github/kubescape
1
0
Fork 0
mirror of https://github.com/kubescape/kubescape.git synced 2026-02-14 18:09:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fetch Rekor before cosign validation

Browse Source 
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
This commit is contained in:
Matthias Bertschy
2024-01-15 14:33:39 +01:00
parent 5e41d7db1e
commit 6a6e4181bd
2 changed files with 60 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/pkg/opaprocessor/cosign_verify.go
View File

@@ -4,7 +4,6 @@ import (
"context"
"crypto"
"fmt"
"github.com/google/go-containerregistry/pkg/name"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
@@ -67,6 +66,11 @@ func verify(img string, key string) (bool, error) {
return false, fmt.Errorf("resolving attachment type %s for image %s: %w", attachment, img, err)
}
co.RekorPubKeys, err = cosign.GetRekorPubs(context.Background())
if err != nil {
return false, fmt.Errorf("getting Rekor public keys: %w", err)
}
_, _, err = cosign.VerifyImageSignatures(context.TODO(), ref, co)
if err != nil {
return false, fmt.Errorf("verifying signature: %w", err)

95
core/pkg/opaprocessor/cosign_verify_test.go
View File

@@ -1,42 +1,57 @@
package opaprocessor
// func Test_verify(t *testing.T) {
// type args struct {
// img string
// key string
// }
// tests := []struct {
// name string
// args args
// want bool
// wantErr assert.ErrorAssertionFunc
// }{
// {
// "valid signature",
// args{
// img: "hisu/cosign-tests:signed",
// key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGnMCUU0jGe6r4mPsPuyTXf61PE4e\nNwB/31SvUMmnoyd/1UxSqd+MRPXPU6pcub4k6E9G9SprVCuf6Sydcbyiqw==\n-----END PUBLIC KEY-----",
// },
// true,
// assert.NoError,
// },
// {
// "no signature",
// args{
// img: "hisu/cosign-tests:unsigned",
// key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGnMCUU0jGe6r4mPsPuyTXf61PE4e\nNwB/31SvUMmnoyd/1UxSqd+MRPXPU6pcub4k6E9G9SprVCuf6Sydcbyiqw==\n-----END PUBLIC KEY-----",
// },
// false,
// assert.Error,
// },
// }
// for _, tt := range tests {
// t.Run(tt.name, func(t *testing.T) {
// got, err := verify(tt.args.img, tt.args.key)
// if !tt.wantErr(t, err, fmt.Sprintf("verify(%v, %v)", tt.args.img, tt.args.key)) {
// return
// }
// assert.Equalf(t, tt.want, got, "verify(%v, %v)", tt.args.img, tt.args.key)
// })
// }
// }
import (
"fmt"
"github.com/stretchr/testify/assert"
"testing"
)
func Test_verify(t *testing.T) {
type args struct {
img string
key string
}
tests := []struct {
name string
args args
want bool
wantErr assert.ErrorAssertionFunc
}{
{
"valid signature",
args{
img: "quay.io/kubescape/kubescape:v3.0.3",
key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbgIMZrMTTlEFDLEeZXz+4R/908BG\nEeO70x6oMN7E4JQgzgbCB5rinqhK5t7dB61saVKQTb4P2NGtjPjXVbSTwQ==\n-----END PUBLIC KEY-----\n",
},
true,
assert.NoError,
},
{
"wrong signature",
args{
img: "quay.io/kubescape/kubescape:v2.9.2",
key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbgIMZrMTTlEFDLEeZXz+4R/908BG\nEeO70x6oMN7E4JQgzgbCB5rinqhK5t7dB61saVKQTb4P2NGtjPjXVbSTwQ==\n-----END PUBLIC KEY-----\n",
},
false,
assert.Error,
},
{
"no matching signature",
args{
img: "quay.io/kubescape/kubescape:v2.0.171",
key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbgIMZrMTTlEFDLEeZXz+4R/908BG\nEeO70x6oMN7E4JQgzgbCB5rinqhK5t7dB61saVKQTb4P2NGtjPjXVbSTwQ==\n-----END PUBLIC KEY-----\n",
},
false,
assert.Error,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := verify(tt.args.img, tt.args.key)
if !tt.wantErr(t, err, fmt.Sprintf("verify(%v, %v)", tt.args.img, tt.args.key)) {
return
}
assert.Equalf(t, tt.want, got, "verify(%v, %v)", tt.args.img, tt.args.key)
})
}
}