chore: update http test data
This commit is contained in:
mrjoelkamp
32
test/testdata/tuf/test-repo/metadata/1.root.json
vendored
32
test/testdata/tuf/test-repo/metadata/1.root.json
vendored
@@ -1,42 +1,42 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"sig": "3064023037bbb03c3472b140572a7d5a2895bd80e74435bbcb7053949731f81b104c6d05a0876590cd6a2e94d7ed619426a2f6fa02303adc8c9006fa5506fdd7ea87d2960074a537ad8bf2459f2863e806b47682cbb2f9b01b7502eaf5437a1a68fdaaeac114"
|
||||
"keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221",
|
||||
"sig": "3065023000f7d0a866576e94eaabc173b9233d4c8fcfa495527088f9022dff5a553f7a457da1015a6d0fc714f84848ec627387360231009fa70b2eebbe15241a2ec9b96a094ebd28661e30b8c3d1eab8d694df2b340bda511c489393630c9a9dacde42c99e9fa1"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "root",
|
||||
"consistent_snapshot": true,
|
||||
"expires": "2034-04-02T17:00:22Z",
|
||||
"expires": "2034-05-29T20:14:11Z",
|
||||
"keys": {
|
||||
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp256",
|
||||
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61"
|
||||
},
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": {
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp384",
|
||||
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
|
||||
},
|
||||
"bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp256",
|
||||
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61"
|
||||
}
|
||||
},
|
||||
"roles": {
|
||||
"root": {
|
||||
"keyids": [
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09"
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221"
|
||||
],
|
||||
"threshold": 1
|
||||
},
|
||||
"snapshot": {
|
||||
"keyids": [
|
||||
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
|
||||
"bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5"
|
||||
],
|
||||
"threshold": 1,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
@@ -44,13 +44,13 @@
|
||||
},
|
||||
"targets": {
|
||||
"keyids": [
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09"
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221"
|
||||
],
|
||||
"threshold": 1
|
||||
},
|
||||
"timestamp": {
|
||||
"keyids": [
|
||||
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
|
||||
"bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5"
|
||||
],
|
||||
"threshold": 1,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
|
||||
46
test/testdata/tuf/test-repo/metadata/2.root.json
vendored
46
test/testdata/tuf/test-repo/metadata/2.root.json
vendored
@@ -1,20 +1,28 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"sig": "3066023100e99acc5f74777ebf40376b60f0216e8fe1829c1a49a5f6a6899126c15de1df7a56533baf493b2b53159c50843a289102023100b6a006b24da62ea0b743fbe38e1497ff485bf3a0833894985fc27a0305ad0693eeb968a7b52723ed3c49af8bef2027b6"
|
||||
"keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221",
|
||||
"sig": "3065023079fce0ddea385d0e5b6eed0da688946f417d1c1bf6397edaa44279bf948d6de41daf5e0852069900f363175abd95959b023100d2b950cb3f39cc4df8140d2ec3c60d81d2811827fbc61034786cd877586f6ab5f9ba03ad95d7de58e9241917d79687a9"
|
||||
},
|
||||
{
|
||||
"keyid": "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664",
|
||||
"sig": "30440220136debcc2f60dd1d63c9c2704f9b13c2cb2f5d2df58ea93f07f7c10f54f36742022059d7f8c6620e33506c6f1766394a32f86c9b008328f6398831ba7ebcf4ce0838"
|
||||
"keyid": "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72",
|
||||
"sig": ""
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "root",
|
||||
"consistent_snapshot": true,
|
||||
"expires": "2034-04-03T08:45:50Z",
|
||||
"expires": "2034-06-12T17:21:13Z",
|
||||
"keys": {
|
||||
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": {
