Skip to content

Commit 6eb53a5

Browse files
Two-HeartsTwo-Hearts
authored
refactor: updated verifier constructor (#508)
Signed-off-by: Patrick Zheng <[email protected]>
1 parent 96b7133 commit 6eb53a5

File tree

3 files changed

+118
-40
lines changed

3 files changed

+118
-40
lines changed

‎example_verifyBlob_test.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ func Example_verifyBlob() {
6161
}
6262

6363
// exampleVerifier implements [notation.Verify] and [notation.VerifyBlob].
64-
exampleVerifier, err := verifier.NewVerifier(nil, &exampleBlobPolicyDocument, truststore.NewX509TrustStore(dir.ConfigFS()), nil)
64+
exampleVerifier, err := verifier.NewVerifierWithOptions(truststore.NewX509TrustStore(dir.ConfigFS()), verifier.VerifierOptions{
65+
BlobTrustPolicy: &exampleBlobPolicyDocument,
66+
})
6567
if err != nil {
6668
panic(err) // Handle error
6769
}

‎verifier/verifier.go

+30-14
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,15 @@ type VerifierOptions struct {
8888
// RevocationTimestampingValidator is used for verifying revocation of
8989
// timestamping certificate chain with context.
9090
RevocationTimestampingValidator revocation.Validator
91+
92+
// OCITrustpolicy is the trust policy document for OCI artifacts.
93+
OCITrustPolicy *trustpolicy.OCIDocument
94+
95+
// BlobTrustPolicy is the trust policy document for Blob artifacts.
96+
BlobTrustPolicy *trustpolicy.BlobDocument
97+
98+
// PluginManager manages plugins installed on the system.
99+
PluginManager plugin.Manager
91100
}
92101

93102
// NewOCIVerifierFromConfig returns an OCI verifier based on local file system
@@ -100,7 +109,10 @@ func NewOCIVerifierFromConfig() (*verifier, error) {
100109
// load trust store
101110
x509TrustStore := truststore.NewX509TrustStore(dir.ConfigFS())
102111

103-
return NewVerifier(policyDocument, nil, x509TrustStore, plugin.NewCLIManager(dir.PluginFS()))
112+
return NewVerifierWithOptions(x509TrustStore, VerifierOptions{
113+
OCITrustPolicy: policyDocument,
114+
PluginManager: plugin.NewCLIManager(dir.PluginFS()),
115+
})
104116
}
105117

106118
// NewBlobVerifierFromConfig returns a Blob verifier based on local file system
@@ -113,7 +125,10 @@ func NewBlobVerifierFromConfig() (*verifier, error) {
113125
// load trust store
114126
x509TrustStore := truststore.NewX509TrustStore(dir.ConfigFS())
115127

116-
return NewVerifier(nil, policyDocument, x509TrustStore, plugin.NewCLIManager(dir.PluginFS()))
128+
return NewVerifierWithOptions(x509TrustStore, VerifierOptions{
129+
BlobTrustPolicy: policyDocument,
130+
PluginManager: plugin.NewCLIManager(dir.PluginFS()),
131+
})
117132
}
118133

119134
// NewWithOptions creates a new verifier given ociTrustPolicy, trustStore,
@@ -122,18 +137,16 @@ func NewBlobVerifierFromConfig() (*verifier, error) {
122137
// Deprecated: NewWithOptions function exists for historical compatibility and
123138
// should not be used. To create verifier, use [NewVerifierWithOptions] function.
124139
func NewWithOptions(ociTrustPolicy *trustpolicy.OCIDocument, trustStore truststore.X509TrustStore, pluginManager plugin.Manager, opts VerifierOptions) (notation.Verifier, error) {
125-
return NewVerifierWithOptions(ociTrustPolicy, nil, trustStore, pluginManager, opts)
126-
}
127-
128-
// NewVerifier creates a new verifier given ociTrustPolicy, trustStore and
129-
// pluginManager
130-
func NewVerifier(ociTrustPolicy *trustpolicy.OCIDocument, blobTrustPolicy *trustpolicy.BlobDocument, trustStore truststore.X509TrustStore, pluginManager plugin.Manager) (*verifier, error) {
131-
return NewVerifierWithOptions(ociTrustPolicy, blobTrustPolicy, trustStore, pluginManager, VerifierOptions{})
140+
opts.OCITrustPolicy = ociTrustPolicy
141+
opts.PluginManager = pluginManager
142+
return NewVerifierWithOptions(trustStore, opts)
132143
}
133144

