mirror of
https://github.com/anchore/syft.git
synced 2025-11-20 09:53:16 +01:00
* feat: expose rpm signature information This helps with more confident identification of an rpm. In theory, two rpms can be built that have the same purl string, and otherwise look identical in syft's output, but the PGP information would distinguish them as signed either by different keys, or signed at different times. In practice, this usually makes no difference since rpms tend to have unique name/version/release strings. This just gives increased confidence about the identity of the rpm found in the db. Signed-off-by: Ralph Bean <rbean@redhat.com> * chore: generate json schema Signed-off-by: Ralph Bean <rbean@redhat.com> * re-generate json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename to a more generic signature field Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * rename rpm.pgp to rpm.signatures Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split out signature fields Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * include RPM archives Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update json schema Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * dont fail on unknown signature type Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Ralph Bean <rbean@redhat.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
96 lines
1.8 KiB
Go
96 lines
1.8 KiB
Go
package pkg
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/go-test/deep"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestRpmMetadata_FileOwner(t *testing.T) {
|
|
tests := []struct {
|
|
metadata RpmDBEntry
|
|
expected []string
|
|
}{
|
|
{
|
|
metadata: RpmDBEntry{
|
|
Files: []RpmFileRecord{
|
|
{Path: "/somewhere"},
|
|
{Path: "/else"},
|
|
},
|
|
},
|
|
expected: []string{
|
|
"/else",
|
|
"/somewhere",
|
|
},
|
|
},
|
|
{
|
|
metadata: RpmDBEntry{
|
|
Files: []RpmFileRecord{
|
|
{Path: "/somewhere"},
|
|
{Path: ""},
|
|
},
|
|
},
|
|
expected: []string{
|
|
"/somewhere",
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(strings.Join(test.expected, ","), func(t *testing.T) {
|
|
actual := test.metadata.OwnedFiles()
|
|
for _, d := range deep.Equal(test.expected, actual) {
|
|
t.Errorf("diff: %+v", d)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRpmSignature_String(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
signature RpmSignature
|
|
expected string
|
|
}{
|
|
{
|
|
name: "standard signature",
|
|
signature: RpmSignature{
|
|
PublicKeyAlgorithm: "RSA",
|
|
HashAlgorithm: "SHA256",
|
|
Created: "Mon May 16 12:32:55 2022",
|
|
IssuerKeyID: "702d426d350d275d",
|
|
},
|
|
expected: "RSA/SHA256, Mon May 16 12:32:55 2022, Key ID 702d426d350d275d",
|
|
},
|
|
{
|
|
name: "empty fields",
|
|
signature: RpmSignature{
|
|
PublicKeyAlgorithm: "",
|
|
HashAlgorithm: "",
|
|
Created: "",
|
|
IssuerKeyID: "",
|
|
},
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "partial empty fields",
|
|
signature: RpmSignature{
|
|
PublicKeyAlgorithm: "RSA",
|
|
HashAlgorithm: "",
|
|
Created: "Mon May 16 12:32:55 2022",
|
|
IssuerKeyID: "",
|
|
},
|
|
expected: "RSA/, Mon May 16 12:32:55 2022, Key ID ",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := tt.signature.String()
|
|
assert.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|