Skip to content

Commit a2cf384

Browse files
mtrmacmtrmac
committed
Change fixtureVariants to identify the v3 fixture
For now, the value is not used, should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>
1 parent 629dae5 commit a2cf384

1 file changed

Lines changed: 72 additions & 63 deletions

File tree

‎image/signature/mechanism_test.go‎

Lines changed: 72 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,23 @@ const (
1919

2020
// Many of the tests use two fixtures: V4 signature packets (*.signature), and V3 signature packets (*.signature-v3)
2121

22-
// fixtureVariants loads V3 and V4 signature fixture variants based on the v4 fixture path, and returns a map which makes it easy to test both.
23-
func fixtureVariants(t *testing.T, v4Path string) map[string][]byte {
22+
type fixtureVariant struct {
23+
path string
24+
bytes []byte
25+
isV3 bool
26+
}
27+
28+
// fixtureVariants loads V3 and V4 signature fixture variants based on the v4 fixture path.
29+
func fixtureVariants(t *testing.T, v4Path string) []fixtureVariant {
2430
v4, err := os.ReadFile(v4Path)
2531
require.NoError(t, err)
2632
v3Path := v4Path + "-v3"
2733
v3, err := os.ReadFile(v3Path)
2834
require.NoError(t, err)
29-
return map[string][]byte{v4Path: v4, v3Path: v3}
35+
return []fixtureVariant{
36+
{path: v4Path, bytes: v4, isV3: false},
37+
{path: v3Path, bytes: v3, isV3: true},
38+
}
3039
}
3140

3241
func TestSigningNotSupportedError(t *testing.T) {
@@ -56,9 +65,9 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
5665
mech, err = newGPGSigningMechanismInDirectory("")
5766
require.NoError(t, err)
5867
defer mech.Close()
59-
for version, signature := range signatures {
60-
_, _, err := mech.Verify(signature)
61-
assert.Error(t, err, version)
68+
for _, variant := range signatures {
69+
_, _, err := mech.Verify(variant.bytes)
70+
assert.Error(t, err, variant.path)
6271
}
6372

6473
// Similarly, using a newly created empty directory makes TestKeyFingerprint
@@ -67,9 +76,9 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
6776
mech, err = newGPGSigningMechanismInDirectory(emptyDir)
6877
require.NoError(t, err)
6978
defer mech.Close()
70-
for version, signature := range signatures {
71-
_, _, err := mech.Verify(signature)
72-
assert.Error(t, err, version)
79+
for _, variant := range signatures {
80+
_, _, err := mech.Verify(variant.bytes)
81+
assert.Error(t, err, variant.path)
7382
}
7483

7584
// If pubring.gpg is unreadable in the directory, either initializing
@@ -82,29 +91,29 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
8291
mech, err = newGPGSigningMechanismInDirectory(unreadableDir)
8392
if err == nil {
8493
defer mech.Close()
85-
for version, signature := range signatures {
86-
_, _, err := mech.Verify(signature)
87-
assert.Error(t, err, version)
94+
for _, variant := range signatures {
95+
_, _, err := mech.Verify(variant.bytes)
96+
assert.Error(t, err, variant.path)
8897
}
8998
}
9099

91100
// Setting the directory parameter to testGPGHomeDirectory makes the key available.
92101
mech, err = newGPGSigningMechanismInDirectory(testGPGHomeDirectory)
93102
require.NoError(t, err)
94103
defer mech.Close()
95-
for version, signature := range signatures {
96-
_, _, err := mech.Verify(signature)
97-
assert.NoError(t, err, version)
104+
for _, variant := range signatures {
105+
_, _, err := mech.Verify(variant.bytes)
106+
assert.NoError(t, err, variant.path)
98107
}
99108

100109
// If we use the default directory mechanism, GNUPGHOME is respected.
101110
t.Setenv("GNUPGHOME", testGPGHomeDirectory)
102111
mech, err = newGPGSigningMechanismInDirectory("")
103112
require.NoError(t, err)
104113
defer mech.Close()
105-
for version, signature := range signatures {
106-
_, _, err := mech.Verify(signature)
107-
assert.NoError(t, err, version)
114+
for _, variant := range signatures {
115+
_, _, err := mech.Verify(variant.bytes)
116+
assert.NoError(t, err, variant.path)
108117
}
109118
}
110119

