Add API and CLI option for offline (no TUF refresh) verification #104
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Facundo Tuesca <[email protected]>
Signed-off-by: Facundo Tuesca <[email protected]>
facutuesca
force-pushed
the
ft/offline-verification
branch
3 times, most recently
from
2c4bd15 to
96885e5
Compare
Signed-off-by: Facundo Tuesca <[email protected]>
facutuesca
force-pushed
the
ft/offline-verification
branch
from
96885e5 to
85754c2
Compare
Signed-off-by: Facundo Tuesca <[email protected]>
facutuesca
force-pushed
the
ft/offline-verification
branch
from
85754c2 to
d1a8415
Compare
Signed-off-by: Facundo Tuesca <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Attestation.verify(...)API has been changed to accept anofflineparameter that, when True, disables TUF refreshes.verifycommands now also accept an--offlineflag that disables TUF refreshes. Additionally, when used with theverify pypisubcommand, the--offlineflag enforces that the distribution and provenance file arguments must be local file paths.Testing
Tests now set
offline=Truewhen possible. In order to make sure that offline tests (those not marked with theonlinepytest marker) work offline, a new GitHub CI job was added that runs the tests under an environment with no network access (usingfirejail).Also, a new
test-nocoveragemake target was added to use in the CI job above, since when running the offline tests we don't want to fail when coverage < 100%.cc @woodruffw @mgorny
(should be merged after #103)
Fixes #102