Skip to content

Commit 1454a28

Browse files
zregvartzregvart
authored
Merge pull request #2150 from zregvart/issue/EC-963 
2 parents 226cbad + 087f465 commit 1454a28

19 files changed

+252
-167
lines changed

‎cmd/fetch/fetch_policy.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323
"github.com/spf13/afero"
2424
"github.com/spf13/cobra"
2525

26+
"github.com/enterprise-contract/ec-cli/internal/mutate"
2627
"github.com/enterprise-contract/ec-cli/internal/policy/source"
2728
"github.com/enterprise-contract/ec-cli/internal/utils"
2829
)
@@ -108,11 +109,11 @@ func fetchPolicyCmd() *cobra.Command {
108109
sources := make([]*source.PolicyUrl, 0, len(sourceUrls)+len(dataSourceUrls))
109110

110111
for _, url := range sourceUrls {
111-
sources = append(sources, &source.PolicyUrl{Url: url, Kind: source.PolicyKind})
112+
sources = append(sources, &source.PolicyUrl{Url: mutate.Const(url), Kind: source.PolicyKind})
112113
}
113114

114115
for _, url := range dataSourceUrls {
115-
sources = append(sources, &source.PolicyUrl{Url: url, Kind: source.DataKind})
116+
sources = append(sources, &source.PolicyUrl{Url: mutate.Const(url), Kind: source.DataKind})
116117
}
117118

118119
for _, s := range sources {

‎cmd/inspect/inspect_policy.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/spf13/cobra"
2929
"golang.org/x/exp/slices"
3030

31+
"github.com/enterprise-contract/ec-cli/internal/mutate"
3132
"github.com/enterprise-contract/ec-cli/internal/opa"
3233
opaRule "github.com/enterprise-contract/ec-cli/internal/opa/rule"
3334
"github.com/enterprise-contract/ec-cli/internal/policy"
@@ -118,7 +119,7 @@ func inspectPolicyCmd() *cobra.Command {
118119

119120
allResults := make(map[string][]*ast.AnnotationsRef)
120121
for _, url := range sourceUrls {
121-
s := &source.PolicyUrl{Url: url, Kind: source.PolicyKind}
122+
s := &source.PolicyUrl{Url: mutate.Const(url), Kind: source.PolicyKind}
122123

123124
// Download
124125
policyDir, err := s.GetPolicy(ctx, destDir, false)

‎cmd/inspect/inspect_policy_data.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131
"golang.org/x/exp/slices"
3232
"sigs.k8s.io/yaml"
3333

34+
"github.com/enterprise-contract/ec-cli/internal/mutate"
3435
"github.com/enterprise-contract/ec-cli/internal/policy/source"
3536
"github.com/enterprise-contract/ec-cli/internal/utils"
3637
)
@@ -88,7 +89,7 @@ func inspectPolicyDataCmd() *cobra.Command {
8889

8990
allData := make(map[string]interface{})
9091
for _, url := range sourceUrls {
91-
s := &source.PolicyUrl{Url: url, Kind: source.PolicyKind}
92+
s := &source.PolicyUrl{Url: mutate.Const(url), Kind: source.PolicyKind}
9293

9394
// Download
9495
policyDir, err := s.GetPolicy(ctx, destDir, false)

‎cmd/validate/image.go

+45-45
Original file line numberDiff line numberDiff line change
@@ -230,63 +230,63 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
230230
RekorURL: data.rekorURL,
231231
}
232232

233-
// We're not currently using the policyCache returned from PreProcessPolicy, but we could
234-
// use it to cache the policy for future use.
235-
if p, _, err := policy.PreProcessPolicy(ctx, policyOptions); err != nil {
233+
p, err := policy.NewPolicy(ctx, policyOptions)
234+
if err != nil {
236235
allErrors = errors.Join(allErrors, err)
237-
} else {
238-
// inject extra variables into rule data per source
239-
if len(data.extraRuleData) > 0 {
240-
policySpec := p.Spec()
241-
sources := policySpec.Sources
242-
for i := range sources {
243-
src := sources[i]
244-
var rule_data_raw []byte
245-
unmarshaled := make(map[string]interface{})
246-
247-
if src.RuleData != nil {
248-
rule_data_raw, err = src.RuleData.MarshalJSON()
249-
if err != nil {
250-
log.Errorf("Unable to parse ruledata to raw data")
251-
}
252-
err = json.Unmarshal(rule_data_raw, &unmarshaled)
253-
if err != nil {
254-
log.Errorf("Unable to parse ruledata into standard JSON object")
255-
}
256-
} else {
257-
sources[i].RuleData = new(extv1.JSON)
258-
}
236+
return
237+
}
259238

