Check version of attest against constraints in TUF (#19)

* Check version of attest against constraints in TUF

* Add link to semver lib constraints docs

pkg/tuf/example_registry_test.go

@@ -20,7 +20,8 @@ func ExampleNewTufClient_registry() {
 	// using oci tuf metadata and targets
 	metadataURI := "registry-1.docker.io/docker/tuf-metadata:latest"
 	targetsURI := "registry-1.docker.io/docker/tuf-targets"
-	registryClient, err := tuf.NewTufClient(embed.StagingRoot, tufOutputPath, metadataURI, targetsURI)
+
+	registryClient, err := tuf.NewTufClient(embed.StagingRoot, tufOutputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker())
 	if err != nil {
 		panic(err)
 	}

pkg/tuf/mock.go

@@ -58,3 +58,15 @@ func (dc *mockTufClient) DownloadTarget(target string, filePath string) (actualF
 
 	return dstFilePath, b, nil
 }
+
+type mockVersionChecker struct {
+	err error
+}
+
+func NewMockVersionChecker() *mockVersionChecker {
+	return &mockVersionChecker{}
+}
+
+func (vc *mockVersionChecker) CheckVersion(client TUFClient) error {
+	return vc.err
+}

pkg/tuf/tuf.go

@@ -36,7 +36,7 @@ type TufClient struct {
 }
 
 // NewTufClient creates a new TUF client
-func NewTufClient(initialRoot []byte, tufPath, metadataSource, targetsSource string) (*TufClient, error) {
+func NewTufClient(initialRoot []byte, tufPath, metadataSource, targetsSource string, versionChecker VersionChecker) (*TufClient, error) {
 	var tufSource TufSource
 	if strings.HasPrefix(metadataSource, "https://") || strings.HasPrefix(metadataSource, "http://") {
 		tufSource = HttpSource
@@ -102,8 +102,13 @@ func NewTufClient(initialRoot []byte, tufPath, metadataSource, targetsSource str
 		updater: up,
 		cfg:     cfg,
 	}
-	return client, nil
 
+	err = versionChecker.CheckVersion(client)
+	if err != nil {
+		return nil, err
+	}
+
+	return client, nil
 }
 
 // DownloadTarget downloads the target file using Updater. The Updater gets the target

pkg/tuf/tuf_test.go

@@ -52,6 +52,9 @@ func TestRootInit(t *testing.T) {
 	}()
 	LoadRegistryTestData(t, regAddr, OciTufTestDataPath)
 
+	alwaysGoodVersionChecker := &mockVersionChecker{err: nil}
+	alwaysBadVersionChecker := &mockVersionChecker{err: assert.AnError}
+
 	testCases := []struct {
 		name           string
 		metadataSource string
@@ -62,15 +65,18 @@ func TestRootInit(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
-		_, err := NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource)
+		_, err := NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
 		assert.NoErrorf(t, err, "Failed to create TUF client: %v", err)
 
 		// recreation should work with same root
-		_, err = NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource)
+		_, err = NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
 		assert.NoErrorf(t, err, "Failed to recreate TUF client: %v", err)
 
-		_, err = NewTufClient([]byte("broken"), tufPath, tc.metadataSource, tc.targetsSource)
+		_, err = NewTufClient([]byte("broken"), tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
 		assert.Errorf(t, err, "Expected error recreating TUF client with broken root: %v", err)
+
+		_, err = NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysBadVersionChecker)
+		assert.Errorf(t, err, "Expected error creating TUF client with bad attest version: %v", err)
 	}
 }
 
@@ -93,6 +99,8 @@ func TestDownloadTarget(t *testing.T) {
 	}()
 	LoadRegistryTestData(t, regAddr, OciTufTestDataPath)
 
+	alwaysGoodVersionChecker := &mockVersionChecker{err: nil}
+
 	testCases := []struct {
 		name           string
 		metadataSource string
@@ -103,7 +111,7 @@ func TestDownloadTarget(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
-		tufClient, err := NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource)
+		tufClient, err := NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
 		assert.NoErrorf(t, err, "Failed to create TUF client: %v", err)
 
 		// get trusted tuf metadata

pkg/tuf/version.go

@@ -0,0 +1,89 @@
+package tuf
+
+import (
+	"fmt"
+	"runtime/debug"
+	"strings"
+
+	"github.com/Masterminds/semver/v3"
+)
+
+const ThisModulePath = "github.com/docker/attest"
+
+type VersionChecker interface {
+	// CheckVersion checks if the current version of this library meets the constraints from the TUF repo
+	CheckVersion(tufClient TUFClient) error
+}
+
+type InvalidVersionError struct {
+	AttestVersion     string
+	VersionConstraint string
+	Errors            []error
+}
+
+func (e *InvalidVersionError) Error() string {
+	var errsStr strings.Builder
+	for i, err := range e.Errors {
+		if i > 0 {
+			errsStr.WriteString("; ")
+		}
+		errsStr.WriteString(err.Error())
+	}
+	return fmt.Sprintf("%s version %s does not satisfy constraints %s: %s", ThisModulePath, e.AttestVersion, e.VersionConstraint, errsStr.String())
+}
+
+func NewVersionChecker() *versionChecker {
+	return &versionChecker{}
+}
+
+type versionChecker struct{}
+
+func (vc *versionChecker) CheckVersion(client TUFClient) error {
+	var attestMod *debug.Module
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		// if we can't read the build info, assume we're good. this should only happen if we're not running in a module
+		return nil
+	}
+	if bi.Main.Path == ThisModulePath {
+		attestMod = &bi.Main
+	} else {
+		for _, dep := range bi.Deps {
+			if dep.Path == ThisModulePath {
+				attestMod = dep
+				break
+			}
+		}
+	}
+	if attestMod == nil {
+		// if we can't find the attest dep, assume we're good. this should only happen in a test
+		return nil
+	}
+
+	attestVersion, err := semver.NewVersion(attestMod.Version)
+	if err != nil {
+		return fmt.Errorf("failed to parse version %s: %w", attestMod.Version, err)
+	}
+
+	// see https://github.com/Masterminds/semver/blob/v3.2.1/README.md#checking-version-constraints
+	// for more information on the expected format of the version constraints in the TUF repo
+	_, versionConstraintsBytes, err := client.DownloadTarget("version-constraints", "")
+	if err != nil {
+		return fmt.Errorf("failed to download version-constraints: %w", err)
+	}
+	versionConstraints, err := semver.NewConstraint(string(versionConstraintsBytes))
+	if err != nil {
+		return fmt.Errorf("failed to parse minimum version: %w", err)
+	}
+
+	ok, errs := versionConstraints.Validate(attestVersion)
+	if !ok {
+		return &InvalidVersionError{
+			AttestVersion:     attestVersion.String(),
+			VersionConstraint: versionConstraints.String(),
+			Errors:            errs,
+		}
+	}
+
+	return nil
+}