Radish alpha
H
HardenedBSD-pkg
rad:z3QDZAW2FAfuLvihrhiyDC9fAD8G9
HardenedBSD Package Manager
Radicle
Git
Commits › 542057c
tests: frontend: add some tests to demonstrate ECC functionality
Kyle Evans committed 2 years ago
commit 542057c403f3794444c0b18282f4253a6a9c1a28
parent 0d6683e
3 files changed +145 -17
modified tests/frontend/fingerprint.sh
@@ -3,18 +3,34 @@
. $(atf_get_srcdir)/test_environment.sh



tests_init \
- 
	fingerprint \
+ 
	fingerprint_ecc \
+ 
	fingerprint_rsa \

	fingerprint_rootdir



setup() {

	local _root=$1
+ 
	local _type=$2

	local _fingerprint
+ 
	local _typecmd



	atf_skip_on Darwin Test fails on Darwin

	atf_skip_on Linux Test fails on Linux
- 
	atf_check -o save:repo.pub -e ignore \
- 
		pkg key --create repo.key
+ 
	case "$_type" in
+ 
	rsa)
+ 
		atf_check -o save:repo.pub -e ignore \
+ 
			pkg key --create repo.key
+ 
		_typecmd=""
+ 
		;;
+ 
	ecc)
+ 
		atf_check -o ignore -e ignore \
+ 
			openssl ecparam -genkey -name secp256k1 -out repo.key -outform DER
+ 
		chmod 0400 repo.key
+ 
		atf_check -o ignore -e ignore \
+ 
			openssl ec -in repo.key -pubout -out repo.pub -outform DER
+ 
		_typecmd='printf "%s\n%s\n" "TYPE" "ecdsa"'
+ 
		;;
+ 
	esac



	rm -rf ${TMPDIR}/keys || :

	mkdir -p ${_root}/${TMPDIR}/keys/trusted
@@ -28,6 +44,8 @@ setup() {
#!/bin/sh

read -t 2 sum

[ -z "\$sum" ] && exit 1
+
+ 
$_typecmd

echo SIGNATURE

echo -n \$sum | /usr/bin/openssl dgst -sign repo.key -sha256 -binary

echo
@@ -53,8 +71,18 @@ local: {
EOF

}
- 
fingerprint_body() {
- 
	setup ""
+ 
fingerprint_ecc_body() {
+ 
	setup "" "ecc"
+
+ 
	atf_check \
+ 
		-o ignore \
+ 
		-e match:".*extracting signature of repo.*" \
+ 
		pkg -dd -o REPOS_DIR="${TMPDIR}" \
+ 
		-o PKG_CACHEDIR="${TMPDIR}" update
+ 
}
+
+ 
fingerprint_rsa_body() {
+ 
	setup "" "rsa"



	atf_check \

		-o ignore \
@@ -64,7 +92,7 @@ fingerprint_body() {
}



fingerprint_rootdir_body() {
- 
	setup "${TMPDIR}/rootdir"
+ 
	setup "${TMPDIR}/rootdir" "rsa"



	atf_check \

		-o ignore \
modified tests/frontend/key.sh
@@ -4,7 +4,8 @@


tests_init \

	key_create \
- 
	key_pubout
+ 
	key_pubout \
+ 
	key_sign



key_create_head() {

	atf_set "require.progs" "openssl"
@@ -12,16 +13,31 @@ key_create_head() {
key_create_body() {

	echo "secure msg" > msg
- 
	atf_check -o ignore -e ignore -x pkg key --create -t rsa repo
+ 
	atf_check -o save:repo.pub -e ignore -x pkg key --create -t rsa \
+ 
	    repo.key
+ 


	# Group permissions are OK, but let's strive for limited to the user.
- 
	atf_check -o match:'-{6}$' -x \
- 
	    'ls -l repo | cut -c1-10'
- 
	# Should have also created the corresponding pub key.
- 
	atf_check test -f repo.pub
+ 
	# This doesn't use stat(1) to side-step the differences between
+ 
	# platforms in how to request specific fields; the ls(1) mode
+ 
	# representation is usually consistent enough.
+ 
	atf_check -o match:'-{6}$' -x 'ls -l repo.key | cut -c1-10'
+ 
	# Should have also output the corresponding pub key.
+ 
	atf_check test -s repo.pub



