Skip to content

Commit 3420832

Browse files
robnester-rhrobnester-rh
authored
Merge pull request #2176 from robnester-rh/EC-1023
Revert "Merge pull request #2150 from zregvart/issue/EC-963"
2 parents fbbef8c + 5f47666 commit 3420832

19 files changed

+186
-270
lines changed

‎cmd/fetch/fetch_policy.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
"github.com/spf13/afero"
2424
"github.com/spf13/cobra"
2525

26-
"github.com/enterprise-contract/ec-cli/internal/mutate"
2726
"github.com/enterprise-contract/ec-cli/internal/policy/source"
2827
"github.com/enterprise-contract/ec-cli/internal/utils"
2928
)
@@ -109,11 +108,11 @@ func fetchPolicyCmd() *cobra.Command {
109108
sources := make([]*source.PolicyUrl, 0, len(sourceUrls)+len(dataSourceUrls))
110109

111110
for _, url := range sourceUrls {
112-
sources = append(sources, &source.PolicyUrl{Url: mutate.Const(url), Kind: source.PolicyKind})
111+
sources = append(sources, &source.PolicyUrl{Url: url, Kind: source.PolicyKind})
113112
}
114113

115114
for _, url := range dataSourceUrls {
116-
sources = append(sources, &source.PolicyUrl{Url: mutate.Const(url), Kind: source.DataKind})
115+
sources = append(sources, &source.PolicyUrl{Url: url, Kind: source.DataKind})
117116
}
118117

119118
for _, s := range sources {

‎cmd/inspect/inspect_policy.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ import (
2828
"github.com/spf13/cobra"
2929
"golang.org/x/exp/slices"
3030

31-
"github.com/enterprise-contract/ec-cli/internal/mutate"
3231
"github.com/enterprise-contract/ec-cli/internal/opa"
3332
opaRule "github.com/enterprise-contract/ec-cli/internal/opa/rule"
3433
"github.com/enterprise-contract/ec-cli/internal/policy"
@@ -119,7 +118,7 @@ func inspectPolicyCmd() *cobra.Command {
119118

120119
allResults := make(map[string][]*ast.AnnotationsRef)
121120
for _, url := range sourceUrls {
122-
s := &source.PolicyUrl{Url: mutate.Const(url), Kind: source.PolicyKind}
121+
s := &source.PolicyUrl{Url: url, Kind: source.PolicyKind}
123122

124123
// Download
125124
policyDir, err := s.GetPolicy(ctx, destDir, false)

‎cmd/inspect/inspect_policy_data.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ import (
3131
"golang.org/x/exp/slices"
3232
"sigs.k8s.io/yaml"
3333

34-
"github.com/enterprise-contract/ec-cli/internal/mutate"
3534
"github.com/enterprise-contract/ec-cli/internal/policy/source"
3635
"github.com/enterprise-contract/ec-cli/internal/utils"
3736
)
@@ -89,7 +88,7 @@ func inspectPolicyDataCmd() *cobra.Command {
8988

9089
allData := make(map[string]interface{})
9190
for _, url := range sourceUrls {
92-
s := &source.PolicyUrl{Url: mutate.Const(url), Kind: source.PolicyKind}
91+
s := &source.PolicyUrl{Url: url, Kind: source.PolicyKind}
9392

9493
// Download
9594
policyDir, err := s.GetPolicy(ctx, destDir, false)

‎cmd/validate/image.go

+45-45
Original file line numberDiff line numberDiff line change
@@ -230,63 +230,63 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
230230
RekorURL: data.rekorURL,
231231
}
232232

233-
p, err := policy.NewPolicy(ctx, policyOptions)
234-
if err != nil {
233+
// We're not currently using the policyCache returned from PreProcessPolicy, but we could
234+
// use it to cache the policy for future use.
235+
if p, _, err := policy.PreProcessPolicy(ctx, policyOptions); err != nil {
235236
allErrors = errors.Join(allErrors, err)
236-
return
237-
}
237+
} else {
238+
// inject extra variables into rule data per source
239+
if len(data.extraRuleData) > 0 {
240+
policySpec := p.Spec()
241+
sources := policySpec.Sources
242+
for i := range sources {
243+
src := sources[i]
244+
var rule_data_raw []byte
245+
unmarshaled := make(map[string]interface{})
246+
247+
if src.RuleData != nil {
248+
rule_data_raw, err = src.RuleData.MarshalJSON()
249+
if err != nil {
250+
log.Errorf("Unable to parse ruledata to raw data")
251+
}
252+
err = json.Unmarshal(rule_data_raw, &unmarshaled)
253+
if err != nil {
254+
log.Errorf("Unable to parse ruledata into standard JSON object")
255+
}
256+
} else {
257+
sources[i].RuleData = new(extv1.JSON)
258+
}
238259

