docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #85 from docker/refactor--use-embedded-root-types

Browse Source 
feat: add EmbeddedRoot type
This commit is contained in:
Joel Kamp
2024-07-11 03:36:06 -05:00
committed by GitHub
parent 0336a21a7d 0330ea4755
commit ac07eaf401
10 changed files with 53 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
internal/embed/root.go
View File

@@ -6,26 +6,39 @@ import (
) )
//go:embed embedded-roots/1.root-dev.json //go:embed embedded-roots/1.root-dev.json
var DevRoot []byte var devRoot []byte
//go:embed embedded-roots/1.root-staging.json //go:embed embedded-roots/1.root-staging.json
var StagingRoot []byte var stagingRoot []byte
//go:embed embedded-roots/1.root.json //go:embed embedded-roots/1.root.json
var ProdRoot []byte var prodRoot []byte
var DefaultRoot = ProdRoot var defaultRoot = prodRoot
func GetRootBytes(root string) ([]byte, error) { type RootName string
type EmbeddedRoot struct {
Data []byte
Name RootName
}
var (
RootDev = EmbeddedRoot{Data: devRoot, Name: "dev"}
RootStaging = EmbeddedRoot{Data: stagingRoot, Name: "staging"}
RootProd = EmbeddedRoot{Data: prodRoot, Name: "prod"}
RootDefault = EmbeddedRoot{Data: defaultRoot, Name: ""}
)
func GetRootFromName(root string) (*EmbeddedRoot, error) {
switch root { switch root {
case "dev": case string(RootDev.Name):
return DevRoot, nil return &RootDev, nil
case "staging": case string(RootStaging.Name):
return StagingRoot, nil return &RootStaging, nil
case "prod": case string(RootProd.Name):
return ProdRoot, nil return &RootProd, nil
case "": case string(RootDefault.Name):
return DefaultRoot, nil return &RootDefault, nil
default: default:
return nil, fmt.Errorf("invalid tuf root: %s", root) return nil, fmt.Errorf("invalid tuf root: %s", root)
} }

2
pkg/attest/example_verify_test.go
View File

@@ -21,7 +21,7 @@ func createTufClient(outputPath string) (*tuf.TufClient, error) {
// metadataURI := "https://docker.github.io/tuf-staging/metadata" // metadataURI := "https://docker.github.io/tuf-staging/metadata"
// targetsURI := "https://docker.github.io/tuf-staging/targets" // targetsURI := "https://docker.github.io/tuf-staging/targets"
return tuf.NewTufClient(embed.StagingRoot, outputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker()) return tuf.NewTufClient(embed.RootStaging.Data, outputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker())
} }
func ExampleVerify_remote() { func ExampleVerify_remote() {

2
pkg/mirror/example_mirror_test.go
View File

@@ -29,7 +29,7 @@ func ExampleNewTufMirror() {
// configure TUF mirror // configure TUF mirror
metadataURI := "https://docker.github.io/tuf-staging/metadata" metadataURI := "https://docker.github.io/tuf-staging/metadata"
targetsURI := "https://docker.github.io/tuf-staging/targets" targetsURI := "https://docker.github.io/tuf-staging/targets"
m, err := mirror.NewTufMirror(embed.StagingRoot, tufOutputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker()) m, err := mirror.NewTufMirror(embed.RootStaging.Data, tufOutputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker())
if err != nil { if err != nil {
panic(err) panic(err)
} }

6
pkg/mirror/metadata_test.go
View File

@@ -21,7 +21,7 @@ func TestGetTufMetadataMirror(t *testing.T) {
defer server.Close() defer server.Close()
path := test.CreateTempDir(t, "", "tuf_temp") path := test.CreateTempDir(t, "", "tuf_temp")
m, err := NewTufMirror(embed.DevRoot, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker()) m, err := NewTufMirror(embed.RootDev.Data, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker())
assert.NoError(t, err) assert.NoError(t, err)
tufMetadata, err := m.getTufMetadataMirror(server.URL + "/metadata") tufMetadata, err := m.getTufMetadataMirror(server.URL + "/metadata")
@@ -39,7 +39,7 @@ func TestGetMetadataManifest(t *testing.T) {
defer server.Close() defer server.Close()
path := test.CreateTempDir(t, "", "tuf_temp") path := test.CreateTempDir(t, "", "tuf_temp")
m, err := NewTufMirror(embed.DevRoot, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker()) m, err := NewTufMirror(embed.RootDev.Data, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker())
assert.NoError(t, err) assert.NoError(t, err)
img, err := m.GetMetadataManifest(server.URL + "/metadata") img, err := m.GetMetadataManifest(server.URL + "/metadata")
@@ -78,7 +78,7 @@ func TestGetDelegatedMetadataMirrors(t *testing.T) {
defer server.Close() defer server.Close()
path := test.CreateTempDir(t, "", "tuf_temp") path := test.CreateTempDir(t, "", "tuf_temp")
m, err := NewTufMirror(embed.DevRoot, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker()) m, err := NewTufMirror(embed.RootDev.Data, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker())
assert.NoError(t, err) assert.NoError(t, err)
delegations, err := m.GetDelegatedMetadataMirrors() delegations, err := m.GetDelegatedMetadataMirrors()

