Download this file
| 1 | package appconfig |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "crypto/ecdh" |
| 6 | "encoding/base64" |
| 7 | "regexp" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | // A box computes the fingerprint from its PRIVATE key's public half; the |
| 12 | // console computes it from CARLOS_SECRETS_PUBKEY. They must agree byte for |
| 13 | // byte (nearest-region spec §6.1, R9). |
| 14 | func TestKeyFingerprintAgreesAcrossHalves(t *testing.T) { |
| 15 | priv, err := ecdh.P256().NewPrivateKey(bytes.Repeat([]byte{1}, 32)) |
| 16 | if err != nil { |
| 17 | t.Fatal(err) |
| 18 | } |
| 19 | fromPriv := KeyFingerprint(priv.PublicKey()) |
| 20 | fromPub, err := PublicFingerprint(base64.StdEncoding.EncodeToString(priv.PublicKey().Bytes())) |
| 21 | if err != nil { |
| 22 | t.Fatal(err) |
| 23 | } |
| 24 | if fromPriv != fromPub { |
| 25 | t.Fatalf("private half %q != public half %q", fromPriv, fromPub) |
| 26 | } |
| 27 | if !regexp.MustCompile(`^sha256:[0-9a-f]{64}$`).MatchString(fromPriv) { |
| 28 | t.Fatalf("format = %q", fromPriv) |
| 29 | } |
| 30 | other, _ := ecdh.P256().NewPrivateKey(bytes.Repeat([]byte{2}, 32)) |
| 31 | if KeyFingerprint(other.PublicKey()) == fromPriv { |
| 32 | t.Fatal("two keys share a fingerprint") |
| 33 | } |
| 34 | if _, err := PublicFingerprint("not base64!"); err == nil { |
| 35 | t.Fatal("garbage parsed") |
| 36 | } |
| 37 | } |
| 38 | |
amadan