docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for separate attestation storage repo (#62)

Browse Source 
* Add support for separate attestation storage repo
* Move mapping file types and parsing to config package
* Change signature of Verify to take image/platform
* Separate Attestation Resolvers to their own files (registry, layout and referrers)
* Add support configuring referrers resolution style in mapping.yaml
* Add registry test
This commit is contained in:
James Carnegie
2024-06-21 11:29:16 +01:00
committed by GitHub
parent 86878482c3
commit 6bd57e02b6
20 changed files with 877 additions and 619 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
pkg/attestation/referrers_test.go
View File

@@ -83,13 +83,13 @@ func TestAttestationReferenceTypes(t *testing.T) {
require.NoError(t, err)
ref = fmt.Sprintf("%s/repo@%s", u.Host, idxDigest.String())
}
resolver, err := oci.NewRegistryAttestationResolver(ref, platform)
require.NoError(t, err)
policyOpts := &policy.PolicyOptions{
LocalPolicyDir: PassPolicyDir,
}
results, err := attest.Verify(ctx, policyOpts, resolver)
src, err := oci.ParseImageSpec(ref, oci.WithPlatform(platform))
require.NoError(t, err)
results, err := attest.Verify(ctx, src, policyOpts)
require.NoError(t, err)
assert.Equal(t, attest.OutcomeSuccess, results.Outcome)
@@ -107,10 +107,9 @@ func TestAttestationReferenceTypes(t *testing.T) {
require.NoError(t, err)
ref = fmt.Sprintf("%s/repo@%s", u.Host, subjectDigest.String())
}
referrersResolver, err := oci.NewReferrersAttestationResolver(ref, oci.WithPlatform(platform))
src, err := oci.ParseImageSpec(ref, oci.WithPlatform(platform))
require.NoError(t, err)
results, err = attest.Verify(ctx, policyOpts, referrersResolver)
results, err = attest.Verify(ctx, src, policyOpts)
require.NoError(t, err)
assert.Equal(t, attest.OutcomeSuccess, results.Outcome)
}
@@ -172,14 +171,13 @@ func TestReferencesInDifferentRepo(t *testing.T) {
continue
}
// can evaluate policy using referrers in a different repo
repo := fmt.Sprintf("%s/%s", refServerUrl.Host, repoName)
referencedImage := fmt.Sprintf("%s@%s", indexName, mf.Digest.String())
referrersResolver, err := oci.NewReferrersAttestationResolver(referencedImage, oci.WithReferrersRepo(repo))
require.NoError(t, err)
policyOpts := &policy.PolicyOptions{
LocalPolicyDir: PassPolicyDir,
}
results, err := attest.Verify(ctx, policyOpts, referrersResolver)
src, err := oci.ParseImageSpec(referencedImage)
require.NoError(t, err)
results, err := attest.Verify(ctx, src, policyOpts)
require.NoError(t, err)
assert.Equal(t, attest.OutcomeSuccess, results.Outcome)
}