func (gkms *gpgKeypairMgrSuite) TestUseInSigningFailure(c *C) { mockGPG := func(prev asserts.GPGRunner, input []byte, args ...string) ([]byte, error) { if args[1] == "--list-secret-keys" || args[1] == "--export" { return prev(input, args...) } n := len(args) c.Assert(args[n-1], Equals, "--detach-sign") return nil, fmt.Errorf("boom") } restore := asserts.MockRunGPG(mockGPG) defer restore() signDB, err := asserts.OpenDatabase(&asserts.DatabaseConfig{ KeypairManager: gkms.keypairMgr, }) c.Assert(err, IsNil) headers := map[string]interface{}{ "authority-id": "dev1-id", "snap-sha3-384": blobSHA3_384, "snap-id": "snap-id-1", "grade": "devel", "snap-size": "1025", "timestamp": time.Now().Format(time.RFC3339), } _, err = signDB.Sign(asserts.SnapBuildType, headers, nil, assertstest.DevKeyID) c.Check(err, ErrorMatches, "cannot sign assertion: cannot sign using GPG: boom") }
func (gkms *gpgKeypairMgrSuite) TestGetNotUnique(c *C) { mockGPG := func(prev asserts.GPGRunner, input []byte, args ...string) ([]byte, error) { if args[1] == "--list-secret-keys" { return prev(input, args...) } c.Assert(args[1], Equals, "--export") pk1, err := rsa.GenerateKey(rand.Reader, 512) c.Assert(err, IsNil) pk2, err := rsa.GenerateKey(rand.Reader, 512) c.Assert(err, IsNil) buf := new(bytes.Buffer) err = packet.NewRSAPublicKey(time.Now(), &pk1.PublicKey).Serialize(buf) c.Assert(err, IsNil) err = packet.NewRSAPublicKey(time.Now(), &pk2.PublicKey).Serialize(buf) c.Assert(err, IsNil) return buf.Bytes(), nil } restore := asserts.MockRunGPG(mockGPG) defer restore() _, err := gkms.keypairMgr.Get(assertstest.DevKeyID) c.Check(err, ErrorMatches, `cannot load GPG public key with fingerprint "[A-F0-9]+": cannot select exported public key, found many`) }
func (gkms *gpgKeypairMgrSuite) TestUseInSigningBrokenSignature(c *C) { _, rsaPrivKey := assertstest.ReadPrivKey(assertstest.DevKey) pgpPrivKey := packet.NewRSAPrivateKey(time.Unix(1, 0), rsaPrivKey) var breakSig func(sig *packet.Signature, cont []byte) []byte mockGPG := func(prev asserts.GPGRunner, input []byte, args ...string) ([]byte, error) { if args[1] == "--list-secret-keys" || args[1] == "--export" { return prev(input, args...) } n := len(args) c.Assert(args[n-1], Equals, "--detach-sign") sig := new(packet.Signature) sig.PubKeyAlgo = packet.PubKeyAlgoRSA sig.Hash = crypto.SHA512 sig.CreationTime = time.Now() // poking to break the signature cont := breakSig(sig, input) h := sig.Hash.New() h.Write([]byte(cont)) err := sig.Sign(h, pgpPrivKey, nil) c.Assert(err, IsNil) buf := new(bytes.Buffer) sig.Serialize(buf) return buf.Bytes(), nil } restore := asserts.MockRunGPG(mockGPG) defer restore() signDB, err := asserts.OpenDatabase(&asserts.DatabaseConfig{ KeypairManager: gkms.keypairMgr, }) c.Assert(err, IsNil) headers := map[string]interface{}{ "authority-id": "dev1-id", "snap-sha3-384": blobSHA3_384, "snap-id": "snap-id-1", "grade": "devel", "snap-size": "1025", "timestamp": time.Now().Format(time.RFC3339), } tests := []struct { breakSig func(*packet.Signature, []byte) []byte expectedErr string }{ {func(sig *packet.Signature, cont []byte) []byte { sig.Hash = crypto.SHA1 return cont }, "cannot sign assertion: bad GPG produced signature: expected SHA512 digest"}, {func(sig *packet.Signature, cont []byte) []byte { return cont[:5] }, "cannot sign assertion: bad GPG produced signature: it does not verify:.*"}, } for _, t := range tests { breakSig = t.breakSig _, err = signDB.Sign(asserts.SnapBuildType, headers, nil, assertstest.DevKeyID) c.Check(err, ErrorMatches, t.expectedErr) } }