Skip to content

Commit 08e4075

Browse files
joejstuartjoejstuart
committed
cleanup unused functions
1 parent 3154516 commit 08e4075

2 files changed

Lines changed: 0 additions & 170 deletions

File tree

‎internal/validate/vsa/rekor_retriever.go‎

Lines changed: 0 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -123,11 +123,6 @@ func (r *RekorVSARetriever) searchForImageDigest(ctx context.Context, imageDiges
123123
return entries, nil
124124
}
125125

126-
// GetAllEntriesForImageDigest returns all entries for an image digest without VSA filtering
127-
func (r *RekorVSARetriever) GetAllEntriesForImageDigest(ctx context.Context, imageDigest string) ([]models.LogEntryAnon, error) {
128-
return r.searchForImageDigest(ctx, imageDigest)
129-
}
130-
131126
// decodeBodyJSON decodes the base64-encoded body of a Rekor entry
132127
func (r *RekorVSARetriever) decodeBodyJSON(entry models.LogEntryAnon) (map[string]any, error) {
133128
bodyStr, ok := entry.Body.(string)
@@ -170,17 +165,6 @@ func isValidImageDigest(digest string) bool {
170165
return err == nil
171166
}
172167

173-
// IsValidHexHash validates that a string is a valid hex hash
174-
func (r *RekorVSARetriever) IsValidHexHash(hash string) bool {
175-
if len(hash) == 0 {
176-
return false
177-
}
178-
179-
// Check if it's a valid hex string
180-
_, err := hex.DecodeString(hash)
181-
return err == nil
182-
}
183-
184168
// classifyEntryKind determines the kind of a Rekor entry (intoto, intoto-v002, dsse, etc.)
185169
func (r *RekorVSARetriever) classifyEntryKind(entry models.LogEntryAnon) string {
186170
// Prefer Body structure from the decoded Rekor body
@@ -257,46 +241,6 @@ func (r *RekorVSARetriever) classifyEntryKind(entry models.LogEntryAnon) string
257241
return "unknown"
258242
}
259243

260-
// ExtractStatementFromIntoto extracts the Statement JSON from an in-toto entry
261-
func (r *RekorVSARetriever) ExtractStatementFromIntoto(entry *models.LogEntryAnon) ([]byte, error) {
262-
if entry == nil {
263-
return nil, fmt.Errorf("entry cannot be nil")
264-
}
265-
266-
// Check if this is an in-toto entry
267-
entryKind := r.classifyEntryKind(*entry)
268-
if entryKind != "intoto" {
269-
return nil, fmt.Errorf("entry is not an in-toto entry (kind: %s)", entryKind)
270-
}
271-
272-
// Extract the DSSE envelope from the entry
273-
envelopeBytes, err := r.extractDSSEEnvelopeFromEntry(entry)
274-
if err != nil {
275-
return nil, fmt.Errorf("failed to extract DSSE envelope from entry: %w", err)
276-
}
277-
278-
// Parse the DSSE envelope
279-
var envelope map[string]interface{}
280-
if err := json.Unmarshal(envelopeBytes, &envelope); err != nil {
281-
return nil, fmt.Errorf("failed to parse DSSE envelope: %w", err)
282-
}
283-
284-
// Extract the payload
285-
payloadBase64, ok := envelope["payload"].(string)
286-
if !ok {
287-
return nil, fmt.Errorf("payload not found in DSSE envelope")
288-
}
289-
290-
// Decode the base64 payload
291-
payloadBytes, err := base64.StdEncoding.DecodeString(payloadBase64)
292-
if err != nil {
293-
return nil, fmt.Errorf("failed to decode base64 payload: %w", err)
294-
}
295-
296-
// The payload should contain the Statement JSON
297-
return payloadBytes, nil
298-
}
299-
300244
// extractDSSEEnvelopeFromEntry extracts the DSSE envelope from a Rekor entry
301245
func (r *RekorVSARetriever) extractDSSEEnvelopeFromEntry(entry *models.LogEntryAnon) ([]byte, error) {
302246
// Determine entry type first
@@ -356,48 +300,6 @@ func (r *RekorVSARetriever) extractDSSEEnvelopeFromEntry(entry *models.LogEntryA
356300
return nil, fmt.Errorf("could not extract DSSE envelope from entry")
357301
}
358302

