oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 07:26:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

add signature verification to install.sh (#2941)

Browse Source 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2024-06-10 11:29:53 -04:00
committed by GitHub
parent db0c33481e
commit c43f4fb416
18 changed files with 477 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/install/Makefile
+23 -14
View File
@@ -1,18 +1,22 @@
NAME=syft
# for local testing (not testing within containers) use the binny-managed version of cosign.
# this also means that the user does not need to install cosign on their system to run tests.
COSIGN_BINARY=../../.tool/cosign
IMAGE_NAME=$(NAME)-install.sh-env
UBUNTU_IMAGE=$(IMAGE_NAME):ubuntu-20.04
ALPINE_IMAGE=$(IMAGE_NAME):alpine-3.6
BUSYBOX_IMAGE=busybox:1.36.1-musl
BUSYBOX_IMAGE=$(IMAGE_NAME):busybox-1.36
ENVS=./environments
DOCKER_RUN=docker run --rm -t -w /project/test/install -v $(shell pwd)/../../:/project
UNIT=make unit-local
UNIT=make unit-run
# acceptance testing is running the current install.sh against the latest release. Note: this could be a problem down
# the line if there are breaking changes made that don't align with the latest release (but will be OK with the next
# release)
ACCEPTANCE_CMD=sh -c '../../install.sh -b /usr/local/bin && syft version'
# release). This tests both installing with signature verification and without.
ACCEPTANCE_CMD=sh -c '../../install.sh -v -b /usr/local/bin && syft version && rm /usr/local/bin/syft && ../../install.sh -b /usr/local/bin && syft version'
# we also want to test against a previous release to ensure that install.sh defers execution to a former install.sh
PREVIOUS_RELEASE=v0.33.0
ACCEPTANCE_PREVIOUS_RELEASE_CMD=sh -c "../../install.sh -b /usr/local/bin $(PREVIOUS_RELEASE) && syft version"
@@ -28,17 +32,22 @@ endef
test: unit acceptance
.PHONY: ci-test-mac
ci-test-mac: unit-local acceptance-local
ci-test-mac: unit-run acceptance-local
# note: do not add acceptance-local to this list
.PHONY: acceptance
acceptance: acceptance-ubuntu-20.04 acceptance-alpine-3.6 acceptance-busybox
acceptance: acceptance-ubuntu-20.04 acceptance-alpine-3.6 acceptance-busybox-1.36
.PHONY: unit
unit: unit-ubuntu-20.04
.PHONY: unit-local
unit-local:
$(call title,unit tests)
@for f in $(shell ls *_test.sh); do echo "Running unit test suite '$${f}'"; bash -c "COSIGN_BINARY=$(COSIGN_BINARY) ./$${f}" || exit 1; done
.PHONY: unit-run
unit-run:
$(call title,unit tests)
@for f in $(shell ls *_test.sh); do echo "Running unit test suite '$${f}'"; bash $${f} || exit 1; done
@@ -55,7 +64,7 @@ acceptance-previous-release-local:
syft version | grep $(shell echo $(PREVIOUS_RELEASE)| tr -d "v")
.PHONY: save
save: ubuntu-20.04 alpine-3.6 pull-busybox
save: ubuntu-20.04 alpine-3.6 busybox-1.36
@mkdir cache || true
docker image save -o cache/ubuntu-env.tar $(UBUNTU_IMAGE)
docker image save -o cache/alpine-env.tar $(ALPINE_IMAGE)
@@ -107,17 +116,17 @@ alpine-3.6:
# note: busybox by default will not have cacerts, so you will get TLS warnings (we want to test under these conditions)
.PHONY: acceptance-busybox
acceptance-busybox: pull-busybox
$(call title,busybox - acceptance)
.PHONY: acceptance-busybox-1.36
acceptance-busybox-1.36: busybox-1.36
$(call title,busybox-1.36 - acceptance)
$(DOCKER_RUN) $(BUSYBOX_IMAGE) \
$(ACCEPTANCE_CMD)
@echo "\n*** test note: you should see syft spit out a 'x509: certificate signed by unknown authority' error --this is expected ***"
.PHONY: pull-busybox
pull-busybox:
$(call title,busybox - build environment)
docker pull $(BUSYBOX_IMAGE)
.PHONY: busybox-1.36
busybox-1.36:
$(call title,busybox-1.36 - build environment)
docker build -t $(BUSYBOX_IMAGE) -f $(ENVS)/Dockerfile-busybox-1.36 .
## For CI ########################################################