docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: support arbitrary rego input parameters (#196)

Browse Source 
* feat: support arbitrary rego input parameters
This commit is contained in:
James Carnegie
2024-10-15 16:07:26 +01:00
committed by GitHub
parent 7027d2d054
commit da667de610
6 changed files with 116 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
verify_test.go
View File

@@ -27,6 +27,8 @@ import (
var (
ExampleAttestation = filepath.Join("test", "testdata", "example_attestation.json")
LocalKeysPolicy = filepath.Join("test", "testdata", "local-policy-real")
LocalParamPolicy = filepath.Join("test", "testdata", "local-policy-param")
ExpiresPolicy = filepath.Join("test", "testdata", "expires")
)
const (
@@ -60,7 +62,7 @@ func TestVerifyAttestations(t *testing.T) {
return policy.AllowedResult(), tc.policyEvaluationError
},
}
_, err := VerifyAttestations(ctx, resolver, &mockPE, &policy.Policy{ResolvedName: ""})
_, err := verifyAttestations(ctx, resolver, &mockPE, &policy.Policy{ResolvedName: ""}, &policy.Options{})
if tc.expectedError != nil {
if assert.Error(t, err) {
assert.Equal(t, tc.expectedError.Error(), err.Error())
@@ -204,16 +206,14 @@ func TestSignVerify(t *testing.T) {
keysYaml, err := yaml.Marshal(config)
require.NoError(t, err)
// write keysYaml to config.yaml in LocalKeysPolicy.
err = os.WriteFile(filepath.Join(LocalKeysPolicy, "config.yaml"), keysYaml, 0o600)
require.NoError(t, err)
testCases := []struct {
name string
signTL bool
policyDir string
imageName string
expectedNonSuccess Outcome
spitConfig bool
param string
}{
{name: "happy path", signTL: true, policyDir: PassNoTLPolicyDir},
{name: "sign tl, verify no tl", signTL: true, policyDir: PassPolicyDir},
@@ -221,7 +221,9 @@ func TestSignVerify(t *testing.T) {
{name: "mirror", signTL: false, policyDir: PassMirrorPolicyDir, imageName: "mirror.org/library/test-image:test"},
{name: "mirror no match", signTL: false, policyDir: PassMirrorPolicyDir, imageName: "incorrect.org/library/test-image:test", expectedNonSuccess: OutcomeNoPolicy},
{name: "verify inputs", signTL: false, policyDir: InputsPolicyDir},
{name: "mirror with verification", signTL: false, policyDir: LocalKeysPolicy, imageName: "mirror.org/library/test-image:test"},
{name: "mirror with verification", signTL: false, policyDir: LocalKeysPolicy, imageName: "mirror.org/library/test-image:test", spitConfig: true},
{name: "policy with input params", spitConfig: true, signTL: false, policyDir: LocalParamPolicy, param: "bar"},
{name: "policy without expected param", spitConfig: true, signTL: false, policyDir: LocalParamPolicy, param: "baz", expectedNonSuccess: OutcomeFailure},
}
attIdx, err := oci.IndexFromPath(test.UnsignedTestIndex())
@@ -232,6 +234,11 @@ func TestSignVerify(t *testing.T) {
if tc.signTL {
opts.TransparencyLog = tlog.GetMockTL()
}
if tc.spitConfig {
// write keysYaml to config.yaml in LocalKeysPolicy.
err = os.WriteFile(filepath.Join(tc.policyDir, "config.yaml"), keysYaml, 0o600)
require.NoError(t, err)
}
signedManifests, err := SignStatements(ctx, attIdx.Index, signer, opts)
require.NoError(t, err)
@@ -254,6 +261,17 @@ func TestSignVerify(t *testing.T) {
DisableTUF: true,
Debug: true,
}
if tc.signTL {
getTL := func(_ context.Context, _ *attestation.VerifyOptions) (tlog.TransparencyLog, error) {
return tlog.GetMockTL(), nil
}
verifier, err := attestation.NewVerfier(attestation.WithLogVerifierFactory(getTL))
require.NoError(t, err)
policyOpts.AttestationVerifier = verifier
}
if tc.param != "" {
policyOpts.Parameters = policy.Parameters{"foo": tc.param}
}
results, err := Verify(ctx, spec, policyOpts)
require.NoError(t, err)
if tc.expectedNonSuccess != "" {