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp384",
|
||||
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
|
||||
},
|
||||
"bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n"
|
||||
@@ -22,34 +30,26 @@
|
||||
"scheme": "ecdsa-sha2-nistp256",
|
||||
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61"
|
||||
},
|
||||
"81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664": {
|
||||
"beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWmhpAfB7Q53UNluMhpkDxXXup4E0\n2Hh4PSgHC1Yh6brGl6Akq9a4io55LtZTk5mnCTqxuB+rc5cI/yaNUeWEqQ==\n-----END PUBLIC KEY-----\n"
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEERet/8hs3WHIXyOXNzhLpTOz6DBx\n7zzHnenJgV/TB0dRMAx6j9UVRvlEkh5OcYuktNeqnLpHce1rLjLjpiRPVg==\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp256",
|
||||
"x-tuf-on-ci-keyowner": "@kipz"
|
||||
},
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp384",
|
||||
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
|
||||
"x-tuf-on-ci-keyowner": "@jonnystoten"
|
||||
}
|
||||
},
|
||||
"roles": {
|
||||
"root": {
|
||||
"keyids": [
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664"
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221",
|
||||
"beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72"
|
||||
],
|
||||
"threshold": 1
|
||||
},
|
||||
"snapshot": {
|
||||
"keyids": [
|
||||
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
|
||||
"bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5"
|
||||
],
|
||||
"threshold": 1,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
@@ -57,14 +57,14 @@
|
||||
},
|
||||
"targets": {
|
||||
"keyids": [
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664"
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221",
|
||||
"beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72"
|
||||
],
|
||||
"threshold": 1
|
||||
},
|
||||
"timestamp": {
|
||||
"keyids": [
|
||||
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
|
||||
"bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5"
|
||||
],
|
||||
"threshold": 1,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
|
||||
30
test/testdata/tuf/test-repo/metadata/2.test-role.json
vendored
Normal file
30
test/testdata/tuf/test-repo/metadata/2.test-role.json
vendored
Normal file
@@ -0,0 +1,30 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221",
|
||||
"sig": "3065023100c37572d6e0608e0501026d99238ee37d26856d93074227410b0748e56775f8369cf7c44553b73d8a30aa94a388148ca602305b46acbb0e8818657725024a39d02589538845ad9fa0c2b6eb18f431f560096045fd825586dce81688c9574b11b975da"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "targets",
|
||||
"expires": "2034-05-29T20:25:01Z",
|
||||
"spec_version": "1.0.31",
|
||||
"targets": {
|
||||
"test-role/dir1/dir2/dir3/test.txt": {
|
||||
"hashes": {
|
||||
"sha256": "bb8fcf06f6c067dcbcb394d7d9ced788316fc02b715fe679097281108a4bd465"
|
||||
},
|
||||
"length": 46
|
||||
},
|
||||
"test-role/test.txt": {
|
||||
"hashes": {
|
||||
"sha256": "d1bb6181284970ae43fbbc88b5e72f9a5942ebac20588aa0c4bf78ba621e1ee2"
|
||||
},
|
||||
"length": 32
|
||||
}
|
||||
},
|
||||
"version": 2,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
"x-tuf-on-ci-signing-period": 60
|
||||
}
|
||||
}
|
||||
@@ -1,34 +0,0 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"sig": ""
|
||||
},
|
||||
{
|
||||
"keyid": "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664",
|
||||
"sig": "3044022015b6ebe9d30895e3be20e707a6738e38460197d90cae3dc37527ddb7c437868602207f85f3d4e068bef4c51a749f5d166cc7fe2cb9483999ea197e72395081c3aa61"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "targets",
|
||||
"expires": "2034-04-03T15:39:02Z",
|
||||