@@ -116,9 +125,9 @@ func TestNewEphemeralGPGSigningMechanism(t *testing.T) {
116125
assert.Empty(t, keyIdentities)
117126
// Try validating a signature when the key is unknown.
118127
signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
119-
for version, signature := range signatures {
120-
_, _, err := mech.Verify(signature)
121-
require.Error(t, err, version)
128+
for _, variant := range signatures {
129+
_, _, err := mech.Verify(variant.bytes)
130+
require.Error(t, err, variant.path)
122131
}
123132

124133
// Successful import
@@ -129,11 +138,11 @@ func TestNewEphemeralGPGSigningMechanism(t *testing.T) {
129138
defer mech.Close()
130139
assert.Equal(t, []string{TestKeyFingerprint}, keyIdentities)
131140
// After import, the signature should validate.
132-
for version, signature := range signatures {
133-
content, signingFingerprint, err := mech.Verify(signature)
134-
require.NoError(t, err, version)
135-
assert.Equal(t, []byte("This is not JSON\n"), content, version)
136-
assert.Equal(t, TestKeyFingerprint, signingFingerprint, version)
141+
for _, variant := range signatures {
142+
content, signingFingerprint, err := mech.Verify(variant.bytes)
143+
require.NoError(t, err, variant.path)
144+
assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
145+
assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant.path)
137146
}
138147

139148
// Import of a key with a subkey
@@ -241,28 +250,28 @@ func TestGPGSigningMechanismVerify(t *testing.T) {
241250

242251
// Successful verification
243252
signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
244-
for variant, signature := range signatures {
245-
content, signingFingerprint, err := mech.Verify(signature)
246-
require.NoError(t, err, variant)
247-
assert.Equal(t, []byte("This is not JSON\n"), content, variant)
248-
assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant)
253+
for _, variant := range signatures {
254+
content, signingFingerprint, err := mech.Verify(variant.bytes)
255+
require.NoError(t, err, variant.path)
256+
assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
257+
assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant.path)
249258
}
250259
// Successful verification of a signature using a subkey
251260
signatures = fixtureVariants(t, "./fixtures/subkey.signature")
252-
for variant, signature := range signatures {
253-
content, signingFingerprint, err := mech.Verify(signature)
254-
require.NoError(t, err, variant)
255-
assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest:latest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{}}`), content, variant)
261+
for _, variant := range signatures {
262+
content, signingFingerprint, err := mech.Verify(variant.bytes)
263+
require.NoError(t, err, variant.path)
264+
assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest:latest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{}}`), content, variant.path)
256265
if signingFingerprint != TestKeyFingerprintPrimaryWithSubkey {
257-
assert.Equal(t, TestKeyFingerprintSubkeyWithSubkey, signingFingerprint, variant)
266+
assert.Equal(t, TestKeyFingerprintSubkeyWithSubkey, signingFingerprint, variant.path)
258267
withLookup, ok := mech.(signingMechanismWithVerificationIdentityLookup)
259-
require.True(t, ok, variant)
268+
require.True(t, ok, variant.path)
260269

261270
primaryKey, err := withLookup.keyIdentityForVerificationKeyIdentity(signingFingerprint)
262-
require.NoError(t, err, variant)
271+
require.NoError(t, err, variant.path)
263272
signingFingerprint = primaryKey
264273
}
265-
assert.Equal(t, TestKeyFingerprintPrimaryWithSubkey, signingFingerprint, variant)
274+
assert.Equal(t, TestKeyFingerprintPrimaryWithSubkey, signingFingerprint, variant.path)
266275
}
267276

268277
// For extra paranoia, test that we return nil data on error.
@@ -296,23 +305,23 @@ func TestGPGSigningMechanismVerify(t *testing.T) {
296305

