| 1 | //go:build linux |
| 2 | |
| 3 | package provisioner |
| 4 | |
| 5 | import ( |
| 6 | "bytes" |
| 7 | "testing" |
| 8 | ) |
| 9 | |
| 10 | func TestAgeCredentialCustody(t *testing.T) { |
| 11 | floor, key := floorFixture(t) |
| 12 | password := []byte("synthetic-test-passphrase") |
| 13 | wrapped, e := wrapCredential(key, floor.identity, password) |
| 14 | if e != nil { |
| 15 | t.Fatal(e) |
| 16 | } |
| 17 | if bytes.Contains(wrapped, password) || bytes.Contains(wrapped, []byte(floor.identity.Registry)) { |
| 18 | t.Fatal("plaintext credential in envelope") |
| 19 | } |
| 20 | if e = floor.dir.create("credential.age", wrapped); e != nil { |
| 21 | t.Fatal(e) |
| 22 | } |
| 23 | stored, e := floor.dir.read("credential.age", 128<<10) |
| 24 | if e != nil { |
| 25 | t.Fatal(e) |
| 26 | } |
| 27 | id, opened, e := unwrapCredential(stored, password) |
| 28 | if e != nil || id != floor.identity || !bytes.Equal(opened.SignPub(), key.SignPub()) || !bytes.Equal(opened.BoxPub(), key.BoxPub()) { |
| 29 | t.Fatal("credential round trip", e) |
| 30 | } |
| 31 | if _, _, e = unwrapCredential(stored, []byte("wrong")); e != ErrRefused { |
| 32 | t.Fatal("wrong passphrase", e) |
| 33 | } |
| 34 | stored[len(stored)-1] ^= 1 |
| 35 | if _, _, e = unwrapCredential(stored, password); e != ErrRefused { |
| 36 | t.Fatal("tampered credential", e) |
| 37 | } |
| 38 | } |
| 39 | |
amadan