134-
// NewVerifierWithOptions creates a new verifier given ociTrustPolicy,
135-
// blobTrustPolicy, trustStore, pluginManager, and verifierOptions
136-
func NewVerifierWithOptions(ociTrustPolicy *trustpolicy.OCIDocument, blobTrustPolicy *trustpolicy.BlobDocument, trustStore truststore.X509TrustStore, pluginManager plugin.Manager, verifierOptions VerifierOptions) (*verifier, error) {
145+
// NewVerifierWithOptions creates a new verifier given trustStore and
146+
// verifierOptions.
147+
func NewVerifierWithOptions(trustStore truststore.X509TrustStore, verifierOptions VerifierOptions) (*verifier, error) {
148+
ociTrustPolicy := verifierOptions.OCITrustPolicy
149+
blobTrustPolicy := verifierOptions.BlobTrustPolicy
137150
if trustStore == nil {
138151
return nil, errors.New("trustStore cannot be nil")
139152
}
@@ -154,7 +167,7 @@ func NewVerifierWithOptions(ociTrustPolicy *trustpolicy.OCIDocument, blobTrustPo
154167
ociTrustPolicyDoc: ociTrustPolicy,
155168
blobTrustPolicyDoc: blobTrustPolicy,
156169
trustStore: trustStore,
157-
pluginManager: pluginManager,
170+
pluginManager: verifierOptions.PluginManager,
158171
}
159172

160173
if err := v.setRevocation(verifierOptions); err != nil {
@@ -177,7 +190,10 @@ func NewFromConfig() (notation.Verifier, error) {
177190
// Deprecated: New function exists for historical compatibility and
178191
// should not be used. To create verifier, use [NewVerifier] function.
179192
func New(ociTrustPolicy *trustpolicy.OCIDocument, trustStore truststore.X509TrustStore, pluginManager plugin.Manager) (notation.Verifier, error) {
180-
return NewVerifier(ociTrustPolicy, nil, trustStore, pluginManager)
193+
return NewVerifierWithOptions(trustStore, VerifierOptions{
194+
OCITrustPolicy: ociTrustPolicy,
195+
PluginManager: pluginManager,
196+
})
181197
}
182198

183199
// setRevocation sets revocation validators of v

‎verifier/verifier_test.go

+85-25
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,12 @@ import (
1717
"context"
1818
"crypto/x509"
1919
"crypto/x509/pkix"
20+
"encoding/json"
2021
"encoding/pem"
2122
"errors"
2223
"fmt"
2324
"net/http"
25+
"os"
2426
"path/filepath"
2527
"reflect"
2628
"strconv"
@@ -728,9 +730,13 @@ func TestNewVerifierWithOptions(t *testing.T) {
728730
if err != nil {
729731
t.Fatalf("unexpected error while creating revocation object: %v", err)
730732
}
731-
opts := VerifierOptions{RevocationClient: r}
732733

733-
v, err := NewVerifierWithOptions(&ociPolicy, &blobPolicy, store, pm, opts)
734+
v, err := NewVerifierWithOptions(store, VerifierOptions{
735+
RevocationClient: r,
736+
OCITrustPolicy: &ociPolicy,
737+
BlobTrustPolicy: &blobPolicy,
738+
PluginManager: pm,
739+
})
734740
if err != nil {
735741
t.Fatalf("expected NewVerifierWithOptions constructor to succeed, but got %v", err)
736742
}
@@ -750,18 +756,28 @@ func TestNewVerifierWithOptions(t *testing.T) {
750756
t.Fatal("expected nil revocationCodeSigningValidator")
751757
}
752758

753-
_, err = NewVerifierWithOptions(nil, &blobPolicy, store, pm, opts)
759+
_, err = NewVerifierWithOptions(store, VerifierOptions{
760+
RevocationClient: r,
761+
BlobTrustPolicy: &blobPolicy,
762+
PluginManager: pm,
763+
})
754764
if err != nil {
755765
t.Fatalf("expected NewVerifierWithOptions constructor to succeed, but got %v", err)
756766
}
757767

758-
_, err = NewVerifierWithOptions(&ociPolicy, nil, store, pm, opts)
768+
_, err = NewVerifierWithOptions(store, VerifierOptions{
769+
RevocationClient: r,
770+
OCITrustPolicy: &ociPolicy,
771+
PluginManager: pm,
772+
})
759773
if err != nil {
760774
t.Fatalf("expected NewVerifierWithOptions constructor to succeed, but got %v", err)
761775
}
762776