260-
for j := range data.extraRuleData {
261-
parts := strings.SplitN(data.extraRuleData[j], "=", 2)
262-
if len(parts) < 2 {
263-
log.Errorf("Incorrect syntax for --extra-rule-data")
264-
}
265-
extraRuleDataPolicyConfig, err := validate_utils.GetPolicyConfig(ctx, parts[1])
266-
if err != nil {
267-
log.Errorf("Unable to load data from extraRuleData: %s", err.Error())
268-
}
269-
unmarshaled[parts[0]] = extraRuleDataPolicyConfig
239+
// inject extra variables into rule data per source
240+
if len(data.extraRuleData) > 0 {
241+
policySpec := p.Spec()
242+
sources := policySpec.Sources
243+
for i := range sources {
244+
src := sources[i]
245+
var rule_data_raw []byte
246+
unmarshaled := make(map[string]interface{})
247+
248+
if src.RuleData != nil {
249+
rule_data_raw, err = src.RuleData.MarshalJSON()
250+
if err != nil {
251+
log.Errorf("Unable to parse ruledata to raw data")
270252
}
271-
rule_data_raw, err = json.Marshal(unmarshaled)
253+
err = json.Unmarshal(rule_data_raw, &unmarshaled)
272254
if err != nil {
273-
log.Errorf("Unable to parse updated ruledata: %s", err.Error())
255+
log.Errorf("Unable to parse ruledata into standard JSON object")
274256
}
257+
} else {
258+
sources[i].RuleData = new(extv1.JSON)
259+
}
275260

276-
if rule_data_raw == nil {
277-
log.Errorf("Invalid rule data JSON")
261+
for j := range data.extraRuleData {
262+
parts := strings.SplitN(data.extraRuleData[j], "=", 2)
263+
if len(parts) < 2 {
264+
log.Errorf("Incorrect syntax for --extra-rule-data")
278265
}
279-
280-
err = sources[i].RuleData.UnmarshalJSON(rule_data_raw)
266+
extraRuleDataPolicyConfig, err := validate_utils.GetPolicyConfig(ctx, parts[1])
281267
if err != nil {
282-
log.Errorf("Unable to marshal updated JSON: %s", err.Error())
268+
log.Errorf("Unable to load data from extraRuleData: %s", err.Error())
283269
}
270+
unmarshaled[parts[0]] = extraRuleDataPolicyConfig
271+
}
272+
rule_data_raw, err = json.Marshal(unmarshaled)
273+
if err != nil {
274+
log.Errorf("Unable to parse updated ruledata: %s", err.Error())
275+
}
276+
277+
if rule_data_raw == nil {
278+
log.Errorf("Invalid rule data JSON")
279+
}
280+
281+
err = sources[i].RuleData.UnmarshalJSON(rule_data_raw)
282+
if err != nil {
283+
log.Errorf("Unable to marshal updated JSON: %s", err.Error())
284284
}
285-
policySpec.Sources = sources
286-
p = p.WithSpec(policySpec)
287285
}
288-
data.policy = p
286+
policySpec.Sources = sources
287+
p = p.WithSpec(policySpec)
289288
}
289+
data.policy = p
290290

291291
return
292292
},

‎cmd/validate/image_integration_test.go

+1-4
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ import (
2828
"time"
2929

3030
"github.com/enterprise-contract/enterprise-contract-controller/api/v1alpha1"
31-
ociMetadata "github.com/enterprise-contract/go-gather/metadata/oci"
3231
app "github.com/konflux-ci/application-api/api/v1alpha1"
3332
"github.com/spf13/afero"
3433
"github.com/stretchr/testify/assert"
@@ -52,12 +51,10 @@ func TestEvaluatorLifecycle(t *testing.T) {
5251
commonMockClient(&client)
5352
ctx = oci.WithClient(ctx, &client)
5453
mdl := MockDownloader{}
55-
downloaderCall := mdl.On("Download", mock.Anything, mock.Anything, false).Return(&ociMetadata.OCIMetadata{Digest: "sha256:da54bca5477bf4e3449bc37de1822888fa0fbb8d89c640218cb31b987374d357"}, nil).Times(noEvaluators)
5654
ctx = context.WithValue(ctx, source.DownloaderFuncKey, &mdl)
5755

