diff --git a/test/bats/base-test.bats b/test/bats/base-test.bats index 28e708845..e20d9d1fa 100644 --- a/test/bats/base-test.bats +++ b/test/bats/base-test.bats @@ -57,6 +57,79 @@ RATIFY_NAMESPACE=gatekeeper-system assert_failure } +@test "test rendering notation verifier with modified trust policies settings" { + teardown() { + echo "cleaning up" + rm -f notation-file1.crt + rm -f notation-file2.crt + rm -f notation-file3.crt + } + + touch notation-file1.crt + echo "fake cert 1" > notation-file1.crt + touch notation-file2.crt + echo "fake cert 2" > notation-file2.crt + touch notation-file2.crt + echo "fake cert 3" > notation-file3.crt + + # Capture Helm template output + rendered=$(helm template multiple-trust-policies ./charts/ratify \ + --set featureFlags.RATIFY_CERT_ROTATION=true \ + --set-file notationCerts[0]="notation-file1.crt" \ + --set-file notationCerts[1]="notation-file2.crt" \ + --set-file notationCerts[2]="notation-file3.crt" \ + --set notation.trustPolicies[0].registryScopes[0]="registry1.azurecr.io/" \ + --set notation.trustPolicies[0].trustedIdentities[0]="cert identity 1" \ + --set notation.trustPolicies[0].trustStores[0]=ca:notationCerts[0] \ + --set notation.trustPolicies[0].trustStores[1]=tsa:notationCerts[1] \ + --set notation.trustPolicies[0].trustStores[2]=signingAuthority:notationCerts[2] \ + --set notation.trustPolicies[1].registryScopes[0]="registry2.azurecr.io/" \ + --set notation.trustPolicies[1].trustedIdentities[0]="cert identity 2" \ + --set notation.trustPolicies[1].trustStores[0]=ca:notationCerts[1]) + + # the expected partial output + expected_verifier_notation=$(cat <