Skip to content

Commit e7c6cfb

Browse files
hectorj2fhectorj2f
authored
Merge pull request #1 from hectorj2f/v0.6.3-improv_auth_validation
change validation to avoid only setting rfc3161timestamp
2 parents 9d1900d + b912dbe commit e7c6cfb

7 files changed

+44
-21
lines changed

‎pkg/apis/policy/v1alpha1/clusterimagepolicy_validation.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -87,17 +87,16 @@ func (image *ImagePattern) Validate(ctx context.Context) *apis.FieldError {
8787

8888
func (authority *Authority) Validate(ctx context.Context) *apis.FieldError {
8989
var errs *apis.FieldError
90-
if authority.Key == nil && authority.Keyless == nil && authority.RFC3161Timestamp == nil && authority.Static == nil {
91-
errs = errs.Also(apis.ErrMissingOneOf("key", "keyless", "rfc3161timestamp", "static"))
90+
if authority.Key == nil && authority.Keyless == nil && authority.Static == nil {
91+
errs = errs.Also(apis.ErrMissingOneOf("key", "keyless", "static"))
9292
// Instead of returning all the missing subfields, just return here
9393
// to give a more concise and arguably a more meaningful error message.
9494
return errs
9595
}
9696
if (authority.Key != nil && authority.Keyless != nil) ||
97-
(authority.RFC3161Timestamp != nil && authority.Static != nil) ||
9897
(authority.Key != nil && authority.Static != nil) ||
9998
(authority.Keyless != nil && authority.Static != nil) {
100-
errs = errs.Also(apis.ErrMultipleOneOf("key", "keyless", "rfc3161timestamp", "static"))
99+
errs = errs.Also(apis.ErrMultipleOneOf("key", "keyless", "static"))
101100
// Instead of returning all the missing subfields, just return here
102101
// to give a more concise and arguably a more meaningful error message.
103102
return errs

‎pkg/apis/policy/v1alpha1/clusterimagepolicy_validation_test.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -534,7 +534,7 @@ func TestAuthoritiesValidation(t *testing.T) {
534534
policy ClusterImagePolicy
535535
}{{
536536
name: "Should fail when authority is empty",
537-
errorString: "expected exactly one, got neither: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
537+
errorString: "expected exactly one, got neither: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
538538
policy: ClusterImagePolicy{
539539
Spec: ClusterImagePolicySpec{
540540
Images: []ImagePattern{
@@ -549,7 +549,7 @@ func TestAuthoritiesValidation(t *testing.T) {
549549
},
550550
}, {
551551
name: "Should fail when key/keyless specified",
552-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
552+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
553553
policy: ClusterImagePolicy{
554554
Spec: ClusterImagePolicySpec{
555555
Images: []ImagePattern{
@@ -567,7 +567,7 @@ func TestAuthoritiesValidation(t *testing.T) {
567567
},
568568
}, {
569569
name: "Should fail when key/static specified",
570-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
570+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
571571
policy: ClusterImagePolicy{
572572
Spec: ClusterImagePolicySpec{
573573
Images: []ImagePattern{
@@ -585,7 +585,7 @@ func TestAuthoritiesValidation(t *testing.T) {
585585
},
586586
}, {
587587
name: "Should fail when keyless/static specified",
588-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
588+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
589589
policy: ClusterImagePolicy{
590590
Spec: ClusterImagePolicySpec{
591591
Images: []ImagePattern{
@@ -603,7 +603,7 @@ func TestAuthoritiesValidation(t *testing.T) {
603603
},
604604
}, {
605605
name: "Should fail when key/keyless/static specified",
606-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
606+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
607607
policy: ClusterImagePolicy{
608608
Spec: ClusterImagePolicySpec{
609609
Images: []ImagePattern{

‎pkg/apis/policy/v1beta1/clusterimagepolicy_validation.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -100,17 +100,16 @@ func (matchResource *MatchResource) Validate(ctx context.Context) *apis.FieldErr
100100

