1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
package config_test
import (
"testing"
"github.com/stretchr/testify/assert"
"gerrit.wikimedia.org/r/blubber/config"
)
func TestPolicyRead(t *testing.T) {
policy, err := config.ReadPolicy([]byte(`---
enforcements:
- path: variants.production.runs.as
rule: ne=root
- path: base
rule: oneof=debian:jessie debian:stretch`))
if assert.NoError(t, err) {
if assert.Len(t, policy.Enforcements, 2) {
assert.Equal(t, "variants.production.runs.as", policy.Enforcements[0].Path)
assert.Equal(t, "ne=root", policy.Enforcements[0].Rule)
assert.Equal(t, "base", policy.Enforcements[1].Path)
assert.Equal(t, "oneof=debian:jessie debian:stretch", policy.Enforcements[1].Rule)
}
}
}
func TestPolicyValidate(t *testing.T) {
cfg := config.Config{
CommonConfig: config.CommonConfig{
Base: "foo:tag",
},
Variants: map[string]config.VariantConfig{
"foo": config.VariantConfig{
CommonConfig: config.CommonConfig{
Runs: config.RunsConfig{
UserConfig: config.UserConfig{
As: "root",
},
},
},
},
},
}
policy := config.Policy{
Enforcements: []config.Enforcement{
{Path: "variants.foo.runs.as", Rule: "ne=root"},
},
}
assert.EqualError(t,
policy.Validate(cfg),
`value for "variants.foo.runs.as" violates policy rule "ne=root"`,
)
policy = config.Policy{
Enforcements: []config.Enforcement{
{Path: "base", Rule: "oneof=debian:jessie debian:stretch"},
},
}
assert.EqualError(t,
policy.Validate(cfg),
`value for "base" violates policy rule "oneof=debian:jessie debian:stretch"`,
)
}
func TestEnforcementOnFlag(t *testing.T) {
cfg := config.Config{
Variants: map[string]config.VariantConfig{
"production": config.VariantConfig{
CommonConfig: config.CommonConfig{
Runs: config.RunsConfig{
Insecurely: config.Flag{True: true},
},
},
},
},
}
policy := config.Policy{
Enforcements: []config.Enforcement{
{Path: "variants.production.runs.insecurely", Rule: "isfalse"},
},
}
assert.Error(t,
policy.Validate(cfg),
`value for "variants.production.runs.insecurely" violates policy rule "isfalse"`,
)
}
func TestResolveYAMLPath(t *testing.T) {
cfg := config.Config{
Variants: map[string]config.VariantConfig{
"foo": config.VariantConfig{
CommonConfig: config.CommonConfig{
Runs: config.RunsConfig{
UserConfig: config.UserConfig{
As: "root",
},
},
},
},
},
}
val, err := config.ResolveYAMLPath("variants.foo.runs.as", cfg)
if assert.NoError(t, err) {
assert.Equal(t, "root", val)
}
}
|
