Skip to content

Commit 0d06de3

Browse files
Two-HeartsFeynmanZhou
Two-Hearts
authored and
FeynmanZhou
committed
refactor: update verifier (notaryproject#1002)
Signed-off-by: Patrick Zheng <patrickzheng@microsoft.com>
1 parent fafe287 commit 0d06de3

File tree

9 files changed

+77
-28
lines changed

9 files changed

+77
-28
lines changed

‎cmd/notation/verify.go

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,26 @@
1414
package main
1515

1616
import (
17+
"context"
1718
"errors"
1819
"fmt"
1920
"io/fs"
21+
"net/http"
2022
"os"
2123
"reflect"
24+
"time"
2225

26+
"github.com/notaryproject/notation-core-go/revocation"
27+
"github.com/notaryproject/notation-core-go/revocation/purpose"
2328
"github.com/notaryproject/notation-go"
29+
"github.com/notaryproject/notation-go/dir"
30+
"github.com/notaryproject/notation-go/plugin"
2431
"github.com/notaryproject/notation-go/verifier"
2532
"github.com/notaryproject/notation-go/verifier/trustpolicy"
2633
"github.com/notaryproject/notation-go/verifier/truststore"
2734
"github.com/notaryproject/notation/cmd/notation/internal/experimental"
2835
"github.com/notaryproject/notation/internal/cmd"
36+
"github.com/notaryproject/notation/internal/httputil"
2937
"github.com/notaryproject/notation/internal/ioutil"
3038
"github.com/spf13/cobra"
3139
)
@@ -111,7 +119,7 @@ func runVerify(command *cobra.Command, opts *verifyOpts) error {
111119
ctx := opts.LoggingFlagOpts.InitializeLogger(command.Context())
112120

113121
// initialize
114-
sigVerifier, err := verifier.NewFromConfig()
122+
sigVerifier, err := getVerifier(ctx)
115123
if err != nil {
116124
return err
117125
}
@@ -219,3 +227,30 @@ func printMetadataIfPresent(outcome *notation.VerificationOutcome) {
219227
ioutil.PrintMetadataMap(os.Stdout, metadata)
220228
}
221229
}
230+
231+
func getVerifier(ctx context.Context) (notation.Verifier, error) {
232+
policyDocument, err := trustpolicy.LoadOCIDocument()
233+
if err != nil {
234+
return nil, err
235+
}
236+
x509TrustStore := truststore.NewX509TrustStore(dir.ConfigFS())
237+
ocspHttpClient := httputil.NewClient(ctx, &http.Client{Timeout: 2 * time.Second})
238+
revocationCodeSigningValidator, err := revocation.NewWithOptions(revocation.Options{
239+
OCSPHTTPClient: ocspHttpClient,
240+
CertChainPurpose: purpose.CodeSigning,
241+
})
242+
if err != nil {
243+
return nil, err
244+
}
245+
revocationTimestampingValidator, err := revocation.NewWithOptions(revocation.Options{
246+
OCSPHTTPClient: ocspHttpClient,
247+
CertChainPurpose: purpose.Timestamping,
248+
})
249+
if err != nil {
250+
return nil, err
251+
}
252+
return verifier.NewVerifierWithOptions(policyDocument, nil, x509TrustStore, plugin.NewCLIManager(dir.PluginFS()), verifier.VerifierOptions{
253+
RevocationCodeSigningValidator: revocationCodeSigningValidator,
254+
RevocationTimestampingValidator: revocationTimestampingValidator,
255+
})
256+
}

‎cmd/notation/verify_test.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,11 @@
1414
package main
1515

1616
import (
17+
"context"
1718
"reflect"
1819
"testing"
20+
21+
"github.com/notaryproject/notation-go/dir"
1922
)
2023

