feat: mem, local uploader
This commit is contained in:
loveuer
121
internal/verify/verify.go
Normal file
121
internal/verify/verify.go
Normal file
@ -0,0 +1,121 @@
|
||||
// Copyright 2020 Google LLC All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
// Package verify provides a ReadCloser that verifies content matches the
|
||||
// expected hash values.
|
||||
package verify
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"hash"
|
||||
"io"
|
||||
"nf-repo/internal/and"
|
||||
"nf-repo/internal/model"
|
||||
)
|
||||
|
||||
// SizeUnknown is a sentinel value to indicate that the expected size is not known.
|
||||
const SizeUnknown = -1
|
||||
|
||||
type verifyReader struct {
|
||||
inner io.Reader
|
||||
hasher hash.Hash
|
||||
expected model.Hash
|
||||
gotSize, wantSize int64
|
||||
}
|
||||
|
||||
// Error provides information about the failed hash verification.
|
||||
type Error struct {
|
||||
got string
|
||||
want model.Hash
|
||||
gotSize int64
|
||||
}
|
||||
|
||||
func (v Error) Error() string {
|
||||
return fmt.Sprintf("error verifying %s checksum after reading %d bytes; got %q, want %q",
|
||||
v.want.Algorithm, v.gotSize, v.got, v.want)
|
||||
}
|
||||
|
||||
// Read implements io.Reader
|
||||
func (vc *verifyReader) Read(b []byte) (int, error) {
|
||||
n, err := vc.inner.Read(b)
|
||||
vc.gotSize += int64(n)
|
||||
if err == io.EOF {
|
||||
if vc.wantSize != SizeUnknown && vc.gotSize != vc.wantSize {
|
||||
return n, fmt.Errorf("error verifying size; got %d, want %d", vc.gotSize, vc.wantSize)
|
||||
}
|
||||
got := hex.EncodeToString(vc.hasher.Sum(nil))
|
||||
if want := vc.expected.Hex; got != want {
|
||||
return n, Error{
|
||||
got: vc.expected.Algorithm + ":" + got,
|
||||
want: vc.expected,
|
||||
gotSize: vc.gotSize,
|
||||
}
|
||||
}
|
||||
}
|
||||
return n, err
|
||||
}
|
||||
|
||||
// ReadCloser wraps the given io.ReadCloser to verify that its contents match
|
||||
// the provided v1.Hash before io.EOF is returned.
|
||||
//
|
||||
// The reader will only be read up to size bytes, to prevent resource
|
||||
// exhaustion. If EOF is returned before size bytes are read, an error is
|
||||
// returned.
|
||||
//
|
||||
// A size of SizeUnknown (-1) indicates disables size verification when the size
|
||||
// is unknown ahead of time.
|
||||
func ReadCloser(r io.ReadCloser, size int64, h model.Hash) (io.ReadCloser, error) {
|
||||
w, err := model.Hasher(h.Algorithm)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
r2 := io.TeeReader(r, w) // pass all writes to the hasher.
|
||||
if size != SizeUnknown {
|
||||
r2 = io.LimitReader(r2, size) // if we know the size, limit to that size.
|
||||
}
|
||||
return &and.ReadCloser{
|
||||
Reader: &verifyReader{
|
||||
inner: r2,
|
||||
hasher: w,
|
||||
expected: h,
|
||||
wantSize: size,
|
||||
},
|
||||
CloseFunc: r.Close,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Descriptor verifies that the embedded Data field matches the Size and Digest
|
||||
// fields of the given v1.Descriptor, returning an error if the Data field is
|
||||
// missing or if it contains incorrect data.
|
||||
func Descriptor(d model.Descriptor) error {
|
||||
if d.Data == nil {
|
||||
return errors.New("error verifying descriptor; Data == nil")
|
||||
}
|
||||
|
||||
h, sz, err := model.SHA256(bytes.NewReader(d.Data))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if h != d.Digest {
|
||||
return fmt.Errorf("error verifying Digest; got %q, want %q", h, d.Digest)
|
||||
}
|
||||
if sz != d.Size {
|
||||
return fmt.Errorf("error verifying Size; got %d, want %d", sz, d.Size)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
147
internal/verify/verify_test.go
Normal file
147
internal/verify/verify_test.go
Normal file
@ -0,0 +1,147 @@
|
||||
// Copyright 2020 Google LLC All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package verify
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
v1 "github.com/google/go-containerregistry/pkg/v1"
|
||||
)
|
||||
|
||||
func mustHash(s string, t *testing.T) v1.Hash {
|
||||
h, _, err := v1.SHA256(strings.NewReader(s))
|
||||
if err != nil {
|
||||
t.Fatalf("v1.SHA256(%s) = %v", s, err)
|
||||
}
|
||||
t.Logf("Hashed: %q -> %q", s, h)
|
||||
return h
|
||||
}
|
||||
|
||||
func TestVerificationFailure(t *testing.T) {
|
||||
want := "This is the input string."
