docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

*Breaking* Parse platform earlier (#43)

Browse Source 
* *Breaking* Parse platform earlier

* Use constructors and hide fields to avoid confusion
This commit is contained in:
James Carnegie
2024-05-30 17:38:58 +01:00
committed by GitHub
parent e81016fc31
commit a334599635
7 changed files with 70 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/attest/example_verify_test.go
View File

@@ -39,9 +39,11 @@ func ExampleVerify_remote() {
// create a resolver for remote attestations // create a resolver for remote attestations
image := "registry-1.docker.io/library/notary:server" image := "registry-1.docker.io/library/notary:server"
platform := "linux/amd64" platform := "linux/amd64"
resolver := &oci.RegistryResolver{ resolver, err := oci.NewRegistryAttestationResolver(
Image: image, // path to image index in OCI registry containing image attestations image, // path to image index in OCI registry containing image attestations
Platform: platform, // platform of subject image (image that attestations are being verified against) platform) // platform of subject image (image that attestations are being verified against)
if err != nil {
panic(err)
} }
// example using a local resolver // example using a local resolver
// path := "/myimage" // path := "/myimage"

7
pkg/attest/sign_test.go
View File

@@ -73,11 +73,8 @@ func TestSignVerifyOCILayout(t *testing.T) {
}) })
_, err = layout.Write(outputLayout, idx) _, err = layout.Write(outputLayout, idx)
require.NoError(t, err) require.NoError(t, err)
resolver, err := oci.NewOCILayoutAttestationResolver(outputLayout, "")
resolver := &oci.OCILayoutResolver{ require.NoError(t, err)
Path: outputLayout,
Platform: "",
}
policy, err := Verify(ctx, policyResolver, resolver) policy, err := Verify(ctx, policyResolver, resolver)
require.NoError(t, err) require.NoError(t, err)
assert.Equalf(t, OutcomeSuccess, policy.Outcome, "Policy should have been found") assert.Equalf(t, OutcomeSuccess, policy.Outcome, "Policy should have been found")

6
pkg/attest/verify.go
View File

@@ -89,7 +89,11 @@ func VerifyAttestations(ctx context.Context, resolver oci.AttestationResolver, p
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to get image name: %w", err) return nil, fmt.Errorf("failed to get image name: %w", err)
} }
purl, canonical, err := oci.RefToPURL(name, resolver.ImagePlatformStr()) platform, err := resolver.ImagePlatform()
if err != nil {
return nil, err
}
purl, canonical, err := oci.RefToPURL(name, platform)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to convert ref to purl: %w", err) return nil, fmt.Errorf("failed to convert ref to purl: %w", err)
} }

12
pkg/attest/verify_test.go
View File

@@ -95,10 +95,8 @@ func TestVSA(t *testing.T) {
assert.NoError(t, err) assert.NoError(t, err)
//verify (without vsa should fail) //verify (without vsa should fail)
resolver := &oci.OCILayoutResolver{ resolver, err := oci.NewOCILayoutAttestationResolver(outputLayout, "linux/amd64")
Path: outputLayout, require.NoError(t, err)
Platform: "linux/amd64",
}
// mocked vsa query should pass // mocked vsa query should pass
policyOpts := &policy.PolicyOptions{ policyOpts := &policy.PolicyOptions{
@@ -150,10 +148,8 @@ func TestVerificationFailure(t *testing.T) {
assert.NoError(t, err) assert.NoError(t, err)
//verify (without vsa should fail) //verify (without vsa should fail)
resolver := &oci.OCILayoutResolver{ resolver, err := oci.NewOCILayoutAttestationResolver(outputLayout, "linux/amd64")
Path: outputLayout, require.NoError(t, err)
Platform: "linux/amd64",
}
// mocked vsa query should pass // mocked vsa query should pass
policyOpts := &policy.PolicyOptions{ policyOpts := &policy.PolicyOptions{

