Skip to content

Commit 434bf61

Browse files
stefanbergerstefanberger
committed
cli: Adjust model name when signing and verifying in model_path '.'
When signing or verifying in model_path '.' then the model_path.name becomes an empty string and cannot be used for the name of the model in the Manifest. In this case, derive the name of the model from the model paths' absolute path and use the last directory's name. Use the same method for the model_path '..'. Extend a test case with signing while in the model directory and add a test case when signing while in a sub-directory of the model directory while using '.. for the model path. Resolves: #451 Signed-off-by: Stefan Berger <[email protected]>
1 parent de2f935 commit 434bf61

File tree

3 files changed

+136
-2
lines changed

3 files changed

+136
-2
lines changed

‎scripts/tests/test-sign-verify‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,3 +84,117 @@ if [ "${res}" != "${exp}" ]; then
8484
echo "Actual : ${res}"
8585
exit 1
8686
fi
87+
88+
# Enter the model directory and sign and verify there
89+
pushd "${TMPDIR}" &>/dev/null || exit 1
90+
91+
echo
92+
echo "Testing 'sign key' when in model directory"
93+
94+
if ! python -m model_signing \
95+
sign key \
96+
--signature "$(basename "${sigfile}")" \
97+
--private_key "${DIR}/keys/certificate/signing-key.pem" \
98+
--ignore-paths "$(basename "${ignorefile}")" \
99+
. ; then
100+
echo "Error: 'sign key' failed"
101+
exit 1
102+
fi
103+
104+
if ! python -m model_signing \
105+
verify key \
106+
--signature "$(basename "${sigfile}")" \
107+
--public_key "${DIR}/keys/certificate/signing-key-pub.pem" \
108+
--ignore-paths "$(basename "${ignorefile}")" \
109+
. ; then
110+
echo "Error: 'verify key' failed"
111+
exit 1
112+
fi
113+
114+
# Check which files are part of signature
115+
res=$(get_signed_files "${sigfile}")
116+
exp='["signme-1","signme-2"]'
117+
if [ "${res}" != "${exp}" ]; then
118+
echo "Error: Unexpected files were signed"
119+
echo "Expected: ${exp}"
120+
echo "Actual : ${res}"
121+
exit 1
122+
fi
123+
124+
echo
125+
echo "Testing 'sign/verify' certificate when in model directory"
126+
127+
if ! python -m model_signing \
128+
sign certificate \
129+
--signature "$(basename "${sigfile}")" \
130+
--private_key "${DIR}/keys/certificate/signing-key.pem" \
131+
--signing_certificate "${DIR}/keys/certificate/signing-key-cert.pem" \
132+
--certificate_chain "${DIR}/keys/certificate/int-ca-cert.pem" \
133+
--ignore-paths "$(basename "${ignorefile}")" \
134+
. ; then
135+
echo "Error: 'sign key' failed"
136+
exit 1
137+
fi
138+
139+
if ! python -m model_signing \
140+
verify certificate \
141+
--signature "$(basename "${sigfile}")" \
142+
--certificate_chain "${DIR}/keys/certificate/ca-cert.pem" \
143+
--ignore-paths "$(basename "${ignorefile}")" \
144+
. ; then
145+
echo "Error: 'sign key' failed"
146+
exit 1
147+
fi
148+
149+
# Check which files are part of signature
150+
res=$(get_signed_files "${sigfile}")
151+
exp='["signme-1","signme-2"]'
152+
if [ "${res}" != "${exp}" ]; then
153+
echo "Error: Unexpected files were signed"
154+
echo "Expected: ${exp}"
155+
echo "Actual : ${res}"
156+
exit 1
157+
fi
158+
159+
echo
160+
echo "Testing 'sign/verify' certificate when in subdir of model directory and using '..'"
161+
162+
rm -f "$(basename "${sigfile}")"
163+
mkdir subdir
164+
pushd subdir 1>/dev/null || exit 1
165+
166+
if ! python -m model_signing \
167+
sign certificate \
168+
--signature "../$(basename "${sigfile}")" \
169+
--private_key "${DIR}/keys/certificate/signing-key.pem" \
170+
--signing_certificate "${DIR}/keys/certificate/signing-key-cert.pem" \
171+
--certificate_chain "${DIR}/keys/certificate/int-ca-cert.pem" \
172+
--ignore-paths "../$(basename "${ignorefile}")" \
173+
.. ; then
174+
echo "Error: 'sign key' failed"
175+
exit 1
176+
fi
177+
178+
popd 1>/dev/null || exit 1 # exit subdir
179+
180+
if ! python -m model_signing \
181+
verify certificate \
182+
--signature "$(basename "${sigfile}")" \
183+
--certificate_chain "${DIR}/keys/certificate/ca-cert.pem" \
184+
--ignore-paths "$(basename "${ignorefile}")" \
185+
. ; then
186+
echo "Error: 'sign key' failed"
187+
exit 1
188+
fi
189+
190+
# Check which files are part of signature
191+
res=$(get_signed_files "${sigfile}")
192+
exp='["signme-1","signme-2"]'
193+
if [ "${res}" != "${exp}" ]; then
194+
echo "Error: Unexpected files were signed"
195+
echo "Expected: ${exp}"
196+
echo "Actual : ${res}"
197+
exit 1
198+
fi
199+
200+
popd 1>/dev/null || exit 1

‎scripts/tests/test-verify-v1.0.0-sigstore‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,20 @@ if ! python -m model_signing \
1111
exit 1
1212
fi
1313

14-
exit 0
14+
pushd v1.0.0-sigstore 1>/dev/null || exit 1
15+
16+
echo
17+
echo "Testing 'verify sigstore' while in model directory"
18+
if ! python -m model_signing \
19+
verify sigstore \
20+
--identity [email protected] \
21+
--identity_provider https://sigstore.verify.ibm.com/oauth2 \
22+
--signature model.sig \
23+
. ; then
24+
echo "Error: 'verify sigstore' failed on v1.0.0"
25+
exit 1
26+
fi
27+
28+
popd 1>/dev/null || exit 1
29+
30+
exit 0

‎src/model_signing/_serialization/file.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,12 @@ def serialize(
129129
frozenset(list(self._ignore_paths) + rel_ignore_paths),
130130
)
131131

132+
model_name = model_path.name
133+
if not model_name or model_name == "..":
134+
model_name = os.path.basename(model_path.resolve())
135+
132136
return manifest.Manifest(
133-
model_path.name, manifest_items, self._serialization_description
137+
model_name, manifest_items, self._serialization_description
134138
)
135139

136140
def _compute_hash(

0 commit comments

Comments
 (0)