Add artifact signature information to the generated index

build/registry/go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.81
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.38.5
 	github.com/blang/semver v3.5.1+incompatible
-	github.com/falcosecurity/falcoctl v0.6.0
+	github.com/falcosecurity/falcoctl v0.6.1
 	github.com/falcosecurity/plugin-sdk-go v0.7.3
 	github.com/onsi/ginkgo/v2 v2.10.0
 	github.com/onsi/gomega v1.27.8

build/registry/go.sum

@@ -148,8 +148,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/falcosecurity/falcoctl v0.6.0 h1:+VW6/HJ9mWU2p8apiTQuKRHFsBngfG1s35ao4X2BEfc=
-github.com/falcosecurity/falcoctl v0.6.0/go.mod h1:4Hx4h3KtcaQzPKxvYn5S9x4IHxwd6QRK9Gu04HHNbhE=
+github.com/falcosecurity/falcoctl v0.6.1 h1:Klg3jHi/PL1Inw9DO9kGpzL6ka+TjI4oDl6kvm1I+VY=
+github.com/falcosecurity/falcoctl v0.6.1/go.mod h1:4Hx4h3KtcaQzPKxvYn5S9x4IHxwd6QRK9Gu04HHNbhE=
 github.com/falcosecurity/plugin-sdk-go v0.7.3 h1:nmlBUmeAgEhcEHhSDWeEYgD9WdiHR9uMWyog5Iv7GIA=
 github.com/falcosecurity/plugin-sdk-go v0.7.3/go.mod h1:NP+y22DYOS+G3GDXIXNmzf0CBL3nfPPMoQuHvAzfitQ=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=

build/registry/pkg/distribution/distribution_suite_test.go

@@ -0,0 +1,29 @@
+/*
+Copyright (C) 2022 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package distribution_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestDistribution(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Distribution Suite")
+}

build/registry/pkg/distribution/index.go

@@ -41,11 +41,12 @@ const (
 	GHOrg = "falcosecurity"
 )
 
-func pluginToIndexEntry(p registry.Plugin, registry, repo string) *index.Entry {
+func PluginToIndexEntry(p registry.Plugin, registry, repo string) *index.Entry {
 	return &index.Entry{
 		Name:        p.Name,
 		Type:        string(falcoctloci.Plugin),
 		Registry:    registry,
+		Signature:   p.Signature,
 		Repository:  repo,
 		Description: p.Description,
 		Home:        p.URL,
@@ -56,11 +57,12 @@ func pluginToIndexEntry(p registry.Plugin, registry, repo string) *index.Entry {
 	}
 }
 
-func pluginRulesToIndexEntry(p registry.Plugin, registry, repo string) *index.Entry {
+func PluginRulesToIndexEntry(p registry.Plugin, registry, repo string) *index.Entry {
 	return &index.Entry{
 		Name:        p.Name + common.RulesArtifactSuffix,
 		Type:        string(falcoctloci.Rulesfile),
 		Registry:    registry,
+		Signature:   p.Signature,
 		Repository:  repo,
 		Description: p.Description,
 		Home:        p.URL,
@@ -89,13 +91,13 @@ func upsertIndex(r *registry.Registry, ociArtifacts map[string]string, indexPath
 			tokens := strings.Split(refPlugin, "/")
 			ociRegistry := tokens[0]
 			ociRepo := filepath.Join(tokens[1:]...)
-			i.Upsert(pluginToIndexEntry(p, ociRegistry, ociRepo))
+			i.Upsert(PluginToIndexEntry(p, ociRegistry, ociRepo))
 		}
 		if refRulesfile, ok := ociArtifacts[p.Name+common.RulesArtifactSuffix]; ok {
 			tokens := strings.Split(refRulesfile, "/")
 			ociRegistry := tokens[0]
 			ociRepo := filepath.Join(tokens[1:]...)
-			i.Upsert(pluginRulesToIndexEntry(p, ociRegistry, ociRepo))
+			i.Upsert(PluginRulesToIndexEntry(p, ociRegistry, ociRepo))
 		}
 	}
 

build/registry/pkg/distribution/index_internal_test.go

@@ -0,0 +1,61 @@
+/*
+Copyright (C) 2022 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package distribution_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/falcosecurity/falcoctl/pkg/index/index"
+
+	"github.com/falcosecurity/plugins/build/registry/pkg/distribution"
+	"github.com/falcosecurity/plugins/build/registry/pkg/registry"
+)
+
+func TestPluginToIndexEntrySignature(t *testing.T) {
+	t.Parallel()
+
+	signature := &index.Signature{
+		Cosign: &index.CosignSignature{},
+	}
+
+	expected := signature
+
+	p := registry.Plugin{Signature: signature}
+
+	entry := distribution.PluginToIndexEntry(p, "", "")
+	if !reflect.DeepEqual(entry.Signature, expected) {
+		t.Fatalf("Index entry signature: expected %#v, got %v", expected, entry.Signature)
+	}
+}
+
+func TestPluginRulesToIndexEntrySignature(t *testing.T) {
+	t.Parallel()
+
+	signature := &index.Signature{
+		Cosign: &index.CosignSignature{},
+	}
+
+	expected := signature
+
+	p := registry.Plugin{Signature: signature}
+
+	entry := distribution.PluginRulesToIndexEntry(p, "", "")
+	if !reflect.DeepEqual(entry.Signature, expected) {
+		t.Fatalf("Index entry signature: expected %#v, got %v", expected, entry.Signature)
+	}
+}

build/registry/pkg/distribution/index_test.go

@@ -0,0 +1,85 @@
+/*
+Copyright (C) 2022 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package distribution_test
+
+import (
+	"os"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	"github.com/falcosecurity/plugins/build/registry/pkg/distribution"
+)
+
+const (
+	indexFile         = "testdata/index.yaml"
+	wrongIndexFile    = "testdata/wrong-index.yaml"
+	registryFile      = "testdata/registry.yaml"
+	wrongRegistryFile = "testdata/wrong-registry.yaml"
+	registryUser      = "falcosecurity"
+	registryName      = "ghcr.io"
+)
+
+var _ = Describe("Update index", func() {
+	var (
+		err error
+	)
+	Context("with registry file", func() {
+		BeforeEach(func() {
+			os.Setenv("REGISTRY_USER", registryUser)
+			os.Setenv("REGISTRY", registryName)
+		})
+		Context("with index file", func() {
+			BeforeEach(func() {
+				err = distribution.DoUpdateIndex(registryFile, indexFile)
+			})
+			It("Should not fail", func() {
+				Expect(err).To(BeNil())
+			})
+		})
+		Context("without index file", func() {
+			BeforeEach(func() {
+				err = distribution.DoUpdateIndex(registryFile, wrongIndexFile)
+			})
+			It("Should fail", func() {
+				Expect(err).ToNot(BeNil())
+			})
+		})
+	})
+	Context("without registry file", func() {
+		BeforeEach(func() {
+			os.Setenv("REGISTRY_USER", registryUser)
+			os.Setenv("REGISTRY", registryName)
+		})
+		Context("with index file", func() {
+			BeforeEach(func() {
+				err = distribution.DoUpdateIndex(wrongRegistryFile, indexFile)
+			})
+			It("Should fail", func() {
+				Expect(err).ToNot(BeNil())
+			})
+		})
+		Context("without index file", func() {
+			BeforeEach(func() {
+				err = distribution.DoUpdateIndex(wrongRegistryFile, wrongIndexFile)
+			})
+			It("Should fail", func() {
+				Expect(err).ToNot(BeNil())
+			})
+		})
+	})
+})