deploy/test/e2e/app_management_source_integrity_test.go at main

mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00

Files

T

zeekayandHanzo Dev 1ab6e799c1 cd: the module is github.com/hanzoai/cd, where it is actually hosted

go.mod still declared `module github.com/hanzoai/deploy` after the repo was
renamed. A Go module path is not cosmetic — it is the resolvable location. So
`go get github.com/hanzoai/cd` could not work, and anything importing this
module had to spell a name that no longer exists at that address. The build log
of v3.6.0 is where it surfaced: the compiler was still emitting
github.com/hanzoai/deploy/cmd/cd/commands.

3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile
and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to
ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from
the module path, replaced separately so neither could clobber the other.

go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-28 21:16:24 -07:00

458 lines

13 KiB

Go

Raw Permalink Blame History

 package e2e
 import (
 	"testing"
 	"github.com/hanzoai/cd/gitops-engine/pkg/health"
 	. "github.com/hanzoai/cd/gitops-engine/pkg/sync/common"
 	"github.com/stretchr/testify/assert"
 	. "github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
 	"github.com/hanzoai/cd/test/e2e/fixture"
 	. "github.com/hanzoai/cd/test/e2e/fixture/app"
 )
 var projectWithNoKeys = AppProjectSpec{
 	SourceRepos:  []string{"*"},
 	Destinations: []ApplicationDestination{{Namespace: "*", Server: "*"}},
 	SourceIntegrity: &SourceIntegrity{
 		Git: &SourceIntegrityGit{
 			Policies: []*SourceIntegrityGitPolicy{{
 				Repos: []SourceIntegrityGitPolicyRepo{{URL: "*"}},
 				GPG: &SourceIntegrityGitPolicyGPG{
 					Keys: []string{}, // Verifying but permitting no keys
 					Mode: "head",
 				},
 			}},
 		},
 	},
 }
 func TestSyncToUnsignedCommit(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		When().
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision")).
 		Expect(Condition(ApplicationConditionComparisonError, " unsigned (key_id=)"))
 }
 func TestSyncToSignedCommitWithoutKnownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with key not in keyring (key_id="+fixture.GpgGoodKeyID+")"))
 }
 func TestSyncToSignedCommitWithKnownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions())
 }
 func TestSyncToSignedCommitWithUnallowedKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		ProjectSpec(projectWithNoKeys).
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with unallowed key (key_id="+fixture.GpgGoodKeyID+")"))
 }
 func TestSyncToSignedBranchWithKnownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		Revision("master").
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions())
 }
 func TestSyncToSignedBranchWithUnknownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		Revision("master").
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with key not in keyring (key_id="+fixture.GpgGoodKeyID+")"))
 }
 func TestSyncToUnsignedBranch(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Revision("master").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddFile("test.yaml", "TestSyncToUnsignedBranch").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision")).
 		Expect(Condition(ApplicationConditionComparisonError, "unsigned (key_id=)"))
 }
 func TestSyncToSignedTagWithKnownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Revision("signed-tag").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedTag("signed-tag").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions())
 }
 func TestSyncToSignedTagWithUnknownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Revision("signed-tag").
 		Path(guestbookPath).
 		Sleep(2).
 		When().
 		AddSignedTag("signed-tag").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision signed-tag by ")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with key not in keyring (key_id="+fixture.GpgGoodKeyID+")"))
 }
 func TestSyncToUnsignedAnnotatedTag(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Revision("unsigned-tag").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		// Signed commit with an unsigned annotated tag will validate the tag signature
 		AddSignedFile("test.yaml", "null").
 		AddAnnotatedTag("unsigned-tag", "message goes here").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision unsigned-tag by ")).
 		Expect(Condition(ApplicationConditionComparisonError, "unsigned (key_id=)"))
 }
 func TestSyncToUnsignedSimpleTag(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Revision("unsigned-simple-tag").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		// Signed commit with an unsigned not-annotated tag will validate the commit, not the tag