|
||||
buf := bytes.NewBufferString(want)
|
||||
|
||||
verified, err := ReadCloser(io.NopCloser(buf), int64(len(want)), mustHash("not the same", t))
|
||||
if err != nil {
|
||||
t.Fatal("ReadCloser() =", err)
|
||||
}
|
||||
if b, err := io.ReadAll(verified); err == nil {
|
||||
t.Errorf("ReadAll() = %q; want verification error", string(b))
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerification(t *testing.T) {
|
||||
want := "This is the input string."
|
||||
buf := bytes.NewBufferString(want)
|
||||
|
||||
verified, err := ReadCloser(io.NopCloser(buf), int64(len(want)), mustHash(want, t))
|
||||
if err != nil {
|
||||
t.Fatal("ReadCloser() =", err)
|
||||
}
|
||||
if _, err := io.ReadAll(verified); err != nil {
|
||||
t.Error("ReadAll() =", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestVerificationSizeUnknown(t *testing.T) {
|
||||
want := "This is the input string."
|
||||
buf := bytes.NewBufferString(want)
|
||||
|
||||
verified, err := ReadCloser(io.NopCloser(buf), SizeUnknown, mustHash(want, t))
|
||||
if err != nil {
|
||||
t.Fatal("ReadCloser() =", err)
|
||||
}
|
||||
if _, err := io.ReadAll(verified); err != nil {
|
||||
t.Error("ReadAll() =", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBadHash(t *testing.T) {
|
||||
h := v1.Hash{
|
||||
Algorithm: "fake256",
|
||||
Hex: "whatever",
|
||||
}
|
||||
_, err := ReadCloser(io.NopCloser(strings.NewReader("hi")), 0, h)
|
||||
if err == nil {
|
||||
t.Errorf("ReadCloser() = %v, wanted err", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBadSize(t *testing.T) {
|
||||
want := "This is the input string."
|
||||
|
||||
// having too much content or expecting too much content returns an error.
|
||||
for _, size := range []int64{3, 100} {
|
||||
t.Run(fmt.Sprintf("expecting size %d", size), func(t *testing.T) {
|
||||
buf := bytes.NewBufferString(want)
|
||||
rc, err := ReadCloser(io.NopCloser(buf), size, mustHash(want, t))
|
||||
if err != nil {
|
||||
t.Fatal("ReadCloser() =", err)
|
||||
}
|
||||
if b, err := io.ReadAll(rc); err == nil {
|
||||
t.Errorf("ReadAll() = %q; want verification error", string(b))
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestDescriptor(t *testing.T) {
|
||||
for _, tc := range []struct {
|
||||
err error
|
||||
desc v1.Descriptor
|
||||
}{{
|
||||
err: errors.New("error verifying descriptor; Data == nil"),
|
||||
}, {
|
||||
err: errors.New(`error verifying Digest; got "sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", want ":"`),
|
||||
desc: v1.Descriptor{
|
||||
Data: []byte("abc"),
|
||||
},
|
||||
}, {
|
||||
err: errors.New("error verifying Size; got 3, want 0"),
|
||||
desc: v1.Descriptor{
|
||||
Data: []byte("abc"),
|
||||
Digest: v1.Hash{
|
||||
Algorithm: "sha256",
|
||||
Hex: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
|
||||
},
|
||||
},
|
||||
}, {
|
||||
desc: v1.Descriptor{
|
||||
Data: []byte("abc"),
|
||||
Size: 3,
|
||||
Digest: v1.Hash{
|
||||
Algorithm: "sha256",
|
||||
Hex: "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
|
||||
},
|
||||
},
|
||||
}} {
|
||||
got, want := Descriptor(tc.desc), tc.err
|
||||
|
||||
if got == nil {
|
||||
if want != nil {
|
||||
t.Errorf("Descriptor(): got nil, want %v", want)
|
||||
}
|
||||
} else if want == nil {
|
||||
t.Errorf("Descriptor(): got %v, want nil", got)
|
||||
} else if got, want := got.Error(), want.Error(); got != want {
|
||||
t.Errorf("Descriptor(): got %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user