1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
package trust
import (
"encoding/json"
"os"
"path/filepath"
"testing"
"github.com/containers/image/v5/signature"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestAddPolicyEntries(t *testing.T) {
tempDir := t.TempDir()
policyPath := filepath.Join(tempDir, "policy.json")
minimalPolicy := &signature.Policy{
Default: []signature.PolicyRequirement{
signature.NewPRInsecureAcceptAnything(),
},
}
minimalPolicyJSON, err := json.Marshal(minimalPolicy)
require.NoError(t, err)
err = os.WriteFile(policyPath, minimalPolicyJSON, 0600)
require.NoError(t, err)
// Invalid input:
for _, invalid := range []AddPolicyEntriesInput{
{
Scope: "default",
Type: "accept",
PubKeyFiles: []string{"/does-not-make-sense"},
},
{
Scope: "default",
Type: "insecureAcceptAnything",
PubKeyFiles: []string{"/does-not-make-sense"},
},
{
Scope: "default",
Type: "reject",
PubKeyFiles: []string{"/does-not-make-sense"},
},
{
Scope: "default",
Type: "signedBy",
PubKeyFiles: []string{}, // A key is missing
},
{
Scope: "default",
Type: "sigstoreSigned",
PubKeyFiles: []string{}, // A key is missing
},
{
Scope: "default",
Type: "this-is-unknown",
PubKeyFiles: []string{},
},
} {
err := AddPolicyEntries(policyPath, invalid)
assert.Error(t, err, "%#v", invalid)
}
err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
Scope: "default",
Type: "reject",
})
assert.NoError(t, err)
err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
Scope: "quay.io/accepted",
Type: "accept",
})
assert.NoError(t, err)
err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
Scope: "quay.io/multi-signed",
Type: "signedBy",
PubKeyFiles: []string{"/1.pub", "/2.pub"},
})
assert.NoError(t, err)
err = AddPolicyEntries(policyPath, AddPolicyEntriesInput{
Scope: "quay.io/sigstore-signed",
Type: "sigstoreSigned",
PubKeyFiles: []string{"/1.pub", "/2.pub"},
})
assert.NoError(t, err)
// Test that the outcome is consumable, and compare it with the expected values.
parsedPolicy, err := signature.NewPolicyFromFile(policyPath)
require.NoError(t, err)
assert.Equal(t, &signature.Policy{
Default: signature.PolicyRequirements{
signature.NewPRReject(),
},
Transports: map[string]signature.PolicyTransportScopes{
"docker": {
"quay.io/accepted": {
signature.NewPRInsecureAcceptAnything(),
},
"quay.io/multi-signed": {
xNewPRSignedByKeyPath(t, "/1.pub", signature.NewPRMMatchRepoDigestOrExact()),
xNewPRSignedByKeyPath(t, "/2.pub", signature.NewPRMMatchRepoDigestOrExact()),
},
"quay.io/sigstore-signed": {
xNewPRSigstoreSignedKeyPath(t, "/1.pub", signature.NewPRMMatchRepoDigestOrExact()),
xNewPRSigstoreSignedKeyPath(t, "/2.pub", signature.NewPRMMatchRepoDigestOrExact()),
},
},
},
}, parsedPolicy)
}
// xNewPRSignedByKeyPath is a wrapper for NewPRSignedByKeyPath which must not fail.
func xNewPRSignedByKeyPath(t *testing.T, keyPath string, signedIdentity signature.PolicyReferenceMatch) signature.PolicyRequirement {
pr, err := signature.NewPRSignedByKeyPath(signature.SBKeyTypeGPGKeys, keyPath, signedIdentity)
require.NoError(t, err)
return pr
}
// xNewPRSigstoreSignedKeyPath is a wrapper for NewPRSigstoreSignedKeyPath which must not fail.
func xNewPRSigstoreSignedKeyPath(t *testing.T, keyPath string, signedIdentity signature.PolicyReferenceMatch) signature.PolicyRequirement {
pr, err := signature.NewPRSigstoreSignedKeyPath(keyPath, signedIdentity)
require.NoError(t, err)
return pr
}
|
