Skip to content

Use ValidateVSAAndComparePolicy for ec validate image VSA skip #3489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
st3penta wants to merge 1 commit into
base: main
Choose a base branch
from
+201 −1,260
Open

Use ValidateVSAAndComparePolicy for ec validate image VSA skip #3489

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions cmd/validate/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,11 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
}
Comment thread
st3penta marked this conversation as resolved.
}

Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
// Require --vsa-public-key when the VSA skip path is active
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
if len(data.vsaUpload) > 0 && data.vsaPublicKey == "" && data.vsaExpiration > 0 {
allErrors = errors.Join(allErrors, fmt.Errorf("--vsa-public-key required when --vsa-upload is set with --vsa-expiration > 0"))
}

return
},

Expand Down Expand Up @@ -367,9 +372,20 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
var out *output.Output
var err error
if data.vsaExpiration > 0 {
vsaChecker := vsa.CreateVSACheckerFromUploadFlags(data.vsaUpload)
if vsaChecker != nil {
out, err = image.ValidateImageWithVSACheck(ctx, comp, data.spec, data.policy, evaluators, data.info, vsaChecker, data.vsaExpiration)
retriever := vsa.CreateRetrieverFromUploadFlags(data.vsaUpload)
Comment thread
st3penta marked this conversation as resolved.
if retriever != nil {
vsaEffectiveTime := data.effectiveTime
if vsaEffectiveTime == "attestation" {
Comment thread
st3penta marked this conversation as resolved.
vsaEffectiveTime = policy.Now
}
vsaConfig := &vsa.VSAValidationConfig{
Retriever: retriever,
VSAExpiration: data.vsaExpiration,
PublicKeyPath: data.vsaPublicKey,
PolicySpec: data.policy.Spec(),
EffectiveTime: vsaEffectiveTime,
}
out, err = image.ValidateImageWithVSACheck(ctx, comp, data.spec, data.policy, evaluators, data.info, vsaConfig)
} else {
// Fall back to normal validation if no VSA retriever is available
out, err = validate(ctx, comp, data.spec, data.policy, evaluators, data.info)
Expand Down Expand Up @@ -583,6 +599,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
cmd.Flags().BoolVar(&data.vsaEnabled, "vsa", false, "Generate a Verification Summary Attestation (VSA) for each validated image.")
Comment thread
st3penta marked this conversation as resolved.
cmd.Flags().StringVar(&data.attestationFormat, "attestation-format", "dsse", "Attestation output format: dsse (signed envelope), predicate (raw JSON)")
cmd.Flags().StringVar(&data.vsaSigningKey, "vsa-signing-key", "", "Path to the private key for signing the VSA. Supports file paths and Kubernetes secret references (k8s://namespace/secret-name/key-field).")
Comment thread
st3penta marked this conversation as resolved.
cmd.Flags().StringVar(&data.vsaPublicKey, "vsa-public-key", "", "Path to the public key for VSA signature verification. Required when --vsa-upload is set and --vsa-expiration is greater than 0.")
cmd.Flags().StringSliceVar(&data.vsaUpload, "vsa-upload", nil, "Storage backends for VSA upload. Format: backend@url?param=value. Examples: rekor@https://rekor.sigstore.dev, local@./vsa-dir")
cmd.Flags().DurationVar(&data.vsaExpiration, "vsa-expiration", data.vsaExpiration, "Expiration threshold for existing VSAs. If a valid VSA exists and is newer than this threshold, validation will be skipped. (default 168h)")
cmd.Flags().StringVar(&data.attestationOutputDir, "attestation-output-dir", "", "Directory for attestation output files. Defaults to a temp directory under /tmp. Must be under /tmp or the current working directory.")
Expand Down Expand Up @@ -667,6 +684,7 @@ type imageData struct {
vsaEnabled bool
Comment thread
st3penta marked this conversation as resolved.
attestationFormat string
vsaSigningKey string
Comment thread
st3penta marked this conversation as resolved.
vsaPublicKey string
vsaUpload []string
vsaExpiration time.Duration
attestationOutputDir string
Expand Down
45 changes: 45 additions & 0 deletions cmd/validate/image_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1471,6 +1471,7 @@ func TestValidateImageCommand_VSAUpload_Success(t *testing.T) {
"--vsa",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1543,6 +1544,39 @@ func TestValidateImageCommand_VSAUpload_NoStorageBackends(t *testing.T) {
// Don't assert no error since VSA processing might fail, but upload logic should be reached
}

func TestValidateImageCommand_VSAPublicKeyRequired(t *testing.T) {
// --vsa-public-key is required when --vsa-upload is set
validateImageCmd := validateImageCmd(happyValidator())
cmd := setUpCobra(validateImageCmd)
Comment thread
qodo-for-conforma[bot] marked this conversation as resolved.

