c60b360c33
Improve the output for these validation errors:
- Removes the short command description from the output. This information
does not provide much useful help, and distracts from the error message.
- Reduces punctuation, and
- Prefixes the error message with the binary / root-command name
(usually `docker:`) to be consistent with other similar errors.
- Adds an empty line between the error-message and the "call to action"
(`Run 'docker volume --help'...` in the example below). This helps
separating the error message and "usage" from the call-to-action.
Before this patch:
$ docker volume ls one two three
"docker volume ls" accepts no arguments.
See 'docker volume ls --help'.
Usage: docker volume ls [OPTIONS]
List volumes
$ docker volume create one two three
"docker volume create" requires at most 1 argument.
See 'docker volume create --help'.
Usage: docker volume create [OPTIONS] [VOLUME]
Create a volume
With this patch:
$ docker volume ls one two three
docker: 'docker volume ls' accepts no arguments
Usage: docker volume ls [OPTIONS]
Run 'docker volume ls --help' for more information
$ docker voludocker volume create one two three
docker: 'docker volume create' requires at most 1 argument
Usage: docker volume create [OPTIONS] [VOLUME]
SRun 'docker volume create --help' for more information
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
286 lines
10 KiB
Go
286 lines
10 KiB
Go
package trust
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"io"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"github.com/docker/cli/cli/config"
|
|
"github.com/docker/cli/cli/trust"
|
|
"github.com/docker/cli/internal/test"
|
|
notaryfake "github.com/docker/cli/internal/test/notary"
|
|
"github.com/theupdateframework/notary"
|
|
"github.com/theupdateframework/notary/client"
|
|
"github.com/theupdateframework/notary/client/changelist"
|
|
"github.com/theupdateframework/notary/passphrase"
|
|
"github.com/theupdateframework/notary/trustpinning"
|
|
"github.com/theupdateframework/notary/tuf/data"
|
|
"gotest.tools/v3/assert"
|
|
is "gotest.tools/v3/assert/cmp"
|
|
"gotest.tools/v3/skip"
|
|
)
|
|
|
|
const passwd = "password"
|
|
|
|
func TestTrustSignCommandErrors(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
args []string
|
|
expectedError string
|
|
}{
|
|
{
|
|
name: "not-enough-args",
|
|
expectedError: "requires 1 argument",
|
|
},
|
|
{
|
|
name: "too-many-args",
|
|
args: []string{"image", "tag"},
|
|
expectedError: "requires 1 argument",
|
|
},
|
|
{
|
|
name: "sha-reference",
|
|
args: []string{"870d292919d01a0af7e7f056271dc78792c05f55f49b9b9012b6d89725bd9abd"},
|
|
expectedError: "invalid repository name",
|
|
},
|
|
{
|
|
name: "invalid-img-reference",
|
|
args: []string{"ALPINE:latest"},
|
|
expectedError: "invalid reference format",
|
|
},
|
|
{
|
|
name: "no-tag",
|
|
args: []string{"reg/img"},
|
|
expectedError: "no tag specified for reg/img",
|
|
},
|
|
{
|
|
name: "digest-reference",
|
|
args: []string{"ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2"},
|
|
expectedError: "cannot use a digest reference for IMAGE:TAG",
|
|
},
|
|
}
|
|
