mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

feat: add check for digest mismatch (#8443)

Browse source 
* feat: add check for digest mismatch

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add unit test

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

---------

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
Vishal Choudhary 2023-09-20 10:59:20 +05:30 committed by GitHub
parent 8a9d8f14d0
commit b4861015f0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
pkg/registryclient/client.go
View file

@ -186,6 +186,9 @@ func (c *client) FetchImageDescriptor(ctx context.Context, imageRef string) (*gc
if err != nil {
return nil, fmt.Errorf("failed to fetch image reference: %s, error: %v", imageRef, err)
}
if _, ok := parsedRef.(name.Digest); ok && parsedRef.Identifier() != desc.Digest.String() {
return nil, fmt.Errorf("digest mismatch, expected: %s, received: %s", parsedRef.Identifier(), desc.Digest.String())
}
return desc, nil
}

14
pkg/registryclient/client_test.go
View file

@ -1,6 +1,7 @@
package registryclient
import (
"context"
"crypto/tls"
"net/http"
"testing"
@ -29,3 +30,16 @@ func TestInitClientWithInsecureRegistryOption(t *testing.T) {
assert.Assert(t, expInsecureSkipVerify == gotInsecureSkipVerify)
assert.Assert(t, c.Keychain() != nil)
}
func TestFetchImageDescriptor(t *testing.T) {
c, err := New()
assert.NilError(t, err)
tagDesc, err := c.FetchImageDescriptor(context.Background(), "ghcr.io/kyverno/test-verify-image:signed-keyless")
assert.NilError(t, err)
assert.Equal(t, tagDesc.Digest.String(), "sha256:445a99db22e9add9bfb15ddb1980861a329e5dff5c88d7eec9cbf08b6b2f4eb1")
digestDesc, err := c.FetchImageDescriptor(context.Background(), "ghcr.io/kyverno/test-verify-image@sha256:b31bfb4d0213f254d361e0079deaaebefa4f82ba7aa76ef82e90b4935ad5b105")
assert.NilError(t, err)
assert.Equal(t, digestDesc.Digest.String(), "sha256:b31bfb4d0213f254d361e0079deaaebefa4f82ba7aa76ef82e90b4935ad5b105")
}