mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-10-01 01:36:09 -04:00
57b8efd1ec
Fetched measurements are now verified using Rekor in addition to a signature check. Signed-off-by: Fabian Kammel <fk@edgeless.systems>
100 lines
2.6 KiB
Go
100 lines
2.6 KiB
Go
//go:build integration
|
|
|
|
/*
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package sigstore
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/goleak"
|
|
)
|
|
|
|
func TestMain(m *testing.M) {
|
|
goleak.VerifyTestMain(m,
|
|
// TODO: Remove once https://github.com/sigstore/rekor/issues/1094 resolved
|
|
goleak.IgnoreTopFunction("internal/poll.runtime_pollWait"),
|
|
)
|
|
}
|
|
|
|
func TestRekorSearchByHash(t *testing.T) {
|
|
testCases := map[string]struct {
|
|
hash string
|
|
wantEmpty bool
|
|
}{
|
|
"Constellation CLI v2.0.0 hash": {
|
|
hash: "40e137b9b9b8204d672642fd1e181c6d5ccb50cfc5cc7fcbb06a8c2c78f44aff",
|
|
},
|
|
"other hash": {
|
|
hash: "d9c5a43ba6284e1059b7e871bcf9b52f376d62b9198f300b1402d1c4d9b7431f",
|
|
wantEmpty: true,
|
|
},
|
|
}
|
|
|
|
for name, tc := range testCases {
|
|
t.Run(name, func(t *testing.T) {
|
|
assert := assert.New(t)
|
|
require := require.New(t)
|
|
|
|
rekor, err := NewRekor()
|
|
require.NoError(err)
|
|
|
|
uuids, err := rekor.SearchByHash(context.Background(), tc.hash)
|
|
assert.NoError(err)
|
|
|
|
if tc.wantEmpty {
|
|
assert.Empty(err)
|
|
return
|
|
}
|
|
assert.NotEmpty(uuids)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestVerifyEntry(t *testing.T) {
|
|
testCases := map[string]struct {
|
|
uuid string
|
|
pubKey string
|
|
wantError bool
|
|
}{
|
|
"Constellation CLI v2.0.0": {
|
|
uuid: "362f8ecba72f4326afaba7f6635b3e058888692841848e5514357315be9528474b23f5dcccb82b13",
|
|
pubKey: "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFZjhGMWhwbXdFK1lDRlh6akd0YVFjckw2WFpWVApKbUVlNWlTTHZHMVN5UVNBZXc3V2RNS0Y2bzl0OGUyVEZ1Q2t6bE9oaGx3czJPSFdiaUZabkZXQ0Z3PT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==",
|
|
},
|
|
"unknown uuid": {
|
|
uuid: "46073a33852fc797ccc341a30323bd69119ff03936bf8d17061606e3e2e4be1fe70dccaa1b66bc34",
|
|
pubKey: "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFZjhGMWhwbXdFK1lDRlh6akd0YVFjckw2WFpWVApKbUVlNWlTTHZHMVN5UVNBZXc3V2RNS0Y2bzl0OGUyVEZ1Q2t6bE9oaGx3czJPSFdiaUZabkZXQ0Z3PT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==",
|
|
wantError: true,
|
|
},
|
|
"broken key": {
|
|
uuid: "362f8ecba72f4326afaba7f6635b3e058888692841848e5514357315be9528474b23f5dcccb82b13",
|
|
pubKey: "d2VsbCB0aGlzIGlzIGRlZmluaXRlbHkgbm90IGEga2V5",
|
|
wantError: true,
|
|
},
|
|
}
|
|
|
|
for name, tc := range testCases {
|
|
t.Run(name, func(t *testing.T) {
|
|
assert := assert.New(t)
|
|
require := require.New(t)
|
|
|
|
rekor, err := NewRekor()
|
|
require.NoError(err)
|
|
|
|
err = rekor.VerifyEntry(context.Background(), tc.uuid, tc.pubKey)
|
|
if tc.wantError {
|
|
assert.Error(err)
|
|
return
|
|
}
|
|
assert.NoError(err)
|
|
})
|
|
}
|
|
}
|