111 lines
3.5 KiB
Go
111 lines
3.5 KiB
Go
package policy_test
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/docker/attest/internal/oci"
|
|
"github.com/docker/attest/internal/test"
|
|
"github.com/docker/attest/pkg/attestation"
|
|
"github.com/docker/attest/pkg/policy"
|
|
"github.com/docker/attest/pkg/tuf"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func loadAttestation(t *testing.T, path string) *attestation.Envelope {
|
|
ex, err := os.ReadFile(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
var env = new(attestation.Envelope)
|
|
err = json.Unmarshal(ex, env)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return env
|
|
}
|
|
|
|
func TestRegoEvaluator_Evaluate(t *testing.T) {
|
|
ctx, _ := test.Setup(t)
|
|
|
|
TestDataPath := filepath.Join("..", "..", "test", "testdata")
|
|
MockTufRepo := filepath.Join(TestDataPath, "local-policy")
|
|
ExampleAttestation := filepath.Join(TestDataPath, "example_attestation.json")
|
|
VSA := filepath.Join(TestDataPath, "vsa.json")
|
|
|
|
re := policy.NewRegoEvaluator(true)
|
|
|
|
defaultInput := &policy.PolicyInput{
|
|
Digest: "sha256:test-digest",
|
|
Purl: "test-purl",
|
|
IsCanonical: true,
|
|
}
|
|
|
|
defaultResolver := oci.MockResolver{
|
|
Envs: []*attestation.Envelope{loadAttestation(t, ExampleAttestation)},
|
|
}
|
|
|
|
vsaResolver := oci.MockResolver{
|
|
Envs: []*attestation.Envelope{loadAttestation(t, ExampleAttestation), loadAttestation(t, VSA)},
|
|
}
|
|
|
|
testCases := []struct {
|
|
repo string
|
|
expectSuccess bool
|
|
input *policy.PolicyInput
|
|
resolver oci.AttestationResolver
|
|
policy *policy.PolicyOptions
|
|
}{
|
|
{repo: "testdata/mock-tuf-allow", expectSuccess: true, input: defaultInput, resolver: defaultResolver},
|
|
{repo: "testdata/mock-tuf-deny", expectSuccess: false, input: defaultInput, resolver: defaultResolver},
|
|
{repo: "testdata/mock-tuf-verify-sig", expectSuccess: true, input: defaultInput, resolver: defaultResolver},
|
|
{repo: "testdata/mock-tuf-wrong-key", expectSuccess: false, input: defaultInput, resolver: defaultResolver},
|
|
{repo: MockTufRepo, expectSuccess: true, input: &policy.PolicyInput{
|
|
Digest: "sha256:da8b190665956ea07890a0273e2a9c96bfe291662f08e2860e868eef69c34620",
|
|
Purl: "pkg:docker/test-image@test?platform=linux%2Famd64",
|
|
IsCanonical: true,
|
|
}, resolver: vsaResolver},
|
|
{repo: MockTufRepo, expectSuccess: true, input: &policy.PolicyInput{
|
|
Digest: "sha256:da8b190665956ea07890a0273e2a9c96bfe291662f08e2860e868eef69c34620",
|
|
Purl: "pkg:docker/test-image@test?platform=linux%2Famd64",
|
|
IsCanonical: false,
|
|
}, resolver: vsaResolver},
|
|
// not a doi
|
|
{repo: MockTufRepo, expectSuccess: false, input: defaultInput, resolver: vsaResolver, policy: &policy.PolicyOptions{
|
|
LocalPolicyDir: "testdata/mock-tuf-deny",
|
|
}},
|
|
// digest mismatch
|
|
{repo: MockTufRepo, expectSuccess: false, input: &policy.PolicyInput{
|
|
Digest: "sha256:test-digest-wrong",
|
|
Purl: "test-purl",
|
|
IsCanonical: false,
|
|
}, resolver: vsaResolver},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.repo, func(t *testing.T) {
|
|
tufClient := tuf.NewMockTufClient(tc.repo, test.CreateTempDir(t, "", "tuf-dest"))
|
|
if tc.policy == nil {
|
|
tc.policy = &policy.PolicyOptions{
|
|
TufClient: tufClient,
|
|
LocalTargetsDir: test.CreateTempDir(t, "", "tuf-targets"),
|
|
}
|
|
}
|
|
|
|
policyFiles, err := policy.ResolvePolicy(ctx, tc.resolver, tc.policy)
|
|
assert.NoErrorf(t, err, "failed to resolve policy")
|
|
err = re.Evaluate(ctx, tc.resolver, policyFiles, tc.input)
|
|
|
|
if tc.expectSuccess {
|
|
assert.NoErrorf(t, err, "Evaluate failed")
|
|
} else {
|
|
assert.Errorf(t, err, "Evaluate should have failed")
|
|
}
|
|
})
|
|
}
|
|
|
|
}
|