Move policy mock for external use (#16)
This commit is contained in:
@@ -10,7 +10,6 @@ import (
|
|||||||
"testing"
|
"testing"
|
||||||
|
|
||||||
"github.com/docker/attest/pkg/attestation"
|
"github.com/docker/attest/pkg/attestation"
|
||||||
"github.com/docker/attest/pkg/oci"
|
|
||||||
"github.com/docker/attest/pkg/policy"
|
"github.com/docker/attest/pkg/policy"
|
||||||
"github.com/docker/attest/pkg/signerverifier"
|
"github.com/docker/attest/pkg/signerverifier"
|
||||||
"github.com/docker/attest/pkg/tlog"
|
"github.com/docker/attest/pkg/tlog"
|
||||||
@@ -18,7 +17,6 @@ import (
|
|||||||
"github.com/google/go-containerregistry/pkg/v1/layout"
|
"github.com/google/go-containerregistry/pkg/v1/layout"
|
||||||
"github.com/google/go-containerregistry/pkg/v1/partial"
|
"github.com/google/go-containerregistry/pkg/v1/partial"
|
||||||
intoto "github.com/in-toto/in-toto-golang/in_toto"
|
intoto "github.com/in-toto/in-toto-golang/in_toto"
|
||||||
"github.com/open-policy-agent/opa/rego"
|
|
||||||
"github.com/secure-systems-lab/go-securesystemslib/dsse"
|
"github.com/secure-systems-lab/go-securesystemslib/dsse"
|
||||||
)
|
)
|
||||||
|
|
||||||
@@ -59,7 +57,7 @@ func Setup(t *testing.T) (context.Context, dsse.SignerVerifier) {
|
|||||||
|
|
||||||
var policyEvaluator policy.PolicyEvaluator
|
var policyEvaluator policy.PolicyEvaluator
|
||||||
if USE_MOCK_POLICY {
|
if USE_MOCK_POLICY {
|
||||||
policyEvaluator = GetMockPolicy()
|
policyEvaluator = policy.GetMockPolicy()
|
||||||
} else {
|
} else {
|
||||||
policyEvaluator = policy.NewRegoEvaluator(true)
|
policyEvaluator = policy.NewRegoEvaluator(true)
|
||||||
}
|
}
|
||||||
@@ -87,38 +85,6 @@ func GetMockSigner(ctx context.Context) (dsse.SignerVerifier, error) {
|
|||||||
return signerverifier.GenKeyPair()
|
return signerverifier.GenKeyPair()
|
||||||
}
|
}
|
||||||
|
|
||||||
type MockPolicyEvaluator struct {
|
|
||||||
EvaluateFunc func(ctx context.Context, resolver oci.AttestationResolver, policy []*policy.PolicyFile, input *policy.PolicyInput) (*rego.ResultSet, error)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (pe *MockPolicyEvaluator) Evaluate(ctx context.Context, resolver oci.AttestationResolver, policy []*policy.PolicyFile, input *policy.PolicyInput) (*rego.ResultSet, error) {
|
|
||||||
if pe.EvaluateFunc != nil {
|
|
||||||
return pe.EvaluateFunc(ctx, resolver, policy, input)
|
|
||||||
}
|
|
||||||
return AllowedResult(), nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func GetMockPolicy() policy.PolicyEvaluator {
|
|
||||||
return &MockPolicyEvaluator{
|
|
||||||
EvaluateFunc: func(ctx context.Context, resolver oci.AttestationResolver, pfs []*policy.PolicyFile, input *policy.PolicyInput) (*rego.ResultSet, error) {
|
|
||||||
return AllowedResult(), nil
|
|
||||||
},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func AllowedResult() *rego.ResultSet {
|
|
||||||
return ®o.ResultSet{
|
|
||||||
{
|
|
||||||
Bindings: rego.Vars{},
|
|
||||||
Expressions: []*rego.ExpressionValue{
|
|
||||||
{
|
|
||||||
Value: true,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
type AnnotatedStatement struct {
|
type AnnotatedStatement struct {
|
||||||
OCIDescriptor *v1.Descriptor
|
OCIDescriptor *v1.Descriptor
|
||||||
InTotoStatement *intoto.Statement
|
InTotoStatement *intoto.Statement
|
||||||
|
|||||||
@@ -8,7 +8,6 @@ import (
|
|||||||
"path/filepath"
|
"path/filepath"
|
||||||
"testing"
|
"testing"
|
||||||
|
|
||||||
"github.com/docker/attest/internal/test"
|
|
||||||
"github.com/docker/attest/pkg/attestation"
|
"github.com/docker/attest/pkg/attestation"
|
||||||
"github.com/docker/attest/pkg/oci"
|
"github.com/docker/attest/pkg/oci"
|
||||||
"github.com/docker/attest/pkg/policy"
|
"github.com/docker/attest/pkg/policy"
|
||||||
@@ -43,9 +42,9 @@ func TestVerifyAttestations(t *testing.T) {
|
|||||||
for _, tc := range testCases {
|
for _, tc := range testCases {
|
||||||
t.Run(tc.name, func(t *testing.T) {
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
|
||||||
mockPE := test.MockPolicyEvaluator{
|
mockPE := policy.MockPolicyEvaluator{
|
||||||
EvaluateFunc: func(ctx context.Context, resolver oci.AttestationResolver, pfs []*policy.PolicyFile, input *policy.PolicyInput) (*rego.ResultSet, error) {
|
EvaluateFunc: func(ctx context.Context, resolver oci.AttestationResolver, pfs []*policy.PolicyFile, input *policy.PolicyInput) (*rego.ResultSet, error) {
|
||||||
return test.AllowedResult(), tc.policyEvaluationError
|
return policy.AllowedResult(), tc.policyEvaluationError
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
40
pkg/policy/mock.go
Normal file
40
pkg/policy/mock.go
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
package policy
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
|
||||||
|
"github.com/docker/attest/pkg/oci"
|
||||||
|
"github.com/open-policy-agent/opa/rego"
|
||||||
|
)
|
||||||
|
|
||||||
|
type MockPolicyEvaluator struct {
|
||||||
|
EvaluateFunc func(ctx context.Context, resolver oci.AttestationResolver, policy []*PolicyFile, input *PolicyInput) (*rego.ResultSet, error)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (pe *MockPolicyEvaluator) Evaluate(ctx context.Context, resolver oci.AttestationResolver, policy []*PolicyFile, input *PolicyInput) (*rego.ResultSet, error) {
|
||||||
|
if pe.EvaluateFunc != nil {
|
||||||
|
return pe.EvaluateFunc(ctx, resolver, policy, input)
|
||||||
|
}
|
||||||
|
return AllowedResult(), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func GetMockPolicy() PolicyEvaluator {
|
||||||
|
return &MockPolicyEvaluator{
|
||||||
|
EvaluateFunc: func(ctx context.Context, resolver oci.AttestationResolver, pfs []*PolicyFile, input *PolicyInput) (*rego.ResultSet, error) {
|
||||||
|
return AllowedResult(), nil
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func AllowedResult() *rego.ResultSet {
|
||||||
|
return ®o.ResultSet{
|
||||||
|
{
|
||||||
|
Bindings: rego.Vars{},
|
||||||
|
Expressions: []*rego.ExpressionValue{
|
||||||
|
{
|
||||||
|
Value: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user