unit test part 2

.gitignore

@@ -9,3 +9,4 @@ connaisseur.yaml
 *.key
 *.pem
 *.csr
+!test/testdata/**/*.pem

internal/validator/notation/notation_validator.go

@@ -6,7 +6,10 @@ import (
 	"connaisseur/internal/utils"
 	"connaisseur/internal/validator/auth"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
+	"net/http"
 
 	"github.com/notaryproject/notation-go"
 	"github.com/notaryproject/notation-go/registry"
@@ -22,13 +25,15 @@ type NotationValidator struct {
 	Name       string `validate:"required"`
 	Type       string `validate:"eq=notation"`
 	Auth       auth.Auth
+	RootCA     *x509.CertPool
 	TrustStore truststore.X509TrustStore
 }
 
 type NotationValidatorYaml struct {
 	Name       string           `yaml:"name"`
 	Type       string           `yaml:"type"`
 	Auth       auth.Auth        `yaml:"auth"`
+	Cert       string           `yaml:"cert"`
 	TrustRoots []auth.TrustRoot `yaml:"trustRoots"`
 }
 
@@ -47,6 +52,14 @@ func (nv *NotationValidator) UnmarshalYAML(unmarshal func(interface{}) error) er
 		return fmt.Errorf("failed to create trust store: %s", err)
 	}
 
+	if valData.Cert != "" {
+		rootCA := x509.NewCertPool()
+		if !rootCA.AppendCertsFromPEM([]byte(valData.Cert)) {
+			return fmt.Errorf("failed to parse certificate")
+		}
+		nv.RootCA = rootCA
+	}
+
 	nv.Name = valData.Name
 	nv.Type = valData.Type
 	nv.Auth = valData.Auth
@@ -75,19 +88,32 @@ func (nv *NotationValidator) ValidateImage(
 		return "", fmt.Errorf("failed to create remote repository: %s", err)
 	}
 
+	client := orasAuth.DefaultClient
+	if nv.RootCA != nil {
+		client.Client = &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					RootCAs: nv.RootCA,
+				},
+			},
+		}
+	}
+
 	if authn := nv.Auth.LookUp(image.Context().Name()); authn.Username != "" &&
 		authn.Password != "" {
-		client := orasAuth.DefaultClient
 		client.Credential = func(nv2_ctx context.Context, s string) (orasAuth.Credential, error) {
 			return orasAuth.Credential{
 				Username: authn.Username,
 				Password: authn.Password,
 			}, nil
 		}
-		remoteRepo.Client = client
 	}
+
+	remoteRepo.Client = client
 	remoteRegisty := registry.NewRepository(remoteRepo)
 
+	// notation needs digests for signature verification
+	// thus we resolve the digest if it is not set
 	if image.Digest() == "" {
 		desc, err := remoteRegisty.Resolve(ctx, image.Name())
 		if err != nil {

internal/validator/notation/notation_validator_test.go

@@ -3,7 +3,10 @@ package notation
 import (
 	"connaisseur/internal/image"
 	"connaisseur/internal/policy"
+	"connaisseur/test/testhelper"
+	"context"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -43,13 +46,13 @@ func TestUnmarshal(t *testing.T) {
 			[]string{},
 			"failed to parse certificate",
 		},
-		{
+		{ // 5: missing certificate
 			"05_missing_cert",
 			"",
 			[]string{},
 			"no certificate provided",
 		},
-		{
+		{ // 6: decode error on certificate
 			"06_decode_cert_err",
 			"",
 			[]string{},
@@ -80,6 +83,46 @@ func TestUnmarshal(t *testing.T) {
 	}
 }
 
