25 lines
1.8 KiB
Bash
Executable File
25 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
|
|
P="$CASAN_HARNESS_ROOT/scripts/bash/release-provenance.sh"
|
|
W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT
|
|
PASS=0; FAIL=0
|
|
pass() { echo "PASS: $1"; PASS=$((PASS+1)); }
|
|
fail() { echo "FAIL: $1"; FAIL=$((FAIL+1)); }
|
|
rc() { set +e; "$@" >/dev/null 2>&1; local c=$?; set -e; echo "$c"; }
|
|
openssl genrsa -out "$W/key.pem" 2048 2>/dev/null
|
|
openssl rsa -in "$W/key.pem" -pubout -out "$W/pub.pem" 2>/dev/null
|
|
openssl genrsa -out "$W/other.pem" 2048 2>/dev/null
|
|
printf '{"bomFormat":"CycloneDX"}\n' > "$W/sbom.json"; printf 'tests passed\n' > "$W/evidence.txt"
|
|
DIGEST="sha256:$(printf 'a%.0s' {1..64})"
|
|
bash "$P" create "$W/provenance.json" "$W/key.pem" "$W/sbom.json" "$W/evidence.txt" "registry.local/casan/api@$DIGEST" >/dev/null \
|
|
&& bash "$P" verify "$W/provenance.json" "$W/pub.pem" >/dev/null && pass "signed provenance binds commit and image digest" || fail "valid provenance rejected"
|
|
printf 'tamper' >> "$W/provenance.json"
|
|
[[ "$(rc bash "$P" verify "$W/provenance.json" "$W/pub.pem")" -ne 0 ]] && pass "tampered provenance is refused" || fail "tampered provenance accepted"
|
|
[[ "$(rc bash "$P" create "$W/bad.json" "$W/key.pem" "$W/sbom.json" "$W/evidence.txt" 'registry.local/casan/api:latest')" -ne 0 ]] && pass "floating image tag is refused" || fail "floating image accepted"
|
|
bash "$P" create "$W/other.json" "$W/other.pem" "$W/sbom.json" "$W/evidence.txt" "registry.local/casan/api@$DIGEST" >/dev/null
|
|
[[ "$(rc bash "$P" verify "$W/other.json" "$W/pub.pem")" -ne 0 ]] && pass "provenance signed by another key is refused" || fail "wrong signing key accepted"
|
|
echo "===== RELEASE PROVENANCE SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
|
[[ "$FAIL" -eq 0 ]]
|