Skip to content

Commit 5f0159a

Browse files
st3pentast3penta
authored
Merge pull request #1609 from st3penta/EC-1541
Implement support for version-based trusted_task_rules
2 parents e173478 + 7d9d165 commit 5f0159a

File tree

8 files changed

+523
-13
lines changed

8 files changed

+523
-13
lines changed

‎acceptance/acceptance_test.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,12 @@ var (
4747
sampleGCPolicyInput string
4848
//go:embed samples/clamav-task.json
4949
sampleClamAVTask string
50+
//go:embed samples/trusted-task.json
51+
sampleTrustedTask string
52+
//go:embed samples/untrusted-task.json
53+
sampleUntrustedTask string
54+
//go:embed samples/untrusted-task-despite-valid-oci-ref-tag.json
55+
sampleUntrustedTaskDespiteValidOciRefTag string
5056
)
5157

5258
type testStateKey struct{}
@@ -105,6 +111,12 @@ func writeSampleGCPolicyInput(ctx context.Context, sampleName string) (context.C
105111
content = sampleGCPolicyInput
106112
case "clamav-task":
107113
content = sampleClamAVTask
114+
case "trusted-task":
115+
content = sampleTrustedTask
116+
case "untrusted-task":
117+
content = sampleUntrustedTask
118+
case "untrusted-task-despite-valid-oci-ref-tag":
119+
content = sampleUntrustedTaskDespiteValidOciRefTag
108120
default:
109121
return ctx, fmt.Errorf("%q is not a known sample name", sampleName)
110122
}
@@ -191,6 +203,24 @@ func thereShouldBeNoViolationsInTheResult(ctx context.Context) error {
191203
return nil
192204
}
193205

206+
func thereShouldBeViolationsInTheResult(ctx context.Context) error {
207+
ts, err := getTestState(ctx)
208+
if err != nil {
209+
return fmt.Errorf("reading test state: %w", err)
210+
}
211+
212+
violationCount := 0
213+
for _, filepath := range ts.report.FilePaths {
214+
violationCount += len(filepath.Violations)
215+
}
216+
217+
if violationCount == 0 {
218+
return errors.New("expected violations, but got none")
219+
}
220+
221+
return nil
222+
}
223+
194224
func thereShouldBeNoWarningsInTheResult(ctx context.Context) error {
195225
ts, err := getTestState(ctx)
196226
if err != nil {
@@ -350,6 +380,7 @@ func InitializeScenario(sc *godog.ScenarioContext) {
350380
sc.Step(`^a policy config:$`, writePolicyConfig)
351381
sc.Step(`^input is validated$`, validateInputWithPolicyConfig)
352382
sc.Step(`^there should be no violations in the result$`, thereShouldBeNoViolationsInTheResult)
383+
sc.Step(`^there should be violations in the result$`, thereShouldBeViolationsInTheResult)
353384
sc.Step(`^there should be no warnings in the result$`, thereShouldBeNoWarningsInTheResult)
354385
sc.Step(`^there should be no violations with "([^"]*)" collection in the result$`, thereShouldBeNoViolationsWithCollectionInTheResult)
355386
sc.Step(`^there should be no violations with "([^"]*)" package in the result$`, thereShouldBeNoViolationsWithPackageInTheResult)

