Skip to content

Commit 8a7d6d2

Browse files
jkujku
authored
Merge pull request #94 from jku/fix-artifacts-in-delegations
repo: Fix tuf-on-ci-status when artifacts are added to delegates
2 parents 4d6087d + e8c4cad commit 8a7d6d2

File tree

8 files changed

+241
-5
lines changed

8 files changed

+241
-5
lines changed

‎repo/tuf_on_ci/status.py‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ def _find_changed_roles(known_good_dir: str, signing_event_dir: str) -> set[str]
5555
def _find_changed_target_roles(
5656
known_good_targets_dir: str, targets_dir: str
5757
) -> set[str]:
58+
"""Compare two artifact directories, return rolenames that have artifacts changes"""
5859
files = (
5960
glob("*", root_dir=targets_dir)
6061
+ glob("*/*", root_dir=targets_dir)
@@ -65,17 +66,23 @@ def _find_changed_target_roles(
6566
for filepath in files:
6667
f1 = os.path.join(targets_dir, filepath)
6768
f2 = os.path.join(known_good_targets_dir, filepath)
69+
70+
# subdirs are allowed to exist, appear and disappear
6871
if os.path.isdir(f1) and os.path.isdir(f2):
6972
continue
73+
if os.path.isdir(f1) and not os.path.exists(f2):
74+
continue
75+
if not os.path.exists(f1) and os.path.isdir(f2):
76+
continue
7077

7178
try:
7279
if filecmp.cmp(f1, f2, shallow=False):
7380
continue
7481
except FileNotFoundError:
7582
pass
7683

77-
# found a changed target, add rolename to list. "targets" is a special case
78-
rolename, _, _ = filepath.rpartition(filepath)
84+
# found a changed artifact, add rolename to set. "targets" is a special case
85+
rolename, _, _ = filepath.rpartition("/")
7986
if not rolename:
8087
rolename = "targets"
8188
changed_roles.add(rolename)

‎tests/e2e.sh‎

Lines changed: 59 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -144,16 +144,14 @@ signer_init()
144144

145145
signer_add_delegation()
146146
{
147-
# run tuf-on-ci-delegate to change root signer from user1 to user2:
147+
# run tuf-on-ci-delegate to add a new delegated role
148148
USER1=$1
149149
EVENT=$2
150150

151151
SIGNER_DIR="$WORK_DIR/$TEST_NAME/$USER1"
152152
SIGNER_GIT="$SIGNER_DIR/git"
153153
export SOFTHSM2_CONF="$SIGNER_DIR/softhsm2.conf"
154154

155-
# user1 needs to eventually sign, but after this, there's on open invitation
156-
# for user2, so signing does not happen here
157155
INPUT=(
158156
"delegated" # select role to modify
159157
"1" # Configure role delegated? [1: configure signers]
@@ -357,6 +355,27 @@ signer_modify_targets()
357355
git push --quiet origin $EVENT
358356
}
359357

358+
signer_add_delegated_target()
359+
{
360+
USER=$1
361+
EVENT=$2
362+
363+
SIGNER_DIR="$WORK_DIR/$TEST_NAME/$USER"
364+
SIGNER_GIT="$SIGNER_DIR/git"
365+
export SOFTHSM2_CONF="$SIGNER_DIR/softhsm2.conf"
366+
367+
cd $SIGNER_GIT
368+
369+
# Make target file changes, push to remote signing event branch
370+
git fetch --quiet origin
371+
git switch --quiet -C $EVENT origin/main
372+
mkdir -p targets/delegated
373+
echo "file1" > targets/delegated/file1.txt
374+
git add targets/delegated/file1.txt
375+
git commit --quiet -m "Add a delegated target file"
376+
git push --quiet origin $EVENT
377+
}
378+
360379
non_signer_change_online_delegation()
361380
{
362381
# run tuf-on-ci-delegate: creates a commit, pushes it to remote branch
@@ -642,6 +661,42 @@ test_target_changes()
642661
echo "OK"
643662
}
644663

664+
test_target_changes_in_delegations()
665+
{
666+
echo -n "Target files in delegated roles... "
667+
setup_test "target_files_in_delegated_roles"
668+
669+
# user1: create repo, add a delegated role
670+
signer_init user1 sign/initial
671+
signer_add_delegation user1 sign/initial
672+
673+
# merge successful signing event, create snapshot
674+
repo_merge sign/initial
675+
repo_online_sign
676+
677+
# second signing event: Any user adds target to delegated role
678+
# Signing-event requires a signature from user1
679+
signer_add_delegated_target user2 sign/new-delegated-target
680+
repo_status_fail sign/new-delegated-target
681+
signer_sign user1 sign/new-delegated-target
682+
683+
# merge successful signing event, create snapshot
684+
repo_merge sign/new-delegated-target
685+
repo_online_sign
686+
687+
repo_publish
688+
689+
# Verify test result
690+
# ECDSA signatures are not deterministic: wipe all sigs so diffing is easy
691+
for t in ${PUBLISH_DIR}/metadata/*.json; do
692+
strip_signatures $t
693+
done
694+
# the resulting metadata should match expected metadata exactly
695+
diff -r $SCRIPT_DIR/expected/target-files-in-delegated-roles/ $PUBLISH_DIR
696+
697+
echo "OK"
698+
}
699+
645700
test_root_key_rotation()
646701
{
647702
echo -n "Root key rotation... "
@@ -716,4 +771,5 @@ test_delegated_role
716771
test_online_bumps
717772
test_multi_user_signing
718773
test_target_changes
774+
test_target_changes_in_delegations
719775
test_root_key_rotation

