mirror of
https://github.com/anchore/syft.git
synced 2026-10-11 21:57:22 +02:00
* fix: sign release checksums with a sigstore bundle The cosign update rejects the legacy `--output-certificate` / `--output-signature` flags alongside the new bundle format, which broke signing during the v1.53.0 release. - checksums are now signed into a single `checksums.txt.sigstore.json` bundle (signature, certificate, and tlog proof) - `install.sh -v` verifies with `--bundle` for releases >= v1.53.0 and keeps the `.sig` / `.pem` flow for older releases Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: smooth the cutover to sigstore bundle verification - `install.sh -v` now hints that bundle verification needs cosign v2.5.0 or newer when verification of a bundle-signed release fails - install tests keep exercising the legacy `.sig` / `.pem` path against v1.52.0 once the latest release is bundle-signed - touch the install test environment Dockerfiles so the cached images rebuild with a current cosign Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: only hint at the cosign minimum when cosign is actually too old - `install.sh -v` used to print the cosign v2.5.0 note on any failed bundle verification, including a missing bundle or a bad signature. It now only prints it when cosign reports it couldn't read the bundle (`bundle does not contain cert`), which is how v2.2.4 through v2.4.1 fail on a sigstore bundle. - `verify_sign` is now covered with a stub cosign, so the bundle path is exercised before any bundle-signed release is latest Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix: stop the install when a release asset is missing or fails its checksum - `install.sh` now stops when the checksums file, the signature bundle, or the asset can't be downloaded, instead of handing an empty or error-page file to the next step - a sha256 mismatch between the asset and the checksums file now stops the install. Before this the mismatch was logged and the asset was installed anyway, so `-v` only ever vouched for `checksums.txt`, not the binary Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: pin cosign in the install test images The install test images pulled whatever cosign was latest, unverified. They now install cosign v3.1.3 checked against its published sha256, so the install tests always run with a cosign that can verify sigstore bundles (releases >= v1.53.0 need v2.5.0 or newer). Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Keith Zantow <kzantow@gmail.com>
216 lines
4.7 KiB
Bash
216 lines
4.7 KiB
Bash
# disable using the install.sh entrypoint such that we can unit test
|
|
# script functions without invoking main()
|
|
TEST_INSTALL_SH=true
|
|
|
|
. ../../install.sh
|
|
set -u
|
|
|
|
echoerr() {
|
|
echo "$@" 1>&2
|
|
}
|
|
|
|
printferr() {
|
|
printf "%s" "$*" >&2
|
|
}
|
|
|
|
|
|
assertTrue() {
|
|
if eval "$1"; then
|
|
echo "assertTrue failed: $2"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
assertFalse() {
|
|
if eval "$1"; then
|
|
echo "assertFalse failed: $2"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
assertEquals() {
|
|
want=$1
|
|
got=$2
|
|
msg=$3
|
|
if [ "$want" != "$got" ]; then
|
|
echo "assertEquals failed: want='$want' got='$got' $msg"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
assertFilesDoesNotExist() {
|
|
path="$1"
|
|
msg=$2
|
|
if [ -f "${path}" ]; then
|
|
echo "assertFilesDoesNotExist failed: path exists '$path': $msg"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
assertFileExists() {
|
|
path="$1"
|
|
msg=$2
|
|
if [ ! -f "${path}" ]; then
|
|
echo "assertFileExists failed: path does not exist '$path': $msg"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
assertContains() {
|
|
haystack=$1
|
|
needle=$2
|
|
msg=$3
|
|
case "$haystack" in
|
|
*"$needle"*) ;;
|
|
*)
|
|
echo "assertContains failed: '$needle' not found in '$haystack' $msg"
|
|
exit 2
|
|
;;
|
|
esac
|
|
}
|
|
|
|
