-
Notifications
You must be signed in to change notification settings - Fork 550
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Allow passing keys via environment variables (
env:// refs) (#1794)
* Bump github.com/sigstore/sigstore Signed-off-by: Zachary Newman <[email protected]> * test: add test for blob.LoadFileOrURL Signed-off-by: Zachary Newman <[email protected]> * refactor: break up LoadFileOrURL by scheme Signed-off-by: Zachary Newman <[email protected]> * feat: add "env://" scheme for blob load Signed-off-by: Zachary Newman <[email protected]> * feat: add "env://" scheme for key lookup Tested manually as well: ```shell $ export COSIGN_PASSWORD=foo $ cosign generate-key-pair Enter password for private key: Enter password for private key again: Private key written to cosign.key Public key written to cosign.pub $ export MYPRIVKEY="$(cat cosign.key)" $ export MYPUBKEY="$(cat cosign.pub)" $ cosign verify-blob --key env://MYPUBKEY /dev/null --signature <(cosign sign-blob --key env://MYPRIVKEY /dev/null) Using payload from: /dev/null tlog entry created with index: 2095539 tlog entry verified with uuid: dd55086556d7ac0cded8f50961b68f7740e1435fbc5bb47460a8d78321313c7d index: 2095539 Verified OK ``` Signed-off-by: Zachary Newman <[email protected]> * test: skip test that flakes on Windows Signed-off-by: Zachary Newman <[email protected]>
- Loading branch information
Showing
10 changed files
with
194 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| // | ||
| // Copyright 2021 The Sigstore Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package blob | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "os" | ||
| "path" | ||
| "runtime" | ||
| "testing" | ||
| ) | ||
|
|
||
| func TestLoadFile(t *testing.T) { | ||
| if runtime.GOOS == "windows" { | ||
| t.Skip("Skipping on Windows due to https://github.com/golang/go/issues/51442") | ||
| } | ||
| temp := t.TempDir() | ||
| fname := "filename.txt" | ||
| path := path.Join(temp, fname) | ||
| data := []byte("test") | ||
| defer os.Remove(path) | ||
| os.WriteFile(path, data, 0400) | ||
|
|
||
| // absolute path | ||
| actual, err := LoadFileOrURL(path) | ||
| if err != nil { | ||
| t.Errorf("Reading from absolute path %s failed: %v", path, err) | ||
| } else if !bytes.Equal(actual, data) { | ||
| t.Errorf("LoadFileOrURL(absolute path) = '%s'; want '%s'", actual, data) | ||
| } | ||
|
|
||
| if err = os.Chdir(temp); err != nil { | ||
| t.Fatalf("Chdir('%s'): %v", temp, err) | ||
| } | ||
| actual, err = LoadFileOrURL(fname) | ||
| if err != nil { | ||
| t.Errorf("Reading from relative path %s failed: %v", fname, err) | ||
| } else if !bytes.Equal(actual, data) { | ||
| t.Errorf("LoadFileOrURL(relative path) = '%s'; want '%s'", actual, data) | ||
| } | ||
| } | ||
|
|
||
| func TestLoadURL(t *testing.T) { | ||
| data := []byte("test") | ||
|
|
||
| server := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) { | ||
| rw.Write(data) | ||
| })) | ||
| defer server.Close() | ||
|
|
||
| actual, err := LoadFileOrURL(server.URL) | ||
| if err != nil { | ||
| t.Errorf("Reading from HTTP failed: %v", err) | ||
| } else if !bytes.Equal(actual, data) { | ||
| t.Errorf("LoadFileOrURL(HTTP) = '%s'; want '%s'", actual, data) | ||
| } | ||
|
|
||
| os.Setenv("MY_ENV_VAR", string(data)) | ||
| actual, err = LoadFileOrURL("env://MY_ENV_VAR") | ||
| if err != nil { | ||
| t.Errorf("Reading from environment failed: %v", err) | ||
| } else if !bytes.Equal(actual, data) { | ||
| t.Errorf("LoadFileOrURL(env) = '%s'; want '%s'", actual, data) | ||
| } | ||
|
|
||
| os.Setenv("MY_ENV_VAR", "") | ||
| actual, err = LoadFileOrURL("env://MY_ENV_VAR") | ||
| if err != nil { | ||
| t.Errorf("Reading from environment failed: %v", err) | ||
| } else if !bytes.Equal(actual, make([]byte, 0)) { | ||
| t.Errorf("LoadFileOrURL(env) = '%s'; should be empty", actual) | ||
| } | ||
|
|
||
| os.Unsetenv("MY_ENV_VAR") | ||
| _, err = LoadFileOrURL("env://MY_ENV_VAR") | ||
| if err == nil { | ||
| t.Error("LoadFileOrURL(): expected error for unset env var") | ||
| } | ||
|
|
||
| _, err = LoadFileOrURL("invalid://url") | ||
| if err == nil { | ||
| t.Error("LoadFileOrURL(): expected error for invalid scheme") | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters