Introduce fixed paths and import command that signs and uploads

Signed-off-by: Matthias Büchse <matthias.buechse@alasca.cloud>

Author: mbuechse

Tests/cli.py

@@ -6,21 +6,31 @@
 import os
 import os.path
 import re
+import shutil
+import subprocess
 import sys
 import tempfile
-import uuid
 
 import click
 import yaml
 
 from scs_cert_lib import load_spec, annotate_validity, add_period, normalize_scope
 
 
+MONITOR_URL = "https://compliance.sovereignit.cloud/"
 HERE = os.path.dirname(__file__)
+CONFIG_PATH = os.path.join(os.path.expanduser('~'), '.config', 'scs')
+STATE_PATH = os.path.join(os.path.expanduser('~'), '.local', 'share', 'scs')
+KEYFILE_PATH = os.path.join(CONFIG_PATH, '.secret', 'keyfile')
+TOKENFILE_PATH = os.path.join(CONFIG_PATH, '.secret', 'tokenfile')
 DEFAULT_SPECPATH = {
     '50393e6f-2ae1-4c5c-a62c-3b75f2abef3f': os.path.join(HERE, 'scs-compatible-iaas.yaml'),
     '1fffebe6-fd4b-44d3-a36c-fc58b4bb0180': os.path.join(HERE, 'scs-compatible-kaas.yaml'),
 }
+SCOPE_DIR = {
+    '50393e6f-2ae1-4c5c-a62c-3b75f2abef3f': 'scs-compatible-iaas',
+    '1fffebe6-fd4b-44d3-a36c-fc58b4bb0180': 'scs-compatible-kaas',
+}
 
 logger = logging.getLogger(__name__)
 
@@ -78,14 +88,42 @@ def select(specpath, version, sections, tests):
         print('\n'.join(sorted(all_testcase_ids)))
 
 
+def _sign_report(target_path):
+    return subprocess.run([
+        shutil.which('ssh-keygen'),
+        '-Y', 'sign',
+        '-f', KEYFILE_PATH,
+        '-n', 'report',
+        target_path,
+    ]).returncode
+
+
+def _upload_report(target_path, monitor_url):
+    try:
+        with open(TOKENFILE_PATH, "r") as fileobj:
+            auth_token = fileobj.read().strip()
+    except Exception as e:
+        logger.error(f"Unable to load token ({e!s}). Aborting upload to compliance monitor")
+        return 1
+    return subprocess.run([
+        shutil.which('curl'),
+        '--fail-with-body',
+        '--data-binary', f'@{target_path}.sig',
+        '--data-binary', f'@{target_path}',
+        '-H', 'Content-Type: application/x-signed-yaml',
+        '-H', f'Authorization: Basic {auth_token}',
+        f"{monitor_url.removesuffix('/')}/reports",
+    ]).returncode
+
+
 def _update_scorecard(scorecard, report, testcase_lookup):
     subject = report['subject']
     scopeuuid = report['scope']
-    if subject != scorecard.setdefault('subject', subject):
+    if subject != scorecard['subject']:
         raise RuntimeError('subjects do not match')
-    if scopeuuid != scorecard.setdefault('scope', scopeuuid):
+    if scopeuuid != scorecard['scope']:
         raise RuntimeError('scopes do not match')
-    scores = scorecard.setdefault('results', {})
+    scores = scorecard['results']
     uuid = report['uuid']
     checked_at = report['checked_at']
     checked_at_str = str(checked_at)[:19]
@@ -115,6 +153,7 @@ def _prune_scorecard(scorecard, testcase_lookup, grace_period_days=7):
         # keep results for unknown testcases for a week to leave time for migration
         if score['checked_at'] > grace_str:
             continue
+        print(tc_id, score['expires_at'], now_str, score['checked_at'], grace_str)
         del scores[tc_id]
 
 
@@ -132,61 +171,47 @@ def _dump(o):
     return yaml.safe_dump(o, default_flow_style=False, sort_keys=False, explicit_start=True)
 