assertNotContains() {
|
|
haystack=$1
|
|
needle=$2
|
|
msg=$3
|
|
case "$haystack" in
|
|
*"$needle"*)
|
|
echo "assertNotContains failed: '$needle' found in '$haystack' $msg"
|
|
exit 2
|
|
;;
|
|
esac
|
|
}
|
|
|
|
assertFilesEqual() {
|
|
want=$1
|
|
got=$2
|
|
msg=$3
|
|
|
|
diff "$1" "$2"
|
|
if [ $? -ne 0 ]; then
|
|
echo "assertFilesEqual failed: $msg"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
assertNotEquals() {
|
|
want=$1
|
|
got=$2
|
|
msg=$3
|
|
if [ "$want" = "$got" ]; then
|
|
echo "assertNotEquals failed: want='$want' got='$got' $msg"
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
log_test_case() {
|
|
echo " running $@"
|
|
}
|
|
|
|
run_test_case_with_snapshot_release() {
|
|
log_test_case ${@:1}
|
|
|
|
worker_pid=$(setup_snapshot_server)
|
|
trap "teardown_snapshot_server $worker_pid" EXIT
|
|
|
|
# run test function with all arguments
|
|
${@:1}
|
|
|
|
trap - EXIT
|
|
teardown_snapshot_server "${worker_pid}"
|
|
}
|
|
|
|
serve_port=8000
|
|
|
|
setup_snapshot_server() {
|
|
# if you want to see proof in the logs, feel free to adjust the redirection
|
|
python3 -m http.server --directory "$(snapshot_dir)" $serve_port &> /dev/null &
|
|
worker_pid=$!
|
|
|
|
echoerr "serving up $(snapshot_dir) on port $serve_port"
|
|
|
|
echoerr "$(ls -1 $(snapshot_dir) | sed 's/^/ ▕―― /')"
|
|
|
|
check_snapshots_server_ready
|
|
|
|
echoerr "snapshot server ready! (worker=${worker_pid})"
|
|
|
|
echo "$worker_pid"
|
|
}
|
|
|
|
check_snapshots_server_ready() {
|
|
i=0
|
|
until $(curl -m 3 --output /dev/null --silent --head --fail localhost:$serve_port/); do
|
|
sleep 1
|
|
((i=i+1))
|
|
if [ "$i" -gt "30" ]; then
|
|
echoerr "could not connect to local snapshot server! bailing..."
|
|
exit 1
|
|
fi
|
|
printferr '.'
|
|
done
|
|
}
|
|
|
|
teardown_snapshot_server() {
|
|
worker_pid="$1"
|
|
echoerr "stopping worker=${worker_pid}"
|
|
kill "$worker_pid"
|
|
}
|
|
|
|
snapshot_version() {
|
|
partial=$(ls ../../snapshot/*_checksums.txt | grep -o "_.*_checksums.txt")
|
|
partial="${partial%_checksums.txt}"
|
|
echo "${partial#_}"
|
|
}
|
|
|
|
snapshot_download_url() {
|
|
echo "localhost:${serve_port}"
|
|
}
|
|
|
|
snapshot_dir() {
|
|
echo "../../snapshot"
|
|
}
|
|
|
|
snapshot_checksums_path() {
|
|
echo "$(ls $(snapshot_dir)/*_checksums.txt)"
|
|
}
|
|
|
|
snapshot_assets_count() {
|
|
# example output before wc -l:
|
|
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.deb
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.tar.gz
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.rpm
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.tar.gz
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.deb
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.rpm
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.zip
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_windows_amd64.zip
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.zip
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.tar.gz
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.tar.gz
|
|
|
|
echo "$(find ../../snapshot -maxdepth 1 -type f | grep 'syft_' | grep -v checksums | wc -l | tr -d '[:space:]')"
|
|
}
|
|
|
|
|
|
snapshot_assets_archive_count() {
|
|
# example output before wc -l:
|
|
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_arm64.tar.gz
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.tar.gz
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.zip
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_windows_amd64.zip
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_arm64.zip
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_linux_amd64.tar.gz
|
|
# ../../snapshot/syft_0.36.0-SNAPSHOT-e5e847a_darwin_amd64.tar.gz
|
|
|
|
echo "$(find ../../snapshot -maxdepth 1 -type f | grep 'syft_' | grep 'tar\|zip' | wc -l | tr -d '[:space:]')"
|
|
}
|
|
|
|
|
|
run_test_case() {
|
|
log_test_case ${@:1}
|
|
${@:1}
|
|
}
|