2124
func TestVerifyCommand_BasicArgs(t *testing.T) {
@@ -80,3 +83,14 @@ func TestVerifyCommand_MissingArgs(t *testing.T) {
8083
t.Fatal("Parse Args expected error, but ok")
8184
}
8285
}
86+
87+
func TestGetVerifier(t *testing.T) {
88+
t.Run("non-existing trust policy", func(t *testing.T) {
89+
dir.UserConfigDir = "/"
90+
expectedErrMsg := "trust policy is not present. To create a trust policy, see: https://notaryproject.dev/docs/quickstart/#create-a-trust-policy"
91+
_, err := getVerifier(context.Background())
92+
if err == nil || err.Error() != expectedErrMsg {
93+
t.Fatalf("expected %s, but got %s", expectedErrMsg, err)
94+
}
95+
})
96+
}

‎go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ module github.com/notaryproject/notation
33
go 1.22
44

55
require (
6-
github.com/notaryproject/notation-core-go v1.1.0-beta.1
7-
github.com/notaryproject/notation-go v1.2.0-beta.1
8-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172
6+
github.com/notaryproject/notation-core-go v1.1.0-rc.1
7+
github.com/notaryproject/notation-go v1.2.0-beta.1.0.20240814004621-3c5a659c1d1d
8+
github.com/notaryproject/tspclient-go v0.2.0
99
github.com/opencontainers/go-digest v1.0.0
1010
github.com/opencontainers/image-spec v1.1.0
1111
github.com/sirupsen/logrus v1.9.3

‎go.sum

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,14 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
3535
github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
3636
github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
3737
github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
38-
github.com/notaryproject/notation-core-go v1.1.0-beta.1 h1:Rpg8qhoEo4nIdiAWz597lbEcvEmjKwJLUtvJqXa8M4c=
39-
github.com/notaryproject/notation-core-go v1.1.0-beta.1/go.mod h1:MdxSbL9F5h63EmtXWfYMWy7hEmGmOmsfN4B6KM2WyhY=
40-
github.com/notaryproject/notation-go v1.2.0-beta.1 h1:xSDkmdZ5j7kLrVs2ae8MyowdN7kEzwlV0EIhHjKfF90=
41-
github.com/notaryproject/notation-go v1.2.0-beta.1/go.mod h1:RypdKUKCUZ8QgJAqaaesgUkTRHQIB+puCPdH3/3dVGE=
38+
github.com/notaryproject/notation-core-go v1.1.0-rc.1 h1:6cxfVUuc4rTqYu0u7vOmgXfqw1zZabSLJNo8KvkDEzU=
39+
github.com/notaryproject/notation-core-go v1.1.0-rc.1/go.mod h1:j6NELapik2bE1DcrL5otTfXWuW5PR/JLLfREZ4ggmYY=
40+
github.com/notaryproject/notation-go v1.2.0-beta.1.0.20240814004621-3c5a659c1d1d h1:7/lNsNkauXRhFuQ7TXTBuJA9PjrLhVraaAHuoDisK5Q=
41+
github.com/notaryproject/notation-go v1.2.0-beta.1.0.20240814004621-3c5a659c1d1d/go.mod h1:YpPRyhvDtpYVYGtRJ1PGZJhigT3mnl9jwqYj7tTBYVM=
4242
github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4=
4343
github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics=
44-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172 h1:Q8UsmeFMzyFuMMq4dlbIRJUi7khEKXKUe2H2Hm3W92Y=
45-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
44+
github.com/notaryproject/tspclient-go v0.2.0 h1:g/KpQGmyk/h7j60irIRG1mfWnibNOzJ8WhLqAzuiQAQ=
45+
github.com/notaryproject/tspclient-go v0.2.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
4646
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
4747
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
4848
github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=

‎test/e2e/go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/notaryproject/notation/test/e2e
33
go 1.21
44

55
require (
6-
github.com/notaryproject/notation-core-go v1.1.0-beta.1
6+
github.com/notaryproject/notation-core-go v1.1.0-rc.1
77
github.com/onsi/ginkgo/v2 v2.11.0
88
github.com/onsi/gomega v1.27.10
99
github.com/opencontainers/image-spec v1.1.0
@@ -16,7 +16,7 @@ require (
1616
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
1717
github.com/google/go-cmp v0.5.9 // indirect
1818
github.com/google/pprof v0.0.0-20230510103437-eeec1cb781c3 // indirect
19-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172 // indirect
19+
github.com/notaryproject/tspclient-go v0.2.0 // indirect
2020
github.com/opencontainers/go-digest v1.0.0 // indirect
2121
github.com/veraison/go-cose v1.1.0 // indirect
2222
github.com/x448/float16 v0.8.4 // indirect