297306
// Corrupt signature
298307
signatures = fixtureVariants(t, "./fixtures/corrupt.signature")
299-
for version, signature := range signatures {
300-
content, signingFingerprint, err := mech.Verify(signature)
301-
assertSigningError(t, content, signingFingerprint, err, version)
308+
for _, variant := range signatures {
309+
content, signingFingerprint, err := mech.Verify(variant.bytes)
310+
assertSigningError(t, content, signingFingerprint, err, variant.path)
302311
}
303312

304313
// Valid signature with an unknown key
305314
signatures = fixtureVariants(t, "./fixtures/unknown-key.signature")
306-
for version, signature := range signatures {
307-
content, signingFingerprint, err := mech.Verify(signature)
308-
assertSigningError(t, content, signingFingerprint, err, version)
315+
for _, variant := range signatures {
316+
content, signingFingerprint, err := mech.Verify(variant.bytes)
317+
assertSigningError(t, content, signingFingerprint, err, variant.path)
309318
}
310319

311320
// Valid signature with a revoked subkey
312321
signatures = fixtureVariants(t, "./fixtures/subkey-revoked.signature")
313-
for version, signature := range signatures {
314-
content, signingFingerprint, err := mech.Verify(signature)
315-
assertSigningError(t, content, signingFingerprint, err, version)
322+
for _, variant := range signatures {
323+
content, signingFingerprint, err := mech.Verify(variant.bytes)
324+
assertSigningError(t, content, signingFingerprint, err, variant.path)
316325
}
317326

318327
// The various GPG/GPGME failures cases are not obviously easy to reach.
@@ -367,11 +376,11 @@ func TestGPGSigningMechanismUntrustedSignatureContents(t *testing.T) {
367376

368377
// A valid signature
369378
signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
370-
for version, signature := range signatures {
371-
content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
372-
require.NoError(t, err, version)
373-
assert.Equal(t, []byte("This is not JSON\n"), content, version)
374-
assert.Equal(t, TestKeyShortID, shortKeyID, version)
379+
for _, variant := range signatures {
380+
content, shortKeyID, err := mech.UntrustedSignatureContents(variant.bytes)
381+
require.NoError(t, err, variant.path)
382+
assert.Equal(t, []byte("This is not JSON\n"), content, variant.path)
383+
assert.Equal(t, TestKeyShortID, shortKeyID, variant.path)
375384
}
376385

377386
// Completely invalid signature.
@@ -403,19 +412,19 @@ func TestGPGSigningMechanismUntrustedSignatureContents(t *testing.T) {
403412

404413
// Corrupt signature
405414
signatures = fixtureVariants(t, "./fixtures/corrupt.signature")
406-
for version, signature := range signatures {
407-
content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
408-
require.NoError(t, err, version)
409-
assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic ","timestamp":1458239713}}`), content, version)
410-
assert.Equal(t, TestKeyShortID, shortKeyID, version)
415+
for _, variant := range signatures {
416+
content, shortKeyID, err := mech.UntrustedSignatureContents(variant.bytes)
417+
require.NoError(t, err, variant.path)
418+
assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic ","timestamp":1458239713}}`), content, variant.path)
419+
assert.Equal(t, TestKeyShortID, shortKeyID, variant.path)
411420
}
412421

413422
// Valid signature with an unknown key
414423
signatures = fixtureVariants(t, "./fixtures/unknown-key.signature")
415-
for version, signature := range signatures {
416-
content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
417-
require.NoError(t, err, version)
418-
assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic 0.1.13-dev","timestamp":1464633474}}`), content, version)
419-
assert.Equal(t, "5F9470E3BC6C3B55", shortKeyID, version)
424+
for _, variant := range signatures {
425+
content, shortKeyID, err := mech.UntrustedSignatureContents(variant.bytes)
426+
require.NoError(t, err, variant.path)
427+
assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic 0.1.13-dev","timestamp":1464633474}}`), content, variant.path)
428+
assert.Equal(t, "5F9470E3BC6C3B55", shortKeyID, variant.path)
420429
}
421430
}

0 commit comments

Comments
 (0)