# FIXTURE_ONLY test table: want_rc|args|expected substring (shared by the bash and Pester tests)
0|--keys tests/fixtures/keys_clean.json|NO FINDINGS: input (keys file): no approved key without an expiration and no approved key for a service outside quay.
0|--keys tests/fixtures/keys_clean.json|NOTE: input (keys file): 2 keys read: 1 approved, 1 not approved, 0 approved with no expiration, 0 not judged.
0|--keys tests/fixtures/keys_clean.json|RESULT: NO FINDINGS (0 SUSPICIOUS, 0 UNKNOWN, exposure: not checked)
0|--keys tests/fixtures/keys_clean.json|there is no version verdict
0|--keys tests/fixtures/keys_clean.json|KEV: CVE-2026-123710 is not in CISA KEV catalog 2026.11.10 (released 10 Nov 2026 19:03 GMT)
0|--keys tests/fixtures/keys_clean.json|MITIGATION (Red Hat): restrict /keys at the proxy or load balancer so only trusted internal components can reach it.
0|--keys tests/fixtures/keys_clean.json|EXPOSURE NOTE: Red Hat says deployments where /keys is reachable by untrusted clients are affected.
1|--keys tests/fixtures/keys_rogue.json|SUSPICIOUS: input (key kid=fx-rogue-key-04 service=quay): approved with no expiration; metadata created_by "Key Rotation"; metadata ip 203.0.113.50. Red Hat's mitigation says to remove unrecognised approved service keys.
1|--keys tests/fixtures/keys_rogue.json|NOTE: input: treat repository tags as untrusted until you have compared their digests with what your build system pushed (OUR ADVICE).
1|--keys tests/fixtures/keys_rogue.json|RESULT: SUSPICIOUS (1 SUSPICIOUS, 0 UNKNOWN, exposure: not checked)
1|--keys tests/fixtures/keys_rogue.json --name fx-site-01|SUSPICIOUS: fx-site-01 (key kid=fx-rogue-key-04
1|--keys tests/fixtures/keys_db_rows.json|SUSPICIOUS: input (key kid=fx-db-key-07 service=quay): approved with no expiration; metadata created_by "Key Rotation"; metadata ip 198.51.100.7.
1|--keys tests/fixtures/keys_db_rows.json|3 keys read: 2 approved, 1 not approved, 1 approved with no expiration, 0 not judged.
1|--keys tests/fixtures/keys_other_service.json|SUSPICIOUS: input (key kid=fx-builder-key-05 service=fx_builder): approved for a service not in the expected list (quay).
0|--keys tests/fixtures/keys_other_service.json --services quay,fx_builder|RESULT: NO FINDINGS
1|--keys tests/fixtures/keys_unicode.json|SUSPICIOUS: input (key kid=fx-Abc?-?-?-?-tab?here?pipe service=quay): approved with no expiration
0|--keys tests/fixtures/keys_bom_crlf.json|1 keys read: 1 approved, 0 not approved, 0 approved with no expiration, 0 not judged.
3|--keys tests/fixtures/keys_missing_fields.json|UNKNOWN: input (key kid=fx-partial-key-09 service=quay): cannot tell whether this key is approved or when it expires
3|--keys tests/fixtures/keys_missing_fields.json|RESULT: UNKNOWN (0 SUSPICIOUS, 1 UNKNOWN, exposure: not checked)
3|--keys tests/fixtures/keys_empty.json|UNKNOWN: input (keys file): no keys in the export.
1|--keys tests/fixtures/keys_shapes.json|UNKNOWN: input (key kid=fx-shape-21 service=quay): cannot tell
1|--keys tests/fixtures/keys_shapes.json|4 keys read: 2 approved, 0 not approved, 1 approved with no expiration, 2 not judged.
