func MakeFakeRefreshForSnaps(snaps []string, blobDir string) error {
storePrivKey, _ := assertstest.ReadPrivKey(systestkeys.TestStorePrivKey)
db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
KeypairManager: asserts.NewMemoryKeypairManager(),
Backstore: asserts.NewMemoryBackstore(),
Trusted: sysdb.Trusted(),
})
if err != nil {
return err
}
// for signing
db.ImportKey(storePrivKey)
var cliConfig client.Config
cli := client.New(&cliConfig)
retrieve := func(ref *asserts.Ref) (asserts.Assertion, error) {
headers := make(map[string]string)
for i, k := range ref.Type.PrimaryKey {
headers[k] = ref.PrimaryKey[i]
}
as, err := cli.Known(ref.Type.Name, headers)
if err != nil {
return nil, err
}
switch len(as) {
case 1:
return as[0], nil
case 0:
return nil, asserts.ErrNotFound
default:
panic(fmt.Sprintf("multiple assertions when retrieving by primary key: %v", ref))
}
}
save := func(a asserts.Assertion) error {
err := db.Add(a)
if err != nil {
if _, ok := err.(*asserts.RevisionError); !ok {
return err
}
}
return writeAssert(a, blobDir)
}
f := asserts.NewFetcher(db, retrieve, save)
for _, snap := range snaps {
if err := makeFakeRefreshForSnap(snap, blobDir, db, f); err != nil {
return err
}
}
return nil
}
func (gkms *gpgKeypairMgrSuite) TestUseInSigningKeyTooShort(c *C) {
gkms.importKey(shortPrivKey)
privk, _ := assertstest.ReadPrivKey(shortPrivKey)
signDB, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
KeypairManager: gkms.keypairMgr,
})
c.Assert(err, IsNil)
headers := map[string]interface{}{
"authority-id": "dev1-id",
"snap-sha3-384": blobSHA3_384,
"snap-id": "snap-id-1",
"grade": "devel",
"snap-size": "1025",
"timestamp": time.Now().Format(time.RFC3339),
}
_, err = signDB.Sign(asserts.SnapBuildType, headers, nil, privk.PublicKey().ID())
c.Check(err, ErrorMatches, `cannot sign assertion: signing needs at least a 4096 bits key, got 2048`)
}
func MakeFakeRefreshForSnaps(snaps []string, blobDir string) error {
storePrivKey, _ := assertstest.ReadPrivKey(systestkeys.TestStorePrivKey)
db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
KeypairManager: asserts.NewMemoryKeypairManager(),
Backstore: asserts.NewMemoryBackstore(),
Trusted: sysdb.Trusted(),
})
if err != nil {
return err
}
// for signing
db.ImportKey(storePrivKey)
// XXX: ideally for consistency we should talk to the local snapd
// but this allows us to go working until snapd itself
// start being fully assertion using
sto := store.New(nil, nil)
retrieve := func(ref *asserts.Ref) (asserts.Assertion, error) {
return sto.Assertion(ref.Type, ref.PrimaryKey, nil)
}
save := func(a asserts.Assertion) error {
err := db.Add(a)
if err != nil {
if _, ok := err.(*asserts.RevisionError); !ok {
return err
}
}
return writeAssert(a, blobDir)
}
f := asserts.NewFetcher(db, retrieve, save)
for _, snap := range snaps {
if err := makeFakeRefreshForSnap(snap, blobDir, db, f); err != nil {
return err
}
}
return nil
}
func (gkms *gpgKeypairMgrSuite) TestUseInSigningBrokenSignature(c *C) {
_, rsaPrivKey := assertstest.ReadPrivKey(assertstest.DevKey)
pgpPrivKey := packet.NewRSAPrivateKey(time.Unix(1, 0), rsaPrivKey)
var breakSig func(sig *packet.Signature, cont []byte) []byte
mockGPG := func(prev asserts.GPGRunner, input []byte, args ...string) ([]byte, error) {
if args[1] == "--list-secret-keys" || args[1] == "--export" {
return prev(input, args...)
}
n := len(args)
c.Assert(args[n-1], Equals, "--detach-sign")
sig := new(packet.Signature)
sig.PubKeyAlgo = packet.PubKeyAlgoRSA
sig.Hash = crypto.SHA512
sig.CreationTime = time.Now()
// poking to break the signature
cont := breakSig(sig, input)
h := sig.Hash.New()
h.Write([]byte(cont))
err := sig.Sign(h, pgpPrivKey, nil)
c.Assert(err, IsNil)
buf := new(bytes.Buffer)
sig.Serialize(buf)
return buf.Bytes(), nil
}
restore := asserts.MockRunGPG(mockGPG)
defer restore()
signDB, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
KeypairManager: gkms.keypairMgr,
})
c.Assert(err, IsNil)
headers := map[string]interface{}{
"authority-id": "dev1-id",
"snap-sha3-384": blobSHA3_384,
"snap-id": "snap-id-1",
"grade": "devel",
"snap-size": "1025",
"timestamp": time.Now().Format(time.RFC3339),
}
tests := []struct {
breakSig func(*packet.Signature, []byte) []byte
expectedErr string
}{
{func(sig *packet.Signature, cont []byte) []byte {
sig.Hash = crypto.SHA1
return cont
}, "cannot sign assertion: bad GPG produced signature: expected SHA512 digest"},
{func(sig *packet.Signature, cont []byte) []byte {
return cont[:5]
}, "cannot sign assertion: bad GPG produced signature: it does not verify:.*"},
}
for _, t := range tests {
breakSig = t.breakSig
_, err = signDB.Sign(asserts.SnapBuildType, headers, nil, assertstest.DevKeyID)
c.Check(err, ErrorMatches, t.expectedErr)
}
}
import (
"fmt"
"io"
"io/ioutil"
"net"
"net/http"
"os"
"os/signal"
"syscall"
"time"
"github.com/snapcore/snapd/asserts"
"github.com/snapcore/snapd/asserts/assertstest"
)
var devPrivKey, _ = assertstest.ReadPrivKey(assertstest.DevKey)
func main() {
if len(os.Args) < 2 {
fmt.Fprintf(os.Stderr, "no listening address arg\n")
os.Exit(1)
}
l, err := net.Listen("tcp", os.Args[1])
if err != nil {
fmt.Fprintf(os.Stderr, "cannot listen: %v\n", err)
os.Exit(1)
}
s := &http.Server{Handler: http.HandlerFunc(handle)}
go s.Serve(l)
