Skip to content

Commit 3f4a73d

Browse files
simonbairdclaude
simonbaird
and
claude
committed
Add acceptance test for task keyless support
Ref: https://issues.redhat.com/browse/EC-1652 Co-authored-by: Claude Code <[email protected]>
1 parent 50a2fd6 commit 3f4a73d

File tree

2 files changed

+279
-0
lines changed

2 files changed

+279
-0
lines changed

‎features/__snapshots__/task_validate_image.snap‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,3 +180,204 @@ true
180180
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":3,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
181181
}
182182
---
183+
184+
[Keyless signing verification - Cosign v3 style:report-json - 1]
185+
{
186+
"success": false,
187+
"components": [
188+
{
189+
"name": "",
190+
"containerImage": "quay.io/conforma/test@sha256:704f54193e2a3698275b6115d32f2c2dd2cf04a07be520407eac8e2a52e40aba",
191+
"source": {},
192+
"violations": [
193+
{
194+
"msg": "Image attestation check failed: no matching attestations: ",
195+
"metadata": {
196+
"code": "builtin.attestation.signature_check",
197+
"description": "The attestation signature matches available signing materials.",
198+
"title": "Attestation signature check passed"
199+
}
200+
},
201+
{
202+
"msg": "Image signature check failed: no signatures found",
203+
"metadata": {
204+
"code": "builtin.image.signature_check",
205+
"description": "The image signature matches available signing materials.",
206+
"title": "Image signature check passed"
207+
}
208+
}
209+
],
210+
"success": false
211+
}
212+
],
213+
"key": "",
214+
"policy": {
215+
"sources": [
216+
{
217+
"policy": [
218+
"git::github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
219+
"git::github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
220+
],
221+
"config": {
222+
"include": [
223+
"slsa_provenance_available"
224+
]
225+
}
226+
}
227+
],
228+
"rekorUrl": "https://rekor.sigstore.dev"
229+
},
230+
"ec-version": "${EC_VERSION}",
231+
"effective-time": "${TIMESTAMP}"
232+
}
233+
---
234+
235+
[Keyless signing verification - Cosign v3 style:results - 1]
236+
{
237+
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":0,\"failures\":2,\"warnings\":0,\"result\":\"FAILURE\"}\n"
238+
}
239+
---
240+
241+
[Keyless signing verification - Cosign v2 style:report-json - 1]
242+
{
243+
"success": true,
244+
"components": [
245+
{
246+
"name": "",
247+
"containerImage": "quay.io/conforma/test@sha256:2dbc250c79306c30801216e37cd25164c64fda9ac3b9677c5eb0860cb13dbb87",
248+
"source": {},
249+
"successes": [
250+
{
251+
"msg": "Pass",
252+
"metadata": {
253+
"code": "builtin.attestation.signature_check",
254+
"description": "The attestation signature matches available signing materials.",
255+
"title": "Attestation signature check passed"
256+
}
257+
},
258+
{
259+
"msg": "Pass",
260+
"metadata": {
261+
"code": "builtin.attestation.syntax_check",
262+
"description": "The attestation has correct syntax.",
263+
"title": "Attestation syntax check passed"
264+
}
265+
},
266+
{
267+
"msg": "Pass",
268+
"metadata": {
269+
"code": "builtin.image.signature_check",
270+
"description": "The image signature matches available signing materials.",
271+
"title": "Image signature check passed"
272+
}
273+
},
274+
{
275+
"msg": "Pass",
276+
"metadata": {
277+
"code": "slsa_provenance_available.allowed_predicate_types_provided",
278+
"collections": [
279+
"minimal",
280+
"slsa3",
281+
"redhat",
282+
"redhat_rpms",
283+
"policy_data"
284+
],
285+
"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.",
286+
"title": "Allowed predicate types provided"
287+
}
288+
},
289+
{
290+
"msg": "Pass",
291+
"metadata": {
292+
"code": "slsa_provenance_available.attestation_predicate_type_accepted",
293+
"collections": [
294+
"minimal",
295+
"slsa3",
296+
"redhat",
297+
"redhat_rpms"
298+
],
299+
"depends_on": [
300+
"attestation_type.known_attestation_type"
301+
],
302+
"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.",
303+
"title": "Expected attestation predicate type found"
304+
}
305+
}
306+
],
307+
"success": true,
308+
"signatures": [
309+
{
310+
"keyid": "ebaae7a16610094b0fe46e10ad9a4364464182c0",
311+
"sig": "MEQCIHX3aDGqhTjZy/vqz+mtxnH7TF0ck0DMNlF6qarDl8QLAiA8cG+G7RDOgCnc94dOM21VRfVw2OdC5BiP0la3INFfiw==",
312+
"certificate": "-----BEGIN CERTIFICATE-----\nMIICyzCCAlGgAwIBAgIUDVXAt072DG4pno8p3eCIGGykBM0wCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMjI4MTc0MTM3WhcNMjYwMjI4MTc1MTM3WjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAEfdTUm6Ln/FXAeWExBXjkEyhAc9dTURgL4k2f\nsU1YdwxaHYvbDhzapPvBnKBKkpsJLXhkUsBWh/YLpF/QXUvEoKOCAXAwggFsMA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU66rn\noWYQCUsP5G4QrZpDZEZBgsAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wHwYDVR0RAQH/BBUwE4ERc2JhaXJkQHJlZGhhdC5jb20wKQYKKwYBBAGDvzAB\nAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwb\naHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGLBgorBgEEAdZ5AgQCBH0EewB5\nAHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGcpVdxPAAABAMA\nSDBGAiEAr0X9iTZ80D1OLk8kgN6ajmCpUqFwjpjRXP8MsiCpwfoCIQDlvn2fX1/w\n7bg8aLjt3+A/d7uHI7W/W1C96nyOCUwEyTAKBggqhkjOPQQDAwNoADBlAjEAseqM\nwN0uPByvC590PZ9QE3f4+hJ8IjoZ+HlToDN/5SxJ4RoTH1IWjNBvIIES6lE/AjAM\nAAR6drRugmHaSldfu/1tPoqJFW93eQBsMmVgc0QFdX4z62hhVDvUENGJxYXwffo=\n-----END CERTIFICATE-----\n",
313+
"chain": [