763-
opts.RevocationClient = nil
764-
_, err = NewVerifierWithOptions(&ociPolicy, nil, store, pm, opts)
777+
_, err = NewVerifierWithOptions(store, VerifierOptions{
778+
OCITrustPolicy: &ociPolicy,
779+
PluginManager: pm,
780+
})
765781
if err != nil {
766782
t.Fatalf("expected NewVerifierWithOptions constructor to succeed, but got %v", err)
767783
}
@@ -770,19 +786,11 @@ func TestNewVerifierWithOptions(t *testing.T) {
770786
if err != nil {
771787
t.Fatal(err)
772788
}
773-
opts = VerifierOptions{
789+
v, err = NewVerifierWithOptions(store, VerifierOptions{
774790
RevocationCodeSigningValidator: csValidator,
775-
}
776-
v, err = NewVerifierWithOptions(&ociPolicy, nil, store, pm, opts)
777-
if err != nil {
778-
t.Fatalf("expected NewVerifierWithOptions constructor to succeed, but got %v", err)
779-
}
780-
if v.revocationCodeSigningValidator == nil {
781-
t.Fatal("expected v.revocationCodeSigningValidator to be non-nil")
782-
}
783-
784-
opts = VerifierOptions{}
785-
v, err = NewVerifierWithOptions(&ociPolicy, nil, store, pm, opts)
791+
OCITrustPolicy: &ociPolicy,
792+
PluginManager: pm,
793+
})
786794
if err != nil {
787795
t.Fatalf("expected NewVerifierWithOptions constructor to succeed, but got %v", err)
788796
}
@@ -803,22 +811,68 @@ func TestNewVerifierWithOptionsError(t *testing.T) {
803811
if err != nil {
804812
t.Fatalf("unexpected error while creating revocation timestamp object: %v", err)
805813
}
806-
opts := VerifierOptions{
814+
815+
_, err = NewVerifierWithOptions(store, VerifierOptions{
807816
RevocationClient: r,
808817
RevocationTimestampingValidator: rt,
809-
}
810-
811-
_, err = NewVerifierWithOptions(nil, nil, store, pm, opts)
818+
PluginManager: pm,
819+
})
812820
if err == nil || err.Error() != "ociTrustPolicy and blobTrustPolicy both cannot be nil" {
813821
t.Errorf("expected err but not found.")
814822
}
815823

816-
_, err = NewVerifierWithOptions(&ociPolicy, &blobPolicy, nil, pm, opts)
824+
_, err = NewVerifierWithOptions(nil, VerifierOptions{
825+
RevocationClient: r,
826+
RevocationTimestampingValidator: rt,
827+
OCITrustPolicy: &ociPolicy,
828+
BlobTrustPolicy: &blobPolicy,
829+
PluginManager: pm,
830+
})
817831
if err == nil || err.Error() != "trustStore cannot be nil" {
818832
t.Errorf("expected err but not found.")
819833
}
820834
}
821835

836+
func TestNewOCIVerifierFromConfig(t *testing.T) {
837+
defer func(oldUserConfigDir string) {
838+
dir.UserConfigDir = oldUserConfigDir
839+
}(dir.UserConfigDir)
840+
841+
tempRoot := t.TempDir()
842+
dir.UserConfigDir = tempRoot
843+
path := filepath.Join(tempRoot, "trustpolicy.oci.json")
844+
policyJson, _ := json.Marshal(dummyOCIPolicyDocument())
845+
if err := os.WriteFile(path, policyJson, 0600); err != nil {
846+
t.Fatalf("TestLoadOCIDocument write policy file failed. Error: %v", err)
847+
}
848+
t.Cleanup(func() { os.RemoveAll(tempRoot) })
849+
850+
_, err := NewOCIVerifierFromConfig()
851+
if err != nil {
852+
t.Fatalf("expected NewOCIVerifierFromConfig constructor to succeed, but got %v", err)
853+
}
854+
}
855+
856+
func TestNewBlobVerifierFromConfig(t *testing.T) {
857+
defer func(oldUserConfigDir string) {
858+
dir.UserConfigDir = oldUserConfigDir
859+
}(dir.UserConfigDir)
860+
861+
tempRoot := t.TempDir()
862+
dir.UserConfigDir = tempRoot
863+
path := filepath.Join(tempRoot, "trustpolicy.blob.json")
864+
policyJson, _ := json.Marshal(dummyBlobPolicyDocument())
865+
if err := os.WriteFile(path, policyJson, 0600); err != nil {
866+
t.Fatalf("TestLoadBlobDocument write policy file failed. Error: %v", err)
867+
}
868+
t.Cleanup(func() { os.RemoveAll(tempRoot) })
869+
870+
_, err := NewBlobVerifierFromConfig()
871+
if err != nil {
872+
t.Fatalf("expected NewBlobVerifierFromConfig constructor to succeed, but got %v", err)
873+
}
874+
}
875+
822876
func TestVerifyBlob(t *testing.T) {
823877
policy := &trustpolicy.BlobDocument{
824878
Version: "1.0",
@@ -831,7 +885,10 @@ func TestVerifyBlob(t *testing.T) {
831885
},
832886
},
833887
}
834-
v, err := NewVerifier(nil, policy, &testTrustStore{}, pm)
888+
v, err := NewVerifierWithOptions(&testTrustStore{}, VerifierOptions{
889+
BlobTrustPolicy: policy,
890+
PluginManager: pm,
891+
})
835892
if err != nil {
836893
t.Fatalf("unexpected error while creating verifier: %v", err)
837894
}
@@ -877,7 +934,10 @@ func TestVerifyBlob_Error(t *testing.T) {
877934
},
878935
},
879936
}
880-
v, err := NewVerifier(nil, policy, &testTrustStore{}, pm)
937+
v, err := NewVerifierWithOptions(&testTrustStore{}, VerifierOptions{
938+
BlobTrustPolicy: policy,
939+
PluginManager: pm,
940+
})
881941
if err != nil {
882942
t.Fatalf("unexpected error while creating verifier: %v", err)
883943
}

0 commit comments

Comments
 (0)