diff --git a/test/testdata/tuf/test-repo/metadata/1.root.json b/test/testdata/tuf/test-repo/metadata/1.root.json index 5e0adaa..7ab8187 100644 --- a/test/testdata/tuf/test-repo/metadata/1.root.json +++ b/test/testdata/tuf/test-repo/metadata/1.root.json @@ -1,42 +1,42 @@ { "signatures": [ { - "keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "sig": "3064023037bbb03c3472b140572a7d5a2895bd80e74435bbcb7053949731f81b104c6d05a0876590cd6a2e94d7ed619426a2f6fa02303adc8c9006fa5506fdd7ea87d2960074a537ad8bf2459f2863e806b47682cbb2f9b01b7502eaf5437a1a68fdaaeac114" + "keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221", + "sig": "3065023000f7d0a866576e94eaabc173b9233d4c8fcfa495527088f9022dff5a553f7a457da1015a6d0fc714f84848ec627387360231009fa70b2eebbe15241a2ec9b96a094ebd28661e30b8c3d1eab8d694df2b340bda511c489393630c9a9dacde42c99e9fa1" } ], "signed": { "_type": "root", "consistent_snapshot": true, - "expires": "2034-04-02T17:00:22Z", + "expires": "2034-05-29T20:14:11Z", "keys": { - "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": { - "keytype": "ecdsa", - "keyval": { - "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n" - }, - "scheme": "ecdsa-sha2-nistp256", - "x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61" - }, - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": { + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221": { "keytype": "ecdsa", "keyval": { "public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n" }, "scheme": "ecdsa-sha2-nistp384", "x-tuf-on-ci-keyowner": "@mrjoelkamp" + }, + "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5": { + "keytype": "ecdsa", + "keyval": { + "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n" + }, + "scheme": "ecdsa-sha2-nistp256", + "x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61" } }, "roles": { "root": { "keyids": [ - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09" + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221" ], "threshold": 1 }, "snapshot": { "keyids": [ - "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3" + "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5" ], "threshold": 1, "x-tuf-on-ci-expiry-period": 3650, @@ -44,13 +44,13 @@ }, "targets": { "keyids": [ - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09" + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221" ], "threshold": 1 }, "timestamp": { "keyids": [ - "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3" + "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5" ], "threshold": 1, "x-tuf-on-ci-expiry-period": 3650, diff --git a/test/testdata/tuf/test-repo/metadata/2.root.json b/test/testdata/tuf/test-repo/metadata/2.root.json index 3601eb2..9de5be2 100644 --- a/test/testdata/tuf/test-repo/metadata/2.root.json +++ b/test/testdata/tuf/test-repo/metadata/2.root.json @@ -1,20 +1,28 @@ { "signatures": [ { - "keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "sig": "3066023100e99acc5f74777ebf40376b60f0216e8fe1829c1a49a5f6a6899126c15de1df7a56533baf493b2b53159c50843a289102023100b6a006b24da62ea0b743fbe38e1497ff485bf3a0833894985fc27a0305ad0693eeb968a7b52723ed3c49af8bef2027b6" + "keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221", + "sig": "3065023079fce0ddea385d0e5b6eed0da688946f417d1c1bf6397edaa44279bf948d6de41daf5e0852069900f363175abd95959b023100d2b950cb3f39cc4df8140d2ec3c60d81d2811827fbc61034786cd877586f6ab5f9ba03ad95d7de58e9241917d79687a9" }, { - "keyid": "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664", - "sig": "30440220136debcc2f60dd1d63c9c2704f9b13c2cb2f5d2df58ea93f07f7c10f54f36742022059d7f8c6620e33506c6f1766394a32f86c9b008328f6398831ba7ebcf4ce0838" + "keyid": "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72", + "sig": "" } ], "signed": { "_type": "root", "consistent_snapshot": true, - "expires": "2034-04-03T08:45:50Z", + "expires": "2034-06-12T17:21:13Z", "keys": { - "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": { + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221": { + "keytype": "ecdsa", + "keyval": { + "public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n" + }, + "scheme": "ecdsa-sha2-nistp384", + "x-tuf-on-ci-keyowner": "@mrjoelkamp" + }, + "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5": { "keytype": "ecdsa", "keyval": { "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n" @@ -22,34 +30,26 @@ "scheme": "ecdsa-sha2-nistp256", "x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61" }, - "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664": { + "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72": { "keytype": "ecdsa", "keyval": { - "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWmhpAfB7Q53UNluMhpkDxXXup4E0\n2Hh4PSgHC1Yh6brGl6Akq9a4io55LtZTk5mnCTqxuB+rc5cI/yaNUeWEqQ==\n-----END PUBLIC KEY-----\n" + "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEERet/8hs3WHIXyOXNzhLpTOz6DBx\n7zzHnenJgV/TB0dRMAx6j9UVRvlEkh5OcYuktNeqnLpHce1rLjLjpiRPVg==\n-----END PUBLIC KEY-----\n" }, "scheme": "ecdsa-sha2-nistp256", - "x-tuf-on-ci-keyowner": "@kipz" - }, - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": { - "keytype": "ecdsa", - "keyval": { - "public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n" - }, - "scheme": "ecdsa-sha2-nistp384", - "x-tuf-on-ci-keyowner": "@mrjoelkamp" + "x-tuf-on-ci-keyowner": "@jonnystoten" } }, "roles": { "root": { "keyids": [ - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664" + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221", + "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72" ], "threshold": 1 }, "snapshot": { "keyids": [ - "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3" + "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5" ], "threshold": 1, "x-tuf-on-ci-expiry-period": 3650, @@ -57,14 +57,14 @@ }, "targets": { "keyids": [ - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664" + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221", + "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72" ], "threshold": 1 }, "timestamp": { "keyids": [ - "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3" + "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5" ], "threshold": 1, "x-tuf-on-ci-expiry-period": 3650, diff --git a/test/testdata/tuf/test-repo/metadata/2.test-role.json b/test/testdata/tuf/test-repo/metadata/2.test-role.json new file mode 100644 index 0000000..d1ecab8 --- /dev/null +++ b/test/testdata/tuf/test-repo/metadata/2.test-role.json @@ -0,0 +1,30 @@ +{ + "signatures": [ + { + "keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221", + "sig": "3065023100c37572d6e0608e0501026d99238ee37d26856d93074227410b0748e56775f8369cf7c44553b73d8a30aa94a388148ca602305b46acbb0e8818657725024a39d02589538845ad9fa0c2b6eb18f431f560096045fd825586dce81688c9574b11b975da" + } + ], + "signed": { + "_type": "targets", + "expires": "2034-05-29T20:25:01Z", + "spec_version": "1.0.31", + "targets": { + "test-role/dir1/dir2/dir3/test.txt": { + "hashes": { + "sha256": "bb8fcf06f6c067dcbcb394d7d9ced788316fc02b715fe679097281108a4bd465" + }, + "length": 46 + }, + "test-role/test.txt": { + "hashes": { + "sha256": "d1bb6181284970ae43fbbc88b5e72f9a5942ebac20588aa0c4bf78ba621e1ee2" + }, + "length": 32 + } + }, + "version": 2, + "x-tuf-on-ci-expiry-period": 3650, + "x-tuf-on-ci-signing-period": 60 + } +} \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/metadata/3.test-role.json b/test/testdata/tuf/test-repo/metadata/3.test-role.json deleted file mode 100644 index db13fb0..0000000 --- a/test/testdata/tuf/test-repo/metadata/3.test-role.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "signatures": [ - { - "keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "sig": "" - }, - { - "keyid": "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664", - "sig": "3044022015b6ebe9d30895e3be20e707a6738e38460197d90cae3dc37527ddb7c437868602207f85f3d4e068bef4c51a749f5d166cc7fe2cb9483999ea197e72395081c3aa61" - } - ], - "signed": { - "_type": "targets", - "expires": "2034-04-03T15:39:02Z", - "spec_version": "1.0.31", - "targets": { - "test-role/dir1/dir2/dir3/myfile.txt": { - "hashes": { - "sha256": "ea230621c53e0bb858ea5526125414f8957fb29c08350528d50a162c620f36b1" - }, - "length": 