github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-19 03:26:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: add docker based spport and start adding tests (#486)

Browse Source 
Signed-off-by: Asra Ali <asraa@google.com>
This commit is contained in:
asraa
2023-02-15 20:46:11 +00:00
committed by GitHub
parent a2388a3c49
commit d8c2961d82
6 changed files with 170 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/slsa-verifier/main_regression_test.go
+151 -3
View File
@@ -8,6 +8,7 @@ import (
"errors"
"fmt"
"io/ioutil"
"os"
"path"
"path/filepath"
"strings"
@@ -38,9 +39,12 @@ func pString(s string) *string {
const TEST_DIR = "./testdata"
var (
GHA_ARTIFACT_PATH_BUILDERS = []string{"gha_go", "gha_generic"}
GHA_ARTIFACT_IMAGE_BUILDERS = []string{"gha_generic_container"}
GCB_ARTIFACT_IMAGE_BUILDERS = []string{"gcb_container"}
GHA_ARTIFACT_PATH_BUILDERS = []string{"gha_go", "gha_generic"}
// TODO(https://github.com/slsa-framework/slsa-verifier/issues/485): Merge this with
// GHA_ARTIFACT_PATH_BUILDERS.
GHA_ARTIFACT_DOCKER_BUILDERS = []string{"gha_docker-based"}
GHA_ARTIFACT_IMAGE_BUILDERS = []string{"gha_generic_container"}
GCB_ARTIFACT_IMAGE_BUILDERS = []string{"gcb_container"}
)
func getBuildersAndVersions(t *testing.T,
@@ -1231,3 +1235,147 @@ func Test_runVerifyGCBArtifactImage(t *testing.T) {
})
}
}
// TODO(https://github.com/slsa-framework/slsa-verifier/issues/485): Version the test-cases
// when a version for the builder is released.
func Test_runVerifyGHADockerBased(t *testing.T) {
// We cannot use t.Setenv due to parallelized tests.
os.Setenv("SLSA_VERIFIER_EXPERIMENTAL", "1")
t.Parallel()
builder := "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"
tests := []struct {
name string
artifacts []string
source string
pbranch *string
ptag *string
pversiontag *string
pBuilderID *string
inputs map[string]string
err error
}{
{
name: "valid main branch default",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
},
{
name: "valid main branch default - invalid builderID",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/not-trusted.yml"),
err: serrors.ErrorUntrustedReusableWorkflow,
},
{
name: "valid main branch set",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
pbranch: pString("main"),
},
{
name: "wrong branch master",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-package",
pbranch: pString("master"),
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
err: serrors.ErrorMismatchBranch,
},
{
name: "wrong source append A",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-packageA",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
err: serrors.ErrorMismatchSource,
},
{
name: "wrong source prepend A",
artifacts: []string{"workflow_dispatch.main.default"},
source: "Agithub.com/slsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
err: serrors.ErrorMismatchSource,
},
{
name: "wrong source middle A",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/Aslsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
err: serrors.ErrorMismatchSource,
},
{
name: "tag no match empty tag workflow_dispatch",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
ptag: pString("v1.2.3"),
err: serrors.ErrorMismatchTag,
},
{
name: "versioned tag no match empty tag workflow_dispatch",
artifacts: []string{"workflow_dispatch.main.default"},
source: "github.com/slsa-framework/example-package",
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
pversiontag: pString("v1"),
err: serrors.ErrorInvalidSemver,
},
}
for _, tt := range tests {
tt := tt // Re-initializing variable so it is not changed while executing the closure below
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
checkVersions := getBuildersAndVersions(t, "", nil, GHA_ARTIFACT_DOCKER_BUILDERS)
for _, v := range checkVersions {
testPath := filepath.Clean(filepath.Join(TEST_DIR, v, tt.artifacts[0]))
provenancePath := fmt.Sprintf("%s.intoto.sigstore", testPath)
artifacts := make([]string, len(tt.artifacts))
for i, artifact := range tt.artifacts {
artifacts[i] = filepath.Clean(filepath.Join(TEST_DIR, v, artifact))
}
// For each test, we run 2 sub-tests:
// 1. With the the full builderID including the semver in short form.
// 2. With the the full builderID including the semver in long form.
// 3. With only the name of the builder.