239-
// inject extra variables into rule data per source
240-
if len(data.extraRuleData) > 0 {
241-
policySpec := p.Spec()
242-
sources := policySpec.Sources
243-
for i := range sources {
244-
src := sources[i]
245-
var rule_data_raw []byte
246-
unmarshaled := make(map[string]interface{})
247-
248-
if src.RuleData != nil {
249-
rule_data_raw, err = src.RuleData.MarshalJSON()
250-
if err != nil {
251-
log.Errorf("Unable to parse ruledata to raw data")
260+
for j := range data.extraRuleData {
261+
parts := strings.SplitN(data.extraRuleData[j], "=", 2)
262+
if len(parts) < 2 {
263+
log.Errorf("Incorrect syntax for --extra-rule-data")
264+
}
265+
extraRuleDataPolicyConfig, err := validate_utils.GetPolicyConfig(ctx, parts[1])
266+
if err != nil {
267+
log.Errorf("Unable to load data from extraRuleData: %s", err.Error())
268+
}
269+
unmarshaled[parts[0]] = extraRuleDataPolicyConfig
252270
}
253-
err = json.Unmarshal(rule_data_raw, &unmarshaled)
271+
rule_data_raw, err = json.Marshal(unmarshaled)
254272
if err != nil {
255-
log.Errorf("Unable to parse ruledata into standard JSON object")
273+
log.Errorf("Unable to parse updated ruledata: %s", err.Error())
256274
}
257-
} else {
258-
sources[i].RuleData = new(extv1.JSON)
259-
}
260275

261-
for j := range data.extraRuleData {
262-
parts := strings.SplitN(data.extraRuleData[j], "=", 2)
263-
if len(parts) < 2 {
264-
log.Errorf("Incorrect syntax for --extra-rule-data")
276+
if rule_data_raw == nil {
277+
log.Errorf("Invalid rule data JSON")
265278
}
266-
extraRuleDataPolicyConfig, err := validate_utils.GetPolicyConfig(ctx, parts[1])
279+
280+
err = sources[i].RuleData.UnmarshalJSON(rule_data_raw)
267281
if err != nil {
268-
log.Errorf("Unable to load data from extraRuleData: %s", err.Error())
282+
log.Errorf("Unable to marshal updated JSON: %s", err.Error())
269283
}
270-
unmarshaled[parts[0]] = extraRuleDataPolicyConfig
271-
}
272-
rule_data_raw, err = json.Marshal(unmarshaled)
273-
if err != nil {
274-
log.Errorf("Unable to parse updated ruledata: %s", err.Error())
275-
}
276-
277-
if rule_data_raw == nil {
278-
log.Errorf("Invalid rule data JSON")
279-
}
280-
281-
err = sources[i].RuleData.UnmarshalJSON(rule_data_raw)
282-
if err != nil {
283-
log.Errorf("Unable to marshal updated JSON: %s", err.Error())
284284
}
285+
policySpec.Sources = sources
286+
p = p.WithSpec(policySpec)
285287
}
286-
policySpec.Sources = sources
287-
p = p.WithSpec(policySpec)
288+
data.policy = p
288289
}
289-
data.policy = p
290290

291291
return
292292
},

‎cmd/validate/image_integration_test.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"time"
2929

