feat: fail if tuf options set and tuf disabled

docker · Aug 28, 2024 · 0fdb133 · 0fdb133
1 parent d109ffb
commit 0fdb133
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/pkg/attest/verify.go b/pkg/attest/verify.go
@@ -33,7 +33,6 @@ func NewVerifier(opts *policy.Options) (Verifier, error) {
 	}
 	var tufClient tuf.Downloader
 	if !opts.DisableTUF {
-		// use client from context if available
 		tufClient, err = tuf.NewClient(opts.TUFClientOptions)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create TUF client: %w", err)
@@ -104,8 +103,8 @@ func populateDefaultOptions(opts *policy.Options) (err error) {
 			return err
 		}
 	}
-	if opts.DisableTUF {
-		opts.TUFClientOptions = nil
+	if opts.DisableTUF && opts.TUFClientOptions != nil {
+		return fmt.Errorf("TUF client options set but TUF disabled")
 	} else if opts.TUFClientOptions == nil {
 		opts.TUFClientOptions = tuf.NewDockerDefaultClientOptions(opts.LocalTargetsDir)
 	}

diff --git a/pkg/attest/verify_test.go b/pkg/attest/verify_test.go
@@ -248,6 +248,7 @@ func TestDefaultOptions(t *testing.T) {
 		referrersRepo    string
 		expectedError    string
 		disableTuf       bool
+		localPolicyDir   string
 	}{
 		{name: "empty"},
 		{name: "tufClient provided", tufOpts: &tuf.ClientOptions{MetadataSource: "a", TargetsSource: "b"}},
@@ -256,6 +257,7 @@ func TestDefaultOptions(t *testing.T) {
 		{name: "referrersRepo provided", referrersRepo: "referrers"},
 		{name: "referrersRepo provided with attached", referrersRepo: "referrers", attestationStyle: config.AttestationStyleAttached, expectedError: "referrers repo specified but attestation source not set to referrers"},
 		{name: "tuf disabled and no local-policy-dir", disableTuf: true, expectedError: "local policy dir must be set if not using TUF"},
+		{name: "tuf disabled but options set", disableTuf: true, tufOpts: &tuf.ClientOptions{MetadataSource: "a", TargetsSource: "b"}, localPolicyDir: "foo", expectedError: "TUF client options set but TUF disabled"},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -268,6 +270,7 @@ func TestDefaultOptions(t *testing.T) {
 				AttestationStyle: tc.attestationStyle,
 				ReferrersRepo:    tc.referrersRepo,
 				DisableTUF:       tc.disableTuf,
+				LocalPolicyDir:   tc.localPolicyDir,
 			}
 
 			err = populateDefaultOptions(opts)

diff --git a/pkg/policy/policy_test.go b/pkg/policy/policy_test.go
@@ -86,6 +86,7 @@ func TestRegoEvaluator_Evaluate(t *testing.T) {
 			require.NoError(t, err)
 			resolver, err := policy.CreateImageDetailsResolver(src)
 			require.NoError(t, err)
+			//nil below indicates TUF is disabled
 			policy, err := policy.ResolvePolicy(ctx, nil, resolver, tc.policy)
 			if tc.resolveErrorStr != "" {
 				require.Error(t, err)