Skip to content

Commit 8b00c5c

Browse files
vdemeestervdemeester
committed
Add more content trust tests
Importing from moby's DockerTrustSuite tests. Signed-off-by: Vincent Demeester <[email protected]>
1 parent 2731c71 commit 8b00c5c

40 files changed

Lines changed: 1258 additions & 183 deletions

‎cli/command/container/create_test.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package container
22

33
import (
44
"context"
5+
"fmt"
56
"io"
67
"io/ioutil"
78
"os"
@@ -10,6 +11,7 @@ import (
1011
"testing"
1112

1213
"github.com/docker/cli/internal/test"
14+
"github.com/docker/cli/internal/test/notary"
1315
"github.com/docker/docker/api/types"
1416
"github.com/docker/docker/api/types/container"
1517
"github.com/docker/docker/api/types/network"
@@ -119,6 +121,51 @@ func TestCreateContainerPullsImageIfMissing(t *testing.T) {
119121
assert.Check(t, is.Contains(stderr, "Unable to find image 'does-not-exist-locally:latest' locally"))
120122
}
121123

124+
func TestNewCreateCommandWithContentTrustErrors(t *testing.T) {
125+
testCases := []struct {
126+
name string
127+
args []string
128+
expectedError string
129+
notaryFunc test.NotaryClientFuncType
130+
}{
131+
{
132+
name: "offline-notary-server",
133+
notaryFunc: notary.GetOfflineNotaryRepository,
134+
expectedError: "client is offline",
135+
args: []string{"image:tag"},
136+
},
137+
{
138+
name: "uninitialized-notary-server",
139+
notaryFunc: notary.GetUninitializedNotaryRepository,
140+
expectedError: "remote trust data does not exist",
141+
args: []string{"image:tag"},
142+
},
143+
{
144+
name: "empty-notary-server",
145+
notaryFunc: notary.GetEmptyTargetsNotaryRepository,
146+
expectedError: "No valid trust data for tag",
147+
args: []string{"image:tag"},
148+
},
149+
}
150+
for _, tc := range testCases {
151+
cli := test.NewFakeCli(&fakeClient{
152+
createContainerFunc: func(config *container.Config,
153+
hostConfig *container.HostConfig,
154+
networkingConfig *network.NetworkingConfig,
155+
containerName string,
156+
) (container.ContainerCreateCreatedBody, error) {
157+
return container.ContainerCreateCreatedBody{}, fmt.Errorf("shouldn't try to pull image")
158+
},
159+
}, test.EnableContentTrust)
160+
cli.SetNotaryClient(tc.notaryFunc)
161+
cmd := NewCreateCommand(cli)
162+
cmd.SetOutput(ioutil.Discard)
163+
cmd.SetArgs(tc.args)
164+
err := cmd.Execute()
165+
assert.ErrorContains(t, err, tc.expectedError)
166+
}
167+
}
168+
122169
type fakeNotFound struct{}
123170

124171
func (f fakeNotFound) NotFound() bool { return true }

‎cli/command/container/run_test.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
package container
22

33
import (
4+
"fmt"
45
"testing"
56

67
"github.com/docker/cli/internal/test"
8+
"github.com/docker/cli/internal/test/notary"
79
"github.com/docker/docker/api/types/container"
810
"github.com/docker/docker/api/types/network"
911
"github.com/gotestyourself/gotestyourself/assert"
12+
is "github.com/gotestyourself/gotestyourself/assert/cmp"
1013
)
1114

1215
func TestRunLabel(t *testing.T) {
@@ -23,3 +26,48 @@ func TestRunLabel(t *testing.T) {
2326
cmd.SetArgs([]string{"--label", "foo", "busybox"})
2427
assert.NilError(t, cmd.Execute())
2528
}
29+
30+
func TestRunCommandWithContentTrustErrors(t *testing.T) {
31+
testCases := []struct {
32+
name string
33+
args []string
34+
expectedError string
35+
notaryFunc test.NotaryClientFuncType
36+
}{
37+
{
38+
name: "offline-notary-server",
39+
notaryFunc: notary.GetOfflineNotaryRepository,
40+
expectedError: "client is offline",
41+
args: []string{"image:tag"},
42+
},
43+
{
44+
name: "uninitialized-notary-server",
45+
notaryFunc: notary.GetUninitializedNotaryRepository,
46+
expectedError: "remote trust data does not exist",
47+
args: []string{"image:tag"},
48+
},
49+
{
50+
name: "empty-notary-server",
51+
notaryFunc: notary.GetEmptyTargetsNotaryRepository,
52+
expectedError: "No valid trust data for tag",
53+
args: []string{"image:tag"},
54+
},
55+
}
56+
for _, tc := range testCases {
57+
cli := test.NewFakeCli(&fakeClient{
58+
createContainerFunc: func(config *container.Config,
59+
hostConfig *container.HostConfig,
60+
networkingConfig *network.NetworkingConfig,
61+
containerName string,
62+
) (container.ContainerCreateCreatedBody, error) {
63+
return container.ContainerCreateCreatedBody{}, fmt.Errorf("shouldn't try to pull image")
64+
},
65+
}, test.EnableContentTrust)
66+
cli.SetNotaryClient(tc.notaryFunc)
67+
cmd := NewRunCommand(cli)
68+
cmd.SetArgs(tc.args)
69+
err := cmd.Execute()
70+
assert.Assert(t, err != nil)
71+
assert.Assert(t, is.Contains(cli.ErrBuffer().String(), tc.expectedError))
72+
}
73+
}

