(t *testing.T)
| 68 | ) |
| 69 | |
| 70 | func TestBuiltinChecks(t *testing.T) { |
| 71 | cases := []struct { |
| 72 | name string |
| 73 | setup func(*fake.FakeClient) |
| 74 | component app.SnapshotComponent |
| 75 | expectedViolations []evaluator.Result |
| 76 | expectedWarnings []evaluator.Result |
| 77 | expectedImageURL string |
| 78 | }{ |
| 79 | { |
| 80 | name: "simple success", |
| 81 | setup: func(c *fake.FakeClient) { |
| 82 | c.On("Head", ref).Return(&v1.Descriptor{MediaType: types.OCIManifestSchema1}, nil) |
| 83 | c.On("HasBundles", mock.Anything, refNoTag).Return(false, nil) |
| 84 | c.On("VerifyImageSignatures", refNoTag, mock.Anything).Return([]oci.Signature{validSignature}, true, nil) |
| 85 | c.On("VerifyImageAttestations", refNoTag, mock.Anything).Return([]oci.Signature{validAttestation}, true, nil) |
| 86 | }, |
| 87 | component: app.SnapshotComponent{ContainerImage: imageRef}, |
| 88 | expectedViolations: []evaluator.Result{}, |
| 89 | expectedWarnings: []evaluator.Result{}, |
| 90 | expectedImageURL: imageRegistry + "@sha256:" + imageDigest, |
| 91 | }, |
| 92 | { |
| 93 | name: "unaccessible image", |
| 94 | setup: func(c *fake.FakeClient) { |
| 95 | c.On("Head", ref).Return(nil, nil) |
| 96 | }, |
| 97 | component: app.SnapshotComponent{ContainerImage: imageRef}, |
| 98 | expectedViolations: []evaluator.Result{ |
| 99 | {Message: "Image URL is not accessible: no response received", Metadata: map[string]interface{}{ |
| 100 | "code": "builtin.image.accessible", |
| 101 | }}, |
| 102 | }, |
| 103 | expectedWarnings: []evaluator.Result{}, |
| 104 | expectedImageURL: imageRef, |
| 105 | }, |
| 106 | { |
| 107 | name: "no image signatures", |
| 108 | setup: func(c *fake.FakeClient) { |
| 109 | c.On("Head", ref).Return(&v1.Descriptor{MediaType: types.OCIManifestSchema1}, nil) |
| 110 | c.On("HasBundles", mock.Anything, refNoTag).Return(false, nil) |
| 111 | c.On("VerifyImageSignatures", refNoTag, mock.Anything).Return(nil, false, errors.New("no image signatures client error")) |
| 112 | c.On("VerifyImageAttestations", refNoTag, mock.Anything).Return([]oci.Signature{validAttestation}, true, nil) |
| 113 | }, |
| 114 | component: app.SnapshotComponent{ContainerImage: imageRef}, |
| 115 | expectedViolations: []evaluator.Result{ |
| 116 | {Message: "Image signature check failed: no image signatures client error", Metadata: map[string]interface{}{ |
| 117 | "code": "builtin.image.signature_check", |
| 118 | }}, |
| 119 | }, |
| 120 | expectedWarnings: []evaluator.Result{}, |
| 121 | expectedImageURL: imageRegistry + "@sha256:" + imageDigest, |
| 122 | }, |
| 123 | { |
| 124 | name: "no image attestations", |
| 125 | setup: func(c *fake.FakeClient) { |
| 126 | c.On("Head", ref).Return(&v1.Descriptor{MediaType: types.OCIManifestSchema1}, nil) |
| 127 | c.On("HasBundles", mock.Anything, refNoTag).Return(false, nil) |
nothing calls this directly
no test coverage detected