podman

1
package trust
2

3
import (
4
	"fmt"
5
	"sort"
6
	"strings"
7

8
	"golang.org/x/exp/maps"
9
)
10

11
// Policy describes a basic trust policy configuration
12
type Policy struct {
13
	Transport      string   `json:"transport"`
14
	Name           string   `json:"name,omitempty"`
15
	RepoName       string   `json:"repo_name,omitempty"`
16
	Keys           []string `json:"keys,omitempty"`
17
	SignatureStore string   `json:"sigstore,omitempty"`
18
	Type           string   `json:"type"`
19
	GPGId          string   `json:"gpg_id,omitempty"`
20
}
21

22
// PolicyDescription returns an user-focused description of the policy in policyPath and registries.d data from registriesDirPath.
23
func PolicyDescription(policyPath, registriesDirPath string) ([]*Policy, error) {
24
	return policyDescriptionWithGPGIDReader(policyPath, registriesDirPath, getGPGIdFromKeyPath)
25
}
26

27
// policyDescriptionWithGPGIDReader is PolicyDescription with a gpgIDReader parameter. It exists only to make testing easier.
28
func policyDescriptionWithGPGIDReader(policyPath, registriesDirPath string, idReader gpgIDReader) ([]*Policy, error) {
29
	policyContentStruct, err := getPolicy(policyPath)
30
	if err != nil {
31
		return nil, fmt.Errorf("could not read trust policies: %w", err)
32
	}
33
	res, err := getPolicyShowOutput(policyContentStruct, registriesDirPath, idReader)
34
	if err != nil {
35
		return nil, fmt.Errorf("could not show trust policies: %w", err)
36
	}
37
	return res, nil
38
}
39

40
func getPolicyShowOutput(policyContentStruct policyContent, systemRegistriesDirPath string, idReader gpgIDReader) ([]*Policy, error) {
41
	var output []*Policy
42

43
	registryConfigs, err := loadAndMergeConfig(systemRegistriesDirPath)
44
	if err != nil {
45
		return nil, err
46
	}
47

48
	if len(policyContentStruct.Default) > 0 {
49
		template := Policy{
50
			Transport: "all",
51
			Name:      "* (default)",
52
			RepoName:  "default",
53
		}
54
		output = append(output, descriptionsOfPolicyRequirements(policyContentStruct.Default, template, registryConfigs, "", idReader)...)
55
	}
56
	transports := maps.Keys(policyContentStruct.Transports)
57
	sort.Strings(transports)
58
	for _, transport := range transports {
59
		transval := policyContentStruct.Transports[transport]
60
		if transport == "docker" {
61
			transport = "repository"
62
		}
63

64
		scopes := maps.Keys(transval)
65
		sort.Strings(scopes)
66
		for _, repo := range scopes {
67
			repoval := transval[repo]
68
			template := Policy{
69
				Transport: transport,
70
				Name:      repo,
71
				RepoName:  repo,
72
			}
73
			output = append(output, descriptionsOfPolicyRequirements(repoval, template, registryConfigs, repo, idReader)...)
74
		}
75
	}
76
	return output, nil
77
}
78

79
// descriptionsOfPolicyRequirements turns reqs into user-readable policy entries, with Transport/Name/Reponame coming from template, potentially looking up scope (which may be "") in registryConfigs.
80
func descriptionsOfPolicyRequirements(reqs []repoContent, template Policy, registryConfigs *registryConfiguration, scope string, idReader gpgIDReader) []*Policy {
81
	res := []*Policy{}
82

83
	var lookasidePath string
84
	registryNamespace := registriesDConfigurationForScope(registryConfigs, scope)
85
	if registryNamespace != nil {
86
		if registryNamespace.Lookaside != "" {
87
			lookasidePath = registryNamespace.Lookaside
88
		} else { // incl. registryNamespace.SigStore == ""
89
			lookasidePath = registryNamespace.SigStore
90
		}
91
	}
92

93
	for _, repoele := range reqs {
94
		entry := template
95
		entry.Type = trustTypeDescription(repoele.Type)
96

97
		var gpgIDString string
98
		switch repoele.Type {
99
		case "signedBy":
100
			uids := []string{}
101
			if len(repoele.KeyPath) > 0 {
102
				uids = append(uids, idReader(repoele.KeyPath)...)
103
			}
104
			for _, path := range repoele.KeyPaths {
105
				uids = append(uids, idReader(path)...)
106
			}
107
			if len(repoele.KeyData) > 0 {
108
				uids = append(uids, getGPGIdFromKeyData(idReader, repoele.KeyData)...)
109
			}
110
			gpgIDString = strings.Join(uids, ", ")
111

112
		case "sigstoreSigned":
113
			gpgIDString = "N/A" // We could potentially return key fingerprints here, but they would not be _GPG_ fingerprints.
114
		}
115
		entry.GPGId = gpgIDString
116
		entry.SignatureStore = lookasidePath // We do this even for sigstoreSigned and things like type: reject, to show that the sigstore is being read.
117
		res = append(res, &entry)
118
	}
119

120
	return res
121
}
122