github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-19 03:26:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: add builder id tests for short form (#455)

Browse Source 
Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
This commit is contained in:
asraa
2023-01-26 09:35:22 -06:00
committed by GitHub
parent bcd23c945e
commit 2444233891
1 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/slsa-verifier/main_regression_test.go
+22 -13
View File
@@ -584,7 +584,7 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
// before GA. Add the tests for tag verification.
if version != "" && semver.Compare(version, "v1.0.0") > 0 {
builderIDs = append(builderIDs, []*string{
// pString(builder + "@" + sv),
pString(builder + "@" + sv),
pString(builder + "@refs/tags/" + sv),
}...)
}
@@ -605,6 +605,8 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
BuildWorkflowInputs: tt.inputs,
}
// The outBuilderID is the actual builder ID from the provenance.
// This is always long form for the GHA builders.
outBuilderID, err := cmd.Exec(context.Background(), artifacts)
if !errCmp(err, tt.err) {
t.Errorf("%v: %v", v, cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
@@ -621,15 +623,6 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
}
}
if bid == nil {
continue
}
// Validate against builderID we generated automatically.
if err := outBuilderID.Matches(*bid, false); err != nil {
t.Errorf(fmt.Sprintf("matches failed (2): %v", err))
}
// Smoke test against the CLI command
cliCmd := verifyArtifactCmd()
args := []string{
@@ -661,6 +654,18 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
if !errCmp(cliErr, tt.err) {
t.Errorf("%v: %v", v, cmp.Diff(cliErr, tt.err, cmpopts.EquateErrors()))
}
if bid == nil {
continue
}
// If we have a generated a user-provided bid, then validate it against the
// resulting builderID returned by the provenance check.
// Since this a GHA and the certificate ID is in long form,
// we pass `allowRef = true`.
if err := outBuilderID.Matches(*bid, true); err != nil {
t.Errorf(fmt.Sprintf("matches failed (2): %v", err))
}
}
}
})
@@ -810,7 +815,7 @@ func Test_runVerifyGHAArtifactImage(t *testing.T) {
// 3. With only the name of the builder.
// 4. With no builder ID.
builderIDs := []*string{
// pString(builder + "@" + sv),
pString(builder + "@" + sv),
pString(builder + "@refs/tags/" + sv),
pString(builder),
nil,
@@ -850,8 +855,12 @@ func Test_runVerifyGHAArtifactImage(t *testing.T) {
if bid == nil {
return
}
// Validate against builderID we generated automatically.
if err := outBuilderID.Matches(*bid, false); err != nil {
// If we have a generated a user-provided bid, then validate it against the
// resulting builderID returned by the provenance check.
// Since this a GHA and the certificate ID is in long form,
// we pass `allowRef = true`.
if err := outBuilderID.Matches(*bid, true); err != nil {
t.Errorf(fmt.Sprintf("matches failed: %v", err))
}
}