	# Make sure it's functional.
- 
	atf_check -o save:msg.sign openssl dgst -sign repo -sha256 -binary msg
- 
	atf_check -o ignore openssl dgst -sha256 -verify repo.pub -signature msg.sign msg
+ 
	atf_check -o save:msg.sign openssl dgst -sign repo.key -sha256 \
+ 
	    -binary msg
+ 
	atf_check -o ignore openssl dgst -sha256 -verify repo.pub \
+ 
	    -signature msg.sign msg
+
+ 
	for signer in ecc ecdsa eddsa; do
+ 
		rm -f repo.key repo.pub
+ 
		atf_check -o save:repo.pub -e ignore -x pkg key --create \
+ 
		    -t "$signer" repo.key
+
+ 
		atf_check -o match:'-{6}$' -x 'ls -l repo.key | cut -c1-10'
+ 
		atf_check test -s repo.pub
+ 
	done

}



key_pubout_head() {
@@ -41,4 +57,23 @@ key_pubout_body() {
	atf_check -o ignore openssl dgst -sha256 -verify repo.pub -signature msg.sign msg

}
+ 
key_sign_head() {
+ 
	atf_set "require.progs" "openssl"
+ 
}
+ 
key_sign_body() {
+ 
	echo "secure msg" > msg
+
+ 
	for signer in rsa ecdsa; do
+ 
		rm -f repo.key repo.pub msg.sig
+ 
		# Generate a key with pkg
+ 
		atf_check -o save:repo.pub -e ignore \
+ 
		    pkg key --create -t "$signer" repo.key
+
+ 
		atf_check -o save:msg.sig \
+ 
		    pkg key --sign -t "$signer" repo.key < msg
+
+ 
		atf_check -o ignore openssl dgst -sha256 -verify repo.pub \
+ 
		    -signature msg.sig msg
+ 
	done
+ 
}
modified tests/frontend/pubkey.sh
@@ -3,11 +3,76 @@
. $(atf_get_srcdir)/test_environment.sh



tests_init \
- 
	pubkey \
+ 
	pubkey_ecdsa \
+ 
	pubkey_eddsa \
+ 
	pubkey_rsa \

	pubkey_legacy
- 
# New format, prefix the key type
- 
pubkey_body() {
+ 
ecc_test() {
+ 
	local _type
+
+ 
	_type="$1"
+
+ 
	case "$_type" in
+ 
	eddsa)
+ 
		atf_check -o save:repo.pub -e ignore \
+ 
			pkg key --create -t "$_type" repo.key
+ 
		;;
+ 
	ecdsa)
+ 
		# pkg can generate these, but we want to be sure that we're still
+ 
		# compatible with what openssl produces.
+ 
		atf_check -o ignore -e ignore \
+ 
			openssl ecparam -genkey -name secp256k1 -out repo.key -outform DER
+ 
		chmod 0400 repo.key
+ 
		atf_check -o ignore -e ignore \
+ 
			openssl ec -in repo.key -pubout -out repo.pub -outform DER
+ 
		;;
+ 
	esac
+
+ 
	mkdir fakerepo
+
+ 
	cat >> test.ucl << EOF
+ 
name: test
+ 
origin: test
+ 
version: "1"
+ 
maintainer: test
+ 
categories: [test]
+ 
comment: a test
+ 
www: http://test
+ 
prefix: /
+ 
abi = "*";
+ 
desc: <<EOD
+ 
Yet another test
+ 
EOD
+ 
EOF
+
+ 
	atf_check -o ignore -e ignore \
+ 
		pkg create -M test.ucl -o fakerepo
+ 
	atf_check -o ignore -e ignore \
+ 
		pkg repo fakerepo "$_type":repo.key
+ 
	cat >> repo.conf << EOF
+ 
local: {
+ 
	url: file:///${TMPDIR}/fakerepo
+ 
	enabled: true
+ 
	pubkey: ${TMPDIR}/repo.pub
+ 
	signature_type: "pubkey"
+ 
}
+ 
EOF
+ 
	atf_check \
+ 
		-o ignore \
+ 
		pkg -o REPOS_DIR="${TMPDIR}" \
+ 
		-o ${PKG_CACHEDIR}="${TMPDIR}" update
+ 
}
+
+ 
pubkey_ecdsa_body() {
+ 
	ecc_test "ecdsa"
+ 
}
+
+ 
pubkey_eddsa_body() {
+ 
	ecc_test "eddsa"
+ 
}
+
+ 
pubkey_rsa_body() {

	atf_check -o save:repo.pub -e ignore \

		pkg key --create repo.key

	mkdir fakerepo