diff --git a/verifier/trustpolicy/blob.go b/verifier/trustpolicy/blob.go index 3d6ea3d4..66af77ce 100644 --- a/verifier/trustpolicy/blob.go +++ b/verifier/trustpolicy/blob.go @@ -16,7 +16,6 @@ package trustpolicy import ( "errors" "fmt" - "reflect" "strings" "github.com/notaryproject/notation-go/dir" @@ -98,7 +97,7 @@ func (policyDoc *BlobDocument) Validate() error { } // verificationLevel is skip - if reflect.DeepEqual(statement.SignatureVerification.VerificationLevel, LevelSkip) { + if statement.SignatureVerification.VerificationLevel == LevelSkip.Name { return errors.New("global blob trust policy statement cannot have verification level set to skip") } foundGlobalPolicy = true diff --git a/verifier/trustpolicy/blob_test.go b/verifier/trustpolicy/blob_test.go index 9ceb9969..d748c01c 100644 --- a/verifier/trustpolicy/blob_test.go +++ b/verifier/trustpolicy/blob_test.go @@ -99,6 +99,32 @@ func TestValidate_BlobDocument_Error(t *testing.T) { t.Fatalf("multiple global blob policy should return error") } + // global policy with verification level skip + policyDoc = dummyBlobPolicyDocument() + policyStatement1 = policyDoc.TrustPolicies[0].clone() + policyStatement1.GlobalPolicy = true + policyStatement1.SignatureVerification = SignatureVerification{VerificationLevel: "skip"} + // validatePolicyCore permits skip only without trust stores or identities, + // so this is the shape that reaches the global policy check. + policyStatement1.TrustStores = nil + policyStatement1.TrustedIdentities = nil + policyDoc.TrustPolicies = []BlobTrustPolicy{*policyStatement1} + err = policyDoc.Validate() + if err == nil || err.Error() != "global blob trust policy statement cannot have verification level set to skip" { + t.Fatalf("global blob policy with skip should return an error, got %v", err) + } + + // a non-global statement may still use skip + policyDoc = dummyBlobPolicyDocument() + policyStatement1 = policyDoc.TrustPolicies[0].clone() + policyStatement1.SignatureVerification = SignatureVerification{VerificationLevel: "skip"} + policyStatement1.TrustStores = nil + policyStatement1.TrustedIdentities = nil + policyDoc.TrustPolicies = []BlobTrustPolicy{*policyStatement1} + if err := policyDoc.Validate(); err != nil { + t.Fatalf("non-global statement with skip should be allowed, got %v", err) + } + // Policy Document with duplicate policy statement names policyDoc = dummyBlobPolicyDocument() policyStatement1 = policyDoc.TrustPolicies[0].clone()