| 1 | package publicrelease |
| 2 | |
| 3 | import ( |
| 4 | "crypto/ed25519" |
| 5 | "encoding/base64" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | ) |
| 9 | |
| 10 | func TestVerifySumsIsStrict(t *testing.T) { |
| 11 | pub, priv, _ := ed25519.GenerateKey(nil) |
| 12 | key := base64.StdEncoding.EncodeToString(pub) |
| 13 | sign := func(s string) string { return base64.StdEncoding.EncodeToString(ed25519.Sign(priv, []byte(s))) + "\n" } |
| 14 | a, b := strings.Repeat("a", 64), strings.Repeat("b", 64) |
| 15 | good := a + " carlos-linux-arm64\n" + b + " carlos-linux-amd64\n" |
| 16 | got, err := VerifySums(key, []byte(good), sign(good)) |
| 17 | if err != nil || len(got) != 2 || got["carlos-linux-arm64"] != a || got["carlos-linux-amd64"] != b { |
| 18 | t.Fatal(got, err) |
| 19 | } |
| 20 | _, other, _ := ed25519.GenerateKey(nil) |
| 21 | for name, tc := range map[string]struct{ key, sums, sig string }{ |
| 22 | "other signer": {key, good, base64.StdEncoding.EncodeToString(ed25519.Sign(other, []byte(good)))}, |
| 23 | "changed after": {key, good + b + " extra\n", sign(good)}, |
| 24 | "bad key": {"not-a-key", good, sign(good)}, |
| 25 | "no signature": {key, good, ""}, |
| 26 | "duplicate name": {key, a + " x\n" + b + " x\n", sign(a + " x\n" + b + " x\n")}, |
| 27 | "upper hex": {key, strings.ToUpper(a) + " x\n", sign(strings.ToUpper(a) + " x\n")}, |
| 28 | "binary marker": {key, a + " *x\n", sign(a + " *x\n")}, |
| 29 | "one space": {key, a + " x\n", sign(a + " x\n")}, |
| 30 | "blank line": {key, a + " x\n\n", sign(a + " x\n\n")}, |
| 31 | "no newline": {key, a + " x", sign(a + " x")}, |
| 32 | "empty": {key, "", sign("")}, |
| 33 | "short hash": {key, a[:63] + " x\n", sign(a[:63] + " x\n")}, |
| 34 | "name with space": {key, a + " x y\n", sign(a + " x y\n")}, |
| 35 | } { |
| 36 | t.Run(name, func(t *testing.T) { |
| 37 | if _, err := VerifySums(tc.key, []byte(tc.sums), tc.sig); err == nil { |
| 38 | t.Fatal("accepted") |
| 39 | } |
| 40 | }) |
| 41 | } |
| 42 | } |
| 43 | |
amadan