+func TestValidateImage(t *testing.T) {
+	var testCases = []struct {
+		file   string
+		image  string
+		args   policy.RuleOptions
+		digest string
+		err    string
+	}{
+		{ // 1: simple working case
+			"07_selfsigned_cert",
+			"sse-secure-systems/testimage:notation-sign",
+			policy.RuleOptions{},
+			"sha256:a136cc4e785798e5e8483047cf621cf0a0300a93d47703a3f066c340c070f5cf",
+			"",
+		},
+	}
+
+	reg := testhelper.NotationMockRegistry(PRE)
+	defer reg.Close()
+
+	for idx, tc := range testCases {
+		var nv NotationValidator
+
+		nvBytes, _ := os.ReadFile(PRE + tc.file + ".yaml")
+		yaml.Unmarshal(nvBytes, &nv)
+
+		img, err := image.New(strings.TrimPrefix(reg.URL, "https://") + "/" + tc.image)
+		assert.NoError(t, err, idx+1)
+		digest, err := nv.ValidateImage(context.Background(), img, tc.args)
+
+		if tc.err != "" {
+			assert.NotNil(t, err, idx+1)
+			assert.ErrorContains(t, err, tc.err, idx+1)
+		} else {
+			assert.Nil(t, err, idx+1)
+			assert.Equal(t, tc.digest, digest, idx+1)
+		}
+	}
+}
+
 func TestSetUpTrustPolicy(t *testing.T) {
 	var testCases = []struct {
 		file          string

