-
Notifications
You must be signed in to change notification settings - Fork 67
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move patch tests to go integration tests
Co-authored-by: Sertaç Özercan <[email protected]> Signed-off-by: Brian Goff <[email protected]>
- Loading branch information
Showing
13 changed files
with
206 additions
and
102 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -eu -o pipefail | ||
|
|
||
| SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)" | ||
|
|
||
| # Collect all the modes into a bash array | ||
| modes=() | ||
| for i in ${SCRIPT_DIR}/buildkitenvs/*; do | ||
| base="${i##*/}" | ||
| for j in "${i}"/*; do | ||
| modes+=(${base}/${j##*/}) | ||
| done | ||
| done | ||
|
|
||
| # Convert bash array to json | ||
| jq -c --null-input '$ARGS.positional' --args -- "${modes[@]}" |
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package integration | ||
|
|
||
| import ( | ||
| "flag" | ||
| "os" | ||
| "testing" | ||
| ) | ||
|
|
||
| var ( | ||
| buildkitAddr string | ||
| copaPath string | ||
| ) | ||
|
|
||
| func TestMain(m *testing.M) { | ||
| flag.StringVar(&buildkitAddr, "addr", "", "buildkit address to pass through to copa binary") | ||
| flag.StringVar(&copaPath, "copa", "./copa", "path to copa binary") | ||
| flag.Parse() | ||
|
|
||
| if copaPath == "" { | ||
| panic("missing --copa") | ||
| } | ||
|
|
||
| ec := m.Run() | ||
| os.Exit(ec) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| package integration | ||
|
|
||
| import ( | ||
| _ "embed" | ||
| "encoding/json" | ||
| "fmt" | ||
| "os" | ||
| "os/exec" | ||
| "path/filepath" | ||
| "strconv" | ||
| "testing" | ||
|
|
||
| "github.com/opencontainers/go-digest" | ||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| var ( | ||
| //go:embed fixtures/test-images.json | ||
| testImages []byte | ||
|
|
||
| //go:embed fixtures/trivy_ignore.rego | ||
| trivyIgnore []byte | ||
| ) | ||
|
|
||
| type testImage struct { | ||
| Image string `json:"image"` | ||
| Tag string `json:"tag"` | ||
| Distro string `json:"distro"` | ||
| Digest digest.Digest `json:"digest"` | ||
| Description string `json:"description"` | ||
| } | ||
|
|
||
| func TestPatch(t *testing.T) { | ||
| var images []testImage | ||
| err := json.Unmarshal(testImages, &images) | ||
| require.NoError(t, err) | ||
|
|
||
| tmp := t.TempDir() | ||
| ignoreFile := filepath.Join(tmp, "ignore.rego") | ||
| err = os.WriteFile(ignoreFile, trivyIgnore, 0o600) | ||
| require.NoError(t, err) | ||
|
|
||
| for _, img := range images { | ||
| img := img | ||
| t.Run(img.Description, func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| dir := t.TempDir() | ||
| output := filepath.Join(dir, "output.json") | ||
| ref := fmt.Sprintf("%s:%s@%s", img.Image, img.Tag, img.Digest) | ||
| tagPatched := img.Tag + "-patched" | ||
| patchedRef := fmt.Sprintf("%s:%s", img.Image, tagPatched) | ||
|
|
||
| t.Log("scanning original image") | ||
| scanner(). | ||
| withIgnoreFile(ignoreFile). | ||
| withOutput(output). | ||
| // Do not set a non-zero exit code because we are expecting vulnerabilities. | ||
| scan(t, ref) | ||
|
|
||
| t.Log("patching image") | ||
| patch(t, ref, tagPatched, output) | ||
|
|
||
| t.Log("scanning patched image") | ||
| scanner(). | ||
| withIgnoreFile(ignoreFile). | ||
| withSkipDBUpdate(). | ||
| // here we want a non-zero exit code because we are expecting no vulnerabilities. | ||
| withExitCode(1). | ||
| scan(t, patchedRef) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func patch(t *testing.T, ref, patchedTag, scan string) { | ||
| var addrFl string | ||
| if buildkitAddr != "" { | ||
| addrFl = "-a=" + buildkitAddr | ||
| } | ||
|
|
||
| //#nosec G204 | ||
| cmd := exec.Command( | ||
| copaPath, | ||
| "patch", | ||
| "-i="+ref, | ||
| "-t="+patchedTag, | ||
| "-r="+scan, | ||
| "--timeout=20m", | ||
| addrFl, | ||
| ) | ||
| out, err := cmd.CombinedOutput() | ||
| require.NoError(t, err, string(out)) | ||
| } | ||
|
|
||
| func scanner() *scannerCmd { | ||
| return &scannerCmd{} | ||
| } | ||
|
|
||
| type scannerCmd struct { | ||
| output string | ||
| skipDBUpdate bool | ||
| ignoreFile string | ||
| exitCode int | ||
| } | ||
|
|
||
| func (s *scannerCmd) scan(t *testing.T, ref string) { | ||
| args := []string{ | ||
| "trivy", | ||
| "image", | ||
| "--vuln-type=os", | ||
| "--ignore-unfixed", | ||
| "--scanners=vuln", | ||
| } | ||
| if s.output != "" { | ||
| args = append(args, []string{"-o=" + s.output, "-f=json"}...) | ||
| } | ||
| if s.skipDBUpdate { | ||
| args = append(args, "--skip-db-update") | ||
| } | ||
| if s.ignoreFile != "" { | ||
| args = append(args, "--ignore-policy="+s.ignoreFile) | ||
| } | ||
| if s.exitCode != 0 { | ||
| args = append(args, "--exit-code="+strconv.Itoa(s.exitCode)) | ||
| } | ||
|
|
||
| args = append(args, ref) | ||
|
|
||
| out, err := exec.Command(args[0], args[1:]...).CombinedOutput() //#nosec G204 | ||
| assert.NoError(t, err, string(out)) | ||
| } | ||
|
|
||
| func (s *scannerCmd) withOutput(p string) *scannerCmd { | ||
| s.output = p | ||
| return s | ||
| } | ||
|
|
||
| func (s *scannerCmd) withSkipDBUpdate() *scannerCmd { | ||
| s.skipDBUpdate = true | ||
| return s | ||
| } | ||
|
|
||
| func (s *scannerCmd) withIgnoreFile(p string) *scannerCmd { | ||
| s.ignoreFile = p | ||
| return s | ||
| } | ||
|
|
||
| func (s *scannerCmd) withExitCode(code int) *scannerCmd { | ||
| s.exitCode = code | ||
| return s | ||
| } |
This file was deleted.
Oops, something went wrong.