‎acceptance/features/task.feature‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,84 @@ Feature: Task Definition
2626
When input is validated
2727
Then there should be no violations in the result
2828
Then there should be no warnings in the result
29+
30+
Scenario: Trusted task using trusted_task_rules
31+
Given a sample policy input "trusted-task"
32+
And a policy config:
33+
"""
34+
{
35+
"sources": [
36+
{
37+
"policy": [
38+
"$GITROOT/policy/lib",
39+
"$GITROOT/policy/pipeline"
40+
],
41+
"data": [
42+
"$GITROOT/example/data",
43+
"$GITROOT/acceptance/testdata"
44+
],
45+
"config": {
46+
"include": [
47+
"task_bundle.*"
48+
]
49+
}
50+
}
51+
]
52+
}
53+
"""
54+
When input is validated
55+
Then there should be no violations in the result
56+
57+
Scenario: Untrusted task rejected by trusted_task_rules
58+
Given a sample policy input "untrusted-task"
59+
And a policy config:
60+
"""
61+
{
62+
"sources": [
63+
{
64+
"policy": [
65+
"$GITROOT/policy/lib",
66+
"$GITROOT/policy/pipeline"
67+
],
68+
"data": [
69+
"$GITROOT/example/data",
70+
"$GITROOT/acceptance/testdata"
71+
],
72+
"config": {
73+
"include": [
74+
"task_bundle.*"
75+
]
76+
}
77+
}
78+
]
79+
}
80+
"""
81+
When input is validated
82+
Then there should be violations in the result
83+
84+
Scenario: Task rejected by trusted_task_rules because of no tag in the manifest annotations (tag in oci ref is ignored)
85+
Given a sample policy input "untrusted-task-despite-valid-oci-ref-tag"
86+
And a policy config:
87+
"""
88+
{
89+
"sources": [
90+
{
91+
"policy": [
92+
"$GITROOT/policy/lib",
93+
"$GITROOT/policy/pipeline"
94+
],
95+
"data": [
96+
"$GITROOT/example/data",
97+
"$GITROOT/acceptance/testdata"
98+
],
99+
"config": {
100+
"include": [
101+
"task_bundle.*"
102+
]
103+
}
104+
}
105+
]
106+
}
107+
"""
108+
When input is validated
109+
Then there should be violations in the result

‎acceptance/samples/trusted-task.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"apiVersion": "tekton.dev/v1",
3+
"kind": "Pipeline",
4+
"metadata": {
5+
"name": "test-pipeline"
6+
},
7+
"spec": {
8+
"tasks": [
9+
{
10+
"name": "buildah-task",
11+
"taskRef": {
12+
"resolver": "bundles",
13+
"params": [
14+
{
15+
"name": "bundle",
16+
"value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.6@sha256:8dcb64b7cd78a3ab1b2cb0e991860ba519aac5a4682b2e7f9f8f91ded1101e29"
17+
},
18+
{
19+
"name": "name",
20+
"value": "buildah"
21+
},
22+
{
23+
"name": "kind",
24+
"value": "task"
25+
}
26+
]
27+
}
28+
}
29+
]
30+
}
31+
}

‎acceptance/samples/untrusted-task-despite-valid-oci-ref-tag.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"_comment": "Task with OCI ref tag 0.7 that should be denied because manifest annotation shows version 0.5 (0.7 in the oci ref is ignored)",
3+
"apiVersion": "tekton.dev/v1",
4+
"kind": "Pipeline",
5+
"metadata": {
6+
"name": "test-pipeline"
7+
},
8+
"spec": {
9+
"tasks": [
10+
{
11+
"name": "buildah-task",
12+
"taskRef": {
13+
"resolver": "bundles",
14+
"params": [
15+
{
16+
"name": "bundle",
17+
"value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.7@sha256:633a99fc16d0b05d32a9c08f792ac1ddaecabf6db5ac805856ac92970b63025b"
18+
},
19+
{
20+
"name": "name",
21+
"value": "buildah"
22+
},
23+
{
24+
"name": "kind",
25+
"value": "task"
26+
}
27+
]
28+
}
29+
}
30+
]
31+
}
32+
}

‎acceptance/samples/untrusted-task.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"apiVersion": "tekton.dev/v1",
3+
"kind": "Pipeline",
4+
"metadata": {
5+
"name": "test-pipeline"
6+
},
7+
"spec": {
8+
"tasks": [
9+
{
10+
"name": "buildah-task",
11+
"taskRef": {
12+
"resolver": "bundles",
13+
"params": [
14+
{
15+
"name": "bundle",
16+
"value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.5@sha256:633a99fc16d0b05d32a9c08f792ac1ddaecabf6db5ac805856ac92970b63025b"
17+
},
18+
{
19+
"name": "name",
20+
"value": "buildah"
21+
},
22+
{
23+
"name": "kind",
24+
"value": "task"
25+
}
26+
]
27+
}
28+
}
29+
]
30+
}
31+
}

‎acceptance/testdata/trusted-task-rules-data.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
# Copyright The Conforma Contributors
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
rule_data:
17+
trusted_task_rules:
18+
allow:
19+
- name: "Allow Konflux tasks"
20+
pattern: "oci://quay.io/konflux-ci/tekton-catalog/*"
21+
deny:
22+
- name: "Deprecate old buildah versions"
23+
pattern: "oci://quay.io/konflux-ci/tekton-catalog/task-buildah"
24+
versions: ["<=0.5"]

0 commit comments

Comments
 (0)