5856
evaluators := make([]*mockEvaluator, 0, noEvaluators)
5957
expectations := make([]*mock.Call, 0, noEvaluators+1)
60-
expectations = append(expectations, downloaderCall)
6158

6259
for i := 0; i < noEvaluators; i++ {
6360
e := mockEvaluator{}
@@ -73,7 +70,7 @@ func TestEvaluatorLifecycle(t *testing.T) {
7370

7471
newConftestEvaluator = func(_ context.Context, s []source.PolicySource, _ evaluator.ConfigProvider, _ v1alpha1.Source) (evaluator.Evaluator, error) {
7572
// We are splitting this url to get to the index of the evaluator.
76-
idx, err := strconv.Atoi(strings.Split(strings.Split(s[0].PolicyUrl(), "@")[0], "::")[1])
73+
idx, err := strconv.Atoi(s[0].PolicyUrl())
7774
require.NoError(t, err)
7875

7976
return evaluators[idx], nil

‎cmd/validate/image_test.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,16 @@ var rootArgs = []string{
6464
}
6565

6666
func happyValidator() imageValidationFunc {
67-
return func(_ context.Context, component app.SnapshotComponent, _ *app.SnapshotSpec, _ policy.Policy, _ []evaluator.Evaluator, _ bool) (*output.Output, error) {
67+
return func(ctx context.Context, component app.SnapshotComponent, _ *app.SnapshotSpec, p policy.Policy, _ []evaluator.Evaluator, _ bool) (*output.Output, error) {
68+
// simulate fetching of sources
69+
for _, src := range p.Spec().Sources {
70+
for _, url := range source.PolicySourcesFrom(src) {
71+
if _, err := url.GetPolicy(ctx, "dest", false); err != nil {
72+
return nil, err
73+
}
74+
}
75+
}
76+
6877
return &output.Output{
6978
ImageSignatureCheck: output.VerificationStatus{
7079
Passed: true,

‎features/__snapshots__/validate_image.snap

+4-4
Original file line numberDiff line numberDiff line change
@@ -1122,7 +1122,7 @@ Error: success criteria not met
11221122
"sources": [
11231123
{
11241124
"policy": [
1125-
"git::${GITHOST}/git/unexpected-keyless-cert.git?ref=${LATEST_COMMIT}"
1125+
"git::https://${GITHOST}/git/unexpected-keyless-cert.git"
11261126
]
11271127
}
11281128
]
@@ -1167,7 +1167,7 @@ Error: success criteria not met
11671167
"sources": [
11681168
{
11691169
"policy": [
1170-
"git::${GITHOST}/git/invalid-image-signature.git?ref=${LATEST_COMMIT}"
1170+
"git::https://${GITHOST}/git/invalid-image-signature.git"
11711171
]
11721172
}
11731173
],
@@ -1598,7 +1598,7 @@ Error: success criteria not met
15981598
"sources": [
15991599
{
16001600
"policy": [
1601-
"git::${GITHOST}/git/mismatched-image-digest.git?ref=${LATEST_COMMIT}"
1601+
"git::https://${GITHOST}/git/mismatched-image-digest.git"
16021602
]
16031603
}
16041604
],
@@ -2744,7 +2744,7 @@ ${__________known_PUBLIC_KEY}
27442744
"sources": [
27452745
{
27462746
"policy": [
2747-
"git::${GITHOST}/git/rekor-by-default.git?ref=${LATEST_COMMIT}"
2747+
"git::https://${GITHOST}/git/rekor-by-default.git"
27482748
]
27492749
}
27502750
],

‎features/__snapshots__/validate_input.snap

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"sources": [
1616
{
1717
"policy": [
18-
"git::https://${GITHOST}/git/happy-day-policy.git"
18+
"git::${GITHOST}/git/happy-day-policy.git?ref=${LATEST_COMMIT}"
1919
]
2020
}
2121
]
@@ -68,12 +68,12 @@ Error: error validating file pipeline_definition.yaml: evaluating policy: no reg
6868
"sources": [
6969
{
7070
"policy": [
71-
"git::https://${GITHOST}/git/ham-policy"
71+
"git::${GITHOST}/git/ham-policy?ref=${LATEST_COMMIT}"
7272
]
7373
},
7474
{
7575
"policy": [
76-
"git::https://${GITHOST}/git/spam-policy"
76+
"git::${GITHOST}/git/spam-policy?ref=4707d251d08b466389705c121d84efa2683114cf"
7777
]
7878
}
7979
]