// change to a tmpdir
|
|
config.SetDir(t.TempDir())
|
|
for _, tc := range testCases {
|
|
cmd := newSignCommand(
|
|
test.NewFakeCli(&fakeClient{}))
|
|
cmd.SetArgs(tc.args)
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
|
|
}
|
|
}
|
|
|
|
func TestTrustSignCommandOfflineErrors(t *testing.T) {
|
|
cli := test.NewFakeCli(&fakeClient{})
|
|
cli.SetNotaryClient(notaryfake.GetOfflineNotaryRepository)
|
|
cmd := newSignCommand(cli)
|
|
cmd.SetArgs([]string{"reg-name.io/image:tag"})
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
assert.ErrorContains(t, cmd.Execute(), "client is offline")
|
|
}
|
|
|
|
func TestGetOrGenerateNotaryKey(t *testing.T) {
|
|
notaryRepo, err := client.NewFileCachedRepository(t.TempDir(), "gun", "https://localhost", nil, passphrase.ConstantRetriever(passwd), trustpinning.TrustPinConfig{})
|
|
assert.NilError(t, err)
|
|
|
|
// repo is empty, try making a root key
|
|
rootKeyA, err := getOrGenerateNotaryKey(notaryRepo, data.CanonicalRootRole)
|
|
assert.NilError(t, err)
|
|
assert.Check(t, rootKeyA != nil)
|
|
|
|
// we should only have one newly generated key
|
|
allKeys := notaryRepo.GetCryptoService().ListAllKeys()
|
|
assert.Check(t, is.Len(allKeys, 1))
|
|
assert.Check(t, notaryRepo.GetCryptoService().GetKey(rootKeyA.ID()) != nil)
|
|
|
|
// this time we should get back the same key if we ask for another root key
|
|
rootKeyB, err := getOrGenerateNotaryKey(notaryRepo, data.CanonicalRootRole)
|
|
assert.NilError(t, err)
|
|
assert.Check(t, rootKeyB != nil)
|
|
|
|
// we should only have one newly generated key
|
|
allKeys = notaryRepo.GetCryptoService().ListAllKeys()
|
|
assert.Check(t, is.Len(allKeys, 1))
|
|
assert.Check(t, notaryRepo.GetCryptoService().GetKey(rootKeyB.ID()) != nil)
|
|
|
|
// The key we retrieved should be identical to the one we generated
|
|
assert.Check(t, is.DeepEqual(rootKeyA.Public(), rootKeyB.Public()))
|
|
|
|
// Now also try with a delegation key
|
|
releasesKey, err := getOrGenerateNotaryKey(notaryRepo, trust.ReleasesRole)
|
|
assert.NilError(t, err)
|
|
assert.Check(t, releasesKey != nil)
|
|
|
|
// we should now have two keys
|
|
allKeys = notaryRepo.GetCryptoService().ListAllKeys()
|
|
assert.Check(t, is.Len(allKeys, 2))
|
|
assert.Check(t, notaryRepo.GetCryptoService().GetKey(releasesKey.ID()) != nil)
|
|
// The key we retrieved should be identical to the one we generated
|
|
assert.Check(t, releasesKey != rootKeyA)
|
|
assert.Check(t, releasesKey != rootKeyB)
|
|
}
|
|
|
|
func TestAddStageSigners(t *testing.T) {
|
|
skip.If(t, runtime.GOOS == "windows", "FIXME: not supported currently")
|
|
|
|
notaryRepo, err := client.NewFileCachedRepository(t.TempDir(), "gun", "https://localhost", nil, passphrase.ConstantRetriever(passwd), trustpinning.TrustPinConfig{})
|
|
assert.NilError(t, err)
|
|
|
|
// stage targets/user
|
|
userRole := data.RoleName("targets/user")
|
|
userKey := data.NewPublicKey("algoA", []byte("a"))
|
|
err = addStagedSigner(notaryRepo, userRole, []data.PublicKey{userKey})
|
|
assert.NilError(t, err)
|
|
// check the changelist for four total changes: two on targets/releases and two on targets/user
