|
|
|
|
@ -24,7 +24,8 @@ import (
|
|
|
|
|
"strings"
|
|
|
|
|
"testing"
|
|
|
|
|
|
|
|
|
|
pgperrors "golang.org/x/crypto/openpgp/errors" //nolint
|
|
|
|
|
pgperrors "github.com/ProtonMail/go-crypto/openpgp/errors"
|
|
|
|
|
"github.com/ProtonMail/go-crypto/openpgp/packet"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
const (
|
|
|
|
|
@ -56,6 +57,9 @@ const (
|
|
|
|
|
// testTamperedSigBlock is a tampered copy of msgblock.yaml.asc
|
|
|
|
|
testTamperedSigBlock = "testdata/msgblock.yaml.tampered"
|
|
|
|
|
|
|
|
|
|
// testMixedKeyring points to a keyring containing RSA and ed25519 keys.
|
|
|
|
|
testMixedKeyring = "testdata/helm-mixed-keyring.pub"
|
|
|
|
|
|
|
|
|
|
// testSumfile points to a SHA256 sum generated by an external tool.
|
|
|
|
|
// We always want to validate against an external tool's representation to
|
|
|
|
|
// verify that we haven't done something stupid. This file was generated
|
|
|
|
|
@ -232,6 +236,56 @@ func TestClearSign(t *testing.T) {
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMixedKeyringRSASigningAndVerification(t *testing.T) {
|
|
|
|
|
signer, err := NewFromFiles(testKeyfile, testMixedKeyring)
|
|
|
|
|
if err != nil {
|
|
|
|
|
t.Fatal(err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if signer.Entity == nil {
|
|
|
|
|
t.Fatal("expected signer entity to be loaded")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if signer.Entity.PrivateKey == nil {
|
|
|
|
|
t.Fatal("expected signer private key to be loaded")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if signer.Entity.PrivateKey.PubKeyAlgo != packet.PubKeyAlgoRSA {
|
|
|
|
|
t.Fatalf("expected RSA key but got %v", signer.Entity.PrivateKey.PubKeyAlgo)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sig, err := signer.ClearSign(testChartfile)
|
|
|
|
|
if err != nil {
|
|
|
|
|
t.Fatalf("failed to sign chart: %v", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sigpath := filepath.Join(t.TempDir(), "hashtest-1.2.3.tgz.prov")
|
|
|
|
|
if err := os.WriteFile(sigpath, []byte(sig), 0o644); err != nil {
|
|
|
|
|
t.Fatal(err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
verification, err := signer.Verify(testChartfile, sigpath)
|
|
|
|
|
if err != nil {
|
|
|
|
|
t.Fatalf("failed to verify chart signature: %v", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if verification.SignedBy == nil {
|
|
|
|
|
t.Fatal("expected verification to include signer")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if verification.SignedBy.PrimaryKey == nil {
|
|
|
|
|
t.Fatal("expected verification to include signer primary key")
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if verification.SignedBy.PrimaryKey.PubKeyAlgo != packet.PubKeyAlgoRSA {
|
|
|
|
|
t.Fatalf("expected verification to report RSA key but got %v", verification.SignedBy.PrimaryKey.PubKeyAlgo)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if _, ok := verification.SignedBy.Identities[testKeyName]; !ok {
|
|
|
|
|
t.Fatalf("expected verification to be signed by %q", testKeyName)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// failSigner always fails to sign and returns an error
|
|
|
|
|
type failSigner struct{}
|
|
|
|
|
|
|
|
|
|
|
Matt Farina
4 days ago
committed by
GitHub