test/testdata/notation/07_selfsigned_cert.yaml

@@ -0,0 +1,73 @@
+name: ghcr-notation
+type: notation
+trustRoots:
+  - name: default
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      MIIDrjCCApagAwIBAgIUfA/t/J6eINSu566aAozkOjQKey4wDQYJKoZIhvcNAQEL
+      BQAwbDELMAkGA1UEBhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVy
+      bGluMQwwCgYDVQQKDANTU0UxEjAQBgNVBAsMCURlZmVuc2l2ZTEZMBcGA1UEAwwQ
+      c2VjdXJlc3lzdGVtcy5kZTAgFw0yNTAxMjQxMjQzMTRaGA8yMTI0MTIzMTEyNDMx
+      NFowbDELMAkGA1UEBhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVy
+      bGluMQwwCgYDVQQKDANTU0UxEjAQBgNVBAsMCURlZmVuc2l2ZTEZMBcGA1UEAwwQ
+      c2VjdXJlc3lzdGVtcy5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+      AJSmGE+Knp0Qc2RqIkMys8e7X1F8zVbpVMmRxvkuZIrWb84Xb+XVeQgE1o5JQgPL
+      7PSgG6EHL/XjY1wKO2bwlC4AxLm3Cvo/r764yUTqGFoeImEsiT/BW8bFKndJYkP8
+      b8iHUkrRX7ZYkhjby91zwFzeewDb9dZPkqiV7npATOL/T5KSUVQ6uIIozX5GCj+b
+      B/iqZWB0bP33uqPEu+GUyYZudJlYe/Yv9aw8vioVXdoEHH10DtTosfXlub/Xd8bC
+      8a7qOBITpWJRrjWRwjaWgnKUlJxymhqU5Iudi57VgtkzD2AgRGLZEN27x67o5p0X
+      aN2O2cFDCCY/7DMlW965++sCAwEAAaNGMEQwDgYDVR0PAQH/BAQDAgeAMBMGA1Ud
+      JQQMMAoGCCsGAQUFBwMDMB0GA1UdDgQWBBSiqJeF6lNSF21K51ePceEtsIBPajAN
+      BgkqhkiG9w0BAQsFAAOCAQEAhaKvo0ofGKIoMNaCqv4qYCBsnXTLWqeRMzrxY3WP
+      RmGkiLoKivXP2ZL4R2igERW8IbXSDqC9u1to7ahwLiiM9Ikjik8I/x3EYJz3DAkz
+      eTDqS227EhSOOGo1G6f0ph/GPO4o71s8ek55Q92ZNrAqHwzGwsByGFbHcwABwtAA
+      1gqAB5luiuokUXhmlqkH46wbQLiVLYnetqIQ8uJiSnUFrWaKQSICnCY1kxptqepv
+      Vfgbd7LIriH+m57IWD2fil6qRXV7c0J6v+N5N7gf2TgDvRBxYRhHV+fQpxRWm+Ti
+      fyEquTrEhfXY4yfYWnpJ/EbjsHheqK+F4EacAqBTjhzW+g==
+      -----END CERTIFICATE-----
+  - name: cosign-cert
+    cert: |
+      -----BEGIN CERTIFICATE-----
+      MIIEAzCCAuugAwIBAgIQaNovZx6t4Id3+bpP3JZAETANBgkqhkiG9w0BAQsFADA4
+      MTYwNAYDVQQDEy1yZWxlYXNlLW5hbWUtcHJpdmF0ZS1yZWdpc3RyeS5jb25uYWlz
+      c2V1ci5zdmMwIBcNMjMwNzE5MDkyNTQ2WhgPMjEyMzA2MjUwOTI1NDZaMDgxNjA0
+      BgNVBAMTLXJlbGVhc2UtbmFtZS1wcml2YXRlLXJlZ2lzdHJ5LmNvbm5haXNzZXVy
+      LnN2YzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJPVASCV0UXXoAE6
+      3jw4L30GKf9+XkTrJ6hBEEmpoD9dmq7fZirCNQ09fX2P+oFs9aVVSXLBpalOriwg
+      OgVmDEKXgeAeyt2cTq9XDvfUJ3vOsCyRoTZTmtTNbnvicNpjw8n8k7yTAORD3NAn
+      tveHYOpjprQxVaXwDJBwX1n0d10KIFINBQSRYhiabEiw0Yqo4QGhq/d/rybS2sZc
+      bsJANSFhdeQMBAMC2KaGhVtSh2wPHZeu7Ie0/p9onP+sSgAkH516hsXn0BYYAHmB
+      M9xjwrWOjvhNGth6Uqv+zoDnqpH9x74cEJJpZyyShpP+5o0i4W26pkN4ubUO3v6m
+      MI7Sf48CAwEAAaOCAQUwggEBMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr
+      BgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADCBwQYDVR0RBIG5MIG2gh1y
+      ZWxlYXNlLW5hbWUtcHJpdmF0ZS1yZWdpc3RyeYIpcmVsZWFzZS1uYW1lLXByaXZh
+      dGUtcmVnaXN0cnkuY29ubmFpc3NldXKCLXJlbGVhc2UtbmFtZS1wcml2YXRlLXJl
+      Z2lzdHJ5LmNvbm5haXNzZXVyLnN2Y4I7cmVsZWFzZS1uYW1lLXByaXZhdGUtcmVn
+      aXN0cnkuY29ubmFpc3NldXIuc3ZjLmNsdXN0ZXIubG9jYWwwDQYJKoZIhvcNAQEL
+      BQADggEBAIs+pLoykr7/DP1rS4BfgchYUP24lNXsM6Xj2gJhYhdcbtgjW+FG5f2d
+      YpwvYimBHhNFxxHnOaIEHjxmMI1+nMz9Mh/zJBT/swV1pDG+uoeT4PqjR/B7EXu+
+      AzzN6VOrJJ3OnlE5x+EuAOTdBBNIfmnsDUO+wgSln0dV3/u7LUBgQaT5hRHf+AQm
+      Y/6duOanh6ORR5FWASh1W+e8VBbvbWc62c9K7Tbt3CyApMHx1MN7oX+WZ0Klv+Q4
+      9Q+j464V31M1jEwZc7GHVvSaiXwL89mtjH7s6d9aAQQPtTiQKY8hAgxpzbBnXLcU
+      YWedcoUI044jFnxGv9P9fHI3LcNTt4I=
+      -----END CERTIFICATE-----
+cert: |
+  -----BEGIN CERTIFICATE-----
+  MIIDBzCCAe+gAwIBAgIUHaowA7TjXaF4qFEqOPEElo8Tp70wDQYJKoZIhvcNAQEL
+  BQAwEjEQMA4GA1UEAwwHVGVzdCBDQTAgFw0yNTAxMzExMjUyMDBaGA8yMTI1MDEw
+  NzEyNTIwMFowEjEQMA4GA1UEAwwHVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+  ggEPADCCAQoCggEBALvKkWeWCA74EWAsoMlI0tvCEVte+PqI6jyy9MDOPAvMux1u
+  w9oqL/mhRTayOwMc7D0ZaDe9KAnJTNLXn+9ZXB/xTgM1HvnGGlUGk/meemppGZE+
+  vKRbTeLeUMG8AXjzPCiZ3YpWHR7nldK9FLbicevsVo9VQEtyxPkDlrjT+XQiwvJe
+  HQAIVPFT7dLd4qMG0BYbsCAdDxbJqAbUjbctsXH9ZH4WEdI4JR2ybw3h89WWmuT2
+  2GT/mnyCvt7TmZMGjiUHQcRqZixcwk6+tvTl/4HwywAGuXphJrojsEBzkAXAdkta
+  JilGq2u5ogwTQJNhjUlWPJ6t03IrtIlPXtNM7k0CAwEAAaNTMFEwHQYDVR0OBBYE
+  FH5/3uuZG9/Px6hKXwSauVWtx9JlMB8GA1UdIwQYMBaAFH5/3uuZG9/Px6hKXwSa
+  uVWtx9JlMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAAbIcQ6F
+  vV2aKUHkDdN5PqPzBT6X99AsL0swUWsCz3fTQJ+4t2k2eadSbJt0Dl99tFTxY+tK
+  7OI8UMi2yINa7Pgeysy+cyRvw879/Udj4Uh0AziOKMQqVFuyh+mPyOKmnX/kYjee
+  5UgGvdVu+4uWfRNSB+gEEJ6mZJKn9pRL5w6i/bycUhHgkTreZgvULRFRqhCcSmB/
+  SF/PHHe06+Ap11LV2YGUhcHOrXF8qpB0aKDVzeiyLaekrNK3pilDDmrskM9dhzI6
+  t3MBZyUvP0U9O/bKy7ecry3swfBwinpVLPUqnhpj257rX7DnF9o0SC9YXfxjrhJC
+  jf4CCZ6UxeKp+50=
+  -----END CERTIFICATE-----