4|--keys tests/fixtures/keys_invalid.json|ERROR: keys file is not valid JSON
4|--keys tests/fixtures/keys_noarray.json|ERROR: keys file has no keys array
4|--keys tests/fixtures/bad_ctrl.json|not valid JSON
4|--keys tests/fixtures/bad_zero.json|not valid JSON
4|--keys tests/fixtures/bad_comment.json|not valid JSON
4|--keys tests/fixtures/bad_quotes.json|not valid JSON
4|--keys tests/fixtures/bad_trailing.json|not valid JSON
4|--keys tests/fixtures/bad_nan.json|not valid JSON
4|--keys tests/fixtures/bad_escape.json|not valid JSON
4|--keys tests/fixtures/bad_blank.json|not valid JSON
4|--keys tests/fixtures/missing.json|ERROR: cannot read keys file
4|--keys tests/fixtures/keys_clean.json --keys tests/fixtures/keys_clean.json|Usage:
4|--keys|Usage:
4|--bogus x|Usage:
4|--name only|Usage:
4|--services Bad! --keys tests/fixtures/keys_clean.json|ERROR: service names are lower case letters, digits and _
1|--logs tests/fixtures/logs_rogue.json|SUSPICIOUS: input (service_key_rotate at Wed, 11 Nov 2026 10:00:00 -0000 from 203.0.113.50): key kid=fx-rogue-key-13 for service quay was installed by rotation (signer fx-instance-key-14) with no expiration. Red Hat's mitigation names service_key_rotate events with a null expiration_date.
1|--logs tests/fixtures/logs_rogue.json|SUSPICIOUS: input (service_key_delete at Wed, 11 Nov 2026 10:01:00 -0000 from 203.0.113.50): key kid=fx-instance-key-12 for service quay was deleted through the key server by a different key (signer fx-rogue-key-13).
1|--logs tests/fixtures/logs_rogue.json|4 log entries read: 2 service key events, 2 tag or push events (push_repo 1, create_tag 0, move_tag 1, delete_tag 0, revert_tag 0, change_tag_expiration 0).
1|--logs tests/fixtures/logs_rogue.json|RESULT: SUSPICIOUS (2 SUSPICIOUS, 0 UNKNOWN, exposure: not checked)
0|--logs tests/fixtures/logs_clean.json|NO FINDINGS: input (audit log): no service_key_rotate with no expiration and no service_key_delete signed by a different key in this export.
0|--logs tests/fixtures/logs_clean.json|NOTE: input (service_key_approve at Wed, 11 Nov 2026 09:00:01 -0000 from 192.0.2.20): key kid=fx-sk-11 for service quay, user fxadmin.
0|--logs tests/fixtures/logs_clean.json|4 log entries read: 2 service key events, 2 tag or push events
0|--logs tests/fixtures/logs_rotate_with_exp.json|NOTE: input (service_key_rotate at Wed, 11 Nov 2026 10:00:00 -0000 from 192.0.2.40): key kid=fx-sk-15 for service quay rotated (signer fx-sk-16), expiration Thu, 12 Nov 2026 10:00:00 GMT.
0|--logs tests/fixtures/logs_array.json|NOTE: input (service_key_delete at Wed, 11 Nov 2026 10:00:00 -0000 from 192.0.2.41): key kid=fx-sk-17 for service quay deleted (self-signed).
0|--logs tests/fixtures/logs_array.json|NOTE: input (service_key_delete at Wed, 11 Nov 2026 10:01:00 -0000 from 192.0.2.42): key kid=fx-sk-18 for service quay deleted by user fxadmin.
0|--logs tests/fixtures/logs_array.json|key kid=fx-sk-19 for service quay, user fxadmin, expiration 1794393600.
3|--logs tests/fixtures/logs_empty.json|UNKNOWN: input (audit log): no log entries in the export.
