Skip to content

Commit

Permalink
update for v1.2.0-rc.1 release
Browse files Browse the repository at this point in the history
Signed-off-by: Patrick Zheng <patrickzheng@microsoft.com>
  • Loading branch information
Two-Hearts committed Aug 14, 2024
1 parent 2574460 commit 6702623
Show file tree
Hide file tree
Showing 4 changed files with 79 additions and 94 deletions.
24 changes: 12 additions & 12 deletions verifier/trustpolicy/oci.go
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ type TrustPolicy struct {
RegistryScopes []string `json:"registryScopes"`
}

var supportedOCIPolicyVersions = []string{"1.0"}
var supportedPolicyVersions = []string{"1.0"}

// LoadDocument retrieves a trust policy document from the local file system.
func LoadDocument() (*Document, error) {
Expand All @@ -68,31 +68,31 @@ func LoadDocument() (*Document, error) {
func (policyDoc *Document) Validate() error {
// sanity check
if policyDoc == nil {
return errors.New("oci trust policy document cannot be nil")
return errors.New("trust policy document cannot be nil")
}

// Validate Version
if policyDoc.Version == "" {
return errors.New("oci trust policy document has empty version, version must be specified")
return errors.New("trust policy document has empty version, version must be specified")

Check warning on line 76 in verifier/trustpolicy/oci.go

View check run for this annotation

Codecov / codecov/patch

verifier/trustpolicy/oci.go#L76

Added line #L76 was not covered by tests
}
if !slices.Contains(supportedOCIPolicyVersions, policyDoc.Version) {
return fmt.Errorf("oci trust policy document uses unsupported version %q", policyDoc.Version)
if !slices.Contains(supportedPolicyVersions, policyDoc.Version) {
return fmt.Errorf("trust policy document uses unsupported version %q", policyDoc.Version)
}

// Validate the policy according to 1.0 rules
if len(policyDoc.TrustPolicies) == 0 {
return errors.New("oci trust policy document can not have zero trust policy statements")
return errors.New("trust policy document can not have zero trust policy statements")
}

policyNames := set.New[string]()
for _, statement := range policyDoc.TrustPolicies {
// Verify unique policy statement names across the policy document
if policyNames.Contains(statement.Name) {
return fmt.Errorf("multiple oci trust policy statements use the same name %q, statement names must be unique", statement.Name)
return fmt.Errorf("multiple trust policy statements use the same name %q, statement names must be unique", statement.Name)
}

if err := validatePolicyCore(statement.Name, statement.SignatureVerification, statement.TrustStores, statement.TrustedIdentities); err != nil {
return fmt.Errorf("oci trust policy: %w", err)
return fmt.Errorf("trust policy: %w", err)
}

policyNames.Add(statement.Name)
Expand Down Expand Up @@ -135,7 +135,7 @@ func (policyDoc *Document) GetApplicableTrustPolicy(artifactReference string) (*
} else if wildcardPolicy != nil {
return wildcardPolicy, nil
} else {
return nil, fmt.Errorf("artifact %q has no applicable oci trust policy statement. Trust policy applicability for a given artifact is determined by registryScopes. To create a trust policy, see: %s", artifactReference, trustPolicyLink)
return nil, fmt.Errorf("artifact %q has no applicable trust policy statement. Trust policy applicability for a given artifact is determined by registryScopes. To create a trust policy, see: %s", artifactReference, trustPolicyLink)
}
}

Expand All @@ -157,10 +157,10 @@ func validateRegistryScopes(policyDoc *Document) error {
for _, statement := range policyDoc.TrustPolicies {
// Verify registry scopes are valid
if len(statement.RegistryScopes) == 0 {
return fmt.Errorf("oci trust policy statement %q has zero registry scopes, it must specify registry scopes with at least one value", statement.Name)
return fmt.Errorf("trust policy statement %q has zero registry scopes, it must specify registry scopes with at least one value", statement.Name)
}
if len(statement.RegistryScopes) > 1 && slices.Contains(statement.RegistryScopes, trustpolicy.Wildcard) {
return fmt.Errorf("oci trust policy statement %q uses wildcard registry scope '*', a wildcard scope cannot be used in conjunction with other scope values", statement.Name)
return fmt.Errorf("trust policy statement %q uses wildcard registry scope '*', a wildcard scope cannot be used in conjunction with other scope values", statement.Name)
}
for _, scope := range statement.RegistryScopes {
if scope != trustpolicy.Wildcard {
Expand All @@ -175,7 +175,7 @@ func validateRegistryScopes(policyDoc *Document) error {
// Verify one policy statement per registry scope
for key := range registryScopeCount {
if registryScopeCount[key] > 1 {
return fmt.Errorf("registry scope %q is present in multiple oci trust policy statements, one registry scope value can only be associated with one statement", key)
return fmt.Errorf("registry scope %q is present in multiple trust policy statements, one registry scope value can only be associated with one statement", key)
}
}

Expand Down
Loading

0 comments on commit 6702623

Please sign in to comment.