"spec_version": "1.0.31",
|
||||
"targets": {
|
||||
"test-role/dir1/dir2/dir3/myfile.txt": {
|
||||
"hashes": {
|
||||
"sha256": "ea230621c53e0bb858ea5526125414f8957fb29c08350528d50a162c620f36b1"
|
||||
},
|
||||
"length": 10
|
||||
},
|
||||
"test-role/test.txt": {
|
||||
"hashes": {
|
||||
"sha256": "d1bb6181284970ae43fbbc88b5e72f9a5942ebac20588aa0c4bf78ba621e1ee2"
|
||||
},
|
||||
"length": 32
|
||||
}
|
||||
},
|
||||
"version": 3,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
"x-tuf-on-ci-signing-period": 60
|
||||
}
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"sig": ""
|
||||
},
|
||||
{
|
||||
"keyid": "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664",
|
||||
"sig": "3046022100f892a496c9bd96082e3b06d5eae85429355876b8eb455aa04b53ab9051911d90022100a3e89c29b15bccfc2877278c0fb2d3b34500da6351e245ad0b3f8c0ae6b67eff"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "targets",
|
||||
"delegations": {
|
||||
"keys": {
|
||||
"81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWmhpAfB7Q53UNluMhpkDxXXup4E0\n2Hh4PSgHC1Yh6brGl6Akq9a4io55LtZTk5mnCTqxuB+rc5cI/yaNUeWEqQ==\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp256",
|
||||
"x-tuf-on-ci-keyowner": "@kipz"
|
||||
},
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp384",
|
||||
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
|
||||
}
|
||||
},
|
||||
"roles": [
|
||||
{
|
||||
"keyids": [
|
||||
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
|
||||
"81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664"
|
||||
],
|
||||
"name": "test-role",
|
||||
"paths": [
|
||||
"test-role/*",
|
||||
"test-role/*/*",
|
||||
"test-role/*/*/*",
|
||||
"test-role/*/*/*/*"
|
||||
],
|
||||
"terminating": true,
|
||||
"threshold": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
"expires": "2034-04-03T15:28:29Z",
|
||||
"spec_version": "1.0.31",
|
||||
"targets": {
|
||||
"test.txt": {
|
||||
"hashes": {
|
||||
"sha256": "02119a076ec3878c736c3a95e20794f5a8d5bce3d7ecc264681bb7334ca2e24b"
|
||||
},
|
||||
"length": 31
|
||||
}
|
||||
},
|
||||
"version": 5,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
"x-tuf-on-ci-signing-period": 60
|
||||
}
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3",
|
||||
"sig": "3044022039b56cd2e3597df74e57d200a652ba020cdc9a8cd050bd65b5f8e2640d50691d02205e073e4b6fc260acc64327a331e4440601af5b1cbff594ea91cf7b70d5828fb1"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "snapshot",
|
||||
"expires": "2034-04-03T15:59:47Z",
|
||||
"meta": {
|
||||
"targets.json": {
|
||||
"version": 5
|
||||
},
|
||||
"test-role.json": {
|
||||
"version": 3
|
||||
}
|
||||
},
|
||||
"spec_version": "1.0.31",
|
||||
"version": 6
|
||||
}
|
||||
}
|
||||
22
test/testdata/tuf/test-repo/metadata/7.snapshot.json
vendored
Normal file
22
test/testdata/tuf/test-repo/metadata/7.snapshot.json
vendored
Normal file
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5",
|
||||
"sig": "3045022018e31a2e743b21054939262706520be10375829fb93dec7f3042e48ed8eb9cec0221008c2765ee9e49d49c12a6b9a5124c984d414b8d86452cdbcc2fc2f2ca10a11e67"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "snapshot",
|
||||
"expires": "2034-06-23T12:47:16Z",
|
||||
"meta": {
|
||||
"targets.json": {
|
||||
"version": 8
|
||||
},
|
||||
"test-role.json": {
|
||||
"version": 2
|
||||
}
|
||||
},
|
||||
"spec_version": "1.0.31",
|
||||
"version": 7
|
||||
}
|
||||
}
|
||||
80
test/testdata/tuf/test-repo/metadata/8.targets.json
vendored
Normal file
80
test/testdata/tuf/test-repo/metadata/8.targets.json
vendored
Normal file
@@ -0,0 +1,80 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221",
|
||||
"sig": ""
|
||||
},
|
||||
{
|
||||
