github.com/keybase/client/go@v0.0.0-20241007131713-f10651d043c8/updater/saltpack/saltpack_test.go (about)

     1  // Copyright 2015 Keybase, Inc. All rights reserved. Use of
     2  // this source code is governed by the included BSD license.
     3  
     4  package saltpack
     5  
     6  import (
     7  	"bytes"
     8  	"io"
     9  	"path/filepath"
    10  	"runtime"
    11  	"strings"
    12  	"testing"
    13  
    14  	"github.com/keybase/go-logging"
    15  	"github.com/stretchr/testify/assert"
    16  	"github.com/stretchr/testify/require"
    17  )
    18  
    19  var testLog = &logging.Logger{Module: "test"}
    20  
    21  var validCodeSigningKIDs = map[string]bool{
    22  	"0120d7539e27e83a9c8caf8701199c6985c0a96801ff7cb69456e9b3a8a8446c66080a": true, // joshblum (saltine)
    23  }
    24  
    25  const message1 = "This is a test message\n"
    26  
    27  // This is the output of running:
    28  //
    29  //	echo "This is a test message" | keybase sign -d
    30  const signature1 = `BEGIN KEYBASE SALTPACK DETACHED SIGNATURE. kXR7VktZdyH7rvq
    31  v5weRa8moXPeKBe e2YLT0PnyHzCrVi RbC1J5uJtYgYyLW eGg4qzsWqkXuVtJ yTsutKVn8DT97Oe
    32  mnvASPWsbU2VjnR t4EChFoYF1RSi75 MvyyWify9iZldeI 0OTYM5yKLpbCrX5 yD0Tmjf2txwg7Jx
    33  UVbWQUb01SmoAzq f. END KEYBASE SALTPACK DETACHED SIGNATURE.`
    34  
    35  var testZipPath string
    36  
    37  // keybase sign -d -i test.zip
    38  const testZipSignature = `BEGIN KEYBASE SALTPACK DETACHED SIGNATURE.
    39  kXR7VktZdyH7rvq v5weRa8moXPeKBe e2YLT0PnyHzCrVi RbC1J5uJtYgYyLW eGg4qzsWqkb7hcX
    40  GTVc0vsEUVwBCly qhPdOL0mE19kfxg A4fMqpNGNTY0jtO iMpjwwuIyLBxkCC jHzMiJFskzluz2S
    41  otWUI0nTu2vG2Fx Mgeyqm20Ug8j7Bi N. END KEYBASE SALTPACK DETACHED SIGNATURE.`
    42  
    43  func init() {
    44  	_, filename, _, _ := runtime.Caller(0)
    45  	testZipPath = filepath.Join(filepath.Dir(filename), "../test/test.zip")
    46  }
    47  
    48  func TestVerify(t *testing.T) {
    49  	reader := bytes.NewReader([]byte(message1))
    50  	err := VerifyDetached(reader, signature1, validCodeSigningKIDs, testLog)
    51  	assert.NoError(t, err)
    52  }
    53  
    54  func TestVerifyDetachedFileAtPath(t *testing.T) {
    55  	err := VerifyDetachedFileAtPath(testZipPath, testZipSignature, validCodeSigningKIDs, testLog)
    56  	assert.NoError(t, err)
    57  }
    58  
    59  func TestVerifyFail(t *testing.T) {
    60  	invalid := bytes.NewReader([]byte("This is a test message changed\n"))
    61  	err := VerifyDetached(invalid, signature1, validCodeSigningKIDs, testLog)
    62  	require.EqualError(t, err, "invalid signature")
    63  }
    64  
    65  func TestVerifyFailDetachedFileAtPath(t *testing.T) {
    66  	err := VerifyDetachedFileAtPath(testZipPath, testZipSignature, map[string]bool{}, testLog)
    67  	require.Error(t, err)
    68  }
    69  
    70  func TestVerifyNoValidIDs(t *testing.T) {
    71  	reader := bytes.NewReader([]byte(message1))
    72  	err := VerifyDetached(reader, signature1, nil, testLog)
    73  	require.EqualError(t, err, "unknown signer KID: 0120d7539e27e83a9c8caf8701199c6985c0a96801ff7cb69456e9b3a8a8446c66080a")
    74  }
    75  
    76  func TestVerifyBadValidIDs(t *testing.T) {
    77  	var badCodeSigningKIDs = map[string]bool{
    78  		"whatever": true,
    79  	}
    80  
    81  	reader := bytes.NewReader([]byte(message1))
    82  	err := VerifyDetached(reader, signature1, badCodeSigningKIDs, testLog)
    83  	require.EqualError(t, err, "unknown signer KID: 0120d7539e27e83a9c8caf8701199c6985c0a96801ff7cb69456e9b3a8a8446c66080a")
    84  }
    85  
    86  func TestVerifyNilInput(t *testing.T) {
    87  	err := VerifyDetached(nil, signature1, validCodeSigningKIDs, testLog)
    88  	require.EqualError(t, err, "no reader")
    89  }
    90  
    91  func TestVerifyNoSignature(t *testing.T) {
    92  	reader := bytes.NewReader([]byte(message1))
    93  	err := VerifyDetached(reader, "", validCodeSigningKIDs, testLog)
    94  	require.Equal(t, io.ErrUnexpectedEOF, err)
    95  }
    96  
    97  type testSigningKey struct {
    98  	kid []byte
    99  }
   100  
   101  func (t testSigningKey) ToKID() []byte {
   102  	return t.kid
   103  }
   104  
   105  func (t testSigningKey) Verify(message []byte, signature []byte) error {
   106  	panic("Unsupported")
   107  }
   108  
   109  func TestCheckNilSender(t *testing.T) {
   110  	err := checkSender(nil, validCodeSigningKIDs, testLog)
   111  	require.Error(t, err)
   112  }
   113  
   114  func TestCheckNoKID(t *testing.T) {
   115  	err := checkSender(testSigningKey{kid: nil}, validCodeSigningKIDs, testLog)
   116  	require.Error(t, err)
   117  }
   118  
   119  func TestVerifyNoFile(t *testing.T) {
   120  	err := VerifyDetachedFileAtPath("/invalid", signature1, validCodeSigningKIDs, testLog)
   121  	assert.Error(t, err)
   122  	require.True(t, strings.HasPrefix(err.Error(), "open /invalid: "))
   123  }