test/testdata/notation/ca.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDBzCCAe+gAwIBAgIUHaowA7TjXaF4qFEqOPEElo8Tp70wDQYJKoZIhvcNAQEL
+BQAwEjEQMA4GA1UEAwwHVGVzdCBDQTAgFw0yNTAxMzExMjUyMDBaGA8yMTI1MDEw
+NzEyNTIwMFowEjEQMA4GA1UEAwwHVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBALvKkWeWCA74EWAsoMlI0tvCEVte+PqI6jyy9MDOPAvMux1u
+w9oqL/mhRTayOwMc7D0ZaDe9KAnJTNLXn+9ZXB/xTgM1HvnGGlUGk/meemppGZE+
+vKRbTeLeUMG8AXjzPCiZ3YpWHR7nldK9FLbicevsVo9VQEtyxPkDlrjT+XQiwvJe
+HQAIVPFT7dLd4qMG0BYbsCAdDxbJqAbUjbctsXH9ZH4WEdI4JR2ybw3h89WWmuT2
+2GT/mnyCvt7TmZMGjiUHQcRqZixcwk6+tvTl/4HwywAGuXphJrojsEBzkAXAdkta
+JilGq2u5ogwTQJNhjUlWPJ6t03IrtIlPXtNM7k0CAwEAAaNTMFEwHQYDVR0OBBYE
+FH5/3uuZG9/Px6hKXwSauVWtx9JlMB8GA1UdIwQYMBaAFH5/3uuZG9/Px6hKXwSa
+uVWtx9JlMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAAbIcQ6F
+vV2aKUHkDdN5PqPzBT6X99AsL0swUWsCz3fTQJ+4t2k2eadSbJt0Dl99tFTxY+tK
+7OI8UMi2yINa7Pgeysy+cyRvw879/Udj4Uh0AziOKMQqVFuyh+mPyOKmnX/kYjee
+5UgGvdVu+4uWfRNSB+gEEJ6mZJKn9pRL5w6i/bycUhHgkTreZgvULRFRqhCcSmB/
+SF/PHHe06+Ap11LV2YGUhcHOrXF8qpB0aKDVzeiyLaekrNK3pilDDmrskM9dhzI6
+t3MBZyUvP0U9O/bKy7ecry3swfBwinpVLPUqnhpj257rX7DnF9o0SC9YXfxjrhJC
+jf4CCZ6UxeKp+50=
+-----END CERTIFICATE-----

