feat: add blob policy import and show commands
#1126
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| // Copyright The Notary Project Authors. | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| // Package policy provides the import and show commands for blob trust policy. | ||
| package policy | ||
|
|
||
| import ( | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| // Cmd returns the commands for policy including import and show. | ||
| func Cmd() *cobra.Command { | ||
| command := &cobra.Command{ | ||
| Use: "policy [command]", | ||
| Short: "Manage trust policy configuration for signed blobs", | ||
| Long: "Manage trust policy configuration for arbitrary blob signature verification.", | ||
| } | ||
|
|
||
| command.AddCommand( | ||
| importCmd(), | ||
| showCmd(), | ||
| ) | ||
|
|
||
| return command | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| // Copyright The Notary Project Authors. | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package policy | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
| "os" | ||
|
|
||
| "github.com/notaryproject/notation-go/dir" | ||
| "github.com/notaryproject/notation-go/verifier/trustpolicy" | ||
| "github.com/notaryproject/notation/cmd/notation/internal/cmdutil" | ||
| "github.com/notaryproject/notation/internal/osutil" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| type importOpts struct { | ||
| filePath string | ||
| force bool | ||
| } | ||
|
|
||
| func importCmd() *cobra.Command { | ||
| var opts importOpts | ||
| command := &cobra.Command{ | ||
| Use: "import [flags] <file_path>", | ||
| Short: "Import blob trust policy configuration from a JSON file", | ||
| Long: `Import blob trust policy configuration from a JSON file. | ||
|
|
||
| Example - Import blob trust policy configuration from a file: | ||
| notation blob policy import my_policy.json | ||
|
|
||
| Example - Import blob trust policy and override existing configuration without prompt: | ||
| notation blob policy import --force my_policy.json | ||
| `, | ||
| Args: func(cmd *cobra.Command, args []string) error { | ||
| if len(args) != 1 { | ||
| return fmt.Errorf("requires 1 argument but received %d.\nUsage: notation blob policy import <path-to-policy.json>\nPlease specify a trust policy file location as the argument", len(args)) | ||
| } | ||
| return nil | ||
| }, | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| opts.filePath = args[0] | ||
| return runImport(opts) | ||
| }, | ||
| } | ||
| command.Flags().BoolVar(&opts.force, "force", false, "override the existing blob trust policy configuration without prompt") | ||
| return command | ||
| } | ||
|
|
||
| func runImport(opts importOpts) error { | ||
| // read configuration | ||
| policyJSON, err := os.ReadFile(opts.filePath) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to read blob trust policy file: %w", err) | ||
| } | ||
|
|
||
| var doc trustpolicy.BlobDocument | ||
| if err = json.Unmarshal(policyJSON, &doc); err != nil { | ||
| return fmt.Errorf("failed to parse blob trust policy configuration: %w", err) | ||
| } | ||
| if err = doc.Validate(); err != nil { | ||
| return fmt.Errorf("failed to validate blob trust policy: %w", err) | ||
| } | ||
|
|
||
| // optional confirmation | ||
| if !opts.force { | ||
| if _, err = trustpolicy.LoadBlobDocument(); err == nil { | ||
| confirmed, err := cmdutil.AskForConfirmation(os.Stdin, "The blob trust policy file already exists, do you want to overwrite it?", opts.force) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| if !confirmed { | ||
| return nil | ||
| } | ||
| } | ||
| } else { | ||
| fmt.Fprintln(os.Stderr, "Warning: existing blob trust policy file will be overwritten") | ||
| } | ||
|
|
||
| // write | ||
| policyPath, err := dir.ConfigFS().SysPath(dir.PathBlobTrustPolicy) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to obtain path of blob trust policy file: %w", err) | ||
| } | ||
| if err = osutil.WriteFile(policyPath, policyJSON); err != nil { | ||
| return fmt.Errorf("failed to write blob trust policy file: %w", err) | ||
| } | ||
|
|
||
| _, err = fmt.Fprintln(os.Stdout, "Successfully imported blob trust policy file.") | ||
| return err | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| // Copyright The Notary Project Authors. | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package policy | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "errors" | ||
| "fmt" | ||
| "io" | ||
| "io/fs" | ||
| "os" | ||
|
|
||
| "github.com/notaryproject/notation-go/dir" | ||
| "github.com/notaryproject/notation-go/verifier/trustpolicy" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func showCmd() *cobra.Command { | ||
| command := &cobra.Command{ | ||
| Use: "show [flags]", | ||
| Short: "Show blob trust policy configuration", | ||
| Long: `Show blob trust policy configuration. | ||
|
|
||
| Example - Show current blob trust policy configuration: | ||
| notation blob policy show | ||
|
|
||
| Example - Save current blob trust policy configuration to a file: | ||
| notation blob policy show > my_policy.json | ||
| `, | ||
| Args: cobra.ExactArgs(0), | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| return runShow() | ||
| }, | ||
| } | ||
| return command | ||
| } | ||
|
|
||
| func runShow() error { | ||
| policyJSON, err := loadBlobTrustPolicy() | ||
| if err != nil { | ||
| if errors.Is(err, fs.ErrNotExist) { | ||
| return fmt.Errorf("failed to show blob trust policy as the trust policy file does not exist.\nYou can import one using `notation blob policy import <path-to-policy.json>`") | ||
| } | ||
| return fmt.Errorf("failed to show trust policy: %w", err) | ||
| } | ||
| var doc trustpolicy.BlobDocument | ||
| if err = json.Unmarshal(policyJSON, &doc); err == nil { | ||
| err = doc.Validate() | ||
| } | ||
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "Existing blob trust policy file is invalid, you may update or create a new one via `notation blob policy import <path-to-policy.json>`. See https://github.com/notaryproject/specifications/blob/8cf800c60b7315a43f0adbcae463d848a353b412/specs/trust-store-trust-policy.md#trust-policy-for-blobs for a blob trust policy example.\n") | ||
| os.Stdout.Write(policyJSON) | ||
| return err | ||
| } | ||
|
|
||
| // show policy content | ||
| _, err = os.Stdout.Write(policyJSON) | ||
| return err | ||
| } | ||
|
|
||
| // loadBlobTrustPolicy loads the blob trust policy from notation configuration | ||
| // directory. | ||
| func loadBlobTrustPolicy() ([]byte, error) { | ||
| f, err := dir.ConfigFS().Open(dir.PathBlobTrustPolicy) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| defer f.Close() | ||
| return io.ReadAll(f) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.