359-
// extractVSAStatement extracts the VSA Statement from an in-toto entry
360-
func (r *RekorVSARetriever) extractVSAStatement(entry models.LogEntryAnon) ([]byte, error) {
361-
// Check if this is an in-toto 0.0.2 entry (single entry)
362-
entryKind := r.classifyEntryKind(entry)
363-
if entryKind == "intoto-v002" {
364-
// For in-toto 0.0.2 entries, the payload is directly in the Attestation field
365-
if entry.Attestation == nil || entry.Attestation.Data == nil {
366-
return nil, fmt.Errorf("in-toto 0.0.2 entry does not contain attestation data")
367-
}
368-
369-
// The attestation data contains the decoded payload (VSA statement)
370-
log.Debugf("Extracting VSA statement from in-toto 0.0.2 entry attestation")
371-
return entry.Attestation.Data, nil
372-
}
373-
374-
// For dual entries (in-toto 0.0.1 + DSSE), use the existing logic
375-
envelopeBytes, err := r.extractDSSEEnvelopeFromEntry(&entry)
376-
if err != nil {
377-
return nil, fmt.Errorf("failed to extract DSSE envelope: %w", err)
378-
}
379-
380-
var envelope map[string]interface{}
381-
if err := json.Unmarshal(envelopeBytes, &envelope); err != nil {
382-
return nil, fmt.Errorf("failed to parse DSSE envelope: %w", err)
383-
}
384-
385-
// Extract the payload
386-
payloadBase64, ok := envelope["payload"].(string)
387-
if !ok {
388-
return nil, fmt.Errorf("payload not found in DSSE envelope")
389-
}
390-
391-
// Decode the base64 payload
392-
payloadBytes, err := base64.StdEncoding.DecodeString(payloadBase64)
393-
if err != nil {
394-
return nil, fmt.Errorf("failed to decode base64 payload: %w", err)
395-
}
396-
397-
// The payload should contain the Statement JSON
398-
return payloadBytes, nil
399-
}
400-
401303
// RetrieveVSA retrieves VSA data as a DSSE envelope for a given image digest
402304
// This is the main method used by validation functions to get VSA data for signature verification
403305
func (r *RekorVSARetriever) RetrieveVSA(ctx context.Context, imageDigest string) (*ssldsse.Envelope, error) {

‎internal/validate/vsa/rekor_retriever_test.go‎

Lines changed: 0 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package vsa
1919
import (
2020
"context"
2121
"encoding/base64"
22-
"encoding/json"
2322
"fmt"
2423
"testing"
2524

@@ -61,53 +60,6 @@ func (m *MockRekorClient) GetLogEntryByUUID(ctx context.Context, uuid string) (*
6160
return nil, fmt.Errorf("entry not found")
6261
}
6362