test/testdata/notation/server-cert.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDYzCCAkugAwIBAgIUUco3MMIdnFLOVB+plaXGv9q9/lwwDQYJKoZIhvcNAQEL
+BQAwEjEQMA4GA1UEAwwHVGVzdCBDQTAgFw0yNTAxMzExMjUyMDRaGA8yMTI1MDEw
+NzEyNTIwNFowYzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAU
+BgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk15IENvbXBhbnkxEjAQBgNV
+BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI+Z
+3Px82+2zhaWXKRnOfbAb2d+hfbh5z0rOu7w3DnKel7Oq0cZCy9EPRR5cK1zxY5Tn
+he2A0/wUWVDoG7UE/1uMK7B5IVCmu6rKCkxM0l4h1hb3VXgryv4/xdILI/bvsUY0
+IJxYiKUHj0gzCimzzR3I8G0T+q8QtTpJsNylF9I4035BjncSyogRGI+RJcX6H72o
+6IdTpX10D1WJ4jmk6/yV5onUKq2g2EhUDu3l7dgoBOHPwJJdVrYy2ugPMpS7AUfJ
+ferbrvgRVK5va1ejHGhI3IlMO5ZmtMv/ejlgKb5Vf4mIoD/y+gr7jJZ2fd0PDqe4
+38d5vfKJAoNsjtHfF5kCAwEAAaNeMFwwGgYDVR0RBBMwEYcEfwAAAYIJbG9jYWxo
+b3N0MB0GA1UdDgQWBBS3e7Sp9jERzoju/A6OEFDqqoxq9DAfBgNVHSMEGDAWgBR+
+f97rmRvfz8eoSl8EmrlVrcfSZTANBgkqhkiG9w0BAQsFAAOCAQEAHLTmLYWL28FK
+GIZbM7l5m20zIbGBDEYHKh0GOYw++O6Bwx0+PWqICOK5anEr55pvQcccH6oQo22/
+2U6wjllWY4X11ZhYS/fXT5Cg0yGBHfdR7R4d2f/4kLcFJpJcwqysItWWh5AIEyyA
+6PRWf7MkN1/IvraNDjRt4TFN75d4Z7EM5wFySji3cPBN+1HSMwpwgvkEEGXVN33q
+89mvO4WvR25Y+yh7EGmlqoo5WVD5SrXaVSLcadpW4aSymBMFoFFAzQABTFccV5Kl
++2u2bstOdL4jMcaPPddtel42l6kKmtVfBya2wo3nHkVUo3J0nve0WbQyXqw0+2vA
+ti55o8aing==
+-----END CERTIFICATE-----

