docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update examples in README.md

Browse Source
This commit is contained in:
Joel Kamp
2024-05-02 13:42:35 -05:00
committed by mrjoelkamp
parent 3701942bf1 0cadeefe6f
commit c99f90cbbf
18 changed files with 100 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/attest/example_sign.go → pkg/attest/example_sign_test.go
View File

@@ -1,8 +1,9 @@
package attest
package attest_test
import (
"context"
"github.com/docker/attest/pkg/attest"
"github.com/docker/attest/pkg/attestation"
"github.com/docker/attest/pkg/mirror"
"github.com/docker/attest/pkg/oci"
@@ -25,7 +26,7 @@ func ExampleSign_remote() {
// signer, err := signerverifier.GetAWSSigner(cmd.Context(), aws_arn, aws_region)
// configure signing options
opts := &SigningOptions{
opts := &attest.SigningOptions{
Replace: true, // replace unsigned intoto statements with signed intoto attestations, otherwise leave in place
}
@@ -50,7 +51,7 @@ func ExampleSign_remote() {
// att, err := oci.AttestationIndexFromLocal(path)
// sign attestations
signedImageIndex, err := Sign(context.Background(), att.Index, signer, opts)
signedImageIndex, err := attest.Sign(context.Background(), att.Index, signer, opts)
if err != nil {
panic(err)
}

7
pkg/attest/example_verify.go → pkg/attest/example_verify_test.go
View File

@@ -1,4 +1,4 @@
package attest
package attest_test
import (
"context"
@@ -6,6 +6,7 @@ import (
"path/filepath"
"github.com/docker/attest/internal/embed"
"github.com/docker/attest/pkg/attest"
"github.com/docker/attest/pkg/oci"
"github.com/docker/attest/pkg/policy"
"github.com/docker/attest/pkg/tuf"
@@ -19,7 +20,7 @@ func createTufClient(outputPath string) (*tuf.TufClient, error) {
// metadataURI := "https://docker.github.io/tuf-staging/metadata"
// targetsURI := "https://docker.github.io/tuf-staging/targets"
return tuf.NewTufClient(embed.DefaultRoot, outputPath, metadataURI, targetsURI)
return tuf.NewTufClient(embed.StagingRoot, outputPath, metadataURI, targetsURI)
}
func ExampleVerify_remote() {
@@ -57,7 +58,7 @@ func ExampleVerify_remote() {
}
// verify attestations
policy, err := Verify(context.Background(), opts, resolver)
policy, err := attest.Verify(context.Background(), opts, resolver)
if err != nil {
panic(err) // failed policy or attestation signature verification
}

5
pkg/attest/verify.go
View File

@@ -31,10 +31,13 @@ func VerifyAttestations(ctx context.Context, resolver oci.AttestationResolver, f
if err != nil {
return err
}
err = evaluator.Evaluate(ctx, resolver, files, input)
rs, err := evaluator.Evaluate(ctx, resolver, files, input)
if err != nil {
return fmt.Errorf("policy evaluation failed: %w", err)
}
if !rs.Allowed() {
return fmt.Errorf("policy evaluation failed: %s", fmt.Sprint(rs))
}
return nil
}

8
pkg/attest/verify_test.go
View File

@@ -8,10 +8,10 @@ import (
"path/filepath"
"testing"
"github.com/docker/attest/internal/test"
"github.com/docker/attest/pkg/attestation"
"github.com/docker/attest/pkg/oci"
"github.com/docker/attest/pkg/policy"
"github.com/open-policy-agent/opa/rego"
"github.com/stretchr/testify/assert"
)
@@ -42,9 +42,9 @@ func TestVerifyAttestations(t *testing.T) {
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
mockPE := test.MockPolicyEvaluator{
EvaluateFunc: func(ctx context.Context, resolver oci.AttestationResolver, pfs []*policy.PolicyFile, input *policy.PolicyInput) error {
return tc.policyEvaluationError
mockPE := policy.MockPolicyEvaluator{
EvaluateFunc: func(ctx context.Context, resolver oci.AttestationResolver, pfs []*policy.PolicyFile, input *policy.PolicyInput) (*rego.ResultSet, error) {
return policy.AllowedResult(), tc.policyEvaluationError
},
}