‎test/e2e/go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
1313
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
1414
github.com/google/pprof v0.0.0-20230510103437-eeec1cb781c3 h1:2XF1Vzq06X+inNqgJ9tRnGuw+ZVCB3FazXODD6JE1R8=
1515
github.com/google/pprof v0.0.0-20230510103437-eeec1cb781c3/go.mod h1:79YE0hCXdHag9sBkw2o+N/YnZtTkXi0UT9Nnixa5eYk=
16-
github.com/notaryproject/notation-core-go v1.1.0-beta.1 h1:Rpg8qhoEo4nIdiAWz597lbEcvEmjKwJLUtvJqXa8M4c=
17-
github.com/notaryproject/notation-core-go v1.1.0-beta.1/go.mod h1:MdxSbL9F5h63EmtXWfYMWy7hEmGmOmsfN4B6KM2WyhY=
18-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172 h1:Q8UsmeFMzyFuMMq4dlbIRJUi7khEKXKUe2H2Hm3W92Y=
19-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
16+
github.com/notaryproject/notation-core-go v1.1.0-rc.1 h1:6cxfVUuc4rTqYu0u7vOmgXfqw1zZabSLJNo8KvkDEzU=
17+
github.com/notaryproject/notation-core-go v1.1.0-rc.1/go.mod h1:j6NELapik2bE1DcrL5otTfXWuW5PR/JLLfREZ4ggmYY=
18+
github.com/notaryproject/tspclient-go v0.2.0 h1:g/KpQGmyk/h7j60irIRG1mfWnibNOzJ8WhLqAzuiQAQ=
19+
github.com/notaryproject/tspclient-go v0.2.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
2020
github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU=
2121
github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM=
2222
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=

‎test/e2e/plugin/go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ go 1.21
44

55
require (
66
github.com/golang-jwt/jwt v3.2.2+incompatible
7-
github.com/notaryproject/notation-core-go v1.1.0-beta.1
8-
github.com/notaryproject/notation-go v1.2.0-beta.1
7+
github.com/notaryproject/notation-core-go v1.1.0-rc.1
8+
github.com/notaryproject/notation-go v1.2.0-beta.1.0.20240814004621-3c5a659c1d1d
99
github.com/notaryproject/notation-plugin-framework-go v1.0.0
1010
github.com/spf13/cobra v1.7.0
1111
)
@@ -18,7 +18,7 @@ require (
1818
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
1919
github.com/google/uuid v1.6.0 // indirect
2020
github.com/inconshreveable/mousetrap v1.1.0 // indirect
21-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172 // indirect
21+
github.com/notaryproject/tspclient-go v0.2.0 // indirect
2222
github.com/opencontainers/go-digest v1.0.0 // indirect
2323
github.com/opencontainers/image-spec v1.1.0 // indirect
2424
github.com/spf13/pflag v1.0.5 // indirect