3030
"github.com/enterprise-contract/enterprise-contract-controller/api/v1alpha1"
31+
ociMetadata "github.com/enterprise-contract/go-gather/metadata/oci"
3132
app "github.com/konflux-ci/application-api/api/v1alpha1"
3233
"github.com/spf13/afero"
3334
"github.com/stretchr/testify/assert"
@@ -51,10 +52,12 @@ func TestEvaluatorLifecycle(t *testing.T) {
5152
commonMockClient(&client)
5253
ctx = oci.WithClient(ctx, &client)
5354
mdl := MockDownloader{}
55+
downloaderCall := mdl.On("Download", mock.Anything, mock.Anything, false).Return(&ociMetadata.OCIMetadata{Digest: "sha256:da54bca5477bf4e3449bc37de1822888fa0fbb8d89c640218cb31b987374d357"}, nil).Times(noEvaluators)
5456
ctx = context.WithValue(ctx, source.DownloaderFuncKey, &mdl)
5557

5658
evaluators := make([]*mockEvaluator, 0, noEvaluators)
5759
expectations := make([]*mock.Call, 0, noEvaluators+1)
60+
expectations = append(expectations, downloaderCall)
5861

5962
for i := 0; i < noEvaluators; i++ {
6063
e := mockEvaluator{}
@@ -70,7 +73,7 @@ func TestEvaluatorLifecycle(t *testing.T) {
7073

7174
newConftestEvaluator = func(_ context.Context, s []source.PolicySource, _ evaluator.ConfigProvider, _ v1alpha1.Source) (evaluator.Evaluator, error) {
7275
// We are splitting this url to get to the index of the evaluator.
73-
idx, err := strconv.Atoi(s[0].PolicyUrl())
76+
idx, err := strconv.Atoi(strings.Split(strings.Split(s[0].PolicyUrl(), "@")[0], "::")[1])
7477
require.NoError(t, err)
7578

7679
return evaluators[idx], nil

‎cmd/validate/image_test.go

+1-10
Original file line numberDiff line numberDiff line change
@@ -64,16 +64,7 @@ var rootArgs = []string{
6464
}
6565

6666
func happyValidator() imageValidationFunc {
67-
return func(ctx context.Context, component app.SnapshotComponent, _ *app.SnapshotSpec, p policy.Policy, _ []evaluator.Evaluator, _ bool) (*output.Output, error) {
68-
// simulate fetching of sources
69-
for _, src := range p.Spec().Sources {
70-
for _, url := range source.PolicySourcesFrom(src) {
71-
if _, err := url.GetPolicy(ctx, "dest", false); err != nil {
72-
return nil, err
73-
}
74-
}
75-
}
76-
67+
return func(_ context.Context, component app.SnapshotComponent, _ *app.SnapshotSpec, _ policy.Policy, _ []evaluator.Evaluator, _ bool) (*output.Output, error) {
7768
return &output.Output{
7869
ImageSignatureCheck: output.VerificationStatus{
7970
Passed: true,

‎features/__snapshots__/validate_image.snap

+4-4
Original file line numberDiff line numberDiff line change
@@ -1122,7 +1122,7 @@ Error: success criteria not met
11221122
"sources": [
11231123
{
11241124
"policy": [
1125-
"git::https://${GITHOST}/git/unexpected-keyless-cert.git"
1125+
"git::${GITHOST}/git/unexpected-keyless-cert.git?ref=${LATEST_COMMIT}"
11261126
]
11271127
}
11281128
]
@@ -1167,7 +1167,7 @@ Error: success criteria not met
11671167
"sources": [
11681168
{
11691169
"policy": [
1170-
"git::https://${GITHOST}/git/invalid-image-signature.git"
1170+
"git::${GITHOST}/git/invalid-image-signature.git?ref=${LATEST_COMMIT}"
11711171
]
11721172
}
11731173
],
@@ -1598,7 +1598,7 @@ Error: success criteria not met
15981598
"sources": [
15991599
{
16001600
"policy": [
1601-
"git::https://${GITHOST}/git/mismatched-image-digest.git"
1601+
"git::${GITHOST}/git/mismatched-image-digest.git?ref=${LATEST_COMMIT}"
16021602
]
16031603
}
16041604
],
@@ -2744,7 +2744,7 @@ ${__________known_PUBLIC_KEY}
27442744
"sources": [
27452745
{
27462746
"policy": [
2747-
"git::https://${GITHOST}/git/rekor-by-default.git"
2747+
"git::${GITHOST}/git/rekor-by-default.git?ref=${LATEST_COMMIT}"
27482748
]
27492749
}
27502750
],

