1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package sigverify_test
4
5import (
6 "os"
7 "strings"
8 "testing"
9
10 "github.com/stretchr/testify/assert"
11 "github.com/stretchr/testify/require"
12
13 "bnema.dev/ermite/internal/adapters/sigverify"
14 "bnema.dev/ermite/internal/domain"
15)
16
17func TestInspectSSH(t *testing.T) {
18 priv, pub := sshKey(t, "ed25519")
19 _, rsaPub := sshKey(t, "rsa", "-b", "2048")
20 privText, err := os.ReadFile(priv)
21 require.NoError(t, err)
22 canonical := strings.Join(strings.Fields(pub)[:2], " ")
23
24 id, got, err := sigverify.Inspector{}.Inspect(domain.FormatSSH, pub)
25 require.NoError(t, err)
26 assert.Equal(t, fingerprint(t, pub), id)
27 assert.Equal(t, canonical, got, "the comment is dropped")
28
29 id2, got2, err := sigverify.Inspector{}.Inspect(domain.FormatSSH, " "+canonical+"\n\n")
30 require.NoError(t, err)
31 assert.Equal(t, id, id2)
32 assert.Equal(t, canonical, got2)
33
34 _, got, err = sigverify.Inspector{}.Inspect(domain.FormatSSH, rsaPub)
35 require.NoError(t, err)
36 assert.True(t, strings.HasPrefix(got, "ssh-rsa "))
37
38 tests := []struct {
39 name, key string
40 }{
41 {"empty", ""},
42 {"garbage", "hello world"},
43 {"private key", string(privText)},
44 {"two keys", pub + "\n" + rsaPub + "\n"},
45 {"truncated", canonical[:len(canonical)-10]},
46 {"larger than the limit", strings.Repeat("a", domain.MaxTrustedKeyBytes+1)},
47 }
48 for _, tt := range tests {
49 t.Run(tt.name, func(t *testing.T) {
50 _, _, err := sigverify.Inspector{}.Inspect(domain.FormatSSH, tt.key)
51 require.ErrorIs(t, err, domain.ErrInvalid)
52 assert.NotContains(t, err.Error(), "PRIVATE KEY")
53 })
54 }
55}
56
57func TestInspectGPG(t *testing.T) {
58 g := newGPGHome(t)
59 fpr := g.generate("inspect <dev@example.org>", "ed25519", "never")
60 pub := g.public(fpr)
61 other := g.generate("two <two@example.org>", "ed25519", "never")
62
63 id, canonical, err := sigverify.Inspector{}.Inspect(domain.FormatGPG, pub)
64 require.NoError(t, err)
65 assert.Equal(t, strings.ToUpper(fpr), id)
66 assert.True(t, strings.HasPrefix(canonical, "-----BEGIN PGP PUBLIC KEY BLOCK-----"))
67
68 // The canonical form is stable and verifies signatures like the original.
69 id2, canonical2, err := sigverify.Inspector{}.Inspect(domain.FormatGPG, canonical)
70 require.NoError(t, err)
71 assert.Equal(t, id, id2)
72 assert.Equal(t, canonical, canonical2)
73 c := g.commit(fpr, "dev@example.org")
74 v := sigverify.GPG{}.Verify(c.payload, c.signature, "dev@example.org", c.signedAt, []domain.TrustedKey{trustedGPG(canonical, "dev@example.org")})
75 assert.Equal(t, domain.StatusVerified, v.Status)
76
77 tests := []struct {
78 name, key string
79 }{
80 {"empty", ""},
81 {"garbage", "hello world"},
82 {"private key", g.private(fpr)},
83 {"two keys in one block", g.public(fpr, other)},
84 {"two blocks", pub + "\n" + g.public(other)},
85 {"a signature", string(c.signature)},
86 {"an ssh key", "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA"},
87 {"larger than the limit", strings.Repeat("a", domain.MaxTrustedKeyBytes+1)},
88 }
89 for _, tt := range tests {
90 t.Run(tt.name, func(t *testing.T) {
91 _, _, err := sigverify.Inspector{}.Inspect(domain.FormatGPG, tt.key)
92 require.ErrorIs(t, err, domain.ErrInvalid)
93 assert.NotContains(t, err.Error(), "PRIVATE KEY")
94 })
95 }
96}
97
98func TestInspectUnknownFormat(t *testing.T) {
99 for _, f := range []domain.SignatureFormat{domain.FormatNone, domain.FormatX509, "pgp"} {
100 _, _, err := sigverify.Inspector{}.Inspect(f, "x")
101 require.ErrorIs(t, err, domain.ErrInvalid)
102 }
103}