cli: Adjust paths when signing and verifying in model_path '.'

All paths have to be adjusted when signing or verifying when the model_path
is '.'. This is the case when signing while the current working directory
is the model's directory. Do the adjustments inside the library.

Extend test case with signing while in model directory.

Resolves: #451
Signed-off-by: Stefan Berger <[email protected]>

Author: stefanberger

scripts/tests/test-sign-verify

@@ -84,3 +84,76 @@ if [ "${res}" != "${exp}" ]; then
 	echo "Actual  : ${res}"
 	exit 1
 fi
+
+# Enter the model directory and sign and verify there
+pushd "${TMPDIR}" &>/dev/null || exit 1
+
+echo
+echo "Testing 'sign key' when in model directory"
+
+if ! python -m model_signing \
+	sign key \
+	--signature "$(basename "${sigfile}")" \
+	--private_key "${DIR}/keys/certificate/signing-key.pem" \
+	--ignore-paths "$(basename "${ignorefile}")" \
+	. ; then
+	echo "Error: 'sign key' failed"
+	exit 1
+fi
+
+if ! python -m model_signing \
+	verify key \
+	--signature "$(basename "${sigfile}")" \
+	--public_key "${DIR}/keys/certificate/signing-key-pub.pem" \
+	--ignore-paths "$(basename "${ignorefile}")" \
+	. ; then
+	echo "Error: 'verify key' failed"
+	exit 1
+fi
+
+# Check which files are part of signature
+res=$(get_signed_files "${sigfile}")
+exp='["signme-1","signme-2"]'
+if [ "${res}" != "${exp}" ]; then
+	echo "Error: Unexpected files were signed"
+	echo "Expected: ${exp}"
+	echo "Actual  : ${res}"
+	exit 1
+fi
+
+echo
+echo "Testing 'sign/verify' certificate when in model directory"
+
+if ! python -m model_signing \
+	sign certificate \
+	--signature "$(basename "${sigfile}")" \
+	--private_key "${DIR}/keys/certificate/signing-key.pem" \
+	--signing_certificate "${DIR}/keys/certificate/signing-key-cert.pem" \
+	--certificate_chain "${DIR}/keys/certificate/int-ca-cert.pem" \
+	--ignore-paths "$(basename "${ignorefile}")" \
+	. ; then
+	echo "Error: 'sign key' failed"
+	exit 1
+fi
+
+if ! python -m model_signing \
+	verify certificate \
+	--signature "$(basename "${sigfile}")" \
+	--certificate_chain "${DIR}/keys/certificate/ca-cert.pem" \
+	--ignore-paths "$(basename "${ignorefile}")" \
+	. ; then
+	echo "Error: 'sign key' failed"
+	exit 1
+fi
+
+# Check which files are part of signature
+res=$(get_signed_files "${sigfile}")
+exp='["signme-1","signme-2"]'
+if [ "${res}" != "${exp}" ]; then
+	echo "Error: Unexpected files were signed"
+	echo "Expected: ${exp}"
+	echo "Actual  : ${res}"
+	exit 1
+fi
+
+popd || exit 1

scripts/tests/test-verify-v1.0.0-sigstore

@@ -11,4 +11,20 @@ if ! python -m model_signing \
 	exit 1
 fi
 
-exit 0
+pushd v1.0.0-sigstore 1>/dev/null || exit 1
+
+echo
+echo "Testing 'verify sigstore' while in model directory"
+if ! python -m model_signing \
+	verify sigstore \
+	--identity [email protected] \
+	--identity_provider https://sigstore.verify.ibm.com/oauth2 \
+	--signature model.sig \
+	. ; then
+	echo "Error: 'verify sigstore' failed on v1.0.0"
+	exit 1
+fi
+
+popd 1>/dev/null || exit 1
+
+exit 0

src/model_signing/hashing.py

@@ -142,6 +142,9 @@ def __init__(self):
 
     def hash(self, model_path: PathLike) -> manifest.Manifest:
         """Hashes a model using the current configuration."""
+        if os.path.basename(model_path) == ".":
+            model_path = pathlib.Path(os.getcwd())
+
         ignored_paths = [path for path in self._ignored_paths]
         if self._ignore_git_paths:
             ignored_paths.extend(
@@ -327,6 +330,13 @@ def set_ignored_paths(
         Returns:
             The new hashing configuration with a new set of ignored paths.
         """
-        self._ignored_paths = frozenset({pathlib.Path(p) for p in paths})
+        paths = [
+            p
+            if os.path.dirname(p) != ""
+            else pathlib.Path(os.path.join(os.getcwd(), os.path.basename(p)))
+            for p in paths
+        ]
+        self._ignored_paths = frozenset(paths)
+
         self._ignore_git_paths = ignore_git_paths
         return self