signatures_test.go

//
// Copyright 2021 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package remote

import (
	"errors"
	"io"
	"net/http"
	"strings"
	"testing"

	"github.com/google/go-containerregistry/pkg/name"
	v1 "github.com/google/go-containerregistry/pkg/v1"
	"github.com/google/go-containerregistry/pkg/v1/fake"
	"github.com/google/go-containerregistry/pkg/v1/remote"
	"github.com/google/go-containerregistry/pkg/v1/remote/transport"
	"github.com/google/go-containerregistry/pkg/v1/types"
)

// oversizeLayer reports a huge Size() but its Uncompressed() must never be
// reached once Bundle() enforces the size cap.
type oversizeLayer struct {
	size int64
}

func (l *oversizeLayer) Digest() (v1.Hash, error) { return v1.Hash{}, nil }
func (l *oversizeLayer) DiffID() (v1.Hash, error) { return v1.Hash{}, nil }
func (l *oversizeLayer) Size() (int64, error)     { return l.size, nil }
func (l *oversizeLayer) MediaType() (types.MediaType, error) {
	return "application/vnd.dev.sigstore.bundle+json", nil
}
func (l *oversizeLayer) Compressed() (io.ReadCloser, error) {
	return nil, errors.New("Compressed should not be called")
}
func (l *oversizeLayer) Uncompressed() (io.ReadCloser, error) {
	return nil, errors.New("Uncompressed should not be called once size is capped")
}

func TestBundleRejectsOversizeLayer(t *testing.T) {
	ri := remote.Image
	t.Cleanup(func() {
		remoteImage = ri
	})

	remoteImage = func(_ name.Reference, _ ...remote.Option) (v1.Image, error) {
		return &fake.FakeImage{
			LayersStub: func() ([]v1.Layer, error) {
				return []v1.Layer{&oversizeLayer{size: 200 * 1024 * 1024}}, nil
			},
		}, nil
	}

	_, err := Bundle(name.MustParseReference("gcr.io/distroless/static:sha256-deadbeef.sig"))
	if err == nil {
		t.Fatal("Bundle() = nil, wanted size limit error")
	}
	if !strings.Contains(err.Error(), "exceeded the limit") {
		t.Fatalf("Bundle() = %v, wanted size limit error", err)
	}
}

func TestSignaturesErrors(t *testing.T) {
	ri := remote.Image
	t.Cleanup(func() {
		remoteImage = ri
	})

	t.Run("404 returns empty", func(t *testing.T) {
		remoteImage = func(_ name.Reference, _ ...remote.Option) (v1.Image, error) {
			return nil, &transport.Error{
				StatusCode: http.StatusNotFound,
			}
		}

		sigs, err := Signatures(name.MustParseReference("gcr.io/distroless/static:sha256-deadbeef.sig"))
		if err != nil {
			t.Fatalf("Signatures() = %v", err)
		}
		if sl, err := sigs.Get(); err != nil {
			t.Fatalf("Get() = %v", err)
		} else if len(sl) != 0 {
			t.Fatalf("len(Get()) = %d, wanted 0", len(sl))
		}
	})

	t.Run("other transport errors propagate", func(t *testing.T) {
		want := &transport.Error{
			StatusCode: http.StatusInternalServerError,
		}
		remoteImage = func(_ name.Reference, _ ...remote.Option) (v1.Image, error) {
			return nil, want
		}

		_, err := Signatures(name.MustParseReference("gcr.io/distroless/static:sha256-deadbeef.sig"))
		if !errors.Is(err, want) {
			t.Fatalf("Signatures() = %v, wanted %v", err, want)
		}
	})

	t.Run("other errors propagate", func(t *testing.T) {
		want := errors.New("it's my error, I can cry if I want to")
		remoteImage = func(_ name.Reference, _ ...remote.Option) (v1.Image, error) {
			return nil, want
		}

		_, err := Signatures(name.MustParseReference("gcr.io/distroless/static:sha256-deadbeef.sig"))
		if !errors.Is(err, want) {
			t.Fatalf("Signatures() = %v, wanted %v", err, want)
		}
	})

	t.Run("too many layers", func(t *testing.T) {
		remoteImage = func(_ name.Reference, _ ...remote.Option) (v1.Image, error) {
			return &fake.FakeImage{
				ManifestStub: func() (*v1.Manifest, error) {
					return &v1.Manifest{
						Layers: make([]v1.Descriptor, 10000),
					}, nil
				},
			}, nil
		}
		sigs, err := Signatures(name.MustParseReference("gcr.io/distroless/static:sha256-deadbeef.sig"))
		if err != nil {
			t.Fatalf("Signatures() = %v", err)
		}
		want := errors.New("number of layers (10000) exceeded the limit (1000)")
		_, err = sigs.Get()
		if err == nil || want.Error() != err.Error() {
			t.Fatalf("Get() = %v", err)
		}
	})
}