Function TestValidateImageSkipAttSigCheck

internal/image/validate_test.go:659–761

(t *testing.T)

}

func TestValidateImageSkipAttSigCheck(t *testing.T) {
	tests := []struct {
		name               string
		skipAttSigCheck    bool
		skipImageSigCheck  bool
		fetchAttErr        error
		expectAttSigResult bool
		expectImgSigResult bool
	}{
		{
			name:               "skip attestation signature check disabled (default)",
			skipAttSigCheck:    false,
			expectAttSigResult: true,
			expectImgSigResult: true,
		},
		{
			name:               "skip attestation signature check enabled",
			skipAttSigCheck:    true,
			expectAttSigResult: false,
			expectImgSigResult: true,
		},
		{
			name:               "skip attestation signature check with fetch error",
			skipAttSigCheck:    true,
			fetchAttErr:        fmt.Errorf("registry unavailable"),
			expectAttSigResult: true,
			expectImgSigResult: true,
		},
		{
			name:               "skip both image and attestation signature checks",
			skipAttSigCheck:    true,
			skipImageSigCheck:  true,
			expectAttSigResult: false,
			expectImgSigResult: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			fs := afero.NewMemMapFs()
			ctx := utils.WithFS(context.Background(), fs)

			comp := app.SnapshotComponent{
				ContainerImage: imageRef,
			}

			ctx = withImageConfig(ctx, comp.ContainerImage)
			client := ecoci.NewClient(ctx)
			fakeClient := client.(*fake.FakeClient)

			fakeClient.On("Head", ref).Return(&v1.Descriptor{MediaType: types.OCIManifestSchema1}, nil)
			fakeClient.On("HasBundles", mock.Anything, refNoTag).Return(false, nil)
			fakeClient.On("VerifyImageSignatures", refNoTag, mock.Anything).Return([]oci.Signature{}, false, fmt.Errorf("no signatures found"))
			fakeClient.On("VerifyImageAttestations", refNoTag, mock.Anything).Return([]oci.Signature{}, false, fmt.Errorf("no attestations found"))
			if tt.fetchAttErr != nil {
				fakeClient.On("FetchAttestationLayers", refNoTag).Return([]oci.Signature(nil), tt.fetchAttErr)
			} else {
				fakeClient.On("FetchAttestationLayers", refNoTag).Return([]oci.Signature{validAttestation}, nil)