Skip to content

Commit 976737f

Browse files
adityasakyadityasaky
committed
Multiple changes
* Consolidate Signer and Verifier interfaces in signerverifier.go * Move verification tests to verify_test.go * Rename interceptSigner Signed-off-by: Aditya Sirish <[email protected]>
1 parent 20dcd93 commit 976737f

File tree

6 files changed

+356
-357
lines changed

6 files changed

+356
-357
lines changed

‎dsse/envelope.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,16 @@ type Signature struct {
3737
Sig string `json:"sig"`
3838
}
3939

40+
/*
41+
PAE implementes the DSSE Pre-Authentic Encoding
42+
https://github.com/secure-systems-lab/dsse/blob/master/protocol.md#signature-definition
43+
*/
44+
func PAE(payloadType string, payload []byte) []byte {
45+
return []byte(fmt.Sprintf("DSSEv1 %d %s %d %s",
46+
len(payloadType), payloadType,
47+
len(payload), payload))
48+
}
49+
4050
/*
4151
Both standard and url encoding are allowed:
4252
https://github.com/secure-systems-lab/dsse/blob/master/envelope.md

‎dsse/sign.go

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -8,46 +8,11 @@ import (
88
"context"
99
"encoding/base64"
1010
"errors"
11-
"fmt"
1211
)
1312

14-
// ErrUnknownKey indicates that the implementation does not recognize the
15-
// key.
16-
var ErrUnknownKey = errors.New("unknown key")
17-
18-
// ErrNoSignature indicates that an envelope did not contain any signatures.
19-
var ErrNoSignature = errors.New("no signature found")
20-
2113
// ErrNoSigners indicates that no signer was provided.
2214
var ErrNoSigners = errors.New("no signers provided")
2315

24-
/*
25-
PAE implementes the DSSE Pre-Authentic Encoding
26-
https://github.com/secure-systems-lab/dsse/blob/master/protocol.md#signature-definition
27-
*/
28-
func PAE(payloadType string, payload []byte) []byte {
29-
return []byte(fmt.Sprintf("DSSEv1 %d %s %d %s",
30-
len(payloadType), payloadType,
31-
len(payload), payload))
32-
}
33-
34-
/*
35-
Signer defines the interface for an abstract signing algorithm.
36-
The Signer interface is used to inject signature algorithm implementations
37-
into the EnevelopeSigner. This decoupling allows for any signing algorithm
38-
and key management system can be used.
39-
The full message is provided as the parameter. If the signature algorithm
40-
depends on hashing of the message prior to signature calculation, the
41-
implementor of this interface must perform such hashing.
42-
The function must return raw bytes representing the calculated signature
43-
using the current algorithm, and the key used (if applicable).
44-
For an example see EcdsaSigner in sign_test.go.
45-
*/
46-
type Signer interface {
47-
Sign(ctx context.Context, data []byte) ([]byte, error)
48-
KeyID() (string, error)
49-
}
50-
5116
// EnvelopeSigner creates signed Envelopes.
5217
type EnvelopeSigner struct {
5318
providers []SignerVerifier