test/testdata/notation/server-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCPmdz8fNvts4Wl
+lykZzn2wG9nfoX24ec9Kzru8Nw5ynpezqtHGQsvRD0UeXCtc8WOU54XtgNP8FFlQ
+6Bu1BP9bjCuweSFQpruqygpMTNJeIdYW91V4K8r+P8XSCyP277FGNCCcWIilB49I
+Mwops80dyPBtE/qvELU6SbDcpRfSONN+QY53EsqIERiPkSXF+h+9qOiHU6V9dA9V
+ieI5pOv8leaJ1CqtoNhIVA7t5e3YKAThz8CSXVa2MtroDzKUuwFHyX3q2674EVSu
+b2tXoxxoSNyJTDuWZrTL/3o5YCm+VX+JiKA/8voK+4yWdn3dDw6nuN/Heb3yiQKD
+bI7R3xeZAgMBAAECggEABS9mrnBEvGBygjWYgep17oq8PdS14S12zx+dYZuxqBuy
+ucWrKvKaVkYWoRTDamj7R0hqioD6cTxRMvhv7a6h7i3myEnAv/SGoLwIY1O/zISC
+F5Sz5PGx3qcyBFZWJLJoJIiOfTlo1QqrlrgPFSKSqhFpdbWBDwVhAds2KWrFrC0c
+GBho0YorV4I2ZLnHc+/pf/RRSZnlVMxWExMoFjitfOvc8XvzZL2ANaYotY3LFjkh
+U7ohtHKcIk4fTMxkfJ16XRVInN1971miArOG7zFTo/2DjrxV40R9wJA7NDyoWh5l
+wihgzzrmfXoW5htNi6fmqy23cuPiwn9HpkvvcAIyDQKBgQDF38AaXfKWNI88mxRu
+SbQt3FoO9239PsaXX+p2gq0M6AAfgtC1Ygj6Sbs5eDdbp5K++8ycgSQ7IV7H0F4U
+pBtthItaa6G/1qNc7JWzaLrEOJSJ30WPMDvmJcEPUOPqfmDmgIbPtt1DgHKmHx8l
+YM/WEJ34hDhtQic/5msiuciTjQKBgQC5yL/v4U5WkGgvmm0jMRWaoQYEq/oljQb3
+MsPHaS0Jl/fifFZv0g4PSmHylRAgJdTsO3qyV9AVLky6vqgUgBerNpL+eWHbNNcy
+hrLgRRAnprH2/YRSF+TLWA7lwB84ZUJ98rK4X1vKR4IktjnuX7Fu+naU3yuJY2FS
+FE91RwhrPQKBgQCacd+OdP/Qz6txYZYb0zlohlJg1i2qeeIl6v6li6+ooDjgX4mp
+2aAqQ3x4CeYjivNWUFFPYtk1sgE5suCL+d9Spx7h75qrksulzx+1jiwg1gzSZEv1
+zG8kXxmGa9vJfuUBZRZUcGXZtxtFoIr98MeoTQYQIJuuY/EgxiefTiVJTQKBgQCR
+/UFuU8MGXOWx+oymaczLPJuJEkc4ONDvcXHNAkYE0ulUjVYy+oJX26CKSj5otLHT
+jI3HFSALdN2QpX9Y1KtEvFbYJzQRWD1+k8B+YWbncaNJLkBLbkE41RKn0cf2vgN5
+Cz0LisuLcZPAG338Zi/8wE5sf84rYO+52wHxa4cfFQKBgA5TholENqf/I8P4waRX
+ZbrR0E5RkghOeNsD1xfreHMEWzUDvFIMIF60SaaT6BLhzkPLxHwQ/YEelvI9HPOP
+XYOR933QfcON/DEO6qX4jHksVzRKXEQ5FzXxx8X+YvEyfyr9otvKXVJ7T5ViNv1t
+dYb3wOpc8wVwz/eBQ+t6tyMf
+-----END PRIVATE KEY-----

test/testdata/notation/sse-secure-systems/testimage/blobs/sha256:929a0a249c4614eb8bef5a914308896e7c8c5422d508eaddfd98dfe61683e556.json

