 insertions, 0 deletions

diff --git a/pkg/trust/policy_test.go b/pkg/trust/policy_test.go
index c4781335f..c2c2d93be 100644
--- a/pkg/trust/policy_test.go
+++ b/pkg/trust/policy_test.go
@@ -49,6 +49,11 @@ func TestAddPolicyEntries(t *testing.T) {
 		},
 		{
 			Scope:       "default",
+			Type:        "sigstoreSigned",
+			PubKeyFiles: []string{}, // A key is missing
+		},
+		{
+			Scope:       "default",
 			Type:        "this-is-unknown",
 			PubKeyFiles: []string{},
 		},
@@ -73,6 +78,12 @@ func TestAddPolicyEntries(t *testing.T) {
 		PubKeyFiles: []string{"/1.pub", "/2.pub"},
 	})
 	assert.NoError(t, err)
+	err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
+		Scope:       "quay.io/sigstore-signed",
+		Type:        "sigstoreSigned",
+		PubKeyFiles: []string{"/1.pub", "/2.pub"},
+	})
+	assert.NoError(t, err)
 
 	// Test that the outcome is consumable, and compare it with the expected values.
 	parsedPolicy, err := signature.NewPolicyFromFile(policyPath)
@@ -90,6 +101,10 @@ func TestAddPolicyEntries(t *testing.T) {
 					xNewPRSignedByKeyPath(t, "/1.pub", signature.NewPRMMatchRepoDigestOrExact()),
 					xNewPRSignedByKeyPath(t, "/2.pub", signature.NewPRMMatchRepoDigestOrExact()),
 				},
+				"quay.io/sigstore-signed": {
+					xNewPRSigstoreSignedKeyPath(t, "/1.pub", signature.NewPRMMatchRepoDigestOrExact()),
+					xNewPRSigstoreSignedKeyPath(t, "/2.pub", signature.NewPRMMatchRepoDigestOrExact()),
+				},
 			},
 		},
 	}, parsedPolicy)
@@ -101,3 +116,10 @@ func xNewPRSignedByKeyPath(t *testing.T, keyPath string, signedIdentity signatur
 	require.NoError(t, err)
 	return pr
 }
+
+// xNewPRSigstoreSignedKeyPath is a wrapper for NewPRSigstoreSignedKeyPath which must not fail.
+func xNewPRSigstoreSignedKeyPath(t *testing.T, keyPath string, signedIdentity signature.PolicyReferenceMatch) signature.PolicyRequirement {
+	pr, err := signature.NewPRSigstoreSignedKeyPath(keyPath, signedIdentity)
+	require.NoError(t, err)
+	return pr
+}