diff options
author | Colin Walters <walters@verbum.org> | 2020-04-12 18:04:06 +0000 |
---|---|---|
committer | Colin Walters <walters@verbum.org> | 2020-04-15 22:07:11 +0000 |
commit | 8e7aea4473375a12ad479d910a1e20fabe23ed18 (patch) | |
tree | 4167df4652fc0857a810c2b1dec7631016c2e09b /tests/test-signed-pull.sh | |
parent | fd55deb0f7f604d8866024540eef25fa370620bb (diff) | |
download | ostree-8e7aea4473375a12ad479d910a1e20fabe23ed18.tar.gz |
Change signature opts to include type, cleanup error handling
Previously we would pass the `verification-key` and `verification-file`
to all backends, ignoring errors from loading keys until we
found one that worked.
Instead, change the options to be `verification-<engine>-key`
and `verification-<engine>-file`, and then
rework this to use standard error handling; barf explicitly if
we can't load the public keys for example. Preserve
the semantics of accepting the first valid signature. The
first signature error is captured, the others are currently
compressed into a `(and %d more)` prefix.
And now that I look at this more closely there's a lot of
duplication between the two code paths in pull.c for verifying;
will dedup this next.
Diffstat (limited to 'tests/test-signed-pull.sh')
-rwxr-xr-x | tests/test-signed-pull.sh | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/tests/test-signed-pull.sh b/tests/test-signed-pull.sh index 6d1afe29..a8d52bc5 100755 --- a/tests/test-signed-pull.sh +++ b/tests/test-signed-pull.sh @@ -80,22 +80,22 @@ if ${CMD_PREFIX} ostree --repo=repo pull origin main; then fi echo "ok pull failure without keys preloaded" -${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-key "somewrongkey" +${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-dummy-key "somewrongkey" if ${CMD_PREFIX} ostree --repo=repo pull origin main; then assert_not_reached "pull with unknown key unexpectedly succeeded" fi echo "ok pull failure with incorrect key option" -${CMD_PREFIX} ostree --repo=repo config unset 'remote "origin"'.verification-key -${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-file "/non/existing/file" +${CMD_PREFIX} ostree --repo=repo config unset 'remote "origin"'.verification-dummy-key +${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-dummy-file "/non/existing/file" if ${CMD_PREFIX} ostree --repo=repo pull origin main; then assert_not_reached "pull with unknown keys file unexpectedly succeeded" fi echo "ok pull failure with incorrect keys file option" # Test with correct dummy key -${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-key "${DUMMYSIGN}" -${CMD_PREFIX} ostree --repo=repo config unset 'remote "origin"'.verification-file +${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-dummy-key "${DUMMYSIGN}" +${CMD_PREFIX} ostree --repo=repo config unset 'remote "origin"'.verification-dummy-file test_signed_pull "dummy" "" if ! has_libsodium; then @@ -117,7 +117,7 @@ SECRET=${ED25519SECRET} COMMIT_ARGS="--sign=${SECRET} --sign-type=ed25519" repo_init --set=sign-verify=true -${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-key "${PUBLIC}" +${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-ed25519-key "${PUBLIC}" test_signed_pull "ed25519" "key" # Prepare files with public ed25519 signatures @@ -130,13 +130,13 @@ for((i=0;i<100;i++)); do done > ${PUBKEYS} # Test case with the file containing incorrect signatures and with the correct key set -${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-file "${PUBKEYS}" +${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-ed25519-file "${PUBKEYS}" test_signed_pull "ed25519" "key+file" # Add correct key into the list echo ${PUBLIC} >> ${PUBKEYS} repo_init --set=sign-verify=true -${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-file "${PUBKEYS}" +${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-ed25519-file "${PUBKEYS}" test_signed_pull "ed25519" "file" |