Add tests for bundle checkopts

Signed-off-by: Cody Soyland <[email protected]>

Author: codysoyland

pkg/webhook/validator_test.go

@@ -33,6 +33,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/go-containerregistry/pkg/authn/k8schain"
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/sigstore/cosign/v2/pkg/cosign"
@@ -46,6 +47,8 @@ import (
 	"github.com/sigstore/policy-controller/pkg/apis/signaturealgo"
 	policycontrollerconfig "github.com/sigstore/policy-controller/pkg/config"
 	webhookcip "github.com/sigstore/policy-controller/pkg/webhook/clusterimagepolicy"
+	pbcommon "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
+	"github.com/sigstore/sigstore-go/pkg/root"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/fulcioroots"
 	"github.com/sigstore/sigstore/pkg/tuf"
@@ -3240,10 +3243,12 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 		}},
 	}
 	skCombined := config.SigstoreKeys{
+		MediaType: "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
 		Tlogs: []*config.TransparencyLogInstance{{
-			PublicKey: pbpkRekor,
-			LogId:     &config.LogID{KeyId: []byte("rekor-logid")},
-			BaseUrl:   "rekor.example.com",
+			PublicKey:     pbpkRekor,
+			LogId:         &config.LogID{KeyId: []byte("rekor-logid")},
+			BaseUrl:       "rekor.example.com",
+			HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256,
 		}},
 		CertificateAuthorities: []*config.CertificateAuthority{{
 			Subject: &config.DistinguishedName{
@@ -3253,8 +3258,9 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 			CertChain: certChainPB,
 		}},
 		Ctlogs: []*config.TransparencyLogInstance{{
-			LogId:     &config.LogID{KeyId: []byte(ctfeLogID)},
-			PublicKey: pbpkCTFE,
+			LogId:         &config.LogID{KeyId: []byte(ctfeLogID)},
+			PublicKey:     pbpkCTFE,
+			HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256,
 		}},
 	}
 	c := &config.Config{
@@ -3355,6 +3361,79 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 			}},
 			CTLogPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{ctfeLogID: {PubKey: pkCTFE, Status: tuf.Active}}},
 		},
+	}, {
+		name: "bundle format, with Identities and Rekor",
+		authority: webhookcip.Authority{
+			SignatureFormat: "bundle",
+			CTLog: &v1alpha1.TLog{
+				URL:          apis.HTTPS("rekor.example.com"),
+				TrustRootRef: "test-trust-combined",
+			},
+			Keyless: &webhookcip.KeylessRef{
+				TrustRootRef: "test-trust-combined",
+				Identities: []v1alpha1.Identity{{
+					Issuer:  "issuer",
+					Subject: "subject",
+				}},
+			},
+		},
+		ctx: testCtx,
+		wantCheckOpts: &cosign.CheckOpts{
+			NewBundleFormat: true,
+			Identities: []cosign.Identity{{
+				Issuer:  "issuer",
+				Subject: "subject",
+			}},
+			TrustedMaterial: &root.TrustedRoot{},
+		},
+	}, {
+		name: "bundle format, with TSA",
+		authority: webhookcip.Authority{
+			SignatureFormat: "bundle",
+			// Test keys do not contain a TSA but that is okay as we are just constructing the checkOpts
+			RFC3161Timestamp: &webhookcip.RFC3161Timestamp{
+				TrustRootRef: "test-trust-combined",
+			},
+			Keyless: &webhookcip.KeylessRef{
+				TrustRootRef: "test-trust-combined",
+			},
+		},
+		ctx: testCtx,
+		wantCheckOpts: &cosign.CheckOpts{
+			NewBundleFormat:     true,
+			UseSignedTimestamps: true,
+			TrustedMaterial:     &root.TrustedRoot{},
+		},
+	}, {
+		name: "bundle format, bad TrustRootRef",
+		authority: webhookcip.Authority{
+			SignatureFormat: "bundle",
+			Keyless: &webhookcip.KeylessRef{
+				TrustRootRef: "not-there",
+			},
+		},
+		ctx:     testCtx,
+		wantErr: "trustRootRef not-there not found",
+	}, {
+		name: "bundle format, unsupported different trustroots",
+		authority: webhookcip.Authority{
+			SignatureFormat: "bundle",
+			CTLog: &v1alpha1.TLog{
+				TrustRootRef: "test-trust-rekor",
+			},
+			Keyless: &webhookcip.KeylessRef{
+				TrustRootRef: "test-trust-combined",
+			},
+		},
+		ctx:     testCtx,
+		wantErr: "when using the new bundle format, the trustRootRef for the TLog must be the same as the trustRootRef for the Keyless authority",
+	}, {
+		name: "bundle format, unsupported non-keyless",
+		authority: webhookcip.Authority{
+			SignatureFormat: "bundle",
+		},
+		ctx:     testCtx,
+		wantErr: "when using the new bundle format, the authority must be keyless",
 	}}
 
 	for _, tc := range tests {
@@ -3384,7 +3463,7 @@ func TestCheckOptsFromAuthority(t *testing.T) {
 			if gotCheckOpts != nil {
 				gotCheckOpts.RekorClient = nil
 			}
-			if diff := cmp.Diff(gotCheckOpts, tc.wantCheckOpts); diff != "" {
+			if diff := cmp.Diff(gotCheckOpts, tc.wantCheckOpts, cmpopts.IgnoreUnexported(root.TrustedRoot{})); diff != "" {
 				t.Errorf("CheckOpts differ: %s", diff)
 			}
 		})