Skip to content

Commit d8c2961

Browse files
asraaasraa
authored
test: add docker based spport and start adding tests (#486)
Signed-off-by: Asra Ali <[email protected]>
1 parent a2388a3 commit d8c2961

File tree

6 files changed

+170
-11
lines changed

6 files changed

+170
-11
lines changed

‎cli/slsa-verifier/main_regression_test.go

+151-3
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"errors"
99
"fmt"
1010
"io/ioutil"
11+
"os"
1112
"path"
1213
"path/filepath"
1314
"strings"
@@ -38,9 +39,12 @@ func pString(s string) *string {
3839
const TEST_DIR = "./testdata"
3940

4041
var (
41-
GHA_ARTIFACT_PATH_BUILDERS = []string{"gha_go", "gha_generic"}
42-
GHA_ARTIFACT_IMAGE_BUILDERS = []string{"gha_generic_container"}
43-
GCB_ARTIFACT_IMAGE_BUILDERS = []string{"gcb_container"}
42+
GHA_ARTIFACT_PATH_BUILDERS = []string{"gha_go", "gha_generic"}
43+
// TODO(https://github.com/slsa-framework/slsa-verifier/issues/485): Merge this with
44+
// GHA_ARTIFACT_PATH_BUILDERS.
45+
GHA_ARTIFACT_DOCKER_BUILDERS = []string{"gha_docker-based"}
46+
GHA_ARTIFACT_IMAGE_BUILDERS = []string{"gha_generic_container"}
47+
GCB_ARTIFACT_IMAGE_BUILDERS = []string{"gcb_container"}
4448
)
4549