‎cli/command/image/build_linux_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ func TestRunBuildResetsUidAndGidInContext(t *testing.T) {
4141

4242
options := newBuildOptions()
4343
options.context = dir.Path()
44+
options.untrusted = true
4445

4546
err := runBuild(cli, options)
4647
assert.NilError(t, err)

‎cli/command/image/build_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ func TestRunBuildDockerfileFromStdinWithCompress(t *testing.T) {
5757
options.compress = true
5858
options.dockerfileName = "-"
5959
options.context = dir
60+
options.untrusted = true
6061

6162
err = runBuild(cli, options)
6263
assert.NilError(t, err)
@@ -191,6 +192,7 @@ RUN echo hello world
191192
cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeImageBuild})
192193
options := newBuildOptions()
193194
options.context = tmpDir.Join("context-link")
195+
options.untrusted = true
194196
assert.NilError(t, runBuild(cli, options))
195197

196198
assert.DeepEqual(t, files, []string{"Dockerfile"})

‎cli/command/image/pull.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ func runPull(cli command.Cli, opts pullOptions) error {
5959
}
6060

6161
ctx := context.Background()
62-
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, AuthResolver(cli), distributionRef.String())
62+
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, AuthResolver(cli), distributionRef.String())
6363
if err != nil {
6464
return err
6565
}

‎cli/command/image/pull_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ func TestNewPullCommandWithContentTrustErrors(t *testing.T) {
9393
args: []string{"image:tag"},
9494
},
9595
{
96-
name: "empty-notary-server",
96+
name: "uninitialized-notary-server",
9797
notaryFunc: notary.GetUninitializedNotaryRepository,
9898
expectedError: "remote trust data does not exist",
9999
args: []string{"image:tag"},

‎cli/command/image/trust.go‎

Lines changed: 5 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ func trustedPull(ctx context.Context, cli command.Cli, imgRefAndAuth trust.Image
198198
if err != nil {
199199
return err
200200
}
201-
updatedImgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, AuthResolver(cli), trustedRef.String())
201+
updatedImgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, AuthResolver(cli), trustedRef.String())
202202
if err != nil {
203203
return err
204204
}
@@ -293,35 +293,24 @@ func imagePullPrivileged(ctx context.Context, cli command.Cli, imgRefAndAuth tru
293293

294294
// TrustedReference returns the canonical trusted reference for an image reference
295295
func TrustedReference(ctx context.Context, cli command.Cli, ref reference.NamedTagged, rs registry.Service) (reference.Canonical, error) {
296-
var (
297-
repoInfo *registry.RepositoryInfo
298-
err error
299-
)
300-
if rs != nil {
301-
repoInfo, err = rs.ResolveRepository(ref)
302-
} else {
303-
repoInfo, err = registry.ParseRepositoryInfo(ref)
304-
}
296+
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, rs, AuthResolver(cli), ref.String())
305297
if err != nil {
306298
return nil, err
307299
}
308300

309-
// Resolve the Auth config relevant for this server
310-
authConfig := command.ResolveAuthConfig(ctx, cli, repoInfo.Index)
311-
312-
notaryRepo, err := trust.GetNotaryRepository(cli.In(), cli.Out(), command.UserAgent(), repoInfo, &authConfig, "pull")
301+
notaryRepo, err := cli.NotaryClient(imgRefAndAuth, []string{"pull"})
313302
if err != nil {
314303
return nil, errors.Wrap(err, "error establishing connection to trust repository")
315304
}
316305

317306
t, err := notaryRepo.GetTargetByName(ref.Tag(), trust.ReleasesRole, data.CanonicalTargetsRole)
318307
if err != nil {
319-
return nil, trust.NotaryError(repoInfo.Name.Name(), err)
308+
return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), err)
320309
}
321310
// Only list tags in the top level targets role or the releases delegation role - ignore
322311
// all other delegation roles
323312
if t.Role != trust.ReleasesRole && t.Role != data.CanonicalTargetsRole {
324-
return nil, trust.NotaryError(repoInfo.Name.Name(), client.ErrNoSuchTarget(ref.Tag()))
313+
return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), client.ErrNoSuchTarget(ref.Tag()))
325314
}
326315
r, err := convertTarget(t.Target)
327316
if err != nil {

‎cli/command/trust/common.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ type trustKey struct {
6666
// This information is to be pretty printed or serialized into a machine-readable format.
6767
func lookupTrustInfo(cli command.Cli, remote string) (trustTagRowList, []client.RoleWithSignatures, []data.Role, error) {
6868
ctx := context.Background()
69-
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, image.AuthResolver(cli), remote)
69+
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, image.AuthResolver(cli), remote)
7070
if err != nil {
7171
return trustTagRowList{}, []client.RoleWithSignatures{}, []data.Role{}, err
7272
}

‎cli/command/trust/revoke.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func newRevokeCommand(dockerCli command.Cli) *cobra.Command {
3636

3737
func revokeTrust(cli command.Cli, remote string, options revokeOptions) error {
3838
ctx := context.Background()
39-
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, image.AuthResolver(cli), remote)
39+
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, image.AuthResolver(cli), remote)
4040
if err != nil {
4141
return err
4242
}

‎cli/command/trust/sign.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ func newSignCommand(dockerCli command.Cli) *cobra.Command {
4242
func runSignImage(cli command.Cli, options signOptions) error {
4343
imageName := options.imageName
4444
ctx := context.Background()
45-
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, image.AuthResolver(cli), imageName)
45+
imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, image.AuthResolver(cli), imageName)
4646
if err != nil {
4747
return err
4848
}

0 commit comments

Comments
 (0)