Generalize keyPath/keyData exclusivity checks

... to make it a bit easier to add one more variant. Should not change behavior (apart from error messages). Signed-off-by: Miloslav Trmač <[email protected]>
containers · Jul 13, 2022 · a7ef900 · a7ef900
1 parent e37f4db
commit a7ef900
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 12 deletions.
diff --git a/signature/policy_config.go b/signature/policy_config.go
@@ -320,8 +320,15 @@ func newPRSignedBy(keyType sbKeyType, keyPath string, keyData []byte, signedIden
  if !keyType.IsValid() {
  return nil, InvalidPolicyFormatError(fmt.Sprintf("invalid keyType \"%s\"", keyType))
  }
- if len(keyPath) > 0 && len(keyData) > 0 {
- return nil, InvalidPolicyFormatError("keyType and keyData cannot be used simultaneously")
+ keySources := 0
+ if keyPath != "" {
+ keySources++
+ }
+ if keyData != nil {
+ keySources++
+ }
+ if keySources != 1 {
+ return nil, InvalidPolicyFormatError("exactly one of keyPath and keyData must be specified")
  }
  if signedIdentity == nil {
  return nil, InvalidPolicyFormatError("signedIdentity not specified")
@@ -401,16 +408,14 @@ func (pr *prSignedBy) UnmarshalJSON(data []byte) error {
  var res *prSignedBy
  var err error
  switch {
- case gotKeyPath && gotKeyData:
- return InvalidPolicyFormatError("keyPath and keyData cannot be used simultaneously")
  case gotKeyPath && !gotKeyData:
  res, err = newPRSignedByKeyPath(tmp.KeyType, tmp.KeyPath, tmp.SignedIdentity)
  case !gotKeyPath && gotKeyData:
  res, err = newPRSignedByKeyData(tmp.KeyType, tmp.KeyData, tmp.SignedIdentity)
  case !gotKeyPath && !gotKeyData:
  return InvalidPolicyFormatError("At least one of keyPath and keyData must be specified")
- default: // Coverage: This should never happen
- return fmt.Errorf("Impossible keyPath/keyData presence combination!?")
+ default:
+ return fmt.Errorf("Exactly one of keyPath and keyData must be specified, more than one present")
  }
  if err != nil {
  return err

diff --git a/signature/policy_eval_signedby.go b/signature/policy_eval_signedby.go
@@ -25,20 +25,24 @@ func (pr *prSignedBy) isSignatureAuthorAccepted(ctx context.Context, image priva
  return sarRejected, nil, fmt.Errorf(`Unknown "keyType" value "%s"`, string(pr.KeyType))
  }
 
- if pr.KeyPath != "" && pr.KeyData != nil {
- return sarRejected, nil, errors.New(`Internal inconsistency: both "keyPath" and "keyData" specified`)
- }
  // FIXME: move this to per-context initialization
  var data []byte
- if pr.KeyData != nil {
-  data = pr.KeyData
- } else {
+ keySources := 0
+ if pr.KeyPath != "" {
+  keySources++
  d, err := os.ReadFile(pr.KeyPath)
  if err != nil {
  return sarRejected, nil, err
  }
  data = d
  }
+ if pr.KeyData != nil {
+ keySources++
+ data = pr.KeyData
+ }
+ if keySources != 1 {
+ return sarRejected, nil, errors.New(`Internal inconsistency: not exactly one of "keyPath" and "keyData" specified`)
+ }
 
  // FIXME: move this to per-context initialization
  mech, trustedIdentities, err := NewEphemeralGPGSigningMechanism(data)