72
pkg/oci/oci.go
View File

@@ -38,7 +38,7 @@ func parsePlatform(platformStr string) (*v1.Platform, error) {
} }
} }
func attestationManifestFromOCILayout(path string, platformStr string) (*AttestationManifest, error) { func attestationManifestFromOCILayout(path string, platform *v1.Platform) (*AttestationManifest, error) {
idx, err := layout.ImageIndexFromPath(path) idx, err := layout.ImageIndexFromPath(path)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to load image index: %w", err) return nil, fmt.Errorf("failed to load image index: %w", err)
@@ -61,10 +61,6 @@ func attestationManifestFromOCILayout(path string, platformStr string) (*Attesta
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to extract IndexManifest from ImageIndex: %w", err) return nil, fmt.Errorf("failed to extract IndexManifest from ImageIndex: %w", err)
} }
platform, err := parsePlatform(platformStr)
if err != nil {
return nil, fmt.Errorf("failed to parse platform: %w", err)
}
var imageDigest string var imageDigest string
for _, mf := range mfs2.Manifests { for _, mf := range mfs2.Manifests {
if mf.Platform.Equals(*platform) { if mf.Platform.Equals(*platform) {
@@ -104,17 +100,28 @@ func attestationManifestFromOCILayout(path string, platformStr string) (*Attesta
// implementation of AttestationResolver that closes over attestations from an oci layout // implementation of AttestationResolver that closes over attestations from an oci layout
type OCILayoutResolver struct { type OCILayoutResolver struct {
Path string path string
Platform string platform *v1.Platform
*AttestationManifest *AttestationManifest
} }
func (r *OCILayoutResolver) ImagePlatformStr() string { func NewOCILayoutAttestationResolver(path string, platform string) (*OCILayoutResolver, error) {
return r.Platform p, err := parsePlatform(platform)
if err != nil {
return nil, err
}
return &OCILayoutResolver{
path: path,
platform: p,
}, nil
}
func (r *OCILayoutResolver) ImagePlatform() (*v1.Platform, error) {
return r.platform, nil
} }
func (r *OCILayoutResolver) fetchAttestationManifest() (*AttestationManifest, error) { func (r *OCILayoutResolver) fetchAttestationManifest() (*AttestationManifest, error) {
if r.AttestationManifest == nil { if r.AttestationManifest == nil {
m, err := attestationManifestFromOCILayout(r.Path, r.Platform) m, err := attestationManifestFromOCILayout(r.path, r.platform)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to get attestation manifest: %w", err) return nil, fmt.Errorf("failed to get attestation manifest: %w", err)
} }
@@ -189,22 +196,33 @@ func (r *OCILayoutResolver) ImageDigest(ctx context.Context) (string, error) {
} }
type RegistryResolver struct { type RegistryResolver struct {
Image string image string
Platform string platform *v1.Platform
*AttestationManifest *AttestationManifest
} }
func (r *RegistryResolver) ImageName(ctx context.Context) (string, error) { func NewRegistryAttestationResolver(image string, platform string) (*RegistryResolver, error) {
return r.Image, nil p, err := parsePlatform(platform)
if err != nil {
return nil, err
}
return &RegistryResolver{
image: image,
platform: p,
}, nil
} }
func (r *RegistryResolver) ImagePlatformStr() string { func (r *RegistryResolver) ImageName(ctx context.Context) (string, error) {
return r.Platform return r.image, nil
}
func (r *RegistryResolver) ImagePlatform() (*v1.Platform, error) {
return r.platform, nil
} }
func (r *RegistryResolver) ImageDigest(ctx context.Context) (string, error) { func (r *RegistryResolver) ImageDigest(ctx context.Context) (string, error) {
if r.AttestationManifest == nil { if r.AttestationManifest == nil {
attest, err := FetchAttestationManifest(ctx, r.Image, r.Platform) attest, err := FetchAttestationManifest(ctx, r.image, r.platform)
if err != nil { if err != nil {
return "", fmt.Errorf("failed to get attestation manifest: %w", err) return "", fmt.Errorf("failed to get attestation manifest: %w", err)
} }
@@ -215,7 +233,7 @@ func (r *RegistryResolver) ImageDigest(ctx context.Context) (string, error) {
func (r *RegistryResolver) Attestations(ctx context.Context, predicateType string) ([]*att.Envelope, error) { func (r *RegistryResolver) Attestations(ctx context.Context, predicateType string) ([]*att.Envelope, error) {
if r.AttestationManifest == nil { if r.AttestationManifest == nil {
attest, err := FetchAttestationManifest(ctx, r.Image, r.Platform) attest, err := FetchAttestationManifest(ctx, r.image, r.platform)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to get attestation manifest: %w", err) return nil, fmt.Errorf("failed to get attestation manifest: %w", err)
} }
@@ -224,19 +242,13 @@ func (r *RegistryResolver) Attestations(ctx context.Context, predicateType strin
return ExtractEnvelopes(r.AttestationManifest, predicateType) return ExtractEnvelopes(r.AttestationManifest, predicateType)
} }
func FetchAttestationManifest(ctx context.Context, image, platformStr string) (*AttestationManifest, error) { func FetchAttestationManifest(ctx context.Context, image string, platform *v1.Platform) (*AttestationManifest, error) {
platform, err := parsePlatform(platformStr)
if err != nil {
return nil, fmt.Errorf("failed to parse platform %s: %w", platform, err)
}
// we want to get to the image index, so ignoring platform for now // we want to get to the image index, so ignoring platform for now
options := withOptions(ctx, nil) options := withOptions(ctx, nil)
ref, err := name.ParseReference(image) ref, err := name.ParseReference(image)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to parse reference: %w", err) return nil, fmt.Errorf("failed to parse reference: %w", err)
} }
desc, err := remote.Index(ref, options...) desc, err := remote.Index(ref, options...)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to obtain index manifest: %w", err) return nil, fmt.Errorf("failed to obtain index manifest: %w", err)
@@ -348,7 +360,7 @@ func attestationDigestForDigest(ix *v1.IndexManifest, imageDigest string, attest
return "", errors.New(fmt.Sprintf("no attestation found for image %s", imageDigest)) return "", errors.New(fmt.Sprintf("no attestation found for image %s", imageDigest))
} }
func RefToPURL(ref string, platform string) (string, bool, error) { func RefToPURL(ref string, platform *v1.Platform) (string, bool, error) {
var isCanonical bool var isCanonical bool
named, err := reference.ParseNormalizedNamed(ref) named, err := reference.ParseNormalizedNamed(ref)
if err != nil { if err != nil {
@@ -380,14 +392,10 @@ func RefToPURL(ref string, platform string) (string, bool, error) {
} }
name = parts[len(parts)-1] name = parts[len(parts)-1]
pf, err := parsePlatform(platform) if platform != nil {
if err != nil {
return "", false, fmt.Errorf("failed to parse platform %q: %w", platform, err)
}
if pf != nil {
qualifiers = append(qualifiers, packageurl.Qualifier{ qualifiers = append(qualifiers, packageurl.Qualifier{
Key: "platform", Key: "platform",
Value: pf.String(), Value: platform.String(),
}) })
} }

