diff --git a/.github/workflows/e2e-test-verify.yml b/.github/workflows/e2e-test-verify.yml index 2108923..2b054de 100644 --- a/.github/workflows/e2e-test-verify.yml +++ b/.github/workflows/e2e-test-verify.yml @@ -75,6 +75,13 @@ jobs: target_artifact_reference: ${{ env.target_artifact_reference }} trust_policy: ./tests/e2e/trustpolicy/trustpolicy.json trust_store: ./tests/e2e/truststore + + - name: Verify released artifact again with the same notation configuration + uses: ./verify + with: + target_artifact_reference: ${{ env.target_artifact_reference }} + trust_policy: ./tests/e2e/trustpolicy/trustpolicy.json + trust_store: ./tests/e2e/truststore - name: Verify released artifact missing target artifact reference continue-on-error: true @@ -143,8 +150,6 @@ jobs: echo "Verify released artifact with invalid trust store structure should fail, but succeeded." exit 1 - - name: Clean up notation trust store - run: notation cert delete --type ca --store e2e-test -y --all - name: Verify released artifact without valid cert in trust store continue-on-error: true id: invalid-cert diff --git a/dist/verify.js b/dist/verify.js index 288df56..984cc86 100644 --- a/dist/verify.js +++ b/dist/verify.js @@ -49,6 +49,7 @@ const core = __importStar(require("@actions/core")); const exec = __importStar(require("@actions/exec")); const fs = __importStar(require("fs")); const path = __importStar(require("path")); +const install_1 = require("./lib/install"); const X509 = "x509"; // verify verifies the target artifact with Notation function verify() { @@ -103,6 +104,10 @@ function configTrustStore(dir) { if (!fs.existsSync(trustStoreX509)) { throw new Error(`cannot find trust store dir: ${trustStoreX509}`); } + const trustStorePath = path.join((0, install_1.getConfigHome)(), 'notation', 'truststore'); + if (fs.existsSync(trustStorePath)) { + fs.rmSync(trustStorePath, { recursive: true }); + } let trustStoreTypes = getSubdir(trustStoreX509); // [.github/truststore/x509/ca, .github/truststore/x509/signingAuthority, ...] for (let i = 0; i < trustStoreTypes.length; ++i) { let trustStoreType = path.basename(trustStoreTypes[i]); @@ -111,7 +116,7 @@ function configTrustStore(dir) { let trustStore = trustStores[j]; // .github/truststore/x509/ca/ let trustStoreName = path.basename(trustStore); // let certFile = getFileFromDir(trustStore); // [.github/truststore/x509/ca//, .github/truststore/x509/ca//, ...] - exec.getExecOutput('notation', ['cert', 'add', '-t', trustStoreType, '-s', trustStoreName, ...certFile]); + yield exec.getExecOutput('notation', ['cert', 'add', '-t', trustStoreType, '-s', trustStoreName, ...certFile]); } } }); diff --git a/dist/verify.js.map b/dist/verify.js.map index ff287ee..1002630 100644 --- a/dist/verify.js.map +++ b/dist/verify.js.map @@ -1 +1 @@ -{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,oDAAsC;AACtC,oDAAsC;AACtC,uCAAyB;AACzB,2CAA6B;AAE7B,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB,oDAAoD;AACpD,SAAe,MAAM;;QACjB,IAAI;YACA,mBAAmB;YACnB,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,uCAAuC;YAC3F,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB;YACvE,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YAEjE,eAAe;YACf,IAAI,CAAC,mBAAmB,EAAE;gBACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;aAClE;YACD,IAAI,CAAC,YAAY,EAAE;gBACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;aACrD;YACD,IAAI,CAAC,WAAW,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;aACpD;YAED,kCAAkC;YAClC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAEzD,iCAAiC;YACjC,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAErD,sBAAsB;YACtB,IAAI,mBAAmB,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE;gBAC9C,kEAAkE;gBAClE,gCAAgC;gBAChC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;aACxG;iBAAM;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;aAC/E;SACJ;QAAC,OAAO,CAAU,EAAE;YACjB,IAAI,CAAC,YAAY,KAAK,EAAE;gBACpB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;aACrB;iBAAM;gBACH,IAAI,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;aAC1D;SACJ;IACL,CAAC;CAAA;AAED,mEAAmE;AACnE,4HAA4H;AAC5H,SAAe,gBAAgB,CAAC,GAAW;;QACvC,IAAI,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,0BAA0B;QACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;YAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,cAAc,EAAE,CAAC,CAAC;SACrE;QACD,IAAI,eAAe,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,8EAA8E;QAC/H,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;YAC7C,IAAI,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,WAAW,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wFAAwF;YACzI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;gBACzC,IAAI,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,wCAAwC;gBACzE,IAAI,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa;gBAC7D,IAAI,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,4GAA4G;gBACvJ,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;aAC5G;SACJ;IACL,CAAC;CAAA;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,GAAW;IAC1B,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAC,CAAC;SAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SAClC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW;IAC/B,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAC,CAAC;SAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SACnC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAID,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IACzB,MAAM,EAAE,CAAC;CACZ;AAJD,iBAAS,MAAM,CAAC"} \ No newline at end of file +{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,oDAAsC;AACtC,oDAAsC;AACtC,uCAAyB;AACzB,2CAA6B;AAC7B,2CAA2C;AAE3C,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB,oDAAoD;AACpD,SAAe,MAAM;;QACjB,IAAI;YACA,mBAAmB;YACnB,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,uCAAuC;YAC3F,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB;YACvE,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YAEjE,eAAe;YACf,IAAI,CAAC,mBAAmB,EAAE;gBACtB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;aAClE;YACD,IAAI,CAAC,YAAY,EAAE;gBACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;aACrD;YACD,IAAI,CAAC,WAAW,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;aACpD;YAED,kCAAkC;YAClC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAEzD,iCAAiC;YACjC,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAErD,sBAAsB;YACtB,IAAI,mBAAmB,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE;gBAC9C,kEAAkE;gBAClE,gCAAgC;gBAChC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;aACxG;iBAAM;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;aAC/E;SACJ;QAAC,OAAO,CAAU,EAAE;YACjB,IAAI,CAAC,YAAY,KAAK,EAAE;gBACpB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;aACrB;iBAAM;gBACH,IAAI,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;aAC1D;SACJ;IACL,CAAC;CAAA;AAED,mEAAmE;AACnE,4HAA4H;AAC5H,SAAe,gBAAgB,CAAC,GAAW;;QACvC,IAAI,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,0BAA0B;QACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;YAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,cAAc,EAAE,CAAC,CAAC;SACrE;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,uBAAa,GAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;YAC/B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;SAChD;QACD,IAAI,eAAe,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,8EAA8E;QAC/H,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;YAC7C,IAAI,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,WAAW,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wFAAwF;YACzI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;gBACzC,IAAI,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,wCAAwC;gBACzE,IAAI,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa;gBAC7D,IAAI,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,4GAA4G;gBACvJ,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;aAClH;SACJ;IACL,CAAC;CAAA;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,GAAW;IAC1B,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAC,CAAC;SAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SAClC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW;IAC/B,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAC,CAAC;SAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SACnC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAID,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IACzB,MAAM,EAAE,CAAC;CACZ;AAJD,iBAAS,MAAM,CAAC"} \ No newline at end of file diff --git a/src/verify.ts b/src/verify.ts index 155f46b..b8fa300 100644 --- a/src/verify.ts +++ b/src/verify.ts @@ -17,6 +17,7 @@ import * as core from '@actions/core'; import * as exec from '@actions/exec'; import * as fs from 'fs'; import * as path from 'path'; +import {getConfigHome} from './lib/install' const X509 = "x509"; @@ -72,6 +73,10 @@ async function configTrustStore(dir: string) { if (!fs.existsSync(trustStoreX509)) { throw new Error(`cannot find trust store dir: ${trustStoreX509}`); } + const trustStorePath = path.join(getConfigHome(), 'notation', 'truststore'); + if (fs.existsSync(trustStorePath)) { + fs.rmSync(trustStorePath, {recursive: true}); + } let trustStoreTypes = getSubdir(trustStoreX509); // [.github/truststore/x509/ca, .github/truststore/x509/signingAuthority, ...] for (let i = 0; i < trustStoreTypes.length; ++i) { let trustStoreType = path.basename(trustStoreTypes[i]); @@ -80,7 +85,7 @@ async function configTrustStore(dir: string) { let trustStore = trustStores[j]; // .github/truststore/x509/ca/ let trustStoreName = path.basename(trustStore); // let certFile = getFileFromDir(trustStore); // [.github/truststore/x509/ca//, .github/truststore/x509/ca//, ...] - exec.getExecOutput('notation', ['cert', 'add', '-t', trustStoreType, '-s', trustStoreName, ...certFile]); + await exec.getExecOutput('notation', ['cert', 'add', '-t', trustStoreType, '-s', trustStoreName, ...certFile]); } } }