diff --git a/notation_test.go b/notation_test.go index 51840959..0495412a 100644 --- a/notation_test.go +++ b/notation_test.go @@ -307,8 +307,7 @@ func TestSignOptsUnknownMediaType(t *testing.T) { func TestRegistryResolveError(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} - + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} errorMessage := "network error" expectedErr := ErrorSignatureRetrievalFailed{Msg: errorMessage} @@ -326,8 +325,7 @@ func TestRegistryResolveError(t *testing.T) { func TestVerifyEmptyReference(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} - + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} errorMessage := "reference is missing digest or tag" expectedErr := ErrorSignatureRetrievalFailed{Msg: errorMessage} @@ -343,7 +341,7 @@ func TestVerifyEmptyReference(t *testing.T) { func TestVerifyTagReferenceFailed(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} errorMessage := "invalid reference: invalid repository \"UPPERCASE/test\"" expectedErr := ErrorSignatureRetrievalFailed{Msg: errorMessage} @@ -360,7 +358,7 @@ func TestVerifyDigestNotMatchResolve(t *testing.T) { repo := mock.NewRepository() repo.MissMatchDigest = true policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} errorMessage := fmt.Sprintf("user input digest %s does not match the resolved digest %s", mock.SampleDigest, mock.ZeroDigest) expectedErr := ErrorSignatureRetrievalFailed{Msg: errorMessage} @@ -384,7 +382,7 @@ func TestSignDigestNotMatchResolve(t *testing.T) { } errorMessage := fmt.Sprintf("user input digest %s does not match the resolved digest %s", mock.SampleDigest, mock.ZeroDigest) - expectedErr := fmt.Errorf(errorMessage) + expectedErr := errors.New(errorMessage) _, err := Sign(context.Background(), &dummySigner{}, repo, signOpts) if err == nil || err.Error() != errorMessage { @@ -395,7 +393,7 @@ func TestSignDigestNotMatchResolve(t *testing.T) { func TestSkippedSignatureVerification(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelSkip} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelSkip, false} opts := VerifyOptions{ArtifactReference: mock.SampleArtifactUri, MaxSignatureAttempts: 50} _, outcomes, err := Verify(context.Background(), &verifier, repo, opts) @@ -408,7 +406,7 @@ func TestSkippedSignatureVerification(t *testing.T) { func TestRegistryNoSignatureManifests(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} errorMessage := fmt.Sprintf("no signature is associated with %q, make sure the artifact was signed successfully", mock.SampleArtifactUri) expectedErr := ErrorSignatureRetrievalFailed{Msg: errorMessage} @@ -425,7 +423,7 @@ func TestRegistryNoSignatureManifests(t *testing.T) { func TestRegistryFetchSignatureBlobError(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} errorMessage := fmt.Sprintf("unable to retrieve digital signature with digest %q associated with %q from the Repository, error : network error", mock.SampleDigest, mock.SampleArtifactUri) expectedErr := ErrorSignatureRetrievalFailed{Msg: errorMessage} @@ -442,21 +440,35 @@ func TestRegistryFetchSignatureBlobError(t *testing.T) { func TestVerifyValid(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} // mock the repository opts := VerifyOptions{ArtifactReference: mock.SampleArtifactUri, MaxSignatureAttempts: 50} _, _, err := Verify(context.Background(), &verifier, repo, opts) if err != nil { - t.Fatalf("SignaureMediaTypeMismatch expected: %v got: %v", nil, err) + t.Fatalf("expected nil error, but got: %v", err) + } +} + +func TestVerifySkip(t *testing.T) { + repo := mock.NewRepository() + policyDocument := dummyPolicyDocument() + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, true} + + // mock the repository + opts := VerifyOptions{ArtifactReference: mock.SampleArtifactUri, MaxSignatureAttempts: 50} + _, _, err := Verify(context.Background(), &verifier, repo, opts) + + if err != nil { + t.Fatalf("expected nil error, but got: %v", err) } } func TestMaxSignatureAttemptsMissing(t *testing.T) { repo := mock.NewRepository() policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} expectedErr := ErrorSignatureRetrievalFailed{Msg: fmt.Sprintf("verifyOptions.MaxSignatureAttempts expects a positive number, got %d", 0)} // mock the repository @@ -472,7 +484,7 @@ func TestExceededMaxSignatureAttempts(t *testing.T) { repo := mock.NewRepository() repo.ExceededNumOfSignatures = true policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, true, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, true, *trustpolicy.LevelStrict, false} expectedErr := ErrorVerificationFailed{Msg: fmt.Sprintf("signature evaluation stopped. The configured limit of %d signatures to verify per artifact exceeded", 1)} @@ -489,7 +501,7 @@ func TestVerifyFailed(t *testing.T) { t.Run("verification error", func(t *testing.T) { policyDocument := dummyPolicyDocument() repo := mock.NewRepository() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, true, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, true, *trustpolicy.LevelStrict, false} expectedErr := ErrorVerificationFailed{} // mock the repository @@ -516,7 +528,7 @@ func TestVerifyFailed(t *testing.T) { t.Run("repo is nil", func(t *testing.T) { policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} expectedErr := errors.New("repo cannot be nil") // mock the repository @@ -582,7 +594,7 @@ func TestVerifyBlobValid(t *testing.T) { _, _, err := VerifyBlob(context.Background(), &dummyVerifier{}, strings.NewReader("some content"), []byte("signature"), opts) if err != nil { - t.Fatalf("SignaureMediaTypeMismatch expected: %v got: %v", nil, err) + t.Fatalf("expected nil error, but got: %v", err) } } @@ -605,7 +617,6 @@ func dummyPolicyStatement() (policyStatement trustpolicy.TrustPolicy) { return } - type dummySigner struct { fail bool } @@ -655,6 +666,7 @@ type dummyVerifier struct { PluginManager plugin.Manager FailVerify bool VerificationLevel trustpolicy.VerificationLevel + SkipVerification bool } func (v *dummyVerifier) Verify(_ context.Context, _ ocispec.Descriptor, _ []byte, _ VerifierVerifyOptions) (*VerificationOutcome, error) { @@ -668,6 +680,13 @@ func (v *dummyVerifier) Verify(_ context.Context, _ ocispec.Descriptor, _ []byte return outcome, nil } +func (v *dummyVerifier) SkipVerify(_ context.Context, _ VerifierVerifyOptions) (bool, *trustpolicy.VerificationLevel, error) { + if v.SkipVerification { + return true, nil, nil + } + return false, nil, nil +} + func (v *dummyVerifier) VerifyBlob(_ context.Context, _ BlobDescriptorGenerator, _ []byte, _ BlobVerifierVerifyOptions) (*VerificationOutcome, error) { if v.FailVerify { return nil, errors.New("failed verify") @@ -744,7 +763,7 @@ func TestLocalContent(t *testing.T) { MaxSignatureAttempts: math.MaxInt64, } policyDocument := dummyPolicyDocument() - verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict} + verifier := dummyVerifier{&policyDocument, mock.PluginManager{}, false, *trustpolicy.LevelStrict, false} // verify signatures inside the OCI layout folder _, _, err = Verify(context.Background(), &verifier, repo, verifyOpts) if err != nil {