64-
func TestRekorVSARetriever_ExtractVSAStatement_IntotoV002(t *testing.T) {
65-
// Create a mock in-toto 0.0.2 entry
66-
// The payload contains a VSA statement
67-
vsaStatement := `{"_type":"https://in-toto.io/Statement/v0.1","subject":[{"name":"test-image","hashes":{"sha256":"abc123"}}],"predicateType":"https://conforma.dev/verification_summary/v1","predicate":{"test":"data"}}`
68-
69-
entry := models.LogEntryAnon{
70-
LogIndex: &[]int64{123}[0],
71-
LogID: &[]string{"intoto-v002-uuid"}[0],
72-
Body: base64.StdEncoding.EncodeToString([]byte(`{"IntotoObj": {"content": {"envelope": {"payloadType": "application/vnd.in-toto+json", "signatures": [{"sig": "dGVzdA=="}]}}}}`)),
73-
Attestation: &models.LogEntryAnonAttestation{
74-
Data: strfmt.Base64(vsaStatement), // The VSA statement is in the Attestation field
75-
},
76-
}
77-
78-
mockClient := &MockRekorClient{entries: []models.LogEntryAnon{entry}}
79-
retriever := NewRekorVSARetrieverWithClient(mockClient, DefaultRetrievalOptions())
80-
81-
// Test successful extraction
82-
statementBytes, err := retriever.extractVSAStatement(entry)
83-
assert.NoError(t, err)
84-
assert.NotNil(t, statementBytes)
85-
86-
// Verify the extracted statement
87-
var statement map[string]interface{}
88-
err = json.Unmarshal(statementBytes, &statement)
89-
assert.NoError(t, err)
90-
assert.Equal(t, "https://in-toto.io/Statement/v0.1", statement["_type"])
91-
assert.Equal(t, "https://conforma.dev/verification_summary/v1", statement["predicateType"])
92-
}
93-
94-
func TestRekorVSARetriever_ExtractVSAStatement_NoAttestation(t *testing.T) {
95-
// Test case where entry has no Attestation field
96-
entry := models.LogEntryAnon{
97-
LogIndex: &[]int64{123}[0],
98-
LogID: &[]string{"intoto-v002-uuid"}[0],
99-
Body: base64.StdEncoding.EncodeToString([]byte(`{"IntotoObj": {"content": {"envelope": {"payloadType": "application/vnd.in-toto+json", "signatures": [{"sig": "dGVzdA=="}]}}}}`)),
100-
// No Attestation field
101-
}
102-
103-
mockClient := &MockRekorClient{entries: []models.LogEntryAnon{entry}}
104-
retriever := NewRekorVSARetrieverWithClient(mockClient, DefaultRetrievalOptions())
105-
106-
_, err := retriever.extractVSAStatement(entry)
107-
assert.Error(t, err)
108-
assert.Contains(t, err.Error(), "in-toto 0.0.2 entry does not contain attestation data")
109-
}
110-
11163
func TestRekorVSARetriever_ClassifyEntryKind(t *testing.T) {
11264
mockClient := &MockRekorClient{entries: []models.LogEntryAnon{}}
11365
retriever := NewRekorVSARetrieverWithClient(mockClient, DefaultRetrievalOptions())
@@ -164,30 +116,6 @@ func TestRekorVSARetriever_ClassifyEntryKind(t *testing.T) {
164116
}
165117
}
166118

167-
func TestRekorVSARetriever_IsValidHexHash(t *testing.T) {
168-
mockClient := &MockRekorClient{entries: []models.LogEntryAnon{}}
169-
retriever := NewRekorVSARetrieverWithClient(mockClient, DefaultRetrievalOptions())
170-
171-
tests := []struct {
172-
name string
173-
hash string
174-
expected bool
175-
}{
176-
{"valid hex", "abcdef1234567890", true},
177-
{"valid hex with uppercase", "ABCDEF1234567890", true},
178-
{"empty string", "", false},
179-
{"invalid hex", "invalid-hex!", false},
180-
{"partial hex", "abcd", true},
181-
}
182-
183-
for _, tt := range tests {
184-
t.Run(tt.name, func(t *testing.T) {
185-
result := retriever.IsValidHexHash(tt.hash)
186-
assert.Equal(t, tt.expected, result)
187-
})
188-
}
189-
}
190-
191119
func TestRekorVSARetriever_RetrieveVSA(t *testing.T) {
192120
// Test the main RetrieveVSA method that returns ssldsse.Envelope
193121
imageDigest := "sha256:abc123def456"

0 commit comments

Comments
 (0)