‎test/e2e/plugin/go.sum

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,14 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
3737
github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
3838
github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
3939
github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
40-
github.com/notaryproject/notation-core-go v1.1.0-beta.1 h1:Rpg8qhoEo4nIdiAWz597lbEcvEmjKwJLUtvJqXa8M4c=
41-
github.com/notaryproject/notation-core-go v1.1.0-beta.1/go.mod h1:MdxSbL9F5h63EmtXWfYMWy7hEmGmOmsfN4B6KM2WyhY=
42-
github.com/notaryproject/notation-go v1.2.0-beta.1 h1:xSDkmdZ5j7kLrVs2ae8MyowdN7kEzwlV0EIhHjKfF90=
43-
github.com/notaryproject/notation-go v1.2.0-beta.1/go.mod h1:RypdKUKCUZ8QgJAqaaesgUkTRHQIB+puCPdH3/3dVGE=
40+
github.com/notaryproject/notation-core-go v1.1.0-rc.1 h1:6cxfVUuc4rTqYu0u7vOmgXfqw1zZabSLJNo8KvkDEzU=
41+
github.com/notaryproject/notation-core-go v1.1.0-rc.1/go.mod h1:j6NELapik2bE1DcrL5otTfXWuW5PR/JLLfREZ4ggmYY=
42+
github.com/notaryproject/notation-go v1.2.0-beta.1.0.20240814004621-3c5a659c1d1d h1:7/lNsNkauXRhFuQ7TXTBuJA9PjrLhVraaAHuoDisK5Q=
43+
github.com/notaryproject/notation-go v1.2.0-beta.1.0.20240814004621-3c5a659c1d1d/go.mod h1:YpPRyhvDtpYVYGtRJ1PGZJhigT3mnl9jwqYj7tTBYVM=
4444
github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4=
4545
github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics=
46-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172 h1:Q8UsmeFMzyFuMMq4dlbIRJUi7khEKXKUe2H2Hm3W92Y=
47-
github.com/notaryproject/tspclient-go v0.1.1-0.20240715235637-df25ef8d2172/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
46+
github.com/notaryproject/tspclient-go v0.2.0 h1:g/KpQGmyk/h7j60irIRG1mfWnibNOzJ8WhLqAzuiQAQ=
47+
github.com/notaryproject/tspclient-go v0.2.0/go.mod h1:LGyA/6Kwd2FlM0uk8Vc5il3j0CddbWSHBj/4kxQDbjs=
4848
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
4949
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
5050
github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=

‎test/e2e/suite/trustpolicy/trusted_identity.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ var _ = Describe("notation trust policy trusted identity test", func() {
125125
artifact := GenerateArtifact("e2e-valid-signature", "")
126126

127127
notation.ExpectFailure().Exec("verify", artifact.ReferenceWithDigest(), "-v").
128-
MatchErrKeyWords(`distinguished name (DN) " CN=e2e,L=Seattle,ST=WA,C=US" has no mandatory RDN attribute for "O", it must contain 'C', 'ST', and 'O' RDN attributes at a minimum`)
128+
MatchErrKeyWords(`distinguished name (DN) " CN=e2e,L=Seattle,ST=WA,C=US" has no mandatory RDN attribute for "O", it must contain 'C', 'ST' or 'S', and 'O' RDN attributes at a minimum`)
129129
})
130130
})
131131

@@ -135,7 +135,7 @@ var _ = Describe("notation trust policy trusted identity test", func() {
135135
artifact := GenerateArtifact("e2e-valid-signature", "")
136136

137137
notation.ExpectFailure().Exec("verify", artifact.ReferenceWithDigest(), "-v").
138-
MatchErrKeyWords(`distinguished name (DN) " CN=e2e,O=Notary,L=Seattle,C=US" has no mandatory RDN attribute for "ST", it must contain 'C', 'ST', and 'O' RDN attributes at a minimum`)
138+
MatchErrKeyWords(`distinguished name (DN) " CN=e2e,O=Notary,L=Seattle,C=US" has no mandatory RDN attribute for "ST", it must contain 'C', 'ST' or 'S', and 'O' RDN attributes at a minimum`)
139139
})
140140
})
141141

@@ -145,7 +145,7 @@ var _ = Describe("notation trust policy trusted identity test", func() {
145145
artifact := GenerateArtifact("e2e-valid-signature", "")
146146

147147
notation.ExpectFailure().Exec("verify", artifact.ReferenceWithDigest(), "-v").
148-
MatchErrKeyWords(`distinguished name (DN) " CN=e2e,O=Notary,L=Seattle,ST=WA" has no mandatory RDN attribute for "C", it must contain 'C', 'ST', and 'O' RDN attributes at a minimum`)
148+
MatchErrKeyWords(`distinguished name (DN) " CN=e2e,O=Notary,L=Seattle,ST=WA" has no mandatory RDN attribute for "C", it must contain 'C', 'ST' or 'S', and 'O' RDN attributes at a minimum`)
149149
})
150150
})
151151
})

0 commit comments

Comments
 (0)