// 4. With no builder ID.
sv := path.Base(v)
builderIDs := []*string{
pString(builder + "@" + sv),
pString(builder + "@refs/tags/" + sv),
pString(builder),
nil,
}
// If builder ID is set, use it.
if tt.pBuilderID != nil {
builderIDs = []*string{tt.pBuilderID}
}
for _, bid := range builderIDs {
cmd := verify.VerifyArtifactCommand{
ProvenancePath: provenancePath,
SourceURI: tt.source,
SourceBranch: tt.pbranch,
BuilderID: bid,
SourceTag: tt.ptag,
SourceVersionTag: tt.pversiontag,
BuildWorkflowInputs: tt.inputs,
}
// The outBuilderID is the actual builder ID from the provenance.
// This is always long form for the GHA builders.
_, err := cmd.Exec(context.Background(), artifacts)
if !errCmp(err, tt.err) {
t.Errorf("%v: %v", v, cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
}
}
}
})
}
}
cli/slsa-verifier/testdata/gha_docker-based/main/workflow_dispatch.main.default
Vendored
+4
View File
@@ -0,0 +1,4 @@
# Simple command for generating a file.
command = ["cp", ".github/configs-docker/config.toml", "config.toml"]
# Path to the file generated by the command above.
artifact_path = "config.toml"
cli/slsa-verifier/testdata/gha_docker-based/main/workflow_dispatch.main.default.intoto.sigstore
Vendored
+1
View File
File diff suppressed because one or more lines are too long
verifiers/internal/gha/builder.go
+3 -2
View File
@@ -23,8 +23,9 @@ var (
)
var defaultArtifactTrustedReusableWorkflows = map[string]bool{
trustedBuilderRepository + "/.github/workflows/generator_generic_slsa3.yml": true,
trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml": true,
trustedBuilderRepository + "/.github/workflows/generator_generic_slsa3.yml": true,
trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml": true,
trustedBuilderRepository + "/.github/workflows/builder_docker-based_slsa3.yml": true,
}
var defaultContainerTrustedReusableWorkflows = map[string]bool{
verifiers/internal/gha/provenance.go
+4 -4
View File
@@ -85,7 +85,7 @@ func verifySourceURI(prov slsaprovenance.Provenance, expectedSourceURI string) e
if err != nil {
return err
}
configURI, err := sourceFromURI(fullConfigURI, false)
configURI, err := sourceFromURI(fullConfigURI)
if err != nil {
return err
}
@@ -99,7 +99,7 @@ func verifySourceURI(prov slsaprovenance.Provenance, expectedSourceURI string) e
if err != nil {
return err
}
materialURI, err := sourceFromURI(materialSourceURI, false)
materialURI, err := sourceFromURI(materialSourceURI)
if err != nil {
return err
}
@@ -119,13 +119,13 @@ func verifySourceURI(prov slsaprovenance.Provenance, expectedSourceURI string) e
return nil
}
func sourceFromURI(uri string, allowNotTag bool) (string, error) {
func sourceFromURI(uri string) (string, error) {
if uri == "" {
return "", fmt.Errorf("%w: empty uri", serrors.ErrorMalformedURI)
}
r := strings.SplitN(uri, "@", 2)
if len(r) < 2 && !allowNotTag {
if len(r) < 2 {
return "", fmt.Errorf("%w: %s", serrors.ErrorMalformedURI,
uri)
}
verifiers/internal/gha/slsaprovenance/v1.0/provenance.go
+7 -2
View File
@@ -1,6 +1,7 @@
package v1
import (
"encoding/json"
"fmt"
intoto "github.com/in-toto/in-toto-golang/in_toto"
@@ -44,8 +45,12 @@ func (prov *ProvenanceV1) SourceURI() (string, error) {
if !ok {
return "", fmt.Errorf("%w: %s", serrors.ErrorInvalidDssePayload, "external parameters source")
}
sourceRef, ok := source.(slsa1.ArtifactReference)
if !ok {
sourceBytes, err := json.Marshal(source)
if err != nil {
return "", fmt.Errorf("%w: %s", serrors.ErrorInvalidDssePayload, err)
}
var sourceRef slsa1.ArtifactReference
if err := json.Unmarshal(sourceBytes, &sourceRef); err != nil {
return "", fmt.Errorf("%w: %s", serrors.ErrorInvalidDssePayload, "external parameters source type")
}
return sourceRef.URI, nil