fix: Address CoPilot feedback

- Centralize host-specific `dmverity-vhd resolution` in
  `rootfs_proxy.py`
- Updated `get_image_layers()` to use the resolver
- Added Darwin `arm64`, `x86_64`/`amd64`, and unsupported arch coverage
- Bumped extension version to 2.2.0
- Clarified Docker requirements for image workflows

Author: ashort96

src/confcom/HISTORY.rst

@@ -3,6 +3,10 @@
 Release History
 ===============
 
+2.4.0
++++++
+* Add MacOS support for Linux-container policy generation
+
 2.3.0
 +++++
 * Add an option to include the kube-proxy image-attached fragment in Linux VN2 policies
@@ -25,7 +29,6 @@ Release History
 +++++
 
 * Added de-duping of exec_processes in the generated policies so same command used in two probes results in one exec_processes entry
-* Add MacOS support for Linux-container policy generation
 
 2.1.0
 +++++

src/confcom/README.md

@@ -24,7 +24,8 @@
     - Ubuntu 18.04 or later comes with python 3.6+ by default
 - **64-bit** MacOS on Apple Silicon or Intel
 - Container runtime: Docker
-  - Docker must be running when generating Linux policies.
+  - Docker must be running when generating Linux policies from container images.
+  - Docker is not required when all image layers are supplied with `--tar`.
   - Windows: [Docker Desktop](https://www.docker.com/products/docker-desktop) and [WSL2](https://docs.microsoft.com/en-us/windows/wsl/install)
 - **CimWriter.dll** (Windows only, for Windows container support)
   - Required for generating security policies for Windows containers
@@ -61,7 +62,7 @@ The `confcom` extension does not currently support:
 
 The `--platform` parameter controls whether policies are generated for Linux (`linux/amd64`, the default) or Windows (`windows/amd64`) containers. On macOS, only Linux-container policies are supported.
 
-Docker must be running when generating Linux policies.
+Docker must be running when generating Linux policies from container images. It is not required when all image layers are supplied with `--tar`.
 
 Windows policies require Docker in Windows-container mode:
 

src/confcom/azext_confcom/_help.py

@@ -107,7 +107,7 @@
 
         - name: --platform
           type: string
-          short-summary: 'Target platform for policy generation (linux/amd64 or windows/amd64). Defaults to linux/amd64. Docker must be running for Linux policies; Docker in Windows-container mode is required for Windows policies.'
+          short-summary: 'Target platform for policy generation (linux/amd64 or windows/amd64). Defaults to linux/amd64. Docker must be running for Linux image workflows; it is not required when all image layers are supplied with --tar. Docker in Windows-container mode is required for Windows policies.'
 
         - name: --allow-kubeproxy
           type: boolean

src/confcom/azext_confcom/_params.py

@@ -121,7 +121,8 @@ def load_arguments(self, _):
             required=False,
             default="linux/amd64",
             help="Target platform for policy generation. Defaults to linux/amd64. "
-                 "Docker must be running for Linux policies; Docker in "
+                 "Docker must be running for Linux image workflows; it is not "
+                 "required when all image layers are supplied with --tar. Docker in "
                  "Windows-container mode is required for Windows policies.",
             choices=["linux/amd64", "windows/amd64"],
         )

src/confcom/azext_confcom/lib/images.py

@@ -7,8 +7,8 @@
 import logging
 import subprocess
 import docker
+from azext_confcom.rootfs_proxy import get_dmverity_vhd_path
 
-from pathlib import Path
 
 logger = logging.getLogger(__name__)
 
@@ -57,8 +57,7 @@ def get_image_platform(image_reference: str) -> str:
 
 def get_image_layers(image: str, platform: str = "linux/amd64") -> list[str]:
 
-    binary_path = Path(__file__).parent.parent / "bin" / "dmverity-vhd"
-
+    binary_path = get_dmverity_vhd_path()
     get_image(image)
 
     arg_list = [binary_path.as_posix(), "-d", "roothash", "-i", image]

src/confcom/azext_confcom/rootfs_proxy.py

@@ -11,6 +11,7 @@
 import stat
 import subprocess
 import sys
+from pathlib import Path
 from typing import List, Dict
 
 import requests
@@ -48,12 +49,12 @@
         "url": "https://github.com/microsoft/integrity-vhd/releases/download/v2.3/dmverity-vhd.exe",
         "sha256": "c3652fb1a4ce1155c388e0e2f7db6b2b985e0ad6da7db062ce82a00bb2b6b6f8",
     },
-    "Darwin-arm64": {
+    {
         "path": _binaries_dir / "dmverity-vhd-darwin-arm64",
         "url": "https://github.com/microsoft/integrity-vhd/releases/download/v2.3/dmverity-vhd-darwin-arm64",
         "sha256": "e7174315c8df15ceb59120d720b63cb62f7cbd1ec6cb3b13436370da72c792be",
     },
-    "Darwin-amd64": {
+    {
         "path": _binaries_dir / "dmverity-vhd-darwin-amd64",
         "url": "https://github.com/microsoft/integrity-vhd/releases/download/v2.3/dmverity-vhd-darwin-amd64",
         "sha256": "4cb5a2970030b120370afd03b25b12605343fd098c4ce539f9f117a17fc2112d",
@@ -71,6 +72,30 @@
 ]
 
