pin/trust_test.go at main · git-pkgs/pin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
package pin

import (
	"strings"
	"testing"

	"github.com/git-pkgs/pin/lock"
	"github.com/git-pkgs/pin/manifest"
)

func boolPtr(b bool) *bool { return &b }

func TestEnforceTrust_PublisherMismatch(t *testing.T) {
	m := &manifest.Manifest{Assets: []manifest.Entry{{Name: "evil", Version: "1.0.0"}}}
	l := &lock.Lock{Assets: []lock.Asset{{
		Name:       "evil",
		Version:    "1.0.0",
		PURL:       "pkg:npm/evil@1.0.0",
		Repository: "https://github.com/legitimate/repo",
		Attestation: &lock.Attestation{
			SourceRepository: "https://github.com/attacker/repo",
			BuilderID:        "https://github.com/attacker/repo/.github/workflows/release.yml@refs/tags/v1",
		},
	}}}
	err := enforceTrust(m, l, SyncOptions{RequirePublisherMatchesRepository: true})
	if err == nil || !strings.Contains(err.Error(), "evil@1.0.0") {
		t.Errorf("expected mismatch error, got %v", err)
	}
}

func TestEnforceTrust_TrustedWorkflowAllows(t *testing.T) {
	m := &manifest.Manifest{
		Trust: &manifest.Trust{
			RequirePublisherMatchesRepository: boolPtr(true),
			TrustedWorkflows:                  []string{"https://github.com/builder-org/builder/.github/workflows/release.yml"},
		},
		Assets: []manifest.Entry{{Name: "monorepo-pkg", Version: "1.0.0"}},
	}
	l := &lock.Lock{Assets: []lock.Asset{{
		Name:       "monorepo-pkg",
		Version:    "1.0.0",
		PURL:       "pkg:npm/monorepo-pkg@1.0.0",
		Repository: "https://github.com/owner/declared-repo",
		Attestation: &lock.Attestation{
			SourceRepository: "https://github.com/builder-org/builder",
			BuilderID:        "https://github.com/builder-org/builder/.github/workflows/release.yml@refs/tags/v1",
		},
	}}}
	if err := enforceTrust(m, l, SyncOptions{}); err != nil {
		t.Errorf("trusted_workflows should permit the mismatch: %v", err)
	}
}

func TestEnforceTrust_RequireProvenanceMissing(t *testing.T) {
	m := &manifest.Manifest{
		Trust:  &manifest.Trust{RequireProvenance: boolPtr(true)},
		Assets: []manifest.Entry{{Name: "no-att", Version: "1.0.0"}},
	}
	l := &lock.Lock{Assets: []lock.Asset{{
		Name: "no-att", Version: "1.0.0", PURL: "pkg:npm/no-att@1.0.0",
	}}}
	err := enforceTrust(m, l, SyncOptions{})
	if err == nil || !strings.Contains(err.Error(), "no-att@1.0.0") {
		t.Errorf("expected provenance error, got %v", err)
	}
}

func TestNormaliseRepoURL_Subpath(t *testing.T) {
	cases := map[string]string{
		"https://github.com/owner/repo/tree/main/packages/baz": "github.com/owner/repo",
		"https://github.com/owner/repo/blob/main/README.md":    "github.com/owner/repo",
		"https://github.com/owner/repo":                        "github.com/owner/repo",
	}
	for in, want := range cases {
		if got := normaliseRepoURL(in); got != want {
			t.Errorf("normaliseRepoURL(%q) = %q, want %q", in, got, want)
		}
	}
}

func TestEnforceTrust_PerEntryOptOut(t *testing.T) {
	m := &manifest.Manifest{
		Trust: &manifest.Trust{RequireProvenance: boolPtr(true)},
		Assets: []manifest.Entry{
			{Name: "no-att", Version: "1.0.0", Trust: &manifest.Trust{RequireProvenance: boolPtr(false)}},
		},
	}
	l := &lock.Lock{Assets: []lock.Asset{{
		Name: "no-att", Version: "1.0.0", PURL: "pkg:npm/no-att@1.0.0",
	}}}
	if err := enforceTrust(m, l, SyncOptions{}); err != nil {
		t.Errorf("per-entry opt-out should let it pass: %v", err)
	}
}

func TestEnforceTrust_CLIFlagForces(t *testing.T) {
	m := &manifest.Manifest{
		Assets: []manifest.Entry{
			{Name: "no-att", Version: "1.0.0", Trust: &manifest.Trust{RequireProvenance: boolPtr(false)}},
		},
	}
	l := &lock.Lock{Assets: []lock.Asset{{
		Name: "no-att", Version: "1.0.0", PURL: "pkg:npm/no-att@1.0.0",
	}}}
	err := enforceTrust(m, l, SyncOptions{StrictProvenance: true})
	if err == nil {
		t.Error("--strict-provenance should override per-entry opt-out")
	}
}

func TestNormaliseRepoURL(t *testing.T) {
	cases := map[string]string{
		"https://github.com/owner/repo":     "github.com/owner/repo",
		"https://github.com/owner/repo.git": "github.com/owner/repo",
		"https://github.com/owner/repo/":    "github.com/owner/repo",
		"http://github.com/Owner/Repo":      "github.com/owner/repo",
		"git@github.com:owner/repo.git":     "git@github.com:owner/repo",
		"":                                  "",
	}
	for in, want := range cases {
		if got := normaliseRepoURL(in); got != want {
			t.Errorf("normaliseRepoURL(%q) = %q, want %q", in, got, want)
		}
	}
}