2
pkg/mirror/mirror.go
View File

@@ -16,7 +16,7 @@ import (
func NewTufMirror(root []byte, tufPath, metadataURL, targetsURL string, versionChecker tuf.VersionChecker) (*TufMirror, error) { func NewTufMirror(root []byte, tufPath, metadataURL, targetsURL string, versionChecker tuf.VersionChecker) (*TufMirror, error) {
if root == nil { if root == nil {
root = embed.DefaultRoot root = embed.RootDefault.Data
} }
tufClient, err := tuf.NewTufClient(root, tufPath, metadataURL, targetsURL, versionChecker) tufClient, err := tuf.NewTufClient(root, tufPath, metadataURL, targetsURL, versionChecker)
if err != nil { if err != nil {

6
pkg/mirror/targets_test.go
View File

@@ -27,7 +27,7 @@ func TestGetTufTargetsMirror(t *testing.T) {
defer server.Close() defer server.Close()
path := test.CreateTempDir(t, "", "tuf_temp") path := test.CreateTempDir(t, "", "tuf_temp")
m, err := NewTufMirror(embed.DevRoot, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker()) m, err := NewTufMirror(embed.RootDev.Data, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker())
assert.NoError(t, err) assert.NoError(t, err)
targets, err := m.GetTufTargetMirrors() targets, err := m.GetTufTargetMirrors()
@@ -61,7 +61,7 @@ func TestTargetDelegationMetadata(t *testing.T) {
defer server.Close() defer server.Close()
path := test.CreateTempDir(t, "", "tuf_temp") path := test.CreateTempDir(t, "", "tuf_temp")
tm, err := NewTufMirror(embed.DevRoot, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker()) tm, err := NewTufMirror(embed.RootDev.Data, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker())
assert.NoError(t, err) assert.NoError(t, err)
targets, err := tm.TufClient.LoadDelegatedTargets("test-role", "targets") targets, err := tm.TufClient.LoadDelegatedTargets("test-role", "targets")
@@ -74,7 +74,7 @@ func TestGetDelegatedTargetMirrors(t *testing.T) {
defer server.Close() defer server.Close()
path := test.CreateTempDir(t, "", "tuf_temp") path := test.CreateTempDir(t, "", "tuf_temp")
m, err := NewTufMirror(embed.DevRoot, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker()) m, err := NewTufMirror(embed.RootDev.Data, path, server.URL+"/metadata", server.URL+"/targets", tuf.NewMockVersionChecker())
assert.NoError(t, err) assert.NoError(t, err)
mirrors, err := m.GetDelegatedTargetMirrors() mirrors, err := m.GetDelegatedTargetMirrors()

2
pkg/tuf/example_registry_test.go
View File

@@ -21,7 +21,7 @@ func ExampleNewTufClient_registry() {
metadataURI := "registry-1.docker.io/docker/tuf-metadata:latest" metadataURI := "registry-1.docker.io/docker/tuf-metadata:latest"
targetsURI := "registry-1.docker.io/docker/tuf-targets" targetsURI := "registry-1.docker.io/docker/tuf-targets"
registryClient, err := tuf.NewTufClient(embed.StagingRoot, tufOutputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker()) registryClient, err := tuf.NewTufClient(embed.RootStaging.Data, tufOutputPath, metadataURI, targetsURI, tuf.NewMockVersionChecker())
if err != nil { if err != nil {
panic(err) panic(err)
} }