10 - }, - "test-role/test.txt": { - "hashes": { - "sha256": "d1bb6181284970ae43fbbc88b5e72f9a5942ebac20588aa0c4bf78ba621e1ee2" - }, - "length": 32 - } - }, - "version": 3, - "x-tuf-on-ci-expiry-period": 3650, - "x-tuf-on-ci-signing-period": 60 - } -} \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/metadata/5.targets.json b/test/testdata/tuf/test-repo/metadata/5.targets.json deleted file mode 100644 index b177300..0000000 --- a/test/testdata/tuf/test-repo/metadata/5.targets.json +++ /dev/null @@ -1,65 +0,0 @@ -{ - "signatures": [ - { - "keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "sig": "" - }, - { - "keyid": "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664", - "sig": "3046022100f892a496c9bd96082e3b06d5eae85429355876b8eb455aa04b53ab9051911d90022100a3e89c29b15bccfc2877278c0fb2d3b34500da6351e245ad0b3f8c0ae6b67eff" - } - ], - "signed": { - "_type": "targets", - "delegations": { - "keys": { - "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664": { - "keytype": "ecdsa", - "keyval": { - "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWmhpAfB7Q53UNluMhpkDxXXup4E0\n2Hh4PSgHC1Yh6brGl6Akq9a4io55LtZTk5mnCTqxuB+rc5cI/yaNUeWEqQ==\n-----END PUBLIC KEY-----\n" - }, - "scheme": "ecdsa-sha2-nistp256", - "x-tuf-on-ci-keyowner": "@kipz" - }, - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": { - "keytype": "ecdsa", - "keyval": { - "public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n" - }, - "scheme": "ecdsa-sha2-nistp384", - "x-tuf-on-ci-keyowner": "@mrjoelkamp" - } - }, - "roles": [ - { - "keyids": [ - "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09", - "81cf5a78d6ea2cd904256b9d814b340289b765e6f75ec4397e4ebb7586cab664" - ], - "name": "test-role", - "paths": [ - "test-role/*", - "test-role/*/*", - "test-role/*/*/*", - "test-role/*/*/*/*" - ], - "terminating": true, - "threshold": 1 - } - ] - }, - "expires": "2034-04-03T15:28:29Z", - "spec_version": "1.0.31", - "targets": { - "test.txt": { - "hashes": { - "sha256": "02119a076ec3878c736c3a95e20794f5a8d5bce3d7ecc264681bb7334ca2e24b" - }, - "length": 31 - } - }, - "version": 5, - "x-tuf-on-ci-expiry-period": 3650, - "x-tuf-on-ci-signing-period": 60 - } -} \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/metadata/6.snapshot.json b/test/testdata/tuf/test-repo/metadata/6.snapshot.json deleted file mode 100644 index 18421ed..0000000 --- a/test/testdata/tuf/test-repo/metadata/6.snapshot.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "signatures": [ - { - "keyid": "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3", - "sig": "3044022039b56cd2e3597df74e57d200a652ba020cdc9a8cd050bd65b5f8e2640d50691d02205e073e4b6fc260acc64327a331e4440601af5b1cbff594ea91cf7b70d5828fb1" - } - ], - "signed": { - "_type": "snapshot", - "expires": "2034-04-03T15:59:47Z", - "meta": { - "targets.json": { - "version": 5 - }, - "test-role.json": { - "version": 3 - } - }, - "spec_version": "1.0.31", - "version": 6 - } -} \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/metadata/7.snapshot.json b/test/testdata/tuf/test-repo/metadata/7.snapshot.json new file mode 100644 index 0000000..8de2ace --- /dev/null +++ b/test/testdata/tuf/test-repo/metadata/7.snapshot.json @@ -0,0 +1,22 @@ +{ + "signatures": [ + { + "keyid": "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5", + "sig": "3045022018e31a2e743b21054939262706520be10375829fb93dec7f3042e48ed8eb9cec0221008c2765ee9e49d49c12a6b9a5124c984d414b8d86452cdbcc2fc2f2ca10a11e67" + } + ], + "signed": { + "_type": "snapshot", + "expires": "2034-06-23T12:47:16Z", + "meta": { + "targets.json": { + "version": 8 + }, + "test-role.json": { + "version": 2 + } + }, + "spec_version": "1.0.31", + "version": 7 + } +} \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/metadata/8.targets.json b/test/testdata/tuf/test-repo/metadata/8.targets.json new file mode 100644 index 0000000..2931bc7 --- /dev/null +++ b/test/testdata/tuf/test-repo/metadata/8.targets.json @@ -0,0 +1,80 @@ +{ + "signatures": [ + { + "keyid": "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221", + "sig": "" + }, + { + "keyid": "beac53949c4cf075824edede7d41715941f524db247d1b455a2389d7490ecd72", + "sig": "304602210086552ad4ffddd7e60f2b80d095b4dfad9d2836cfce5d6b12dfb2aec0786240df02210097807190a1f64c615798b74068e8c9f19a29f495566bc1f16d296c7edd9343b3" + } + ], + "signed": { + "_type": "targets", + "delegations": { + "keys": { + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221": { + "keytype": "ecdsa", + "keyval": { + "public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n" + }, + "scheme": "ecdsa-sha2-nistp384", + "x-tuf-on-ci-keyowner": "@mrjoelkamp" + } + }, + "roles": [ + { + "keyids": [ + "76d0a7e1ff8617ce99627d0fa5c9809f2c0f0d52e0bf65c7b84c031608d25221" + ], + "name": "test-role", + "paths": [ + "test-role/*", + "test-role/*/*", + "test-role/*/*/*", + "test-role/*/*/*/*" + ], + "terminating": true, + "threshold": 1 + } + ] + }, + "expires": "2034-06-23T12:42:15Z", + "spec_version": "1.0.31", + "targets": { + "always-fail.rego": { + "hashes": { + "sha256": "e8a5b75ac27a28056d2155ff63acc1ffd76c30ed8558011c54708f4832f073ac" + }, + "length": 364 + }, + "jonnystoten2.rego": { + "hashes": { + "sha256": "bc46e8c31646f166a9efbd14fef154dd84cf07efc95c96be3a201c84470dcbc1" + }, + "length": 5857 + }, + "mapping.yaml": { + "hashes": { + "sha256": "baad1a9d61afa5d6f8717f576b57b9749e5549da4b826746fd73a5a914ac5be1" + }, + "length": 272 + }, + "test.txt": { + "hashes": { + "sha256": "02119a076ec3878c736c3a95e20794f5a8d5bce3d7ecc264681bb7334ca2e24b" + }, + "length": 31 + }, + "version-constraints": { + "hashes": { + "sha256": "bd6394a08afc1edfe5512fc14e63025a337e25ca0013c1068ec879742fc3a3c3" + }, + "length": 12 + } + }, + "version": 8, + "x-tuf-on-ci-expiry-period": 3650, + "x-tuf-on-ci-signing-period": 60 + } +} \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/metadata/timestamp.json b/test/testdata/tuf/test-repo/metadata/timestamp.json index c8bbfc5..82d1759 100644 --- a/test/testdata/tuf/test-repo/metadata/timestamp.json +++ b/test/testdata/tuf/test-repo/metadata/timestamp.json @@ -1,19 +1,19 @@ { "signatures": [ { - "keyid": "198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3", - "sig": "3045022011f2afa9b448fcbbac983c11fc3e264e95d5d7a9c9527b09d83a316ee762635f022100d05197a78ccc7a713ebdb0bccb44844f67a7c5208af8d346e201064b7ce11055" + "keyid": "bdd1703ecbde8812614b112a6551d58de3ad681048fd90fca2a3e491edd8afe5", + "sig": "304502204019c08b30b7525b95c4010e5c1420c5618c18d5b0719fb1d9392ef93322ca4e022100924ec18242ba21edcc2c7ad92ee13a38a6f4a8e1315c588eb9eb2d0bce0a1a80" } ], "signed": { "_type": "timestamp", - "expires": "2034-04-03T15:59:47Z", + "expires": "2034-06-23T12:47:16Z", "meta": { "snapshot.json": { - "version": 6 + "version": 7 } }, "spec_version": "1.0.31", - "version": 6 + "version": 7 } } \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/targets/baad1a9d61afa5d6f8717f576b57b9749e5549da4b826746fd73a5a914ac5be1.mapping.yaml b/test/testdata/tuf/test-repo/targets/baad1a9d61afa5d6f8717f576b57b9749e5549da4b826746fd73a5a914ac5be1.mapping.yaml new file mode 100644 index 0000000..438aee3 --- /dev/null +++ b/test/testdata/tuf/test-repo/targets/baad1a9d61afa5d6f8717f576b57b9749e5549da4b826746fd73a5a914ac5be1.mapping.yaml @@ -0,0 +1,12 @@ +version: v1 +kind: policy-mapping +policies: + - origin: + domain: docker.io + prefix: jonnystoten2/ + id: jonnystoten2 + description: jonnystoten2 personal images for testing + attestations: + style: "referrers" + files: + - path: jonnystoten2.rego diff --git a/test/testdata/tuf/test-repo/targets/bc46e8c31646f166a9efbd14fef154dd84cf07efc95c96be3a201c84470dcbc1.jonnystoten2.rego b/test/testdata/tuf/test-repo/targets/bc46e8c31646f166a9efbd14fef154dd84cf07efc95c96be3a201c84470dcbc1.jonnystoten2.rego new file mode 100644 index 0000000..3e7069f --- /dev/null +++ b/test/testdata/tuf/test-repo/targets/bc46e8c31646f166a9efbd14fef154dd84cf07efc95c96be3a201c84470dcbc1.jonnystoten2.rego @@ -0,0 +1,200 @@ +package attest + +import rego.v1 + +split_digest := split(input.digest, ":") + +digest_type := split_digest[0] + +digest := split_digest[1] + +keys := [{ + "id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4", + "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgH23D1i2+ZIOtVjmfB7iFvX8AhVN\n9CPJ4ie9axw+WRHozGnRy99U2dRge3zueBBg2MweF0zrToXGig2v3YOrdw==\n-----END PUBLIC KEY-----", + "from": "2023-12-15T14:00:00Z", + "to": null, + "status": "active", + "signing-format": "dssev1", +}] + +verify_opts := {"keys": keys} + +verify_attestation(att) := attest.verify(att, verify_opts) + +attestations contains att if { + result := attest.fetch("https://slsa.dev/verification_summary/v1") + not result.error + some att in result.value +} + +signed_statements contains statement if { + some att in attestations + result := verify_attestation(att) + not result.error + statement := result.value +} + +statements_with_subject contains statement if { + some statement in signed_statements + some subject in statement.subject + subject.digest[digest_type] == digest + valid_subject_name(input.isCanonical, subject.name, input.purl) +} + +id(statement) := crypto.sha256(json.marshal(statement)) + +subjects contains subject if { + some statement in statements_with_subject + some subject in statement.subject +} + +global_violations contains v if { + count(attestations) == 0 + v := { + "type": "missing_attestation", + "description": "No https://slsa.dev/verification_summary/v1 attestation found", + "attestation": null, + "details": {}, + } +} + +# we need to key this by statement_id rather than statement because we can't +# use an object as a key due to a bug(?) in OPA: https://github.com/open-policy-agent/opa/issues/6736 +statement_violations[statement_id] contains v if { + some att in attestations + result := verify_attestation(att) + err := result.error + statement := unsafe_statement_from_attestation(att) + statement_id := id(statement) + v := { + "type": "unsigned_statement", + "description": sprintf("Statement is not correctly signed: %v", [err]), + "attestation": statement, + "details": {"error": err}, + } +} + +statement_violations[statement_id] contains v if { + some statement in signed_statements + statement_id := id(statement) + not statement in statements_with_subject + v := { + "type": "bad_subjects", + "description": "Statement does not have this image as a subject", + "attestation": statement, + "details": {"input": input}, + } +} + +statement_violations[statement_id] contains v if { + some statement in statements_with_subject + statement_id := id(statement) + v := field_value_does_not_equal(statement, "verificationResult", "PASSED", "wrong_verification_result") +} + +# TODO: add to statement_violations if there are statements that have an incorrect resource_uri +# this should match the input.purl, but we really only care about the repo name and the digest +# we need to receive the input.purl as a parsed object so we can compare only the parts we care about + +statement_violations[statement_id] contains v if { + some statement in statements_with_subject + statement_id := id(statement) + v := field_value_does_not_equal(statement, "verifier.id", "signing-demo-verifier", "wrong_verifier") +} + +statement_violations[statement_id] contains v if { + some statement in statements_with_subject + statement_id := id(statement) + v := field_value_does_not_equal(statement, "policy.uri", "https://docker.com/official/policy/v0.1", "wrong_policy_uri") +} + +statement_violations[statement_id] contains v if { + some statement in statements_with_subject + statement_id := id(statement) + v := array_field_does_not_contain(statement, "verifiedLevels", "SLSA_BUILD_LEVEL_3", "wrong_verified_levels") +} + +bad_statements contains statement if { + some statement in statements_with_subject + statement_id := id(statement) + statement_violations[statement_id] +} + +good_statements := statements_with_subject - bad_statements + +all_violations contains v if { + some v in global_violations +} + +all_violations contains v if { + some violations in statement_violations + some v in violations +} + +result := { + "success": allow, + "violations": all_violations, + "summary": { + "subjects": subjects, + "slsa_levels": ["SLSA_BUILD_LEVEL_3"], + "verifier": "signing-demo-verifier", + "policy_uri": "https://docker.com/official/policy/v0.1", + }, +} + +default