Function TestValidateImageSkipImageSigCheck

internal/image/validate_test.go:575–657

(t *testing.T)

}

func TestValidateImageSkipImageSigCheck(t *testing.T) {
	tests := []struct {
		name                 string
		skipImageSigCheck    bool
		expectImageSigResult bool
	}{
		{
			name:                 "skip image signature check disabled (default)",
			skipImageSigCheck:    false,
			expectImageSigResult: true,
		},
		{
			name:                 "skip image signature check enabled",
			skipImageSigCheck:    true,
			expectImageSigResult: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			fs := afero.NewMemMapFs()
			ctx := utils.WithFS(context.Background(), fs)

			// Create a test component with a valid SHA256 digest
			comp := app.SnapshotComponent{
				ContainerImage: imageRef, // Use the existing imageRef constant
			}

			// Set up mock image infrastructure like other tests
			ctx = withImageConfig(ctx, comp.ContainerImage)
			client := ecoci.NewClient(ctx)
			fakeClient := client.(*fake.FakeClient)

			// Set up minimal fake data for image to pass accessibility check
			// and signature/attestation checks (they will fail but create results)
			fakeClient.On("Head", ref).Return(&v1.Descriptor{MediaType: types.OCIManifestSchema1}, nil)
			fakeClient.On("HasBundles", mock.Anything, refNoTag).Return(false, nil)
			fakeClient.On("VerifyImageSignatures", refNoTag, mock.Anything).Return([]oci.Signature{}, false, fmt.Errorf("no signatures found"))
			fakeClient.On("VerifyImageAttestations", refNoTag, mock.Anything).Return([]oci.Signature{}, false, fmt.Errorf("no attestations found"))

			// Create policy options to set SkipImageSigCheck
			opts := policy.Options{
				EffectiveTime:     policy.Now,
				SkipImageSigCheck: tt.skipImageSigCheck,
				Identity: cosign.Identity{
					Issuer:  "https://example.com/oidc",
					Subject: "test@example.com",
				},
			}

			// Apply the options to create the policy
			updatedPolicy, _, err := policy.PreProcessPolicy(ctx, opts)
			require.NoError(t, err)

			// Create a mock snapshot spec
			snap := &app.SnapshotSpec{}

			// Create empty evaluators slice