fs := afero.NewMemMapFs()
ctx := utils.WithFS(context.Background(), fs)

client := fake.FakeClient{}
commonMockClient(&client)
ctx = oci.WithClient(ctx, &client)
cmd.SetContext(ctx)

cmd.SetArgs([]string{
"validate", "image",
"--image", "registry/image:tag",
"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
"--vsa-upload", "local@/tmp/vsa-test",
// Missing --vsa-public-key
})

var out bytes.Buffer
cmd.SetOut(&out)
cmd.SilenceErrors = true
cmd.SilenceUsage = true

utils.SetTestRekorPublicKey(t)

err := cmd.Execute()
assert.Error(t, err)
assert.Contains(t, err.Error(), "--vsa-public-key required when --vsa-upload is set with --vsa-expiration > 0")
}

func TestValidateImageCommand_ShowWarningsFlag(t *testing.T) {
// Create a validator that returns warnings
warningValidator := func(_ context.Context, component app.SnapshotComponent, _ *app.SnapshotSpec, _ policy.Policy, _ []evaluator.Evaluator, _ bool) (*output.Output, error) {
Expand Down Expand Up @@ -1676,6 +1710,7 @@ func TestValidateImageCommand_VSAFormat_DSSE(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1712,6 +1747,7 @@ func TestValidateImageCommand_VSAFormat_Predicate(t *testing.T) {
"--vsa",
"--attestation-format", "predicate",
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1747,6 +1783,7 @@ func TestValidateImageCommand_VSAFormat_InvalidFormat(t *testing.T) {
"--attestation-format", "invalid-format",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1784,6 +1821,7 @@ func TestValidateImageCommand_VSAFormat_DSSE_RequiresSigningKey(t *testing.T) {
"--attestation-format", "dsse",
// Missing --vsa-signing-key
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1822,6 +1860,7 @@ func TestValidateImageCommand_VSAFormat_Predicate_WorksWithoutSigningKey(t *test
"--attestation-format", "predicate",
// No --vsa-signing-key provided
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1940,6 +1979,7 @@ func TestGenerateVSAsDSSE_Errors(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/invalid-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1974,6 +2014,7 @@ func TestGenerateVSAsDSSE_Errors(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/nonexistent-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2025,6 +2066,7 @@ func TestGenerateVSAsDSSE_Errors(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2060,6 +2102,7 @@ func TestGenerateVSAsPredicates_Errors(t *testing.T) {
"--attestation-format", "predicate",
"--attestation-output-dir", "/etc/invalid-dir", // Invalid directory outside /tmp and cwd
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2096,6 +2139,7 @@ func TestGenerateVSAsPredicates_Errors(t *testing.T) {
"--attestation-format", "predicate",
"--attestation-output-dir", "/tmp/vsa-predicates",
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2175,6 +2219,7 @@ func TestVSAGeneration_WithOutputDir(t *testing.T) {
"--attestation-format", tt.format,
"--attestation-output-dir", tt.outputDir,
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
}

if tt.needsKey {
Expand Down
1 change: 1 addition & 0 deletions docs/modules/ROOT/pages/ec_validate_image.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ JSON of the "spec" or a reference to a Kubernetes object [<namespace>/]<name>
-s, --strict:: Return non-zero status on non-successful validation. Defaults to true. Use --strict=false to return a zero status code. (Default: true)
--vsa:: Generate a Verification Summary Attestation (VSA) for each validated image. (Default: false)
--vsa-expiration:: Expiration threshold for existing VSAs. If a valid VSA exists and is newer than this threshold, validation will be skipped. (default 168h) (Default: 168h0m0s)
--vsa-public-key:: Path to the public key for VSA signature verification. Required when --vsa-upload is set and --vsa-expiration is greater than 0.
--vsa-signing-key:: Path to the private key for signing the VSA. Supports file paths and Kubernetes secret references (k8s://namespace/secret-name/key-field).
--vsa-upload:: Storage backends for VSA upload. Format: backend@url?param=value. Examples: rekor@https://rekor.sigstore.dev, local@./vsa-dir (Default: [])
--workers:: Number of workers to use for validation. Defaults to 5. (Default: 5)
Expand Down
Loading
Loading