// CreateKey creates a new key inside the cryptoservice for the given role and gun,
// returning the public key. If the role is a root role, create an x509 key.
func CreateKey(cs signed.CryptoService, gun, role, keyAlgorithm string) (data.PublicKey, error) {
key, err := cs.Create(role, gun, keyAlgorithm)
if err != nil {
return nil, err
}
if role == data.CanonicalRootRole {
start := time.Now().AddDate(0, 0, -1)
privKey, _, err := cs.GetPrivateKey(key.ID())
if err != nil {
return nil, err
}
cert, err := cryptoservice.GenerateCertificate(
privKey, gun, start, start.AddDate(1, 0, 0),
)
if err != nil {
return nil, err
}
// Keep the x509 key type consistent with the key's algorithm
switch keyAlgorithm {
case data.RSAKey:
key = data.NewRSAx509PublicKey(utils.CertToPEM(cert))
case data.ECDSAKey:
key = data.NewECDSAx509PublicKey(utils.CertToPEM(cert))
default:
// This should be impossible because of the Create() call above, but just in case
return nil, fmt.Errorf("invalid key algorithm type")
}
}
return key, nil
}
func TestAddInvalidDelegationCert(t *testing.T) {
// Setup certificate
tempFile, err := ioutil.TempFile("", "pemfile")
require.NoError(t, err)
cert, _, err := generateExpiredTestCert()
require.NoError(t, err)
_, err = tempFile.Write(utils.CertToPEM(cert))
require.NoError(t, err)
tempFile.Close()
defer os.Remove(tempFile.Name())
// Setup commander
tmpDir, err := ioutil.TempDir("", "notary-cmd-test-")
require.NoError(t, err)
defer os.RemoveAll(tmpDir)
commander := setup(tmpDir)
// Should error due to expired cert
err = commander.delegationAdd(commander.GetCommand(), []string{"gun", "targets/delegation", tempFile.Name(), "--paths", "path"})
require.Error(t, err)
// Should error due to bad path
err = commander.delegationAdd(commander.GetCommand(), []string{"gun", "targets/delegation", "nonexistent-pathing", "--paths", "path"})
require.Error(t, err)
require.Contains(t, err.Error(), "file for public key does not exist")
}
func TestAddInvalidShortPubkeyCert(t *testing.T) {
// Setup certificate
tempFile, err := ioutil.TempFile("", "pemfile")
require.NoError(t, err)
cert, _, err := generateShortRSAKeyTestCert()
require.NoError(t, err)
_, err = tempFile.Write(utils.CertToPEM(cert))
require.NoError(t, err)
tempFile.Close()
defer os.Remove(tempFile.Name())
// Setup commander
tmpDir, err := ioutil.TempDir("", "notary-cmd-test-")
require.NoError(t, err)
defer os.RemoveAll(tmpDir)
commander := setup(tmpDir)
// Should error due to short RSA key
err = commander.delegationAdd(commander.GetCommand(), []string{"gun", "targets/delegation", tempFile.Name(), "--paths", "path"})
require.Error(t, err)
}
func TestAddInvalidDelegationName(t *testing.T) {
// Setup certificate
tempFile, err := ioutil.TempFile("", "pemfile")
require.NoError(t, err)
cert, _, err := generateValidTestCert()
require.NoError(t, err)
_, err = tempFile.Write(utils.CertToPEM(cert))
require.NoError(t, err)
tempFile.Close()
defer os.Remove(tempFile.Name())
// Setup commander
tmpDir, err := ioutil.TempDir("", "notary-cmd-test-")
require.NoError(t, err)
defer os.RemoveAll(tmpDir)
commander := setup(tmpDir)
// Should error due to invalid delegation name (should be prefixed by "targets/")
err = commander.delegationAdd(commander.GetCommand(), []string{"gun", "INVALID_NAME", tempFile.Name()})
require.Error(t, err)
}