2
pkg/tuf/registry_test.go
View File

@@ -52,7 +52,7 @@ func TestRegistryFetcher(t *testing.T) {
delegatedDir := CreateTempDir(t, dir, delegatedRole) delegatedDir := CreateTempDir(t, dir, delegatedRole)
delegatedTargetFile := fmt.Sprintf("%s/%s", delegatedRole, targetFile) delegatedTargetFile := fmt.Sprintf("%s/%s", delegatedRole, targetFile)
cfg, err := config.New(metadataRepo, embed.DevRoot) cfg, err := config.New(metadataRepo, embed.RootDev.Data)
assert.NoError(t, err) assert.NoError(t, err)
cfg.Fetcher = NewRegistryFetcher(metadataRepo, metadataImgTag, targetsRepo) cfg.Fetcher = NewRegistryFetcher(metadataRepo, metadataImgTag, targetsRepo)

6
pkg/tuf/tuf.go
View File

@@ -229,7 +229,7 @@ func ensureTrailingSlash(url string) string {
return url + "/" return url + "/"
} }
// GetEmbeddedTufRootBytes returns the embedded TUF root based on the given root name // GetEmbeddedTufRoot returns the embedded TUF root based on the given root name
func GetEmbeddedTufRootBytes(root string) ([]byte, error) { func GetEmbeddedTufRoot(root string) (*embed.EmbeddedRoot, error) {
return embed.GetRootBytes(root) return embed.GetRootFromName(root)
} }

26
pkg/tuf/tuf_test.go
View File

@@ -65,17 +65,17 @@ func TestRootInit(t *testing.T) {
} }
for _, tc := range testCases { for _, tc := range testCases {
_, err := NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker) _, err := NewTufClient(embed.RootDev.Data, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
assert.NoErrorf(t, err, "Failed to create TUF client: %v", err) assert.NoErrorf(t, err, "Failed to create TUF client: %v", err)
// recreation should work with same root // recreation should work with same root
_, err = NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker) _, err = NewTufClient(embed.RootDev.Data, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
assert.NoErrorf(t, err, "Failed to recreate TUF client: %v", err) assert.NoErrorf(t, err, "Failed to recreate TUF client: %v", err)
_, err = NewTufClient([]byte("broken"), tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker) _, err = NewTufClient([]byte("broken"), tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
assert.Errorf(t, err, "Expected error recreating TUF client with broken root: %v", err) assert.Errorf(t, err, "Expected error recreating TUF client with broken root: %v", err)
_, err = NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysBadVersionChecker) _, err = NewTufClient(embed.RootDev.Data, tufPath, tc.metadataSource, tc.targetsSource, alwaysBadVersionChecker)
assert.Errorf(t, err, "Expected error creating TUF client with bad attest version: %v", err) assert.Errorf(t, err, "Expected error creating TUF client with bad attest version: %v", err)
} }
} }
@@ -111,7 +111,7 @@ func TestDownloadTarget(t *testing.T) {
} }
for _, tc := range testCases { for _, tc := range testCases {
tufClient, err := NewTufClient(embed.DevRoot, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker) tufClient, err := NewTufClient(embed.RootDev.Data, tufPath, tc.metadataSource, tc.targetsSource, alwaysGoodVersionChecker)
assert.NoErrorf(t, err, "Failed to create TUF client: %v", err) assert.NoErrorf(t, err, "Failed to create TUF client: %v", err)
// get trusted tuf metadata // get trusted tuf metadata
@@ -135,22 +135,22 @@ func TestDownloadTarget(t *testing.T) {
} }
func TestGetEmbeddedTufRootBytes(t *testing.T) { func TestGetEmbeddedTufRootBytes(t *testing.T) {
dev, err := GetEmbeddedTufRootBytes("dev") dev, err := GetEmbeddedTufRoot("dev")
assert.NoError(t, err) assert.NoError(t, err)
staging, err := GetEmbeddedTufRootBytes("staging") staging, err := GetEmbeddedTufRoot("staging")
assert.NoError(t, err) assert.NoError(t, err)
assert.NotEqual(t, dev, staging) assert.NotEqual(t, dev.Data, staging.Data)
prod, err := GetEmbeddedTufRootBytes("prod") prod, err := GetEmbeddedTufRoot("prod")
assert.NoError(t, err) assert.NoError(t, err)
assert.NotEqual(t, dev, prod) assert.NotEqual(t, dev.Data, prod.Data)
assert.NotEqual(t, staging, prod) assert.NotEqual(t, staging.Data, prod.Data)
def, err := GetEmbeddedTufRootBytes("") def, err := GetEmbeddedTufRoot("")
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, def, prod) assert.Equal(t, def.Data, prod.Data)
_, err = GetEmbeddedTufRootBytes("invalid") _, err = GetEmbeddedTufRoot("invalid")
assert.Error(t, err) assert.Error(t, err)
} }