()
| 1172 | } |
| 1173 | |
| 1174 | func (s *testSuite) TestContainerMaterial() { |
| 1175 | cases := []struct { |
| 1176 | name string |
| 1177 | policy string |
| 1178 | tag string |
| 1179 | expectErr bool |
| 1180 | expectSkipped bool |
| 1181 | expectReasons []string |
| 1182 | }{ |
| 1183 | { |
| 1184 | name: "containers", |
| 1185 | // This policy injects the container tag in the `skip_reason` field |
| 1186 | policy: "file://testdata/container_policy.yaml", |
| 1187 | tag: "latest", |
| 1188 | expectSkipped: true, |
| 1189 | expectReasons: []string{"the tag is 'latest'"}, |
| 1190 | }, |
| 1191 | } |
| 1192 | |
| 1193 | for _, tc := range cases { |
| 1194 | s.Run(tc.name, func() { |
| 1195 | schema := &v12.CraftingSchema{ |
| 1196 | Materials: []*v12.CraftingSchema_Material{ |
| 1197 | { |
| 1198 | Name: "the-container", |
| 1199 | Type: v12.CraftingSchema_Material_CONTAINER_IMAGE, |
| 1200 | }, |
| 1201 | }, |
| 1202 | Policies: &v12.Policies{ |
| 1203 | Materials: []*v12.PolicyAttachment{ |
| 1204 | { |
| 1205 | Policy: &v12.PolicyAttachment_Ref{Ref: tc.policy}, |
| 1206 | }, |
| 1207 | }, |
| 1208 | Attestation: nil, |
| 1209 | }, |
| 1210 | } |
| 1211 | material := &v1.Attestation_Material{ |
| 1212 | Id: "material-1729779925030105000", |
| 1213 | M: &v1.Attestation_Material_ContainerImage_{ContainerImage: &v1.Attestation_Material_ContainerImage{ |
| 1214 | Tag: tc.tag, |
| 1215 | SignatureProvider: "cosign", |
| 1216 | }}, |
| 1217 | MaterialType: v12.CraftingSchema_Material_CONTAINER_IMAGE, |
| 1218 | } |
| 1219 | |
| 1220 | verifier := NewPolicyVerifier(schema.Policies, nil, &s.logger) |
| 1221 | res, err := verifier.VerifyMaterial(context.TODO(), material, "") |
| 1222 | |
| 1223 | if tc.expectErr { |
| 1224 | s.Error(err) |
| 1225 | return |
| 1226 | } |
| 1227 | |
| 1228 | s.Require().NoError(err) |
| 1229 | s.Len(res, 1) |
| 1230 | s.Equal(tc.expectSkipped, res[0].Skipped) |
| 1231 | if len(res[0].SkipReasons) > 0 { |
nothing calls this directly
no test coverage detected