19
pkg/oci/oci_test.go
View File

@@ -6,45 +6,48 @@ import (
"github.com/google/go-containerregistry/pkg/v1/layout" "github.com/google/go-containerregistry/pkg/v1/layout"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
) )
func TestRefToPurl(t *testing.T) { func TestRefToPurl(t *testing.T) {
purl, canonical, err := RefToPURL("alpine", "arm64/linux") arm, err := parsePlatform("arm64/linux")
require.NoError(t, err)
purl, canonical, err := RefToPURL("alpine", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/alpine@latest?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/alpine@latest?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("alpine:123", "arm64/linux") purl, canonical, err = RefToPURL("alpine:123", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/alpine@123?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/alpine@123?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("google/alpine:123", "arm64/linux") purl, canonical, err = RefToPURL("google/alpine:123", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/google/alpine@123?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/google/alpine@123?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("library/alpine:123", "arm64/linux") purl, canonical, err = RefToPURL("library/alpine:123", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/alpine@123?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/alpine@123?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("docker.io/library/alpine:123", "arm64/linux") purl, canonical, err = RefToPURL("docker.io/library/alpine:123", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/alpine@123?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/alpine@123?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("localhost:5001/library/alpine:123", "arm64/linux") purl, canonical, err = RefToPURL("localhost:5001/library/alpine:123", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/localhost%3A5001/library/alpine@123?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/localhost%3A5001/library/alpine@123?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("localhost:5001/alpine:123", "arm64/linux") purl, canonical, err = RefToPURL("localhost:5001/alpine:123", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/localhost%3A5001/alpine@123?platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/localhost%3A5001/alpine@123?platform=arm64%2Flinux", purl)
assert.False(t, canonical) assert.False(t, canonical)
purl, canonical, err = RefToPURL("localhost:5001/alpine@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b", "arm64/linux") purl, canonical, err = RefToPURL("localhost:5001/alpine@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b", arm)
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, "pkg:docker/localhost%3A5001/alpine?digest=sha256%3Ac5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b&platform=arm64%2Flinux", purl) assert.Equal(t, "pkg:docker/localhost%3A5001/alpine?digest=sha256%3Ac5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b&platform=arm64%2Flinux", purl)
assert.True(t, canonical) assert.True(t, canonical)

6
pkg/oci/resolver.go
View File

@@ -20,7 +20,7 @@ type AttestationManifest struct {
type AttestationResolver interface { type AttestationResolver interface {
ImageName(ctx context.Context) (string, error) ImageName(ctx context.Context) (string, error)
ImagePlatformStr() string ImagePlatform() (*v1.Platform, error)
ImageDigest(ctx context.Context) (string, error) ImageDigest(ctx context.Context) (string, error)
Attestations(ctx context.Context, mediaType string) ([]*att.Envelope, error) Attestations(ctx context.Context, mediaType string) ([]*att.Envelope, error)
} }
@@ -41,6 +41,6 @@ func (r MockResolver) ImageDigest(ctx context.Context) (string, error) {
return "sha256:test-digest", nil return "sha256:test-digest", nil
} }
func (r MockResolver) ImagePlatformStr() string { func (r MockResolver) ImagePlatform() (*v1.Platform, error) {
return "linux/amd64" return parsePlatform("linux/amd64")
} }