@@ -0,0 +1 @@
+{"payload":"eyJ0YXJnZXRBcnRpZmFjdCI6eyJkaWdlc3QiOiJzaGEyNTY6YTEzNmNjNGU3ODU3OThlNWU4NDgzMDQ3Y2Y2MjFjZjBhMDMwMGE5M2Q0NzcwM2EzZjA2NmMzNDBjMDcwZjVjZiIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuZGlzdHJpYnV0aW9uLm1hbmlmZXN0LnYyK2pzb24iLCJzaXplIjo1MjZ9fQ","protected":"eyJhbGciOiJQUzI1NiIsImNyaXQiOlsiaW8uY25jZi5ub3Rhcnkuc2lnbmluZ1NjaGVtZSJdLCJjdHkiOiJhcHBsaWNhdGlvbi92bmQuY25jZi5ub3RhcnkucGF5bG9hZC52MStqc29uIiwiaW8uY25jZi5ub3Rhcnkuc2lnbmluZ1NjaGVtZSI6Im5vdGFyeS54NTA5IiwiaW8uY25jZi5ub3Rhcnkuc2lnbmluZ1RpbWUiOiIyMDI1LTAxLTI0VDEzOjQzOjQ2KzAxOjAwIn0","header":{"x5c":["MIIDrjCCApagAwIBAgIUfA/t/J6eINSu566aAozkOjQKey4wDQYJKoZIhvcNAQELBQAwbDELMAkGA1UEBhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVybGluMQwwCgYDVQQKDANTU0UxEjAQBgNVBAsMCURlZmVuc2l2ZTEZMBcGA1UEAwwQc2VjdXJlc3lzdGVtcy5kZTAgFw0yNTAxMjQxMjQzMTRaGA8yMTI0MTIzMTEyNDMxNFowbDELMAkGA1UEBhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVybGluMQwwCgYDVQQKDANTU0UxEjAQBgNVBAsMCURlZmVuc2l2ZTEZMBcGA1UEAwwQc2VjdXJlc3lzdGVtcy5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJSmGE+Knp0Qc2RqIkMys8e7X1F8zVbpVMmRxvkuZIrWb84Xb+XVeQgE1o5JQgPL7PSgG6EHL/XjY1wKO2bwlC4AxLm3Cvo/r764yUTqGFoeImEsiT/BW8bFKndJYkP8b8iHUkrRX7ZYkhjby91zwFzeewDb9dZPkqiV7npATOL/T5KSUVQ6uIIozX5GCj+bB/iqZWB0bP33uqPEu+GUyYZudJlYe/Yv9aw8vioVXdoEHH10DtTosfXlub/Xd8bC8a7qOBITpWJRrjWRwjaWgnKUlJxymhqU5Iudi57VgtkzD2AgRGLZEN27x67o5p0XaN2O2cFDCCY/7DMlW965++sCAwEAAaNGMEQwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMB0GA1UdDgQWBBSiqJeF6lNSF21K51ePceEtsIBPajANBgkqhkiG9w0BAQsFAAOCAQEAhaKvo0ofGKIoMNaCqv4qYCBsnXTLWqeRMzrxY3WPRmGkiLoKivXP2ZL4R2igERW8IbXSDqC9u1to7ahwLiiM9Ikjik8I/x3EYJz3DAkzeTDqS227EhSOOGo1G6f0ph/GPO4o71s8ek55Q92ZNrAqHwzGwsByGFbHcwABwtAA1gqAB5luiuokUXhmlqkH46wbQLiVLYnetqIQ8uJiSnUFrWaKQSICnCY1kxptqepvVfgbd7LIriH+m57IWD2fil6qRXV7c0J6v+N5N7gf2TgDvRBxYRhHV+fQpxRWm+TifyEquTrEhfXY4yfYWnpJ/EbjsHheqK+F4EacAqBTjhzW+g=="],"io.cncf.notary.signingAgent":"notation-go/1.3.0"},"signature":"dLXafWiA46vucnM0X9RHCLnbriZDgqqJpdlhkHbvvlj3-D5fJetH0XNyt3Z6uqmpivGZXfwopWracRuMTwkblv0hpmXZs2IE6YVFcxFOy09Ep-faJTuT6PQ1O3Ut2IGh1iQFHu9tdAoIX7OcjWcV-UckEospDhLe8NdNJZSKosAijUEaNcr3schNRfg7lNrxkMAS8AcFIbG9UCklOwQEh45c-1aczzerLXos8LuLOT3oy_OXu4GMY7YgrMaXmW9SQioztkTOz5nccxeiw-BIv0Pxqi0A9ETzUn2gGpWbcnX93kNlXaikt2UlM7BzR-tDpcLTd6bvb7TDG0ibrt2-ew"}