314+
"-----BEGIN CERTIFICATE-----\nMIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C\nAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7\n7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS\n0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB\nBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp\nKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI\nzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR\nnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP\nmygUY7Ii2zbdCdliiow=\n-----END CERTIFICATE-----\n",
315+
"-----BEGIN CERTIFICATE-----\nMIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7\nXeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex\nX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j\nYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY\nwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ\nKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM\nWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9\nTNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\n-----END CERTIFICATE-----\n"
316+
],
317+
"metadata": {
318+
"Fulcio Issuer": "https://accounts.google.com",
319+
"Fulcio Issuer (V2)": "https://accounts.google.com",
320+
"Issuer": "CN=sigstore-intermediate,O=sigstore.dev",
321+
"Not After": "${TIMESTAMP}",
322+
"Not Before": "${TIMESTAMP}",
323+
"Serial Number": "d55c0b74ef60c6e299e8f29dde088186ca404cd",
324+
"Subject Alternative Name": "Email Addresses:[email protected]"
325+
}
326+
}
327+
],
328+
"attestations": [
329+
{
330+
"type": "https://in-toto.io/Statement/v0.1",
331+
"predicateType": "https://slsa.dev/provenance/v1",
332+
"predicateBuildType": "https://example.com/build-type/v1",
333+
"signatures": [
334+
{
335+
"keyid": "a5f7cfad1a5096bda904e09298b7a1ef4ee3ba8a",
336+
"sig": "MEUCIQDwhJ8ih3vEbxkEi3cKOcHOXmM/fspp199FTSqlDaEkHQIgFpZGtk8HUn0OSAfXtQa1cdIFB4On8UX6h2HLrcEvoJ8=",
337+
"certificate": "-----BEGIN CERTIFICATE-----\nMIICyTCCAk+gAwIBAgIUFUg18Z3r6YfM9Nj8Y03yAUuO5yIwCgYIKoZIzj0EAwMw\nNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl\ncm1lZGlhdGUwHhcNMjYwMjI4MTc0MTU0WhcNMjYwMjI4MTc1MTU0WjAAMFkwEwYH\nKoZIzj0CAQYIKoZIzj0DAQcDQgAEBl2hK5c1b9vqypKKZldJMCragUPWi5hnhIad\n162nomyr8GLb+B0dmMtEGbGQBj6rzLfH2PtmtfMVb5kal4MgZ6OCAW4wggFqMA4G\nA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUpffP\nrRpQlr2pBOCSmLeh707juoowHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y\nZD8wHwYDVR0RAQH/BBUwE4ERc2JhaXJkQHJlZGhhdC5jb20wKQYKKwYBBAGDvzAB\nAQQbaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMCsGCisGAQQBg78wAQgEHQwb\naHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tMIGJBgorBgEEAdZ5AgQCBHsEeQB3\nAHUA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGcpVezWgAABAMA\nRjBEAiA/NXWMmbfw2wWZlI+BvrYO4jC01rw/0YF5bEY4tXsg0gIgXIpNG0qjaB0u\nm6Q0pNRu10K46Gt9SmJYJ8U+FpnmuPIwCgYIKoZIzj0EAwMDaAAwZQIwMVWt3/LU\npCCWMADC8p3hxvjyDDNGc3BXCZVkCeSf239ZYutcDI4u2D0nO9Tr+aCdAjEA2SUD\ny7pTu+/eOnj5k3Rh5RoHN6QDgeYp8txCdzVGnKzqAgRbLhsduqKF91pGJsKN\n-----END CERTIFICATE-----\n",
338+
"chain": [
339+
"-----BEGIN CERTIFICATE-----\nMIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C\nAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7\n7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS\n0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB\nBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp\nKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI\nzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR\nnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP\nmygUY7Ii2zbdCdliiow=\n-----END CERTIFICATE-----\n",
340+
"-----BEGIN CERTIFICATE-----\nMIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw\nKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y\nMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl\nLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7\nXeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex\nX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j\nYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY\nwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ\nKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM\nWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9\nTNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ\n-----END CERTIFICATE-----\n"
341+
],
342+
"metadata": {
343+
"Fulcio Issuer": "https://accounts.google.com",
344+
"Fulcio Issuer (V2)": "https://accounts.google.com",
345+
"Issuer": "CN=sigstore-intermediate,O=sigstore.dev",
346+
"Not After": "${TIMESTAMP}",
347+
"Not Before": "${TIMESTAMP}",
348+
"Serial Number": "154835f19debe987ccf4d8fc634df2014b8ee722",
349+
"Subject Alternative Name": "Email Addresses:[email protected]"
350+
}
351+
}
352+
]
353+
}
354+
]
355+
}
356+
],
357+
"key": "",
358+
"policy": {
359+
"sources": [
360+
{
361+
"policy": [
362+
"git::github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
363+
"git::github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
364+
],
365+
"config": {
366+
"include": [
367+
"slsa_provenance_available"
368+
]
369+
}
370+
}
371+
],
372+
"rekorUrl": "https://rekor.sigstore.dev"
373+
},
374+
"ec-version": "${EC_VERSION}",
375+
"effective-time": "${TIMESTAMP}"
376+
}
377+
---
378+
379+
[Keyless signing verification - Cosign v2 style:results - 1]
380+
{
381+
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
382+
}
383+
---