‎features/validate_image.feature

+1-1
Original file line numberDiff line numberDiff line change
@@ -1139,7 +1139,7 @@ Feature: evaluate enterprise contract
11391139
And an Snapshot named "multitude" with 10 components signed with "known" key
11401140
When ec command is run with "validate image --snapshot acceptance/multitude --policy acceptance/ec-policy --public-key ${known_PUBLIC_KEY} --rekor-url ${REKOR} --show-successes --output json"
11411141
Then the exit status should be 0
1142-
And the output should match the snapshot
1142+
And the output should match the snapshot
11431143

11441144
Scenario: Format options
11451145
Given a key pair named "known"

‎internal/evaluation_target/input/input.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ type Input struct {
3636

3737
// NewInput returns a Input struct with FPath and evaluator ready to use
3838
func NewInput(ctx context.Context, paths []string, p policy.Policy) (*Input, error) {
39-
i := &Input{
39+
in := &Input{
4040
Paths: paths,
4141
}
4242

@@ -55,8 +55,8 @@ func NewInput(ctx context.Context, paths []string, p policy.Policy) (*Input, err
5555
}
5656

5757
log.Debug("Conftest evaluator initialized")
58-
i.Evaluators = append(i.Evaluators, c)
58+
in.Evaluators = append(in.Evaluators, c)
5959

6060
}
61-
return i, nil
61+
return in, nil
6262
}

‎internal/evaluator/conftest_evaluator_test.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ import (
4545
"k8s.io/kube-openapi/pkg/util/sets"
4646

4747
"github.com/enterprise-contract/ec-cli/internal/downloader"
48+
"github.com/enterprise-contract/ec-cli/internal/mutate"
4849
"github.com/enterprise-contract/ec-cli/internal/opa/rule"
4950
"github.com/enterprise-contract/ec-cli/internal/policy"
5051
"github.com/enterprise-contract/ec-cli/internal/policy/source"
@@ -1819,7 +1820,7 @@ func TestConftestEvaluatorEvaluate(t *testing.T) {
18191820

18201821
evaluator, err := NewConftestEvaluator(ctx, []source.PolicySource{
18211822
&source.PolicyUrl{
1822-
Url: rules,
1823+
Url: mutate.Const(rules),
18231824
Kind: source.PolicyKind,
18241825
},
18251826
}, config, ecc.Source{})
@@ -1882,7 +1883,7 @@ func TestUnconformingRule(t *testing.T) {
18821883

18831884
evaluator, err := NewConftestEvaluator(ctx, []source.PolicySource{
18841885
&source.PolicyUrl{
1885-
Url: rules,
1886+
Url: mutate.Const(rules),
18861887
Kind: source.PolicyKind,
18871888
},
18881889
}, p, ecc.Source{})
@@ -2098,7 +2099,7 @@ func TestNewConftestEvaluatorComputeIncludeExclude(t *testing.T) {
20982099

20992100
evaluator, err := NewConftestEvaluator(ctx, []source.PolicySource{
21002101
&source.PolicyUrl{
2101-
Url: path.Join(dir, "policy", "rules.tar"),
2102+
Url: mutate.Const(path.Join(dir, "policy", "rules.tar")),
21022103
Kind: source.PolicyKind,
21032104
},
21042105
}, p, tt.source)

‎internal/input/validate.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,14 @@ func ValidateInput(ctx context.Context, fpath string, policy policy.Policy, deta
4747
return nil, err
4848
}
4949

50-
p, err := inputFile(ctx, inputFiles, policy)
50+
in, err := inputFile(ctx, inputFiles, policy)
5151
if err != nil {
5252
log.Debug("Failed to create input!")
5353
return nil, err
5454
}
5555

5656
var allResults []evaluator.Outcome
57-
for _, e := range p.Evaluators {
57+
for _, e := range in.Evaluators {
5858
results, _, err := e.Evaluate(ctx, evaluator.EvaluationTarget{Inputs: inputFiles})
5959
if err != nil {
6060
return nil, fmt.Errorf("evaluating policy: %w", err)

0 commit comments

Comments
 (0)