Skip to content

Add pin-policy-bundle acceptance tests for TA task #3324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joejstuart wants to merge 1 commit into
base: main
Choose a base branch
from
+82 −0
Open

Add pin-policy-bundle acceptance tests for TA task #3324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions features/__snapshots__/ta_task_validate_image.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,40 @@

[TestFeatures/Golden container image with trusted artifacts:pin-policy-bundle - 1]
Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2
'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do.

---

[TestFeatures/Pin policy bundle digest:pin-policy-bundle - 1]
Applying policy bundle digest override: sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2
Replaced: oci::quay.io/conforma/release-policy:konflux
with: oci::quay.io/conforma/release-policy@sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2
Modified policy written to: /tekton/home/policy-with-pinned-bundle.yaml

---

[TestFeatures/Pin policy bundle digest:show-config - 1]
{
"policy": {
"sources": [
{
"policy": [
"oci::quay.io/conforma/release-policy@sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2"
],
"config": {
"include": [
"slsa_provenance_available"
]
}
}
],
"publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\n-----END PUBLIC KEY-----"
},
"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\n-----END PUBLIC KEY-----\n",
"effective-time": "${TIMESTAMP}"
}
---

[TestFeatures/Golden container image with trusted artifacts:report-json - 1]
{
"success": true,
Expand Down
46 changes: 46 additions & 0 deletions features/ta_task_validate_image.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,56 @@ Feature: Verify Conforma Trusted Artifact Tekton Task
| TRUSTED_ARTIFACTS_DEBUG | "true" |
| ORAS_OPTIONS | --plain-http |
Then the task should succeed
And the task logs for step "pin-policy-bundle" should match the snapshot
And the task logs for step "report-json" should match the snapshot
And the task results should match the snapshot
And the task logs for step "show-config" should match the snapshot

Scenario: Pin policy bundle digest
Given a working namespace
Given a snapshot artifact with content:
```
{
"components": [
{
"containerImage": "quay.io/hacbs-contract-demo/golden-container@sha256:e76a4ae9dd8a52a0d191fd34ca133af5b4f2609536d32200a4a40a09fdc93a0d"
}
]
}
```
Given a cluster policy with content:
```
{
"publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\n-----END PUBLIC KEY-----",
"sources": [
{
"policy": [
"oci::quay.io/conforma/release-policy:konflux"
],
"config": {
"include": [
"slsa_provenance_available"
]
}
}
]
}
```
When version 0.1 of the task named "verify-conforma-konflux-ta" is run with parameters:
| SNAPSHOT_FILENAME | snapshotartifact |
| SOURCE_DATA_ARTIFACT | oci:${REGISTRY}/acceptance/snapshotartifact@${BUILD_SNAPSHOT_DIGEST} |
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
| POLICY_BUNDLE_DIGEST | sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2 |
| STRICT | false |
| IGNORE_REKOR | true |
| TRUSTED_ARTIFACTS_DEBUG | "true" |
| ORAS_OPTIONS | --plain-http |
Then the task should succeed
And the task logs for step "pin-policy-bundle" should match the snapshot
And the task logs for step "show-config" should match the snapshot
# The show-config step is enough to confirm the ECP was modified. No need
# to look at the other output

Scenario: VSA generation with predicate format
Given a working namespace
Given a snapshot artifact with content:
Expand Down
Loading