test/testdata/notation/sse-secure-systems/testimage/manifests/notation-sign.json

@@ -0,0 +1,16 @@
+{
+   "schemaVersion": 2,
+   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+   "config": {
+      "mediaType": "application/vnd.docker.container.image.v1+json",
+      "size": 610,
+      "digest": "sha256:d84e5e596967d4b989ccf0588d9eb49b3319d0a04f9b2c0369e8642adaa3974d"
+   },
+   "layers": [
+      {
+         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+         "size": 423313,
+         "digest": "sha256:5cefa3df37669b41bf4e298d94bc9b65b8884f13c354835b893a71d25d5d038b"
+      }
+   ]
+}

test/testdata/notation/sse-secure-systems/testimage/manifests/sha256-a136cc4e785798e5e8483047cf621cf0a0300a93d47703a3f066c340c070f5cf.json

@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:d397b30282982b80818b2705f8d542d35158bc59d8bf42549f3e898f23d55a77","size":738,"annotations":{"io.cncf.notary.x509chain.thumbprint#S256":"[\"3f10778c58c7be26c886b7f801b0179f4059a4d066cd61f9f20df59daee906ff\"]","org.opencontainers.image.created":"2025-01-24T12:43:46Z"},"artifactType":"application/vnd.cncf.notary.signature"}]}

test/testdata/notation/sse-secure-systems/testimage/manifests/sha256:a136cc4e785798e5e8483047cf621cf0a0300a93d47703a3f066c340c070f5cf.json

@@ -0,0 +1,16 @@
+{
+   "schemaVersion": 2,
+   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+   "config": {
+      "mediaType": "application/vnd.docker.container.image.v1+json",
+      "size": 610,
+      "digest": "sha256:d84e5e596967d4b989ccf0588d9eb49b3319d0a04f9b2c0369e8642adaa3974d"
+   },
+   "layers": [
+      {
+         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+         "size": 423313,
+         "digest": "sha256:5cefa3df37669b41bf4e298d94bc9b65b8884f13c354835b893a71d25d5d038b"
+      }
+   ]
+}

test/testdata/notation/sse-secure-systems/testimage/manifests/sha256:d397b30282982b80818b2705f8d542d35158bc59d8bf42549f3e898f23d55a77.json

@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.cncf.notary.signature","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2},"layers":[{"mediaType":"application/jose+json","digest":"sha256:929a0a249c4614eb8bef5a914308896e7c8c5422d508eaddfd98dfe61683e556","size":2243}],"subject":{"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"sha256:a136cc4e785798e5e8483047cf621cf0a0300a93d47703a3f066c340c070f5cf","size":526},"annotations":{"io.cncf.notary.x509chain.thumbprint#S256":"[\"3f10778c58c7be26c886b7f801b0179f4059a4d066cd61f9f20df59daee906ff\"]","org.opencontainers.image.created":"2025-01-24T12:43:46Z"}}