‎tests/expected/target-files-in-delegated-roles/metadata/1.root.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999",
5+
"sig": "XXX"
6+
}
7+
],
8+
"signed": {
9+
"_type": "root",
10+
"consistent_snapshot": true,
11+
"expires": "2022-02-03T01:02:03Z",
12+
"keys": {
13+
"95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999": {
14+
"keytype": "ecdsa",
15+
"keyval": {
16+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
17+
},
18+
"scheme": "ecdsa-sha2-nistp384",
19+
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
20+
},
21+
"fa47289": {
22+
"keytype": "ed25519",
23+
"keyval": {
24+
"public": "fa472895c9756c2b9bcd1440bf867d0fa5c4edee79e9792fa9822be3dd6fcbb3"
25+
},
26+
"scheme": "ed25519",
27+
"x-tuf-on-ci-online-uri": "envvar:LOCAL_TESTING_KEY"
28+
}
29+
},
30+
"roles": {
31+
"root": {
32+
"keyids": [
33+
"95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999"
34+
],
35+
"threshold": 1
36+
},
37+
"snapshot": {
38+
"keyids": [
39+
"fa47289"
40+
],
41+
"threshold": 1,
42+
"x-tuf-on-ci-expiry-period": 365,
43+
"x-tuf-on-ci-signing-period": 60
44+
},
45+
"targets": {
46+
"keyids": [
47+
"95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999"
48+
],
49+
"threshold": 1
50+
},
51+
"timestamp": {
52+
"keyids": [
53+
"fa47289"
54+
],
55+
"threshold": 1,
56+
"x-tuf-on-ci-expiry-period": 2,
57+
"x-tuf-on-ci-signing-period": 1
58+
}
59+
},
60+
"spec_version": "1.0.31",
61+
"version": 1,
62+
"x-tuf-on-ci-expiry-period": 365,
63+
"x-tuf-on-ci-signing-period": 60
64+
}
65+
}

‎tests/expected/target-files-in-delegated-roles/metadata/1.targets.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999",
5+
"sig": "XXX"
6+
}
7+
],
8+
"signed": {
9+
"_type": "targets",
10+
"delegations": {
11+
"keys": {
12+
"95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999": {
13+
"keytype": "ecdsa",
14+
"keyval": {
15+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ3pswWmx9Bx2VBcpqaooQFA7dQnhRafh\ntj942eg086x6EMHdfgdox9TbwGm7sU2sn/gyjyDr1ez8Ld2ORnyYJ8cAlegfTqNq\nE0eSrLrb+YpzQJxLwh6qWcSngF99Unft\n-----END PUBLIC KEY-----\n"
16+
},
17+
"scheme": "ecdsa-sha2-nistp384",
18+
"x-tuf-on-ci-keyowner": "@tuf-on-ci-user1"
19+
}
20+
},
21+
"roles": [
22+
{
23+
"keyids": [
24+
"95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999"
25+
],
26+
"name": "delegated",
27+
"paths": [
28+
"delegated/*"
29+
],
30+
"terminating": true,
31+
"threshold": 1
32+
}
33+
]
34+
},
35+
"expires": "2022-02-03T01:02:03Z",
36+
"spec_version": "1.0.31",
37+
"targets": {},
38+
"version": 1,
39+
"x-tuf-on-ci-expiry-period": 365,
40+
"x-tuf-on-ci-signing-period": 60
41+
}
42+
}

‎tests/expected/target-files-in-delegated-roles/metadata/2.delegated.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "95da323daa78f7b2557ae91e23be619ff932f9aec035abd4e40301405b363999",
5+
"sig": "XXX"
6+
}
7+
],
8+
"signed": {
9+
"_type": "targets",
10+
"expires": "2022-02-03T01:02:03Z",
11+
"spec_version": "1.0.31",
12+
"targets": {
13+
"delegated/file1.txt": {
14+
"hashes": {
15+
"sha256": "ecdc5536f73bdae8816f0ea40726ef5e9b810d914493075903bb90623d97b1d8"
16+
},
17+
"length": 6
18+
}
19+
},
20+
"version": 2,
21+
"x-tuf-on-ci-expiry-period": 365,
22+
"x-tuf-on-ci-signing-period": 60
23+
}
24+
}

‎tests/expected/target-files-in-delegated-roles/metadata/2.snapshot.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "fa47289",
5+
"sig": "XXX"
6+
}
7+
],
8+
"signed": {
9+
"_type": "snapshot",
10+
"expires": "2022-02-03T01:02:03Z",
11+
"meta": {
12+
"delegated.json": {
13+
"version": 2
14+
},
15+
"targets.json": {
16+
"version": 1
17+
}
18+
},
19+
"spec_version": "1.0.31",
20+
"version": 2
21+
}
22+
}

‎tests/expected/target-files-in-delegated-roles/metadata/timestamp.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "fa47289",
5+
"sig": "XXX"
6+
}
7+
],
8+
"signed": {
9+
"_type": "timestamp",
10+
"expires": "2021-02-05T01:02:03Z",
11+
"meta": {
12+
"snapshot.json": {
13+
"version": 2
14+
}
15+
},
16+
"spec_version": "1.0.31",
17+
"version": 2
18+
}
19+
}

‎tests/expected/target-files-in-delegated-roles/targets/delegated/ecdc5536f73bdae8816f0ea40726ef5e9b810d914493075903bb90623d97b1d8.file1.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
file1

0 commit comments

Comments
 (0)