‎features/__snapshots__/validate_input.snap

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
"sources": [
1616
{
1717
"policy": [
18-
"git::${GITHOST}/git/happy-day-policy.git?ref=${LATEST_COMMIT}"
18+
"git::https://${GITHOST}/git/happy-day-policy.git"
1919
]
2020
}
2121
]
@@ -68,12 +68,12 @@ Error: error validating file pipeline_definition.yaml: evaluating policy: no reg
6868
"sources": [
6969
{
7070
"policy": [
71-
"git::${GITHOST}/git/ham-policy?ref=${LATEST_COMMIT}"
71+
"git::https://${GITHOST}/git/ham-policy"
7272
]
7373
},
7474
{
7575
"policy": [
76-
"git::${GITHOST}/git/spam-policy?ref=4707d251d08b466389705c121d84efa2683114cf"
76+
"git::https://${GITHOST}/git/spam-policy"
7777
]
7878
}
7979
]

‎features/validate_image.feature

+20-19
Original file line numberDiff line numberDiff line change
@@ -1121,25 +1121,26 @@ Feature: evaluate enterprise contract
11211121
Then the exit status should be 0
11221122
Then the output should match the snapshot
11231123

1124-
Scenario: many components and sources
1125-
Given a key pair named "known"
1126-
And a git repository named "multitude-policy" with
1127-
| main.rego | examples/happy_day.rego |
1128-
And policy configuration named "ec-policy" with 10 policy sources from "git::https://${GITHOST}/git/multitude-policy.git", patched with
1129-
| [{"op": "add", "path": "/sources/0/ruleData", "value": {"key": "value"}}] |
1130-
| [{"op": "add", "path": "/sources/1/ruleData", "value": {"something": "here"}}] |
1131-
| [{"op": "add", "path": "/sources/2/ruleData", "value": {"key": "different"}}] |
1132-
| [{"op": "add", "path": "/sources/3/ruleData", "value": {"hello": "world"}}] |
1133-
| [{"op": "add", "path": "/sources/4/ruleData", "value": {"foo": "bar"}}] |
1134-
| [{"op": "add", "path": "/sources/5/ruleData", "value": {"peek": "poke"}}] |
1135-
| [{"op": "add", "path": "/sources/6/ruleData", "value": {"hide": "seek"}}] |
1136-
| [{"op": "add", "path": "/sources/7/ruleData", "value": {"hokus": "pokus"}}] |
1137-
| [{"op": "add", "path": "/sources/8/ruleData", "value": {"mr": "mxyzptlk"}}] |
1138-
| [{"op": "add", "path": "/sources/9/ruleData", "value": {"more": "data"}}] |
1139-
And an Snapshot named "multitude" with 10 components signed with "known" key
1140-
When ec command is run with "validate image --snapshot acceptance/multitude --policy acceptance/ec-policy --public-key ${known_PUBLIC_KEY} --rekor-url ${REKOR} --show-successes --output json"
1141-
Then the exit status should be 0
1142-
And the output should match the snapshot
1124+
# Commented out as part of EC-1023. This will be enabled once the issue is resolved.
1125+
# Scenario: many components and sources
1126+
# Given a key pair named "known"
1127+
# And a git repository named "multitude-policy" with
1128+
# | main.rego | examples/happy_day.rego |
1129+
# And policy configuration named "ec-policy" with 10 policy sources from "git::https://${GITHOST}/git/multitude-policy.git", patched with
1130+
# | [{"op": "add", "path": "/sources/0/ruleData", "value": {"key": "value"}}] |
1131+
# | [{"op": "add", "path": "/sources/1/ruleData", "value": {"something": "here"}}] |
1132+
# | [{"op": "add", "path": "/sources/2/ruleData", "value": {"key": "different"}}] |
1133+
# | [{"op": "add", "path": "/sources/3/ruleData", "value": {"hello": "world"}}] |
1134+
# | [{"op": "add", "path": "/sources/4/ruleData", "value": {"foo": "bar"}}] |
1135+
# | [{"op": "add", "path": "/sources/5/ruleData", "value": {"peek": "poke"}}] |
1136+
# | [{"op": "add", "path": "/sources/6/ruleData", "value": {"hide": "seek"}}] |
1137+
# | [{"op": "add", "path": "/sources/7/ruleData", "value": {"hokus": "pokus"}}] |
1138+
# | [{"op": "add", "path": "/sources/8/ruleData", "value": {"mr": "mxyzptlk"}}] |
1139+
# | [{"op": "add", "path": "/sources/9/ruleData", "value": {"more": "data"}}] |
1140+
# And an Snapshot named "multitude" with 10 components signed with "known" key
1141+
# When ec command is run with "validate image --snapshot acceptance/multitude --policy acceptance/ec-policy --public-key ${known_PUBLIC_KEY} --rekor-url ${REKOR} --show-successes --output json"
1142+
# Then the exit status should be 0
1143+
# And the output should match the snapshot
11431144