|
|
cl, err := notaryRepo.GetChangelist()
|
|
assert.NilError(t, err)
|
|
changeList := cl.List()
|
|
assert.Check(t, is.Len(changeList, 4))
|
|
// ordering is deterministic:
|
|
|
|
// first change is for targets/user key creation
|
|
newSignerKeyChange := changeList[0]
|
|
expectedJSON, err := json.Marshal(&changelist.TUFDelegation{
|
|
NewThreshold: notary.MinThreshold,
|
|
AddKeys: data.KeyList([]data.PublicKey{userKey}),
|
|
})
|
|
assert.NilError(t, err)
|
|
expectedChange := changelist.NewTUFChange(
|
|
changelist.ActionCreate,
|
|
userRole,
|
|
changelist.TypeTargetsDelegation,
|
|
"", // no path for delegations
|
|
expectedJSON,
|
|
)
|
|
assert.Check(t, is.DeepEqual(expectedChange, newSignerKeyChange))
|
|
|
|
// second change is for targets/user getting all paths
|
|
newSignerPathsChange := changeList[1]
|
|
expectedJSON, err = json.Marshal(&changelist.TUFDelegation{
|
|
AddPaths: []string{""},
|
|
})
|
|
assert.NilError(t, err)
|
|
expectedChange = changelist.NewTUFChange(
|
|
changelist.ActionCreate,
|
|
userRole,
|
|
changelist.TypeTargetsDelegation,
|
|
"", // no path for delegations
|
|
expectedJSON,
|
|
)
|
|
assert.Check(t, is.DeepEqual(expectedChange, newSignerPathsChange))
|
|
|
|
releasesRole := data.RoleName("targets/releases")
|
|
|
|
// third change is for targets/releases key creation
|
|
releasesKeyChange := changeList[2]
|
|
expectedJSON, err = json.Marshal(&changelist.TUFDelegation{
|
|
NewThreshold: notary.MinThreshold,
|
|
AddKeys: data.KeyList([]data.PublicKey{userKey}),
|
|
})
|
|
assert.NilError(t, err)
|
|
expectedChange = changelist.NewTUFChange(
|
|
changelist.ActionCreate,
|
|
releasesRole,
|
|
changelist.TypeTargetsDelegation,
|
|
"", // no path for delegations
|
|
expectedJSON,
|
|
)
|
|
assert.Check(t, is.DeepEqual(expectedChange, releasesKeyChange))
|
|
|
|
// fourth change is for targets/releases getting all paths
|
|
releasesPathsChange := changeList[3]
|
|
expectedJSON, err = json.Marshal(&changelist.TUFDelegation{
|
|
AddPaths: []string{""},
|
|
})
|
|
assert.NilError(t, err)
|
|
expectedChange = changelist.NewTUFChange(
|
|
changelist.ActionCreate,
|
|
releasesRole,
|
|
changelist.TypeTargetsDelegation,
|
|
"", // no path for delegations
|
|
expectedJSON,
|
|
)
|
|
assert.Check(t, is.DeepEqual(expectedChange, releasesPathsChange))
|
|
}
|
|
|
|
func TestGetSignedManifestHashAndSize(t *testing.T) {
|
|
notaryRepo, err := client.NewFileCachedRepository(t.TempDir(), "gun", "https://localhost", nil, passphrase.ConstantRetriever(passwd), trustpinning.TrustPinConfig{})
|
|
assert.NilError(t, err)
|
|
_, _, err = getSignedManifestHashAndSize(notaryRepo, "test")
|
|
assert.Error(t, err, "client is offline")
|
|
}
|
|
|
|
func TestGetReleasedTargetHashAndSize(t *testing.T) {
|
|
oneReleasedTgt := []client.TargetSignedStruct{}
|
|
// make and append 3 non-released signatures on the "unreleased" target
|
|
unreleasedTgt := client.Target{Name: "unreleased", Hashes: data.Hashes{notary.SHA256: []byte("hash")}}
|
|
for _, unreleasedRole := range []string{"targets/a", "targets/b", "targets/c"} {
|
|
