chore: address review comments, add key length check, updates ut's

Signed-off-by: Chiman Jain <chimanjain15@gmail.com>

Author: chimanjain

cmd/testdata/ComplexYAML/config.yaml

@@ -10,7 +10,7 @@ updaters:
     - alpine
 auth:
   psk:
-    key: 'c2VjcmV0'
+    key: 'c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U='
     iss:
       - quay
       - clairctl

cmd/testdata/ComplexYAML/want.json

@@ -10,7 +10,7 @@
   },
   "auth": {
     "psk": {
-      "key": "c2VjcmV0",
+      "key": "c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U=",
       "iss": [
         "quay",
         "clairctl"

cmd/testdata/SimpleYAML/config.yaml

@@ -10,7 +10,7 @@ updaters:
     - alpine
 auth:
   psk:
-    key: 'c2VjcmV0'
+    key: 'c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U='
     iss:
       - quay
       - clairctl

cmd/testdata/SimpleYAML/want.json

@@ -12,7 +12,7 @@
   },
   "auth": {
     "psk": {
-      "key": "c2VjcmV0",
+      "key": "c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U=",
       "iss": [
         "quay",
         "clairctl"

config/auth.go

@@ -86,6 +86,11 @@ func (a *AuthPSK) validate(_ Mode) ([]Warning, error) {
 			msg: "key is empty",
 		}
 	}
+	if len(a.Key) < 32 {
+		return nil, &Warning{
+			msg:  "key is too short: must be at least 32 bytes",
+		}
+	}
 	if len(a.Issuer) == 0 {
 		return nil, &Warning{
 			path: ".iss",

config/config_test.go

@@ -39,6 +39,17 @@ func TestValidateFailure(t *testing.T) {
 		}
 	}
 
+	expectError := func(want string) func(*testing.T, *config.Config, error) {
+		return func(t *testing.T, _ *config.Config, err error) {
+			if err == nil {
+				t.Fatal("unexpected success")
+			}
+			if got := err.Error(); got != want {
+				t.Errorf("got error %q, want %q", got, want)
+			}
+		}
+	}
+
 	// Tests on the base Config struct.
 	tt := []ValidateTestcase{
 		{
@@ -90,19 +101,32 @@ func TestValidateFailure(t *testing.T) {
 						PSK: &config.AuthPSK{},
 					},
 				},
-				Check: shouldFail,
+				Check: expectError("key is empty (at )"),
+			},
+			{
+				Name: "BadPSKKeyLen",
+				Conf: config.Config{
+					Mode: config.IndexerMode,
+					Auth: config.Auth{
+						PSK: &config.AuthPSK{
+							Key:    config.Base64([]byte{0xde, 0xad, 0xbe, 0xef}),
+							Issuer: []string{"iss"},
+						},
+					},
+				},
+				Check: expectError("key is too short: must be at least 32 bytes (at )"),
 			},
 			{
 				Name: "BadPSKIssuer",
 				Conf: config.Config{
 					Mode: config.IndexerMode,
 					Auth: config.Auth{
 						PSK: &config.AuthPSK{
-							Key: config.Base64([]byte{0xde, 0xad, 0xbe, 0xef}),
+							Key: config.Base64([]byte("deadbeefdeadbeefdeadbeefdeadbeef")),
 						},
 					},
 				},
-				Check: shouldFail,
+				Check: expectError("no issuers defined (at .iss)"),
 			},
 		}
 		for _, tc := range tt {

docker-compose.yaml

@@ -172,7 +172,7 @@ services:
       - ./notifier/webhook/cmd/webhookd
       - -D
       - -key
-      - c2VjcmV0
+      - c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U=
   rabbitmq:
     # This provides STOMP and AMQP on the usual ports.
     # The web UI is available on /rabbitmq

local-dev/clair/config.yaml

@@ -11,7 +11,7 @@ updaters:
     - osv
 auth:
   psk:
-    key: 'c2VjcmV0'
+    key: 'c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U='
     iss:
       - quay
       - clairctl

local-dev/quay/config.yaml

@@ -49,7 +49,7 @@ REPO_MIRROR_SERVER_HOSTNAME: null
 REPO_MIRROR_TLS_VERIFY: true
 SECURITY_SCANNER_V4_ENDPOINT: http://clair-traefik:6060
 SECURITY_SCANNER_ISSUER_NAME: quay
-SECURITY_SCANNER_V4_PSK: 'c2VjcmV0'
+SECURITY_SCANNER_V4_PSK: 'c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2VjcmV0c2U='
 SERVER_HOSTNAME: clair-quay:8080
 SETUP_COMPLETE: true
 SIGNING_ENGINE: gpg2