"keyid": "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72",
|
||||
"sig": "304602210086552ad4ffddd7e60f2b80d095b4dfad9d2836cfce5d6b12dfb2aec0786240df02210097807190a1f64c615798b74068e8c9f19a29f495566bc1f16d296c7edd9343b3"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "targets",
|
||||
"delegations": {
|
||||
"keys": {
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221": {
|
||||
"keytype": "ecdsa",
|
||||
"keyval": {
|
||||
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
|
||||
},
|
||||
"scheme": "ecdsa-sha2-nistp384",
|
||||
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
|
||||
}
|
||||
},
|
||||
"roles": [
|
||||
{
|
||||
"keyids": [
|
||||
"76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221"
|
||||
],
|
||||
"name": "test-role",
|
||||
"paths": [
|
||||
"test-role/*",
|
||||
"test-role/*/*",
|
||||
"test-role/*/*/*",
|
||||
"test-role/*/*/*/*"
|
||||
],
|
||||
"terminating": true,
|
||||
"threshold": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
"expires": "2034-06-23T12:42:15Z",
|
||||
"spec_version": "1.0.31",
|
||||
"targets": {
|
||||
"always-fail.rego": {
|
||||
"hashes": {
|
||||
"sha256": "e8a5b75ac27a28056d2155ff63acc1ffd76c30ed8558011c54708f4832f073ac"
|
||||
},
|
||||
"length": 364
|
||||
},
|
||||
"jonnystoten2.rego": {
|
||||
"hashes": {
|
||||
"sha256": "bc46e8c31646f166a9efbd14fef154dd84cf07efc95c96be3a201c84470dcbc1"
|
||||
},
|
||||
"length": 5857
|
||||
},
|
||||
"mapping.yaml": {
|
||||
"hashes": {
|
||||
"sha256": "baad1a9d61afa5d6f8717f576b57b9749e5549da4b826746fd73a5a914ac5be1"
|
||||
},
|
||||
"length": 272
|
||||
},
|
||||
"test.txt": {
|
||||
"hashes": {
|
||||
"sha256": "02119a076ec3878c736c3a95e20794f5a8d5bce3d7ecc264681bb7334ca2e24b"
|
||||
},
|
||||
"length": 31
|
||||
},
|
||||
"version-constraints": {
|
||||
"hashes": {
|
||||
"sha256": "bd6394a08afc1edfe5512fc14e63025a337e25ca0013c1068ec879742fc3a3c3"
|
||||
},
|
||||
"length": 12
|
||||
}
|
||||
},
|
||||
"version": 8,
|
||||
"x-tuf-on-ci-expiry-period": 3650,
|
||||
"x-tuf-on-ci-signing-period": 60
|
||||
}
|
||||
}
|
||||
@@ -1,19 +1,19 @@
|
||||
{
|
||||
"signatures": [
|
||||
{
|
||||
"keyid": "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3",
|
||||
"sig": "3045022011f2afa9b448fcbbac983c11fc3e264e95d5d7a9c9527b09d83a316ee762635f022100d05197a78ccc7a713ebdb0bccb44844f67a7c5208af8d346e201064b7ce11055"
|
||||
"keyid": "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5",
|
||||
"sig": "304502204019c08b30b7525b95c4010e5c1420c5618c18d5b0719fb1d9392ef93322ca4e022100924ec18242ba21edcc2c7ad92ee13a38a6f4a8e1315c588eb9eb2d0bce0a1a80"
|
||||
}
|
||||
],
|
||||
"signed": {
|
||||
"_type": "timestamp",
|
||||
"expires": "2034-04-03T15:59:47Z",
|
||||
"expires": "2034-06-23T12:47:16Z",
|
||||
"meta": {
|
||||
"snapshot.json": {
|
||||
"version": 6
|
||||
"version": 7
|
||||
}
|
||||
},
|
||||
"spec_version": "1.0.31",
|
||||
"version": 6
|
||||
"version": 7
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
version: v1
|
||||
kind: policy-mapping
|
||||
policies:
|
||||
- origin:
|
||||
domain: docker.io
|
||||
prefix: jonnystoten2/
|
||||
id: jonnystoten2
|
||||
description: jonnystoten2 personal images for testing
|
||||
attestations:
|
||||
style: "referrers"
|
||||
files:
|
||||
- path: jonnystoten2.rego
|
||||
@@ -0,0 +1,200 @@
|
||||
package attest
|
||||
|
||||
import rego.v1
|
||||
|
||||
split_digest := split(input.digest, ":")
|
||||
|
||||
digest_type := split_digest[0]
|
||||
|
||||
digest := split_digest[1]
|
||||
|
||||
keys := [{
|
||||
"id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
|
||||
"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgH23D1i2+ZIOtVjmfB7iFvX8AhVN\n9CPJ4ie9axw+WRHozGnRy99U2dRge3zueBBg2MweF0zrToXGig2v3YOrdw==\n-----END PUBLIC KEY-----",
