amadan

eleven / ocho Public

Clone 
git clone https://amadan.net/eleven/ocho

Plain git — no account needed to clone.

Download

Download this file

1package main
2
3import (
4 "crypto/ed25519"
5 "crypto/rand"
6 "encoding/base64"
7 "encoding/json"
8 "os"
9 "path/filepath"
10 "strings"
11 "testing"
12 "time"
13)
14
15func testManifest() *releaseManifest {
16 return &releaseManifest{
17 Schema: 1,
18 GeneratedAt: time.Now().UTC(),
19 Channels: map[string]releaseEntry{
20 "edge": {
21 Version: "abc1234",
22 URL: "https://github.com/elevenmessenger/releases/releases/download/server-abc1234/lchat-linux-amd64",
23 SHA256: strings.Repeat("ab", 32),
24 Size: 123,
25 },
26 "stable": {
27 Version: "def5678",
28 URL: "https://github.com/elevenmessenger/releases/releases/download/server-def5678/lchat-linux-amd64",
29 SHA256: strings.Repeat("cd", 32),
30 },
31 },
32 }
33}
34
35func TestReleaseManifestSignVerifyRoundTrip(t *testing.T) {
36 pub, priv, err := ed25519.GenerateKey(rand.Reader)
37 if err != nil {
38 t.Fatal(err)
39 }
40 wrapper, err := signReleaseManifest(priv, testManifest())
41 if err != nil {
42 t.Fatalf("sign: %v", err)
43 }
44 m, err := verifyReleaseManifest(pub, wrapper)
45 if err != nil {
46 t.Fatalf("verify: %v", err)
47 }
48 if m.Channels["edge"].Version != "abc1234" || m.Channels["stable"].Version != "def5678" {
49 t.Fatalf("channels didn't round-trip: %+v", m.Channels)
50 }
51 if m.GeneratedAt.IsZero() {
52 t.Fatal("generated_at not stamped")
53 }
54 // beta is legitimately unset — a channel may lag behind.
55 if _, ok := m.Channels["beta"]; ok {
56 t.Fatal("unexpected beta channel")
57 }
58}
59
60func TestReleaseManifestRejectsTamperAndWrongKey(t *testing.T) {
61 pub, priv, _ := ed25519.GenerateKey(rand.Reader)
62 otherPub, _, _ := ed25519.GenerateKey(rand.Reader)
63 wrapper, err := signReleaseManifest(priv, testManifest())
64 if err != nil {
65 t.Fatal(err)
66 }
67
68 if _, err := verifyReleaseManifest(otherPub, wrapper); err == nil {
69 t.Fatal("verified with the wrong public key")
70 }
71
72 // Flip the channel pointer inside the payload; the signature must not survive.
73 var sm signedManifest
74 if err := json.Unmarshal(wrapper, &sm); err != nil {
75 t.Fatal(err)
76 }
77 payload, _ := base64.StdEncoding.DecodeString(sm.Payload)
78 tampered := strings.Replace(string(payload), "abc1234", "eee6666", 1)
79 sm.Payload = base64.StdEncoding.EncodeToString([]byte(tampered))
80 rewrapped, _ := json.Marshal(sm)
81 if _, err := verifyReleaseManifest(pub, rewrapped); err == nil {
82 t.Fatal("verified a tampered payload")
83 }
84
85 if _, err := verifyReleaseManifest(pub, []byte(`{"payload":"","sig":""}`)); err == nil {
86 t.Fatal("verified an empty wrapper")
87 }
88}
89
90func TestValidateManifestRejectsBadEntries(t *testing.T) {
91 cases := map[string]func(*releaseManifest){
92 "unknown channel": func(m *releaseManifest) { m.Channels["nightly"] = m.Channels["edge"] },
93 "bad version": func(m *releaseManifest) { e := m.Channels["edge"]; e.Version = "../evil"; m.Channels["edge"] = e },
94 "dev version": func(m *releaseManifest) { e := m.Channels["edge"]; e.Version = "dev"; m.Channels["edge"] = e },
95 "http url": func(m *releaseManifest) { e := m.Channels["edge"]; e.URL = "http://x/lchat"; m.Channels["edge"] = e },
96 "short sha256": func(m *releaseManifest) { e := m.Channels["edge"]; e.SHA256 = "abcd"; m.Channels["edge"] = e },
97 "non-hex sha256": func(m *releaseManifest) {
98 e := m.Channels["edge"]
99 e.SHA256 = strings.Repeat("zz", 32)
100 m.Channels["edge"] = e
101 },
102 "unknown schema": func(m *releaseManifest) { m.Schema = 2 },
103 "zero generatedAt": func(m *releaseManifest) { m.GeneratedAt = time.Time{} },