‎features/task_validate_image.feature‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,3 +337,81 @@ Feature: Verify Enterprise Contract Tekton Tasks
337337
Then the task should succeed
338338
And the task logs for step "report" should match the snapshot
339339
And the task results should match the snapshot
340+
341+
Scenario: Keyless signing verification - Cosign v2 style
342+
Given a working namespace
343+
Given a cluster policy with content:
344+
```
345+
{
346+
"sources": [
347+
{
348+
"policy": [
349+
"github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
350+
"github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
351+
],
352+
"config": {
353+
"include": [
354+
"slsa_provenance_available"
355+
]
356+
}
357+
}
358+
]
359+
}
360+
```
361+
#
362+
# See hack/keyless-test-image for how the test image was created. It's not ideal
363+
# that this test requires an external image, but we already do this elsewhere, so
364+
# I guess one more is okay. I'm hard coding the identity used to sign the image
365+
# which is my personal account. That might have to change if the image is recreated.
366+
#
367+
# Todo: We should be able test this also with an internal image similar to how it's
368+
# done in the "happy day with keyless" scenario in validate_image.feature.
369+
#
370+
When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
371+
| IMAGES | {"components": [{"containerImage": "quay.io/conforma/test:keyless_v2@sha256:2dbc250c79306c30801216e37cd25164c64fda9ac3b9677c5eb0860cb13dbb87"}]} |
372+
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
373+
| CERTIFICATE_IDENTITY | sbaird@redhat.com |
374+
| CERTIFICATE_OIDC_ISSUER | https://accounts.google.com |
375+
| REKOR_HOST | https://rekor.sigstore.dev |
376+
| IGNORE_REKOR | false |
377+
| STRICT | true |
378+
Then the task should succeed
379+
And the task logs for step "report-json" should match the snapshot
380+
And the task results should match the snapshot
381+
382+
#
383+
# Todo: This is the same as the above but using a test image signed with cosign v3. It
384+
# fails currently, but it might pass if https://github.com/conforma/cli/pull/3123 is merged.
385+
#
386+
Scenario: Keyless signing verification - Cosign v3 style
387+
Given a working namespace
388+
Given a cluster policy with content:
389+
```
390+
{
391+
"sources": [
392+
{
393+
"policy": [
394+
"github.com/conforma/policy//policy/release?ref=0de5461c14413484575e63e96ddb514d8ab954b5",
395+
"github.com/conforma/policy//policy/lib?ref=0de5461c14413484575e63e96ddb514d8ab954b5"
396+
],
397+
"config": {
398+
"include": [
399+
"slsa_provenance_available"
400+
]
401+
}
402+
}
403+
]
404+
}
405+
```
406+
When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
407+
| IMAGES | {"components": [{"containerImage": "quay.io/conforma/test:keyless_v3@sha256:704f54193e2a3698275b6115d32f2c2dd2cf04a07be520407eac8e2a52e40aba"}]} |
408+
| POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME} |
409+
| CERTIFICATE_IDENTITY | sbaird@redhat.com |
410+
| CERTIFICATE_OIDC_ISSUER | https://accounts.google.com |
411+
| REKOR_HOST | https://rekor.sigstore.dev |
412+
| IGNORE_REKOR | false |
413+
| STRICT | true |
414+
# Todo: Make it not fail
415+
Then the task should fail
416+
And the task logs for step "report-json" should match the snapshot
417+
And the task results should match the snapshot

0 commit comments

Comments
 (0)