From 165cdd9187fd6dab587d23c46c385f9c450c64d4 Mon Sep 17 00:00:00 2001
From: David Dworken <david@daviddworken.com>
Date: Thu, 9 Nov 2023 20:51:47 -0800
Subject: [PATCH] Update slsa integration to use the shared library for parsing
 version strings

---
 client/lib/slsa.go      | 13 ++++++-------
 client/lib/slsa_test.go | 22 ++++++++++++++++++++++
 2 files changed, 28 insertions(+), 7 deletions(-)
 create mode 100644 client/lib/slsa_test.go

diff --git a/client/lib/slsa.go b/client/lib/slsa.go
index c485e60..768a07d 100644
--- a/client/lib/slsa.go
+++ b/client/lib/slsa.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"strconv"
 	"strings"
 
+	"github.com/ddworken/hishtory/shared"
 	"github.com/slsa-framework/slsa-verifier/options"
 	"github.com/slsa-framework/slsa-verifier/verifiers"
 )
@@ -30,16 +30,15 @@ func verify(ctx context.Context, provenance []byte, artifactHash, source, branch
 }
 
 func checkForDowngrade(currentVersionS, newVersionS string) error {
-	currentVersion, err := strconv.Atoi(strings.TrimPrefix(currentVersionS, "v0."))
+	currentVersion, err := shared.ParseVersionString(currentVersionS)
 	if err != nil {
-		return fmt.Errorf("failed to parse current version %#v", currentVersionS)
+		return fmt.Errorf("failed to parse current version string: %w", err)
 	}
-	newVersion, err := strconv.Atoi(strings.TrimPrefix(newVersionS, "v0."))
+	newVersion, err := shared.ParseVersionString(newVersionS)
 	if err != nil {
-		return fmt.Errorf("failed to parse updated version %#v", newVersionS)
+		return fmt.Errorf("failed to parse new version string: %w", err)
 	}
-	// TODO: migrate this to the version parser struct
-	if currentVersion > newVersion {
+	if currentVersion.GreaterThan(newVersion) {
 		return fmt.Errorf("failed to update because the new version (%#v) is a downgrade compared to the current version (%#v)", newVersionS, currentVersionS)
 	}
 	return nil
diff --git a/client/lib/slsa_test.go b/client/lib/slsa_test.go
new file mode 100644
index 0000000..f70848f
--- /dev/null
+++ b/client/lib/slsa_test.go
@@ -0,0 +1,22 @@
+package lib
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCheckForDowngrade(t *testing.T) {
+	require.NoError(t, checkForDowngrade("v0.100", "v0.100"))
+	require.NoError(t, checkForDowngrade("v0.100", "v0.101"))
+	require.NoError(t, checkForDowngrade("v0.100", "v0.200"))
+	require.NoError(t, checkForDowngrade("v0.100", "v1.0"))
+	require.NoError(t, checkForDowngrade("v0.1", "v1.0"))
+	require.NoError(t, checkForDowngrade("v1.0", "v1.1"))
+	require.Equal(t, "failed to update because the new version (\"v0.99\") is a downgrade compared to the current version (\"v0.100\")",
+		checkForDowngrade("v0.100", "v0.99").Error())
+	require.Equal(t, "failed to update because the new version (\"v0.10\") is a downgrade compared to the current version (\"v0.100\")",
+		checkForDowngrade("v0.100", "v0.10").Error())
+	require.Equal(t, "failed to update because the new version (\"v0.100\") is a downgrade compared to the current version (\"v1.0\")",
+		checkForDowngrade("v1.0", "v0.100").Error())
+}