‎dsse/sign_test.go

Lines changed: 0 additions & 309 deletions
Original file line numberDiff line numberDiff line change
@@ -378,312 +378,3 @@ func TestDecodeB64Payload(t *testing.T) {
378378
assert.Nil(t, got, "wrong data")
379379
})
380380
}
381-
382-
func TestVerifyOneProvider(t *testing.T) {
383-
var payloadType = "http://example.com/HelloWorld"
384-
var payload = "hello world"
385-
386-
var ns nilSignerVerifier
387-
signer, err := NewEnvelopeSigner(ns)
388-
assert.Nil(t, err, "unexpected error")
389-
390-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
391-
assert.Nil(t, err, "sign failed")
392-
393-
verifier, err := NewEnvelopeVerifier(ns)
394-
assert.Nil(t, err, "unexpected error")
395-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
396-
assert.Nil(t, err, "unexpected error")
397-
assert.Len(t, acceptedKeys, 1, "unexpected keys")
398-
assert.Equal(t, acceptedKeys[0].KeyID, "nil", "unexpected keyid")
399-
}
400-
401-
func TestVerifyMultipleProvider(t *testing.T) {
402-
var payloadType = "http://example.com/HelloWorld"
403-
var payload = "hello world"
404-
405-
var ns nilSignerVerifier
406-
var null nullSignerVerifier
407-
signer, err := NewEnvelopeSigner(ns, null)
408-
assert.Nil(t, err, "unexpected error")
409-
410-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
411-
assert.Nil(t, err, "sign failed")
412-
413-
verifier, err := NewEnvelopeVerifier(ns, null)
414-
assert.Nil(t, err, "unexpected error")
415-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
416-
assert.Nil(t, err, "unexpected error")
417-
assert.Len(t, acceptedKeys, 2, "unexpected keys")
418-
}
419-
420-
func TestVerifyMultipleProviderThreshold(t *testing.T) {
421-
var payloadType = "http://example.com/HelloWorld"
422-
var payload = "hello world"
423-
424-
var ns nilSignerVerifier
425-
var null nullSignerVerifier
426-
signer, err := NewMultiEnvelopeSigner(2, ns, null)
427-
assert.Nil(t, err)
428-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
429-
assert.Nil(t, err, "sign failed")
430-
431-
verifier, err := NewMultiEnvelopeVerifier(2, ns, null)
432-
assert.Nil(t, err, "unexpected error")
433-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
434-
assert.Nil(t, err, "unexpected error")
435-
assert.Len(t, acceptedKeys, 2, "unexpected keys")
436-
}
437-
438-
func TestVerifyMultipleProviderThresholdErr(t *testing.T) {
439-
var ns nilSignerVerifier
440-
var null nullSignerVerifier
441-
_, err := NewMultiEnvelopeVerifier(3, ns, null)
442-
assert.Equal(t, errThreshold, err, "wrong error")
443-
_, err = NewMultiEnvelopeVerifier(0, ns, null)
444-
assert.Equal(t, errThreshold, err, "wrong error")
445-
}
446-
447-
func TestVerifyErr(t *testing.T) {
448-
var payloadType = "http://example.com/HelloWorld"
449-
var payload = "hello world"
450-
451-
var errsv errSignerVerifier
452-
signer, err := NewEnvelopeSigner(errsv)
453-
assert.Nil(t, err, "unexpected error")
454-
455-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
456-
assert.Nil(t, err, "sign failed")
457-
458-
verifier, err := NewEnvelopeVerifier(errsv)
459-
assert.Nil(t, err, "unexpected error")
460-
_, err = verifier.Verify(context.TODO(), env)
461-
assert.Equal(t, errVerify, err, "wrong error")
462-
}
463-
464-
func TestBadVerifier(t *testing.T) {
465-
var payloadType = "http://example.com/HelloWorld"
466-
var payload = "hello world"
467-
468-
var badv badverifier
469-
signer, err := NewEnvelopeSigner(badv)
470-
assert.Nil(t, err, "unexpected error")
471-
472-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
473-
assert.Nil(t, err, "sign failed")
474-
475-
verifier, err := NewEnvelopeVerifier(badv)
476-
assert.Nil(t, err, "unexpected error")
477-
_, err = verifier.Verify(context.TODO(), env)
478-
assert.NotNil(t, err, "expected error")
479-
}
480-
481-
func TestVerifyNoSig(t *testing.T) {
482-
var badv badverifier
483-
verifier, err := NewEnvelopeVerifier(badv)
484-
assert.Nil(t, err, "unexpected error")
485-
486-
env := &Envelope{}
487-
488-
_, err = verifier.Verify(context.TODO(), env)
489-
assert.Equal(t, ErrNoSignature, err, "wrong error")
490-
}
491-
492-
func TestVerifyBadBase64(t *testing.T) {
493-
var badv badverifier
494-
verifier, err := NewEnvelopeVerifier(badv)
495-
assert.Nil(t, err, "unexpected error")
496-
497-
t.Run("Payload", func(t *testing.T) {
498-
env := &Envelope{
499-
Payload: "Not base 64",
500-
Signatures: []Signature{
501-
{},
502-
},
503-
}
504-
505-
_, err := verifier.Verify(context.TODO(), env)
506-
assert.IsType(t, base64.CorruptInputError(0), err, "wrong error")
507-
})
508-
509-
t.Run("Signature", func(t *testing.T) {
510-
env := &Envelope{
511-
Payload: "cGF5bG9hZAo=",
512-
Signatures: []Signature{
513-
{
514-
Sig: "not base 64",
515-
},
516-
},
517-
}
518-
519-
_, err := verifier.Verify(context.TODO(), env)
520-
assert.IsType(t, base64.CorruptInputError(0), err, "wrong error")
521-
})
522-
}
523-
524-
func TestVerifyNoMatch(t *testing.T) {
525-
var payloadType = "http://example.com/HelloWorld"