 		AddSignedFile("test.yaml", "null").
 		AddTag("unsigned-simple-tag").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions())
 }
 func TestSyncToSignedAnnotatedTagWithUnallowedKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		ProjectSpec(projectWithNoKeys).
 		Revision("v1.0").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddFile("test.yaml", "null").
 		AddSignedTag("v1.0").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision v1.0")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with unallowed key (key_id="+fixture.GpgGoodKeyID+")"))
 }
 func TestSyncToTagBasedConstraint(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Revision("1.*").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		AddSignedTag("1.0").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions())
 }
 func TestNamespacedSyncToUnsignedCommit(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	GivenWithNamespace(t, fixture.AppNamespace()).
 		SetTrackingMethod("annotation").
 		Project("gpg").
 		Path(guestbookPath).
 		When().
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision ")).
 		Expect(Condition(ApplicationConditionComparisonError, "unsigned (key_id=)"))
 }
 func TestNamespacedSyncToSignedCommitWithUnknownKey(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		SetAppNamespace(fixture.AppNamespace()).
 		SetTrackingMethod("annotation").
 		Project("gpg").
 		Path(guestbookPath).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(SyncStatusIs(SyncStatusCodeOutOfSync)).
 		Expect(HealthIs(health.HealthStatusMissing)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision ")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with key not in keyring (key_id="+fixture.GpgGoodKeyID+")"))
 }
 func TestNamespacedSyncToSignedCommit(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		SetAppNamespace(fixture.AppNamespace()).
 		SetTrackingMethod("annotation").
 		Project("gpg").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions())
 }
 func TestLocalManifestRejectedWithSourceIntegrity(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		CreateApp().
 		Sync().
 		Then().
 		And(func(app *Application) {
 			res, _ := fixture.RunCli("app", "manifests", app.Name)
 			assert.Contains(t, res, "containerPort: 80")
 			assert.Contains(t, res, "image: quay.io/argoprojlabs/cd-e2e-container:0.2")
 		}).
 		Given().
 		LocalPath(guestbookPathLocal).
 		When().
 		IgnoreErrors().
 		Sync("--local-repo-root", ".").
 		Then().
 		Expect(ErrorRegex("", "Cannot use local manifests when source integrity is enforced"))
 }
 func TestOCISourceIgnoredWithSourceIntegrity(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	// No keys in keyring, no keys in project, OCI is not git, yet source integrity is defined.
 	// Expecting some of that would cause visible failure if the source integrity should be applied
 	Given(t).
 		Project("gpg").
 		ProjectSpec(appProjectWithSourceIntegrity()).
 		HTTPSInsecureRepoURLWithClientCertAdded().
 		PushImageToOCIRegistry("testdata/guestbook", "1.0.0").
 		OCIRepoAdded("my-oci-repo", "guestbook").
 		OCIRegistry(fixture.OCIHostURL).
 		OCIRegistryPath("guestbook").
 		RepoURLType(fixture.RepoURLTypeOCI).
 		Revision("1.0.0").
 		Path(".").
 		When().
 		IgnoreErrors().
 		CreateApp().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		// Verify local manifests are permitted - source integrity criteria for git should not apply for oci
 		Given().
 		LocalPath(guestbookPathLocal).
 		When().
 		DoNotIgnoreErrors().
 		Sync("--local-repo-root", ".", "--force", "--prune")
 }
 func TestArtifactCacheInvalidatedOnSourceIntegrityChange(t *testing.T) {
 	fixture.SkipOnEnv(t, "GPG")
 	fixture.EnsureCleanState(t)
 	Given(t).
 		Project("gpg").
 		Path(guestbookPath).
 		GPGPublicKeyAdded().
 		Sleep(2).
 		When().
 		AddSignedFile("test.yaml", "null").
 		CreateApp().
 		IgnoreErrors().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationSucceeded)).
 		Expect(SyncStatusIs(SyncStatusCodeSynced)).
 		Expect(HealthIs(health.HealthStatusHealthy)).
 		Expect(NoConditions()).
 		Given().
 		// Should start failing when the project does not bless they key anymore
 		ProjectSpec(appProjectWithSourceIntegrity()).
 		When().
 		IgnoreErrors().
 		Sync().
 		Then().
 		Expect(OperationPhaseIs(OperationError)).
 		Expect(Condition(ApplicationConditionComparisonError, "GIT/GPG: Failed verifying revision")).
 		Expect(Condition(ApplicationConditionComparisonError, "signed with unallowed key (key_id="+fixture.GpgGoodKeyID+")"))
 }

458 lines 13 KiB Go Raw Permalink Blame History

458 lines

13 KiB

Go

Raw Permalink Blame History