11441145
Scenario: Format options
11451146
Given a key pair named "known"

‎internal/evaluation_target/input/input.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ type Input struct {
3636

3737
// NewInput returns a Input struct with FPath and evaluator ready to use
3838
func NewInput(ctx context.Context, paths []string, p policy.Policy) (*Input, error) {
39-
in := &Input{
39+
i := &Input{
4040
Paths: paths,
4141
}
4242

@@ -55,8 +55,8 @@ func NewInput(ctx context.Context, paths []string, p policy.Policy) (*Input, err
5555
}
5656

5757
log.Debug("Conftest evaluator initialized")
58-
in.Evaluators = append(in.Evaluators, c)
58+
i.Evaluators = append(i.Evaluators, c)
5959

6060
}
61-
return in, nil
61+
return i, nil
6262
}

‎internal/evaluator/conftest_evaluator_test.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ import (
4545
"k8s.io/kube-openapi/pkg/util/sets"
4646

4747
"github.com/enterprise-contract/ec-cli/internal/downloader"
48-
"github.com/enterprise-contract/ec-cli/internal/mutate"
4948
"github.com/enterprise-contract/ec-cli/internal/opa/rule"
5049
"github.com/enterprise-contract/ec-cli/internal/policy"
5150
"github.com/enterprise-contract/ec-cli/internal/policy/source"
@@ -1820,7 +1819,7 @@ func TestConftestEvaluatorEvaluate(t *testing.T) {
18201819

18211820
evaluator, err := NewConftestEvaluator(ctx, []source.PolicySource{
18221821
&source.PolicyUrl{
1823-
Url: mutate.Const(rules),
1822+
Url: rules,
18241823
Kind: source.PolicyKind,
18251824
},
18261825
}, config, ecc.Source{})
@@ -1883,7 +1882,7 @@ func TestUnconformingRule(t *testing.T) {
18831882

18841883
evaluator, err := NewConftestEvaluator(ctx, []source.PolicySource{
18851884
&source.PolicyUrl{
1886-
Url: mutate.Const(rules),
1885+
Url: rules,
18871886
Kind: source.PolicyKind,
18881887
},
18891888
}, p, ecc.Source{})
@@ -2099,7 +2098,7 @@ func TestNewConftestEvaluatorComputeIncludeExclude(t *testing.T) {
20992098

21002099
evaluator, err := NewConftestEvaluator(ctx, []source.PolicySource{
21012100
&source.PolicyUrl{
2102-
Url: mutate.Const(path.Join(dir, "policy", "rules.tar")),
2101+
Url: path.Join(dir, "policy", "rules.tar"),
21032102
Kind: source.PolicyKind,
21042103
},
21052104
}, p, tt.source)

‎internal/input/validate.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,14 @@ func ValidateInput(ctx context.Context, fpath string, policy policy.Policy, deta
4747
return nil, err
4848
}
4949

50-
in, err := inputFile(ctx, inputFiles, policy)
50+
p, err := inputFile(ctx, inputFiles, policy)
5151
if err != nil {
5252
log.Debug("Failed to create input!")
5353
return nil, err
5454
}
5555

5656
var allResults []evaluator.Outcome
57-
for _, e := range in.Evaluators {
57+
for _, e := range p.Evaluators {
5858
results, _, err := e.Evaluate(ctx, evaluator.EvaluationTarget{Inputs: inputFiles})
5959
if err != nil {
6060
return nil, fmt.Errorf("evaluating policy: %w", err)

0 commit comments

Comments
 (0)