4650
func getBuildersAndVersions(t *testing.T,
@@ -1231,3 +1235,147 @@ func Test_runVerifyGCBArtifactImage(t *testing.T) {
12311235
})
12321236
}
12331237
}
1238+
1239+
// TODO(https://github.com/slsa-framework/slsa-verifier/issues/485): Version the test-cases
1240+
// when a version for the builder is released.
1241+
func Test_runVerifyGHADockerBased(t *testing.T) {
1242+
// We cannot use t.Setenv due to parallelized tests.
1243+
os.Setenv("SLSA_VERIFIER_EXPERIMENTAL", "1")
1244+
1245+
t.Parallel()
1246+
1247+
builder := "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"
1248+
tests := []struct {
1249+
name string
1250+
artifacts []string
1251+
source string
1252+
pbranch *string
1253+
ptag *string
1254+
pversiontag *string
1255+
pBuilderID *string
1256+
inputs map[string]string
1257+
err error
1258+
}{
1259+
{
1260+
name: "valid main branch default",
1261+
artifacts: []string{"workflow_dispatch.main.default"},
1262+
source: "github.com/slsa-framework/example-package",
1263+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1264+
},
1265+
{
1266+
name: "valid main branch default - invalid builderID",
1267+
artifacts: []string{"workflow_dispatch.main.default"},
1268+
source: "github.com/slsa-framework/example-package",
1269+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/not-trusted.yml"),
1270+
err: serrors.ErrorUntrustedReusableWorkflow,
1271+
},
1272+
{
1273+
name: "valid main branch set",
1274+
artifacts: []string{"workflow_dispatch.main.default"},
1275+
source: "github.com/slsa-framework/example-package",
1276+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1277+
pbranch: pString("main"),
1278+
},
1279+
1280+
{
1281+
name: "wrong branch master",
1282+
artifacts: []string{"workflow_dispatch.main.default"},
1283+
source: "github.com/slsa-framework/example-package",
1284+
pbranch: pString("master"),
1285+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1286+
err: serrors.ErrorMismatchBranch,
1287+
},
1288+
{
1289+
name: "wrong source append A",
1290+
artifacts: []string{"workflow_dispatch.main.default"},
1291+
source: "github.com/slsa-framework/example-packageA",
1292+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1293+
err: serrors.ErrorMismatchSource,
1294+
},
1295+
{
1296+
name: "wrong source prepend A",
1297+
artifacts: []string{"workflow_dispatch.main.default"},
1298+
source: "Agithub.com/slsa-framework/example-package",
1299+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1300+
err: serrors.ErrorMismatchSource,
1301+
},
1302+
{
1303+
name: "wrong source middle A",
1304+
artifacts: []string{"workflow_dispatch.main.default"},
1305+
source: "github.com/Aslsa-framework/example-package",
1306+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1307+
err: serrors.ErrorMismatchSource,
1308+
},
1309+
{
1310+
name: "tag no match empty tag workflow_dispatch",
1311+
artifacts: []string{"workflow_dispatch.main.default"},
1312+
source: "github.com/slsa-framework/example-package",
1313+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1314+
ptag: pString("v1.2.3"),
1315+
err: serrors.ErrorMismatchTag,
1316+
},
1317+
{
1318+
name: "versioned tag no match empty tag workflow_dispatch",
1319+
artifacts: []string{"workflow_dispatch.main.default"},
1320+
source: "github.com/slsa-framework/example-package",
1321+
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_docker-based_slsa3.yml"),
1322+
pversiontag: pString("v1"),
1323+
err: serrors.ErrorInvalidSemver,
1324+
},
1325+
}
1326+
for _, tt := range tests {
1327+
tt := tt // Re-initializing variable so it is not changed while executing the closure below
1328+
t.Run(tt.name, func(t *testing.T) {
1329+
t.Parallel()
1330+
1331+
checkVersions := getBuildersAndVersions(t, "", nil, GHA_ARTIFACT_DOCKER_BUILDERS)
1332+
1333+
for _, v := range checkVersions {
1334+
testPath := filepath.Clean(filepath.Join(TEST_DIR, v, tt.artifacts[0]))
1335+
provenancePath := fmt.Sprintf("%s.intoto.sigstore", testPath)
1336+
1337+
artifacts := make([]string, len(tt.artifacts))
1338+
for i, artifact := range tt.artifacts {
1339+
artifacts[i] = filepath.Clean(filepath.Join(TEST_DIR, v, artifact))
1340+
}
1341+
1342+
// For each test, we run 2 sub-tests:
1343+
// 1. With the the full builderID including the semver in short form.
1344+
// 2. With the the full builderID including the semver in long form.
1345+
// 3. With only the name of the builder.
1346+
// 4. With no builder ID.
1347+
sv := path.Base(v)
1348+
builderIDs := []*string{
1349+
pString(builder + "@" + sv),
1350+
pString(builder + "@refs/tags/" + sv),
1351+
pString(builder),
1352+
nil,
1353+
}
1354+
1355+
// If builder ID is set, use it.
1356+
if tt.pBuilderID != nil {
1357+
builderIDs = []*string{tt.pBuilderID}
1358+
}
1359+
1360+
for _, bid := range builderIDs {
1361+
cmd := verify.VerifyArtifactCommand{
1362+
ProvenancePath: provenancePath,
1363+
SourceURI: tt.source,
1364+
SourceBranch: tt.pbranch,
1365+
BuilderID: bid,
1366+
SourceTag: tt.ptag,
1367+
SourceVersionTag: tt.pversiontag,
1368+
BuildWorkflowInputs: tt.inputs,
1369+
}
1370+
1371+
// The outBuilderID is the actual builder ID from the provenance.
1372+
// This is always long form for the GHA builders.
1373+
_, err := cmd.Exec(context.Background(), artifacts)
1374+
if !errCmp(err, tt.err) {
1375+
t.Errorf("%v: %v", v, cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
1376+
}
1377+
}
1378+
}
1379+
})
1380+
}
1381+
}

‎cli/slsa-verifier/testdata/gha_docker-based/main/workflow_dispatch.main.default

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Simple command for generating a file.
2+
command = ["cp", ".github/configs-docker/config.toml", "config.toml"]
3+
# Path to the file generated by the command above.
4+
artifact_path = "config.toml"

0 commit comments

Comments
 (0)