|
||||
"from": "2023-12-15T14:00:00Z",
|
||||
"to": null,
|
||||
"status": "active",
|
||||
"signing-format": "dssev1",
|
||||
}]
|
||||
|
||||
verify_opts := {"keys": keys}
|
||||
|
||||
verify_attestation(att) := attest.verify(att, verify_opts)
|
||||
|
||||
attestations contains att if {
|
||||
result := attest.fetch("https://slsa.dev/verification_summary/v1")
|
||||
not result.error
|
||||
some att in result.value
|
||||
}
|
||||
|
||||
signed_statements contains statement if {
|
||||
some att in attestations
|
||||
result := verify_attestation(att)
|
||||
not result.error
|
||||
statement := result.value
|
||||
}
|
||||
|
||||
statements_with_subject contains statement if {
|
||||
some statement in signed_statements
|
||||
some subject in statement.subject
|
||||
subject.digest[digest_type] == digest
|
||||
valid_subject_name(input.isCanonical, subject.name, input.purl)
|
||||
}
|
||||
|
||||
id(statement) := crypto.sha256(json.marshal(statement))
|
||||
|
||||
subjects contains subject if {
|
||||
some statement in statements_with_subject
|
||||
some subject in statement.subject
|
||||
}
|
||||
|
||||
global_violations contains v if {
|
||||
count(attestations) == 0
|
||||
v := {
|
||||
"type": "missing_attestation",
|
||||
"description": "No https://slsa.dev/verification_summary/v1 attestation found",
|
||||
"attestation": null,
|
||||
"details": {},
|
||||
}
|
||||
}
|
||||
|
||||
# we need to key this by statement_id rather than statement because we can't
|
||||
# use an object as a key due to a bug(?) in OPA: https://github.com/open-policy-agent/opa/issues/6736
|
||||
statement_violations[statement_id] contains v if {
|
||||
some att in attestations
|
||||
result := verify_attestation(att)
|
||||
err := result.error
|
||||
statement := unsafe_statement_from_attestation(att)
|
||||
statement_id := id(statement)
|
||||
v := {
|
||||
"type": "unsigned_statement",
|
||||
"description": sprintf("Statement is not correctly signed: %v", [err]),
|
||||
"attestation": statement,
|
||||
"details": {"error": err},
|
||||
}
|
||||
}
|
||||
|
||||
statement_violations[statement_id] contains v if {
|
||||
some statement in signed_statements
|
||||
statement_id := id(statement)
|
||||
not statement in statements_with_subject
|
||||
v := {
|
||||
"type": "bad_subjects",
|
||||
"description": "Statement does not have this image as a subject",
|
||||
"attestation": statement,
|
||||
"details": {"input": input},
|
||||
}
|
||||
}
|
||||
|
||||
statement_violations[statement_id] contains v if {
|
||||
some statement in statements_with_subject
|
||||
statement_id := id(statement)
|
||||
v := field_value_does_not_equal(statement, "verificationResult", "PASSED", "wrong_verification_result")
|
||||
}
|
||||
|
||||
# TODO: add to statement_violations if there are statements that have an incorrect resource_uri
|
||||
# this should match the input.purl, but we really only care about the repo name and the digest
|
||||
# we need to receive the input.purl as a parsed object so we can compare only the parts we care about
|
||||
|
||||
statement_violations[statement_id] contains v if {
|
||||
some statement in statements_with_subject
|
||||
statement_id := id(statement)
|
||||
v := field_value_does_not_equal(statement, "verifier.id", "signing-demo-verifier", "wrong_verifier")
|
||||
}
|
||||
|
||||
statement_violations[statement_id] contains v if {
|
||||
some statement in statements_with_subject
|
||||
statement_id := id(statement)
|
||||
v := field_value_does_not_equal(statement, "policy.uri", "https://docker.com/official/policy/v0.1", "wrong_policy_uri")
|
||||
}