allow := false + +allow if { + count(good_statements) > 0 +} + +# TODO: this should take into account the repo name from the purl +valid_subject_name(true, name, purl) + +valid_subject_name(false, name, purl) if { + name == purl +} + +field_value_does_not_equal(statement, field, expected, type) := v if { + path := split(field, ".") + actual := object.get(statement.predicate, path, null) + expected != actual + v := is_not_violation(statement, field, expected, actual, type) +} + +array_field_does_not_contain(statement, field, expected, type) := v if { + path := split(field, ".") + actual := object.get(statement.predicate, path, null) + not expected in actual + v := not_contains_violation(statement, field, expected, actual, type) +} + +is_not_violation(statement, field, expected, actual, type) := { + "type": type, + "description": sprintf("%v is not %v", [field, expected]), + "attestation": statement, + "details": { + "field": field, + "actual": actual, + "expected": expected, + }, +} + +not_contains_violation(statement, field, expected, actual, type) := { + "type": type, + "description": sprintf("%v does not contain %v", [field, expected]), + "attestation": statement, + "details": { + "field": field, + "actual": actual, + "expected": expected, + }, +} + +# This is unsafe because we're not checking the signature on the attestation, +# do not call this unless you've already verified the attestation or you need the +# statement for some other reason +unsafe_statement_from_attestation(att) := statement if { + payload := att.payload + statement := json.unmarshal(base64.decode(payload)) +} diff --git a/test/testdata/tuf/test-repo/targets/bd6394a08afc1edfe5512fc14e63025a337e25ca0013c1068ec879742fc3a3c3.version-constraints b/test/testdata/tuf/test-repo/targets/bd6394a08afc1edfe5512fc14e63025a337e25ca0013c1068ec879742fc3a3c3.version-constraints new file mode 100644 index 0000000..aaf0058 --- /dev/null +++ b/test/testdata/tuf/test-repo/targets/bd6394a08afc1edfe5512fc14e63025a337e25ca0013c1068ec879742fc3a3c3.version-constraints @@ -0,0 +1 @@ +>= v0.1.4-0 diff --git a/test/testdata/tuf/test-repo/targets/e8a5b75ac27a28056d2155ff63acc1ffd76c30ed8558011c54708f4832f073ac.always-fail.rego b/test/testdata/tuf/test-repo/targets/e8a5b75ac27a28056d2155ff63acc1ffd76c30ed8558011c54708f4832f073ac.always-fail.rego new file mode 100644 index 0000000..e16ec55 --- /dev/null +++ b/test/testdata/tuf/test-repo/targets/e8a5b75ac27a28056d2155ff63acc1ffd76c30ed8558011c54708f4832f073ac.always-fail.rego @@ -0,0 +1,19 @@ +package attest + +import rego.v1 + +violations contains { + "type": "always_fail", + "description": "This policy always fails", +} + +result := { + "success": false, + "violations": violations, + "summary": { + "subjects": set(), + "slsa_levels": ["SLSA_BUILD_LEVEL_3"], + "verifier": "docker-official-images", + "policy_uri": "https://docker.com/official/policy/v0.1", + }, +} diff --git a/test/testdata/tuf/test-repo/targets/test-role/dir1/dir2/dir3/bb8fcf06f6c067dcbcb394d7d9ced788316fc02b715fe679097281108a4bd465.test.txt b/test/testdata/tuf/test-repo/targets/test-role/dir1/dir2/dir3/bb8fcf06f6c067dcbcb394d7d9ced788316fc02b715fe679097281108a4bd465.test.txt new file mode 100644 index 0000000..17aba85 --- /dev/null +++ b/test/testdata/tuf/test-repo/targets/test-role/dir1/dir2/dir3/bb8fcf06f6c067dcbcb394d7d9ced788316fc02b715fe679097281108a4bd465.test.txt @@ -0,0 +1 @@ +this is a deeply nested delegated targets file \ No newline at end of file diff --git a/test/testdata/tuf/test-repo/targets/test-role/dir1/dir2/dir3/ea230621c53e0bb858ea5526125414f8957fb29c08350528d50a162c620f36b1.myfile.txt b/test/testdata/tuf/test-repo/targets/test-role/dir1/dir2/dir3/ea230621c53e0bb858ea5526125414f8957fb29c08350528d50a162c620f36b1.myfile.txt deleted file mode 100644 index 327dce1..0000000 --- a/test/testdata/tuf/test-repo/targets/test-role/dir1/dir2/dir3/ea230621c53e0bb858ea5526125414f8957fb29c08350528d50a162c620f36b1.myfile.txt +++ /dev/null @@ -1 +0,0 @@ -hello tuf