fix(notation): Decouple Signature trust UI processing from scanning (#4178)

* fix(notation): Decouple Signature trust UI processing from scanning

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): Fixed broken unit test, fixed use of loop variable references within loop.

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): After review commit.

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): Fix lint error.

Signed-off-by: Felix Rubio <felix@kngnt.org>

---------

Signed-off-by: Felix Rubio <felix@kngnt.org>

Author: flixman

pkg/extensions/search/convert/convert_test.go

@@ -186,7 +186,7 @@ func TestGetSignaturesInfo(t *testing.T) {
 		signaturesSummary := convert.GetSignaturesInfo(true, signatures[digest.String()])
 		So(signaturesSummary, ShouldNotBeEmpty)
 		So(*signaturesSummary[0].Author, ShouldEqual, "author")
-		So(*signaturesSummary[0].IsTrusted, ShouldEqual, false)
+		So(*signaturesSummary[0].IsTrusted, ShouldEqual, true)
 		So(*signaturesSummary[0].Tool, ShouldEqual, "notation")
 	})
 }

pkg/extensions/search/convert/metadb.go

@@ -263,26 +263,10 @@ func GetSignaturesInfo(isSigned bool, signatures mTypes.ManifestSignatures) []*g
 	for sigType, signatures := range signatures {
 		for _, sig := range signatures {
 			for _, layer := range sig.LayersInfo {
-				var (
-					isTrusted bool
-					author    string
-					tool      string
-				)
-
-				if layer.Signer != "" {
-					author = layer.Signer
-
-					if !layer.Date.IsZero() && time.Now().After(layer.Date) {
-						isTrusted = false
-					} else {
-						isTrusted = true
-					}
-				} else {
-					isTrusted = false
-					author = ""
-				}
-
-				tool = sigType
+				// Signer is only set by UpdateSignaturesValidity when VerifySignature succeeds, so empty Signer means untrusted.
+				tool := sigType
+				author := layer.Signer
+				isTrusted := author != ""
 
 				signaturesInfo = append(signaturesInfo,
 					&gql_generated.SignatureSummary{Tool: &tool, IsTrusted: &isTrusted, Author: &author})

pkg/meta/boltdb/boltdb.go

@@ -1398,10 +1398,11 @@ func (bdw *BoltDB) UpdateSignaturesValidity(ctx context.Context, repo string, ma
 
 					if isTrusted {
 						layerInfo.Signer = author
+					} else {
+						layerInfo.Signer = ""
 					}
 
 					if !date.IsZero() {
-						layerInfo.Signer = author
 						layerInfo.Date = timestamppb.New(date)
 					}
 

pkg/meta/dynamodb/dynamodb.go

@@ -1314,10 +1314,11 @@ func (dwr *DynamoDB) UpdateSignaturesValidity(ctx context.Context, repo string,
 
 				if isTrusted {
 					layerInfo.Signer = author
+				} else {
+					layerInfo.Signer = ""
 				}
 
 				if !date.IsZero() {
-					layerInfo.Signer = author
 					layerInfo.Date = timestamppb.New(date)
 				}
 

pkg/meta/redis/redis.go

@@ -1532,10 +1532,11 @@ func (rc *RedisDB) UpdateSignaturesValidity(ctx context.Context, repo string, ma
 
 					if isTrusted {
 						layerInfo.Signer = author
+					} else {
+						layerInfo.Signer = ""
 					}
 
 					if !date.IsZero() {
-						layerInfo.Signer = author
 						layerInfo.Date = timestamppb.New(date)
 					}