 
-@cli.command()
-@click.option('--subject', '-s', 'subject', type=str)
-@click.option('--score', '-S', 'score_yaml', type=click.Path(exists=False), default=None)
-@click.option('-o', '--output', 'report_yaml', type=click.Path(exists=False), default=None)
-@click.option('--spec', 'specpath', type=click.Path(exists=True))
-def score(specpath, subject, score_yaml, report_yaml):
-    scorecard = {}
-    if score_yaml and os.path.exists(score_yaml):
-        with open(score_yaml, "r", encoding="UTF-8") as fileobj:
-            scorecard = yaml.load(fileobj, Loader=yaml.SafeLoader)
-        if not subject:
-            subject = scorecard['subject']
-        if not specpath:
-            specpath = scorecard['scope']
-    elif not subject:
-        raise click.UsageError('need to supply at least one of -s or -S')
-    elif not specpath:
-        raise click.UsageError('need to supply at least one of --spec or -S')
-    spec = _load_spec(specpath)
-    scopeuuid = spec['uuid']
-    snippet = yaml.load(sys.stdin.read(), Loader=yaml.SafeLoader)
-    if not snippet:
-        logger.warning('Empty report snippet. Bailing')
+@cli.command(name='import')
+@click.option('--monitor-url', 'monitor_url', type=str, default=MONITOR_URL)
+def import_report(monitor_url):
+    report = yaml.load(sys.stdin.read(), Loader=yaml.SafeLoader)
+    if not report:
+        logger.warning('Empty report. Bailing')
         return
-    report = {
-        'uuid': str(uuid.uuid4()),
-        'subject': subject,
-        'scope': scopeuuid,
-        **snippet
-    }
-    if report_yaml is None:
-        ts = str(report['checked_at'])[:19]
-        ts = ts.replace(':', '').replace('-', '').replace(' ', 'T')
-        report_yaml = f'report-{ts}-{subject}.yaml'
+    uuid = report['uuid']
+    subject = report['subject']
+    scopeuuid = report['scope']
+    basepath = os.path.join(STATE_PATH, SCOPE_DIR[scopeuuid], subject)
+    os.makedirs(basepath, exist_ok=True)
+    # save report
+    report_yaml = os.path.join(basepath, f'report-{uuid}.yaml')
+    if os.path.exists(report_yaml):
+        raise RuntimeError(f"File 'report-{uuid}.yaml' already exists; report uuid NOT UNIQUE?")
     _atomic_write(report_yaml, _dump(report))
-    if score_yaml:
-        _prune_scorecard(scorecard, spec['testcases'])
-        _update_scorecard(scorecard, report, spec['testcases'])
-        _atomic_write(score_yaml, _dump(scorecard))
-        # collect report uuids
-        # prune reports
-
-
-@cli.command()
-@click.option('--subject', '-s', 'subject', type=str)
-@click.option('--spec', 'specpath', type=click.Path(exists=True))
-@click.argument('score_yaml', type=click.Path(exists=False))
-def init(specpath, subject, score_yaml):
-    spec = _load_spec(specpath)
-    scorecard = {
-        'subject': subject,
-        'scope': spec['uuid'],
-        'results': {},
-    }
+    _sign_report(report_yaml)
+    _upload_report(report_yaml, monitor_url)
+    # handle scorecard
+    score_yaml = os.path.join(basepath, 'scorecard.yaml')
+    if os.path.exists(score_yaml):
+        with open(score_yaml, "r", encoding="UTF-8") as fileobj:
+            scorecard = yaml.load(fileobj, Loader=yaml.SafeLoader)
+    else:
+        scorecard = {'subject': subject, 'scope': scopeuuid, 'results': {}}
+    spec = _load_spec(scopeuuid)
+    _prune_scorecard(scorecard, spec['testcases'])
+    _update_scorecard(scorecard, report, spec['testcases'])
     _atomic_write(score_yaml, _dump(scorecard))
+    # prune reports that don't occur in scorecard (i.e., old ones)
+    report_uuids = set(result['report'] for result in scorecard['results'].values())
+    fns = os.listdir(basepath)
+    for fn in fns:
+        if not fn.startswith('report-'):
+            continue
+        uuid = fn.removeprefix('report-').removesuffix('.sig').removesuffix('.yaml')
+        if len(uuid) != 36 or uuid in report_uuids:
+            continue
+        logger.info(f"Pruning {fn!s}")
+        os.unlink(os.path.join(basepath, fn))
 
 
 if __name__ == "__main__":

Tests/iaas/openstack_test.py

@@ -12,6 +12,7 @@
 import logging
 import os
 import sys
+import uuid
 
 import openstack
 import yaml
@@ -256,13 +257,14 @@ def main(argv):
     logging.basicConfig(format='%(levelname)s: %(message)s', level=logging.DEBUG)
     openstack.enable_logging(debug=False)
     cloud = None
+    subject = None
 
     try:
         cloud = os.environ["OS_CLOUD"]
     except KeyError:
         pass
     try:
-        opts, args = getopt.gnu_getopt(argv, "c:C:", ("os-cloud=", ))
+        opts, args = getopt.gnu_getopt(argv, "c:s:", ("os-cloud=", "subject="))
     except getopt.GetoptError as exc:
         print(f"CRITICAL: {exc!r}", file=sys.stderr)
         usage(1)
@@ -271,6 +273,8 @@ def main(argv):
             usage(0)
         elif opt[0] == "-c" or opt[0] == "--os-cloud":
             cloud = opt[1]
+        elif opt[0] == "-s" or opt[0] == "--subject":
+            subject = opt[1]
         else:
             usage(2)
 
@@ -285,6 +289,8 @@ def main(argv):
     if not cloud:
         print("CRITICAL: You need to have OS_CLOUD set or pass --os-cloud=CLOUD.", file=sys.stderr)
         sys.exit(1)
+    if not subject:
+        subject = cloud
 
     c = make_container(cloud)
     try:
@@ -301,8 +307,11 @@ def main(argv):
     for testcase in testcases:
         harness(testcase, results, lambda: getattr(c, testcase.replace('-', '_')))
     report = {
+        'uuid': str(uuid.uuid4()),
         'creator': 'openstack_test.py v0.1.0',
         'checked_at': datetime.now(),
+        'subject': subject,
+        'scope': '50393e6f-2ae1-4c5c-a62c-3b75f2abef3f',
         'tests': {
             key: {'result': value}
             for key, value in results.items()