oneReleasedTgt = append(oneReleasedTgt, client.TargetSignedStruct{Role: mockDelegationRoleWithName(unreleasedRole), Target: unreleasedTgt})
|
|
}
|
|
_, _, err := getReleasedTargetHashAndSize(oneReleasedTgt, "unreleased")
|
|
assert.Error(t, err, "No valid trust data for unreleased")
|
|
releasedTgt := client.Target{Name: "released", Hashes: data.Hashes{notary.SHA256: []byte("released-hash")}}
|
|
oneReleasedTgt = append(oneReleasedTgt, client.TargetSignedStruct{Role: mockDelegationRoleWithName("targets/releases"), Target: releasedTgt})
|
|
hash, _, _ := getReleasedTargetHashAndSize(oneReleasedTgt, "unreleased")
|
|
assert.Check(t, is.DeepEqual(data.Hashes{notary.SHA256: []byte("released-hash")}, hash))
|
|
}
|
|
|
|
func TestCreateTarget(t *testing.T) {
|
|
notaryRepo, err := client.NewFileCachedRepository(t.TempDir(), "gun", "https://localhost", nil, passphrase.ConstantRetriever(passwd), trustpinning.TrustPinConfig{})
|
|
assert.NilError(t, err)
|
|
_, err = createTarget(notaryRepo, "")
|
|
assert.Error(t, err, "no tag specified")
|
|
_, err = createTarget(notaryRepo, "1")
|
|
assert.Error(t, err, "client is offline")
|
|
}
|
|
|
|
func TestGetExistingSignatureInfoForReleasedTag(t *testing.T) {
|
|
notaryRepo, err := client.NewFileCachedRepository(t.TempDir(), "gun", "https://localhost", nil, passphrase.ConstantRetriever(passwd), trustpinning.TrustPinConfig{})
|
|
assert.NilError(t, err)
|
|
_, err = getExistingSignatureInfoForReleasedTag(notaryRepo, "test")
|
|
assert.Error(t, err, "client is offline")
|
|
}
|
|
|
|
func TestPrettyPrintExistingSignatureInfo(t *testing.T) {
|
|
buf := bytes.NewBuffer(nil)
|
|
signers := []string{"Bob", "Alice", "Carol"}
|
|
existingSig := trustTagRow{trustTagKey{"tagName", "abc123"}, signers}
|
|
prettyPrintExistingSignatureInfo(buf, existingSig)
|
|
|
|
assert.Check(t, is.Contains(buf.String(), "Existing signatures for tag tagName digest abc123 from:\nAlice, Bob, Carol"))
|
|
}
|
|
|
|
func TestSignCommandChangeListIsCleanedOnError(t *testing.T) {
|
|
tmpDir := t.TempDir()
|
|
|
|
config.SetDir(tmpDir)
|
|
cli := test.NewFakeCli(&fakeClient{})
|
|
cli.SetNotaryClient(notaryfake.GetLoadedNotaryRepository)
|
|
cmd := newSignCommand(cli)
|
|
cmd.SetArgs([]string{"ubuntu:latest"})
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
|
|
err := cmd.Execute()
|
|
assert.Assert(t, err != nil)
|
|
|
|
notaryRepo, err := client.NewFileCachedRepository(tmpDir, "docker.io/library/ubuntu", "https://localhost", nil, passphrase.ConstantRetriever(passwd), trustpinning.TrustPinConfig{})
|
|
assert.NilError(t, err)
|
|
cl, err := notaryRepo.GetChangelist()
|
|
assert.NilError(t, err)
|
|
assert.Check(t, is.Equal(len(cl.List()), 0))
|
|
}
|
|
|
|
func TestSignCommandLocalFlag(t *testing.T) {
|
|
cli := test.NewFakeCli(&fakeClient{})
|
|
cli.SetNotaryClient(notaryfake.GetEmptyTargetsNotaryRepository)
|
|
cmd := newSignCommand(cli)
|
|
cmd.SetArgs([]string{"--local", "reg-name.io/image:red"})
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
assert.ErrorContains(t, cmd.Execute(), "error contacting notary server: dial tcp: lookup reg-name.io")
|
|
}
|