101101
func (authority *Authority) Validate(ctx context.Context) *apis.FieldError {
102102
var errs *apis.FieldError
103-
if authority.Key == nil && authority.Keyless == nil && authority.RFC3161Timestamp == nil && authority.Static == nil {
104-
errs = errs.Also(apis.ErrMissingOneOf("key", "keyless", "rfc3161timestamp", "static"))
103+
if authority.Key == nil && authority.Keyless == nil && authority.Static == nil {
104+
errs = errs.Also(apis.ErrMissingOneOf("key", "keyless", "static"))
105105
// Instead of returning all the missing subfields, just return here
106106
// to give a more concise and arguably a more meaningful error message.
107107
return errs
108108
}
109109
if (authority.Key != nil && authority.Keyless != nil) ||
110110
(authority.Key != nil && authority.Static != nil) ||
111-
(authority.RFC3161Timestamp != nil && authority.Static != nil) ||
112111
(authority.Keyless != nil && authority.Static != nil) {
113-
errs = errs.Also(apis.ErrMultipleOneOf("key", "keyless", "rfc3161timestamp", "static"))
112+
errs = errs.Also(apis.ErrMultipleOneOf("key", "keyless", "static"))
114113
// Instead of returning all the missing subfields, just return here
115114
// to give a more concise and arguably a more meaningful error message.
116115
return errs

‎pkg/apis/policy/v1beta1/clusterimagepolicy_validation_test.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -582,7 +582,7 @@ func TestAuthoritiesValidation(t *testing.T) {
582582
policy ClusterImagePolicy
583583
}{{
584584
name: "Should fail when authority is empty",
585-
errorString: "expected exactly one, got neither: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
585+
errorString: "expected exactly one, got neither: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
586586
policy: ClusterImagePolicy{
587587
Spec: ClusterImagePolicySpec{
588588
Images: []ImagePattern{
@@ -597,7 +597,7 @@ func TestAuthoritiesValidation(t *testing.T) {
597597
},
598598
}, {
599599
name: "Should fail when key/keyless specified",
600-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
600+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
601601
policy: ClusterImagePolicy{
602602
Spec: ClusterImagePolicySpec{
603603
Images: []ImagePattern{
@@ -615,7 +615,7 @@ func TestAuthoritiesValidation(t *testing.T) {
615615
},
616616
}, {
617617
name: "Should fail when key/static specified",
618-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
618+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
619619
policy: ClusterImagePolicy{
620620
Spec: ClusterImagePolicySpec{
621621
Images: []ImagePattern{
@@ -633,7 +633,7 @@ func TestAuthoritiesValidation(t *testing.T) {
633633
},
634634
}, {
635635
name: "Should fail when keyless/static specified",
636-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
636+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
637637
policy: ClusterImagePolicy{
638638
Spec: ClusterImagePolicySpec{
639639
Images: []ImagePattern{
@@ -651,7 +651,7 @@ func TestAuthoritiesValidation(t *testing.T) {
651651
},
652652
}, {
653653
name: "Should fail when key/keyless/static specified",
654-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
654+
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static",
655655
policy: ClusterImagePolicy{
656656
Spec: ClusterImagePolicySpec{
657657
Images: []ImagePattern{
@@ -711,7 +711,7 @@ func TestAuthoritiesValidation(t *testing.T) {
711711
},
712712
}, {
713713
name: "Should fail when static and sources,attestations, and rfc3161timestamp is specified",
714-
errorString: "expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static",
714+
errorString: "expected exactly one, got both: spec.authorities[0].attestations, spec.authorities[0].rfc3161timestamp, spec.authorities[0].source, spec.authorities[0].static",
715715
policy: ClusterImagePolicy{
716716
Spec: ClusterImagePolicySpec{
717717
Images: []ImagePattern{

‎test/testdata/policy-controller/invalid/invalid-authority.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Copyright 2022 The Sigstore Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http:#www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
---
15+
# ERROR: expected exactly one, got neither: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static
16+
apiVersion: policy.sigstore.dev/v1beta1
17+
kind: ClusterImagePolicy
18+
metadata:
19+
name: invalid-authority
20+
spec:
21+
images:
22+
- glob: image*
23+
authorities:
24+
- rfc3161timestamp:
25+
trustRootRef: my-sigstore-keys

‎test/testdata/policy-controller/invalid/v1beta1-valid-keyref-and-keylessref.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414
---
15-
# ERROR:expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static
15+
# ERROR:expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static
1616
apiVersion: policy.sigstore.dev/v1beta1
1717
kind: ClusterImagePolicy
1818
metadata:

‎test/testdata/policy-controller/invalid/valid-keyref-and-keylessref.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414
---
15-
# ERROR:expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].rfc3161timestamp, spec.authorities[0].static
15+
# ERROR:expected exactly one, got both: spec.authorities[0].key, spec.authorities[0].keyless, spec.authorities[0].static
1616
apiVersion: policy.sigstore.dev/v1alpha1
1717
kind: ClusterImagePolicy
1818
metadata:

0 commit comments

Comments
 (0)