|
||||
|
||||
statement_violations[statement_id] contains v if {
|
||||
some statement in statements_with_subject
|
||||
statement_id := id(statement)
|
||||
v := array_field_does_not_contain(statement, "verifiedLevels", "SLSA_BUILD_LEVEL_3", "wrong_verified_levels")
|
||||
}
|
||||
|
||||
bad_statements contains statement if {
|
||||
some statement in statements_with_subject
|
||||
statement_id := id(statement)
|
||||
statement_violations[statement_id]
|
||||
}
|
||||
|
||||
good_statements := statements_with_subject - bad_statements
|
||||
|
||||
all_violations contains v if {
|
||||
some v in global_violations
|
||||
}
|
||||
|
||||
all_violations contains v if {
|
||||
some violations in statement_violations
|
||||
some v in violations
|
||||
}
|
||||
|
||||
result := {
|
||||
"success": allow,
|
||||
"violations": all_violations,
|
||||
"summary": {
|
||||
"subjects": subjects,
|
||||
"slsa_levels": ["SLSA_BUILD_LEVEL_3"],
|
||||
"verifier": "signing-demo-verifier",
|
||||
"policy_uri": "https://docker.com/official/policy/v0.1",
|
||||
},
|
||||
}
|
||||
|
||||
default allow := false
|
||||
|
||||
allow if {
|
||||
count(good_statements) > 0
|
||||
}
|
||||
|
||||
# TODO: this should take into account the repo name from the purl
|
||||
valid_subject_name(true, name, purl)
|
||||
|
||||
valid_subject_name(false, name, purl) if {
|
||||
name == purl
|
||||
}
|
||||
|
||||
field_value_does_not_equal(statement, field, expected, type) := v if {
|
||||
path := split(field, ".")
|
||||
actual := object.get(statement.predicate, path, null)
|
||||
expected != actual
|
||||
v := is_not_violation(statement, field, expected, actual, type)
|
||||
}
|
||||
|
||||
array_field_does_not_contain(statement, field, expected, type) := v if {
|
||||
path := split(field, ".")
|
||||
actual := object.get(statement.predicate, path, null)
|
||||
not expected in actual
|
||||
v := not_contains_violation(statement, field, expected, actual, type)
|
||||
}
|
||||
|
||||
is_not_violation(statement, field, expected, actual, type) := {
|
||||
"type": type,
|
||||
"description": sprintf("%v is not %v", [field, expected]),
|
||||
"attestation": statement,
|
||||
"details": {
|
||||
"field": field,
|
||||
"actual": actual,
|
||||
"expected": expected,
|
||||
},
|
||||
}
|
||||
|
||||
not_contains_violation(statement, field, expected, actual, type) := {
|
||||
"type": type,
|
||||
"description": sprintf("%v does not contain %v", [field, expected]),
|
||||
"attestation": statement,
|
||||
"details": {
|
||||
"field": field,
|
||||
"actual": actual,
|
||||
"expected": expected,
|
||||
},
|
||||
}
|
||||
|
||||
# This is unsafe because we're not checking the signature on the attestation,
|
||||
# do not call this unless you've already verified the attestation or you need the
|
||||
# statement for some other reason
|
||||
unsafe_statement_from_attestation(att) := statement if {
|
||||
payload := att.payload
|
||||
statement := json.unmarshal(base64.decode(payload))
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
>= v0.1.4-0
|
||||
@@ -0,0 +1,19 @@
|
||||
package attest
|
||||
|
||||
import rego.v1
|
||||
|
||||
violations contains {
|
||||
"type": "always_fail",
|
||||
"description": "This policy always fails",
|
||||
}
|
||||
|
||||
result := {
|
||||
"success": false,
|
||||
"violations": violations,
|
||||
"summary": {
|
||||
"subjects": set(),
|
||||
"slsa_levels": ["SLSA_BUILD_LEVEL_3"],
|
||||
"verifier": "docker-official-images",
|
||||
"policy_uri": "https://docker.com/official/policy/v0.1",
|
||||
},
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
this is a deeply nested delegated targets file
|
||||
Reference in New Issue
Block a user