summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
Diffstat (limited to 'pkg')
-rw-r--r--pkg/trust/policy.go8
-rw-r--r--pkg/trust/policy_test.go22
2 files changed, 30 insertions, 0 deletions
diff --git a/pkg/trust/policy.go b/pkg/trust/policy.go
index 77e02a05c..3a31b9338 100644
--- a/pkg/trust/policy.go
+++ b/pkg/trust/policy.go
@@ -161,6 +161,14 @@ func AddPolicyEntries(policyPath string, input AddPolicyEntriesInput) error {
newReposContent = append(newReposContent, RepoContent{Type: trustType, KeyType: "GPGKeys", KeyPath: filepath})
}
+ case "sigstoreSigned":
+ if len(pubkeysfile) == 0 {
+ return errors.New("at least one public key must be defined for type 'sigstoreSigned'")
+ }
+ for _, filepath := range pubkeysfile {
+ newReposContent = append(newReposContent, RepoContent{Type: trustType, KeyPath: filepath})
+ }
+
default:
return fmt.Errorf("unknown trust type %q", input.Type)
}
diff --git a/pkg/trust/policy_test.go b/pkg/trust/policy_test.go
index c4781335f..c2c2d93be 100644
--- a/pkg/trust/policy_test.go
+++ b/pkg/trust/policy_test.go
@@ -49,6 +49,11 @@ func TestAddPolicyEntries(t *testing.T) {
},
{
Scope: "default",
+ Type: "sigstoreSigned",
+ PubKeyFiles: []string{}, // A key is missing
+ },
+ {
+ Scope: "default",
Type: "this-is-unknown",
PubKeyFiles: []string{},
},
@@ -73,6 +78,12 @@ func TestAddPolicyEntries(t *testing.T) {
PubKeyFiles: []string{"/1.pub", "/2.pub"},
})
assert.NoError(t, err)
+ err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
+ Scope: "quay.io/sigstore-signed",
+ Type: "sigstoreSigned",
+ PubKeyFiles: []string{"/1.pub", "/2.pub"},
+ })
+ assert.NoError(t, err)
// Test that the outcome is consumable, and compare it with the expected values.
parsedPolicy, err := signature.NewPolicyFromFile(policyPath)
@@ -90,6 +101,10 @@ func TestAddPolicyEntries(t *testing.T) {
xNewPRSignedByKeyPath(t, "/1.pub", signature.NewPRMMatchRepoDigestOrExact()),
xNewPRSignedByKeyPath(t, "/2.pub", signature.NewPRMMatchRepoDigestOrExact()),
},
+ "quay.io/sigstore-signed": {
+ xNewPRSigstoreSignedKeyPath(t, "/1.pub", signature.NewPRMMatchRepoDigestOrExact()),
+ xNewPRSigstoreSignedKeyPath(t, "/2.pub", signature.NewPRMMatchRepoDigestOrExact()),
+ },
},
},
}, parsedPolicy)
@@ -101,3 +116,10 @@ func xNewPRSignedByKeyPath(t *testing.T, keyPath string, signedIdentity signatur
require.NoError(t, err)
return pr
}
+
+// xNewPRSigstoreSignedKeyPath is a wrapper for NewPRSigstoreSignedKeyPath which must not fail.
+func xNewPRSigstoreSignedKeyPath(t *testing.T, keyPath string, signedIdentity signature.PolicyReferenceMatch) signature.PolicyRequirement {
+ pr, err := signature.NewPRSigstoreSignedKeyPath(keyPath, signedIdentity)
+ require.NoError(t, err)
+ return pr
+}