104 }
105 for name, mutate := range cases {
106 m := testManifest()
107 mutate(m)
108 if err := validateManifest(m); err == nil {
109 t.Errorf("%s: validateManifest accepted it", name)
110 }
111 }
112 if err := validateManifest(testManifest()); err != nil {
113 t.Errorf("good manifest rejected: %v", err)
114 }
115}
116
117func TestReleaseEntryForArch(t *testing.T) {
118 both := releaseEntry{
119 URL: "https://x/amd64", SHA256: strings.Repeat("aa", 32),
120 ARM64URL: "https://x/arm64", ARM64SHA256: strings.Repeat("bb", 32),
121 }
122 if u, s, ok := both.forArch("amd64"); !ok || u != "https://x/amd64" || s != strings.Repeat("aa", 32) {
123 t.Fatalf("amd64 = %q %q %v", u, s, ok)
124 }
125 if u, s, ok := both.forArch("arm64"); !ok || u != "https://x/arm64" || s != strings.Repeat("bb", 32) {
126 t.Fatalf("arm64 = %q %q %v", u, s, ok)
127 }
128 // A pre-arm64 entry: amd64 resolves, arm64 says "no build".
129 amdOnly := releaseEntry{URL: "https://x/amd64", SHA256: strings.Repeat("aa", 32)}
130 if _, _, ok := amdOnly.forArch("arm64"); ok {
131 t.Fatal("arm64 resolved on an amd64-only entry")
132 }
133 if _, _, ok := amdOnly.forArch("riscv64"); ok {
134 t.Fatal("unknown arch resolved")
135 }
136}
137
138func TestValidateManifestChecksARM64Fields(t *testing.T) {
139 m := testManifest()
140 e := m.Channels["edge"]
141 e.ARM64URL = "http://insecure.example/lchat"
142 e.ARM64SHA256 = strings.Repeat("cd", 32)
143 m.Channels["edge"] = e
144 if err := validateManifest(m); err == nil {
145 t.Fatal("http arm64 URL accepted")
146 }
147 e.ARM64URL = "https://ok.example/lchat"
148 e.ARM64SHA256 = "short"
149 m.Channels["edge"] = e
150 if err := validateManifest(m); err == nil {
151 t.Fatal("bad arm64 sha accepted")
152 }
153 e.ARM64SHA256 = strings.Repeat("cd", 32)
154 m.Channels["edge"] = e
155 if err := validateManifest(m); err != nil {
156 t.Fatalf("good arm64 entry rejected: %v", err)
157 }
158}
159
160func TestReadReleaseKeyRoundTrip(t *testing.T) {
161 pub, priv, _ := ed25519.GenerateKey(rand.Reader)
162 path := filepath.Join(t.TempDir(), "key.b64")
163 // keygen writes base64(seed) + newline; mirror that.
164 if err := os.WriteFile(path, []byte(base64.StdEncoding.EncodeToString(priv.Seed())+"\n"), 0o600); err != nil {
165 t.Fatal(err)
166 }
167 got, err := readReleaseKey(path)
168 if err != nil {
169 t.Fatal(err)
170 }
171 if !got.Public().(ed25519.PublicKey).Equal(pub) {
172 t.Fatal("key didn't round-trip through the seed file")
173 }
174
175 bad := filepath.Join(t.TempDir(), "bad.b64")
176 os.WriteFile(bad, []byte("not-a-key\n"), 0o600)
177 if _, err := readReleaseKey(bad); err == nil {
178 t.Fatal("accepted a malformed key file")
179 }
180}
181
182// The no-disk path: the seed value itself (as LCHAT_RELEASE_KEY carries it)
183// parses straight from a string, tolerating the whitespace a shell fetch
184// picks up, and rejects everything that isn't a 32-byte seed.
185func TestParseReleaseSeedFromValue(t *testing.T) {
186 pub, priv, _ := ed25519.GenerateKey(rand.Reader)
187 got, err := parseReleaseSeed(base64.StdEncoding.EncodeToString(priv.Seed())+"\n", "LCHAT_RELEASE_KEY")
188 if err != nil {
189 t.Fatal(err)
190 }
191 if !got.Public().(ed25519.PublicKey).Equal(pub) {
192 t.Fatal("key didn't round-trip through the env value")
193 }
194 for _, bad := range []string{"", "not-a-key", base64.StdEncoding.EncodeToString([]byte("short"))} {
195 if _, err := parseReleaseSeed(bad, "LCHAT_RELEASE_KEY"); err == nil {
196 t.Fatalf("accepted %q as a seed", bad)
197 }
198 }
199}
200
201func TestBakedReleasePubKeyParses(t *testing.T) {
202 if _, err := releasePubKey(); err != nil {
203 t.Fatalf("baked public key is invalid: %v", err)
204 }
205}
206