526-
527-
var ns nilSignerVerifier
528-
var null nullSignerVerifier
529-
verifier, err := NewEnvelopeVerifier(ns, null)
530-
assert.Nil(t, err, "unexpected error")
531-
532-
env := &Envelope{
533-
PayloadType: payloadType,
534-
Payload: "cGF5bG9hZAo=",
535-
Signatures: []Signature{
536-
{
537-
KeyID: "not found",
538-
Sig: "cGF5bG9hZAo=",
539-
},
540-
},
541-
}
542-
543-
_, err = verifier.Verify(context.TODO(), env)
544-
assert.NotNil(t, err, "expected error")
545-
}
546-
547-
type interceptSigner struct {
548-
keyID string
549-
verifyRes bool
550-
verifyCalled bool
551-
}
552-
553-
func (i *interceptSigner) Sign(ctx context.Context, data []byte) ([]byte, error) {
554-
return data, nil
555-
}
556-
557-
func (i *interceptSigner) Verify(ctx context.Context, data, sig []byte) error {
558-
i.verifyCalled = true
559-
560-
if i.verifyRes {
561-
return nil
562-
}
563-
return errVerify
564-
}
565-
566-
func (i *interceptSigner) KeyID() (string, error) {
567-
return i.keyID, nil
568-
}
569-
570-
func (i *interceptSigner) Public() crypto.PublicKey {
571-
return "intercept-public"
572-
}
573-
574-
func TestVerifyOneFail(t *testing.T) {
575-
var payloadType = "http://example.com/HelloWorld"
576-
var payload = "hello world"
577-
578-
var s1 = &interceptSigner{
579-
keyID: "i1",
580-
verifyRes: true,
581-
}
582-
var s2 = &interceptSigner{
583-
keyID: "i2",
584-
verifyRes: false,
585-
}
586-
signer, err := NewEnvelopeSigner(s1, s2)
587-
assert.Nil(t, err, "unexpected error")
588-
589-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
590-
assert.Nil(t, err, "sign failed")
591-
592-
verifier, err := NewEnvelopeVerifier(s1, s2)
593-
assert.Nil(t, err, "unexpected error")
594-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
595-
assert.Nil(t, err, "expected error")
596-
assert.True(t, s1.verifyCalled, "verify not called")
597-
assert.True(t, s2.verifyCalled, "verify not called")
598-
assert.Len(t, acceptedKeys, 1, "unexpected keys")
599-
assert.Equal(t, acceptedKeys[0].KeyID, "i1", "unexpected keyid")
600-
}
601-
602-
func TestVerifySameKeyID(t *testing.T) {
603-
var payloadType = "http://example.com/HelloWorld"
604-
var payload = "hello world"
605-
606-
var s1 = &interceptSigner{
607-
keyID: "i1",
608-
verifyRes: true,
609-
}
610-
var s2 = &interceptSigner{
611-
keyID: "i1",
612-
verifyRes: true,
613-
}
614-
signer, err := NewEnvelopeSigner(s1, s2)
615-
assert.Nil(t, err, "unexpected error")
616-
617-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
618-
assert.Nil(t, err, "sign failed")
619-
620-
verifier, err := NewEnvelopeVerifier(s1, s2)
621-
assert.Nil(t, err, "unexpected error")
622-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
623-
assert.Nil(t, err, "expected error")
624-
assert.True(t, s1.verifyCalled, "verify not called")
625-
assert.True(t, s2.verifyCalled, "verify not called")
626-
assert.Len(t, acceptedKeys, 1, "unexpected keys")
627-
assert.Equal(t, acceptedKeys[0].KeyID, "i1", "unexpected keyid")
628-
}
629-
630-
func TestVerifyEmptyKeyID(t *testing.T) {
631-
var payloadType = "http://example.com/HelloWorld"
632-
var payload = "hello world"
633-
634-
var s1 = &interceptSigner{
635-
keyID: "",
636-
verifyRes: true,
637-
}
638-
639-
var s2 = &interceptSigner{
640-
keyID: "",
641-
verifyRes: true,
642-
}
643-
644-
signer, err := NewEnvelopeSigner(s1, s2)
645-
assert.Nil(t, err, "unexpected error")
646-
647-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
648-
assert.Nil(t, err, "sign failed")
649-
650-
verifier, err := NewEnvelopeVerifier(s1, s2)
651-
assert.Nil(t, err, "unexpected error")
652-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
653-
assert.Nil(t, err, "expected error")
654-
// assert.True(t, s1.verifyCalled, "verify not called")
655-
// assert.True(t, s2.verifyCalled, "verify not called")
656-
assert.Len(t, acceptedKeys, 1, "unexpected keys")
657-
assert.Equal(t, acceptedKeys[0].KeyID, "", "unexpected keyid")
658-
}
659-
660-
func TestVerifyPublicKeyID(t *testing.T) {
661-
var payloadType = "http://example.com/HelloWorld"
662-
var payload = "hello world"
663-
var keyID = "SHA256:f4AuBLdH4Lj/dIuwAUXXebzoI9B/cJ4iSQ3/qByIl4M"
664-
// var keyID = "test key 123"
665-
666-
var s1 = &ecdsaSignerVerifier{
667-
keyID: "",
668-
key: newEcdsaKey(),
669-
}
670-
671-
var s2 = &ecdsaSignerVerifier{
672-
keyID: "",
673-
key: newEcdsaKey(),
674-
}
675-
// a := s1.Public()
676-
677-
signer, err := NewEnvelopeSigner(s1, s2)
678-
assert.Nil(t, err, "unexpected error")
679-
680-
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
681-
assert.Nil(t, err, "sign failed")
682-
683-
verifier, err := NewEnvelopeVerifier(s1, s2)
684-
assert.Nil(t, err, "unexpected error")
685-
acceptedKeys, err := verifier.Verify(context.TODO(), env)
686-
assert.Nil(t, err, "expected error")
687-
assert.Len(t, acceptedKeys, 1, "unexpected keys")
688-
assert.Equal(t, acceptedKeys[0].KeyID, keyID, "unexpected keyid")
689-
}

0 commit comments

Comments
 (0)