Suppressed diffs if the algorithms are equivalent (#4575) (#3035)

Signed-off-by: Modular Magician <magic-modules@google.com>
hashicorp · Mar 9, 2021 · 326da63 · 326da63
1 parent 304abc8
commit 326da63
Show file tree

Hide file tree

Showing 3 changed files with 75 additions and 0 deletions.
diff --git a/.changelog/4575.txt b/.changelog/4575.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+binaryauthorization: fixed permadiff in `google_binary_authorization_attestor`
+```
diff --git a/google-beta/resource_binary_authorization_attestor.go b/google-beta/resource_binary_authorization_attestor.go
@@ -24,6 +24,34 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
+func compareSignatureAlgorithm(_, old, new string, _ *schema.ResourceData) bool {
+	// See https://cloud.google.com/binary-authorization/docs/reference/rest/v1/projects.attestors#signaturealgorithm
+	normalizedAlgorithms := map[string]string{
+		"ECDSA_P256_SHA256":   "ECDSA_P256_SHA256",
+		"EC_SIGN_P256_SHA256": "ECDSA_P256_SHA256",
+		"ECDSA_P384_SHA384":   "ECDSA_P384_SHA384",
+		"EC_SIGN_P384_SHA384": "ECDSA_P384_SHA384",
+		"ECDSA_P521_SHA512":   "ECDSA_P521_SHA512",
+		"EC_SIGN_P521_SHA512": "ECDSA_P521_SHA512",
+	}
+
+	normalizedOld := old
+	normalizedNew := new
+
+	if normalized, ok := normalizedAlgorithms[old]; ok {
+		normalizedOld = normalized
+	}
+	if normalized, ok := normalizedAlgorithms[new]; ok {
+		normalizedNew = normalized
+	}
+
+	if normalizedNew == normalizedOld {
+		return true
+	}
+
+	return false
+}
+
 func resourceBinaryAuthorizationAttestor() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceBinaryAuthorizationAttestorCreate,

diff --git a/google-beta/resource_binaryauthorization_attestor_test.go b/google-beta/resource_binaryauthorization_attestor_test.go
@@ -7,6 +7,50 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 )
 
+func TestSignatureAlgorithmDiffSuppress(t *testing.T) {
+	cases := map[string]struct {
+		Old, New           string
+		ExpectDiffSuppress bool
+	}{
+		"ECDSA_P256 equivalent": {
+			Old:                "ECDSA_P256_SHA256",
+			New:                "EC_SIGN_P256_SHA256",
+			ExpectDiffSuppress: true,
+		},
+		"ECDSA_P384 equivalent": {
+			Old:                "ECDSA_P384_SHA384",
+			New:                "EC_SIGN_P384_SHA384",
+			ExpectDiffSuppress: true,
+		},
+		"ECDSA_P521 equivalent": {
+			Old:                "ECDSA_P521_SHA512",
+			New:                "EC_SIGN_P521_SHA512",
+			ExpectDiffSuppress: true,
+		},
+		"not equivalent 1": {
+			Old:                "ECDSA_P256",
+			New:                "EC_SIGN_P384_SHA384",
+			ExpectDiffSuppress: false,
+		},
+		"not equivalent 2": {
+			Old:                "ECDSA_P384_SHA384",
+			New:                "EC_SIGN_P521_SHA512",
+			ExpectDiffSuppress: false,
+		},
+		"not equivalent 3": {
+			Old:                "ECDSA_P521_SHA512",
+			New:                "EC_SIGN_P256_SHA256",
+			ExpectDiffSuppress: false,
+		},
+	}
+
+	for tn, tc := range cases {
+		if compareSignatureAlgorithm("signature_algorithm", tc.Old, tc.New, nil) != tc.ExpectDiffSuppress {
+			t.Errorf("bad: %s, %q => %q expect DiffSuppress to return %t", tn, tc.Old, tc.New, tc.ExpectDiffSuppress)
+		}
+	}
+}
+
 func TestAccBinaryAuthorizationAttestor_basic(t *testing.T) {
 	t.Parallel()