 
+def get_dmverity_vhd_path() -> Path:
+    """Return the host-specific dmverity-vhd binary path."""
+    binary_name = "dmverity-vhd"
+
+    if host_os == "Windows":
+        if machine.endswith("64"):
+            binary_name += ".exe"
+        else:
+            eprint("32-bit Windows is not supported.")
+    elif host_os == "Darwin":
+        if machine == "arm64":
+            binary_name += "-darwin-arm64"
+        elif machine in ("x86_64", "amd64"):
+            binary_name += "-darwin-amd64"
+        else:
+            eprint(f"Unsupported MacOS architecture: {machine}.")
+    elif host_os != "Linux":
+        eprint(
+            "Unknown target platform. The extension only works with Windows, Linux, and Darwin"
+        )
+
+    return Path(__file__).parent / "bin" / binary_name
+
+
 class SecurityPolicyProxy:  # pylint: disable=too-few-public-methods
     # static variable to cache layer hashes between container groups
     layer_cache = {}
@@ -88,31 +113,7 @@ def download_binaries():
                 f.write(dmverity_vhd_fetch_resp.content)
 
     def __init__(self):
-        script_directory = os.path.dirname(os.path.realpath(__file__))
-        DEFAULT_LIB = "./bin/dmverity-vhd"
-
-        if host_os == "Linux":
-            pass
-        elif host_os == "Windows":
-            if machine.endswith("64"):
-                DEFAULT_LIB += ".exe"
-            else:
-                eprint(
-                    "32-bit Windows is not supported."
-                )
-        elif host_os == "Darwin":
-            if machine == "arm64":
-                DEFAULT_LIB += "-darwin-arm64"
-            elif machine in ("x86_64", "amd64"):
-                DEFAULT_LIB += "-darwin-amd64"
-            else:
-                eprint(f"Unsupported MacOS architecture: {machine}.")
-        else:
-            eprint(
-                "Unknown target platform. The extension only works with Windows, Linux, and Darwin"
-            )
-
-        self.policy_bin = os.path.join(f"{script_directory}", f"{DEFAULT_LIB}")
+        self.policy_bin = str(get_dmverity_vhd_path())
 
         # check if the extension binary exists
         if not os.path.exists(self.policy_bin):

src/confcom/azext_confcom/tests/latest/test_confcom_platform.py

@@ -0,0 +1,80 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+# --------------------------------------------------------------------------------------------
+
+import subprocess
+import unittest
+from pathlib import Path
+from unittest import mock
+
+from azext_confcom import cose_proxy, rootfs_proxy
+from azext_confcom.lib import images
+
+
+class TestDarwinBinarySelection(unittest.TestCase):
+    def test_dmverity_binary_selection(self):
+        for machine, expected in (
+            ("arm64", "dmverity-vhd-darwin-arm64"),
+            ("x86_64", "dmverity-vhd-darwin-amd64"),
+            ("amd64", "dmverity-vhd-darwin-amd64"),
+        ):
+            with self.subTest(machine=machine):
+                with mock.patch.object(rootfs_proxy, "host_os", "Darwin"), \
+                        mock.patch.object(rootfs_proxy, "machine", machine), \
+                        mock.patch.object(rootfs_proxy.os.path, "exists", return_value=True), \
+                        mock.patch.object(rootfs_proxy.os, "access", return_value=True):
+                    self.assertEqual(
+                        Path(rootfs_proxy.SecurityPolicyProxy().policy_bin).name,
+                        expected,
+                    )
+
+    def test_cose_binary_selection(self):
+        for machine, expected in (
+            ("arm64", "sign1util-darwin-arm64"),
+            ("x86_64", "sign1util-darwin-amd64"),
+            ("amd64", "sign1util-darwin-amd64"),
+        ):
+            with self.subTest(machine=machine):
+                with mock.patch.object(cose_proxy, "host_os", "Darwin"), \
+                        mock.patch.object(cose_proxy, "machine", machine), \
+                        mock.patch.object(cose_proxy.os.path, "exists", return_value=True), \
+                        mock.patch.object(cose_proxy.os, "access", return_value=True):
+                    self.assertEqual(
+                        Path(cose_proxy.CoseSignToolProxy().policy_bin).name,
+                        expected,
+                    )
+
+    def test_unsupported_dmverity_architecture(self):
+        with mock.patch.object(rootfs_proxy, "host_os", "Darwin"), \
+                mock.patch.object(rootfs_proxy, "machine", "powerpc64"):
+            with self.assertRaises(SystemExit) as exception:
+                rootfs_proxy.get_dmverity_vhd_path()
+        self.assertEqual(exception.exception.code, 1)
+
+    def test_unsupported_cose_architecture(self):
+        with mock.patch.object(cose_proxy, "host_os", "Darwin"), \
+                mock.patch.object(cose_proxy, "machine", "powerpc64"):
+            with self.assertRaises(SystemExit) as exception:
+                cose_proxy.CoseSignToolProxy()
+        self.assertEqual(exception.exception.code, 1)
+
+    @mock.patch.object(images, "get_image")
+    @mock.patch.object(images.subprocess, "run")
+    @mock.patch.object(images, "get_dmverity_vhd_path")
+    def test_image_layer_hashing_uses_host_binary(self, get_binary_path, run, get_image):
+        binary_path = Path("/tmp/dmverity-vhd-darwin-arm64")
+        get_binary_path.return_value = binary_path
+        run.return_value = subprocess.CompletedProcess(
+            args=[],
+            returncode=0,
+            stdout="Layer 0 root hash: abc123\n",
+        )
+
+        self.assertEqual(images.get_image_layers("image:tag"), ["abc123"])
+        self.assertEqual(run.call_args[0][0][0], binary_path.as_posix())
+        get_image.assert_called_once_with("image:tag")
+
+
+if __name__ == "__main__":
+    unittest.main()

src/confcom/setup.py

@@ -19,7 +19,7 @@
 
     logger.warn("Wheel is not available, disabling bdist_wheel hook")
 
-VERSION = "2.3.0"
+VERSION = "2.4.0"
 
 # The full list of classifiers is available at
 # https://pypi.python.org/pypi?%3Aaction=list_classifiers