From 9c822317aa0349d81fdc15fda8c6e3831f5bb4a0 Mon Sep 17 00:00:00 2001 From: James Carnegie Date: Tue, 9 Jul 2024 10:14:20 +0100 Subject: [PATCH] Move mock to test package. Add artifacts test --- internal/test/test.go | 30 ++++++++++++++++++++ pkg/attest/sign_test.go | 60 +++++++++++++++++++++++++++++++++++++++ pkg/attest/verify_test.go | 2 +- pkg/oci/resolver.go | 29 ------------------- pkg/policy/policy_test.go | 2 +- 5 files changed, 92 insertions(+), 31 deletions(-) diff --git a/internal/test/test.go b/internal/test/test.go index 2da3576..1853dda 100644 --- a/internal/test/test.go +++ b/internal/test/test.go @@ -11,6 +11,7 @@ import ( "testing" "github.com/docker/attest/pkg/attestation" + "github.com/docker/attest/pkg/oci" "github.com/docker/attest/pkg/policy" "github.com/docker/attest/pkg/signerverifier" "github.com/docker/attest/pkg/tlog" @@ -193,3 +194,32 @@ func ExtractAnnotatedStatements(path string, mediaType string) ([]*AnnotatedStat } return ExtractStatementsFromIndex(mfs, mediaType) } + +type MockResolver struct { + Envs []*attestation.Envelope +} + +func (r MockResolver) Attestations(ctx context.Context, mediaType string) ([]*attestation.Envelope, error) { + return r.Envs, nil +} + +func (r MockResolver) ImageName(ctx context.Context) (string, error) { + return "library/alpine:latest", nil +} + +func (r MockResolver) ImageDescriptor(ctx context.Context) (*v1.Descriptor, error) { + digest, err := v1.NewHash("sha256:da8b190665956ea07890a0273e2a9c96bfe291662f08e2860e868eef69c34620") + if err != nil { + return nil, err + } + return &v1.Descriptor{ + Digest: digest, + Size: 1234, + MediaType: "application/vnd.oci.image.manifest.v1+json", + }, nil + +} + +func (r MockResolver) ImagePlatform(ctx context.Context) (*v1.Platform, error) { + return oci.ParsePlatform("linux/amd64") +} diff --git a/pkg/attest/sign_test.go b/pkg/attest/sign_test.go index dfd4cb8..4fa494b 100644 --- a/pkg/attest/sign_test.go +++ b/pkg/attest/sign_test.go @@ -155,3 +155,63 @@ func TestAddSignedLayerAnnotations(t *testing.T) { }) } } + +func TestSimpleStatementSigning(t *testing.T) { + ctx, signer := test.Setup(t) + empty := types.MediaType("application/vnd.oci.empty.v1+json") + testCases := []struct { + name string + replace bool + }{ + {"replaced", true}, + {"not replaced", false}, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + opts := &attestation.SigningOptions{} + statement := &intoto.Statement{ + StatementHeader: intoto.StatementHeader{ + PredicateType: attestation.VSAPredicateType, + }, + } + statement2 := &intoto.Statement{ + StatementHeader: intoto.StatementHeader{ + PredicateType: attestation.VSAPredicateType, + }, + } + subject := &v1.Descriptor{ + MediaType: "application/vnd.oci.image.manifest.v1+json", + } + manifest, err := NewAttestationManifest(subject) + require.NoError(t, err) + err = manifest.AddAttestation(ctx, signer, statement, opts) + require.NoError(t, err) + + err = manifest.AddAttestation(ctx, signer, statement2, opts) + require.NoError(t, err) + + newImg, err := manifest.BuildAttestationImage(attestation.WithReplacedLayers(tc.replace)) + require.NoError(t, err) + layers, err := newImg.Layers() + require.NoError(t, err) + assert.Len(t, layers, 2) + + newImgs, err := manifest.BuildReferringArtifacts() + require.NoError(t, err) + assert.Len(t, newImgs, 2) + for _, img := range newImgs { + mf, err := img.Manifest() + require.NoError(t, err) + assert.Equal(t, "application/vnd.in-toto+json", mf.ArtifactType) + assert.Equal(t, subject.MediaType, mf.MediaType) + assert.Equal(t, empty, mf.Config.MediaType) + assert.Equal(t, int64(2), mf.Config.Size) + assert.Equal(t, "e30=", string(mf.Config.Data)) + layers, err := img.Layers() + require.NoError(t, err) + assert.Len(t, layers, 1) + } + }) + } +} diff --git a/pkg/attest/verify_test.go b/pkg/attest/verify_test.go index dd93f84..b2ed630 100644 --- a/pkg/attest/verify_test.go +++ b/pkg/attest/verify_test.go @@ -36,7 +36,7 @@ func TestVerifyAttestations(t *testing.T) { var env = new(attestation.Envelope) err = json.Unmarshal(ex, env) assert.NoError(t, err) - resolver := &oci.MockResolver{ + resolver := &test.MockResolver{ Envs: []*attestation.Envelope{env}, } diff --git a/pkg/oci/resolver.go b/pkg/oci/resolver.go index 79cf277..2c653f9 100644 --- a/pkg/oci/resolver.go +++ b/pkg/oci/resolver.go @@ -17,32 +17,3 @@ type ImageDetailsResolver interface { ImagePlatform(ctx context.Context) (*v1.Platform, error) ImageDescriptor(ctx context.Context) (*v1.Descriptor, error) } - -type MockResolver struct { - Envs []*att.Envelope -} - -func (r MockResolver) Attestations(ctx context.Context, mediaType string) ([]*att.Envelope, error) { - return r.Envs, nil -} - -func (r MockResolver) ImageName(ctx context.Context) (string, error) { - return "library/alpine:latest", nil -} - -func (r MockResolver) ImageDescriptor(ctx context.Context) (*v1.Descriptor, error) { - digest, err := v1.NewHash("sha256:da8b190665956ea07890a0273e2a9c96bfe291662f08e2860e868eef69c34620") - if err != nil { - return nil, err - } - return &v1.Descriptor{ - Digest: digest, - Size: 1234, - MediaType: "application/vnd.oci.image.manifest.v1+json", - }, nil - -} - -func (r MockResolver) ImagePlatform(ctx context.Context) (*v1.Platform, error) { - return ParsePlatform("linux/amd64") -} diff --git a/pkg/policy/policy_test.go b/pkg/policy/policy_test.go index c45e445..82ab8b1 100644 --- a/pkg/policy/policy_test.go +++ b/pkg/policy/policy_test.go @@ -38,7 +38,7 @@ func TestRegoEvaluator_Evaluate(t *testing.T) { re := policy.NewRegoEvaluator(true) - defaultResolver := oci.MockResolver{ + defaultResolver := test.MockResolver{ Envs: []*attestation.Envelope{loadAttestation(t, ExampleAttestation)}, }