4|--logs tests/fixtures/keys_noarray.json|ERROR: audit log file has no logs array
5|--proxy-config tests/fixtures/nginx_quay_default.conf|EXPOSURE: NOT RESTRICTED: input (proxy config tests/fixtures/nginx_quay_default.conf): nginx would send /keys/services/quay/keys/testkid to location ~* ^(/config|/csrf_token|/oauth1|/oauth2|/webhooks|/keys|/.well-known|/health(/.*)?|/status) at line 5
5|--proxy-config tests/fixtures/nginx_quay_default.conf|RESULT: CHECK EXPOSURE (0 SUSPICIOUS, 0 UNKNOWN, exposure: NOT RESTRICTED)
0|--proxy-config tests/fixtures/nginx_restricted_regex.conf|EXPOSURE: RESTRICTED: input (proxy config tests/fixtures/nginx_restricted_regex.conf): nginx would pick location ~ ^/keys/ at line 4 for /keys/services/quay/keys/testkid, and it has deny all
0|--proxy-config tests/fixtures/nginx_restricted_regex.conf|RESULT: NO FINDINGS (0 SUSPICIOUS, 0 UNKNOWN, exposure: RESTRICTED)
5|--proxy-config tests/fixtures/nginx_prefix_overridden.conf|EXPOSURE: UNCLEAR: input (proxy config tests/fixtures/nginx_prefix_overridden.conf): location /keys at line 4 restricts /keys, but nginx would pick location ~*
0|--proxy-config tests/fixtures/nginx_prefix_caret.conf|nginx would pick location ^~ /keys/ at line 4 for /keys/services/quay/keys/testkid, and it has deny all
5|--proxy-config tests/fixtures/nginx_exact_only.conf|nginx would send /keys/services/quay/keys/testkid to location / at line 4, which has no deny all, return 4xx or internal
5|--proxy-config tests/fixtures/nginx_no_match.conf|EXPOSURE: UNCLEAR: input (proxy config tests/fixtures/nginx_no_match.conf): no location block matches
0|--proxy-config tests/fixtures/haproxy_restricted.cfg|EXPOSURE: RESTRICTED: input (proxy config tests/fixtures/haproxy_restricted.cfg): line 5 denies requests matching acl is_keys
0|--proxy-config tests/fixtures/haproxy_inline.cfg|line 3 denies requests matching an inline /keys condition
5|--proxy-config tests/fixtures/haproxy_unrestricted.cfg|EXPOSURE: NOT RESTRICTED: input (proxy config tests/fixtures/haproxy_unrestricted.cfg): acl is_keys matches /keys but no http-request deny
5|--proxy-config tests/fixtures/haproxy_unless.cfg|EXPOSURE: UNCLEAR: input (proxy config tests/fixtures/haproxy_unless.cfg): acl is_keys at line 4 is used in a deny rule, but not in a way that denies /keys
5|--proxy-config tests/fixtures/haproxy_noacl.cfg|no acl matches /keys and no deny rule covers it
5|--proxy-config tests/fixtures/unknown.conf|not recognised as an nginx or HAProxy config
4|--proxy-config tests/fixtures/missing.conf|ERROR: cannot read proxy config file
1|--keys tests/fixtures/keys_rogue.json --logs tests/fixtures/logs_rogue.json --proxy-config tests/fixtures/nginx_quay_default.conf --name fx-site-02|RESULT: SUSPICIOUS (3 SUSPICIOUS, 0 UNKNOWN, exposure: NOT RESTRICTED)
5|--keys tests/fixtures/keys_clean.json --logs tests/fixtures/logs_clean.json --proxy-config tests/fixtures/haproxy_noacl.cfg|RESULT: CHECK EXPOSURE (0 SUSPICIOUS, 0 UNKNOWN, exposure: NOT RESTRICTED)
3|--keys tests/fixtures/keys_missing_fields.json --proxy-config tests/fixtures/haproxy_restricted.cfg|RESULT: UNKNOWN (0 SUSPICIOUS, 1 UNKNOWN, exposure: RESTRICTED)
