diff options
41 files changed, 57 insertions, 160 deletions
diff --git a/test_data/dummy/empty.minisig b/test_data/dummy/empty.minisig deleted file mode 100644 index d63a76b..0000000 --- a/test_data/dummy/empty.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH37X0B74mktSw+uhv3eD71BHADzcpvP5eGU2lRX9a0MNk8TJj8nIOQJmJWHKi87o42MUYDLYrOvXRZdrUReaQLA0= -trusted comment: time:10 file:server_list.json hashed -4vDB1K8YvTX52NYN9NAEqYg39dRe60mBu93GxFmWHPdzAGzI8OKY9IuQhQrEyhEVjnrLBnQquWuBcA6oKjjOBw== diff --git a/test_data/dummy/generate.sh b/test_data/dummy/generate.sh index c1827eb..38bbc89 100755 --- a/test_data/dummy/generate.sh +++ b/test_data/dummy/generate.sh @@ -8,11 +8,13 @@ then exit 1 fi -rm -f *.minisig *.blake2b *.key +rm -f *.minisig *.blake2b -echo -en "\n\n" | minisign -Gf -p public.key -s secret.key & -echo -en "\n\n" | minisign -Gf -p wrong_public.key -s wrong_secret.key & -wait +# Uncomment to regenerate keys +#rm -f *.key +#echo -en "\n\n" | minisign -Gf -p public.key -s secret.key & +#echo -en "\n\n" | minisign -Gf -p wrong_public.key -s wrong_secret.key & +#wait # Try to create pure signature with default Minisign (works with version < 0.10) echo | minisign -Sm server_list.json -x server_list.json.pure.minisig -t $'time:10\tfile:server_list.json' -s secret.key @@ -33,36 +35,25 @@ echo | minisign -SHm server_list.json -t $'time:10\tfile:server_list.json\thashe echo | minisign -SHm server_list.json -x server_list.json.tc_timestamp.minisig -t $'timestamp:10\tfile:server_list.json\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_nohashed.minisig -t $'time:10\tfile:server_list.json' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_latertime.minisig -t $'time:20\tfile:server_list.json\t hashed' -s secret.key & -echo | minisign -SHm server_list.json -x server_list.json.tc_orglist.minisig -t $'time:10\tfile:organization_list.json\thashed' -s secret.key & wait +echo | minisign -SHm server_list.json -x server_list.json.tc_orglist.minisig -t $'time:10\tfile:organization_list.json\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_otherfile.minisig -t $'time:10\tfile:otherfile\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_nofile.minisig -t $'time:10\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_notime.minisig -t $'file:server_list.json\thashed' -s secret.key & -echo | minisign -SHm server_list.json -x server_list.json.tc_emptytime.minisig -t $'time:\tfile:server_list.json\thashed' -s secret.key & wait +echo | minisign -SHm server_list.json -x server_list.json.tc_emptytime.minisig -t $'time:\tfile:server_list.json\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_emptyfile.minisig -t $'time:10\tfile:\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_earliertime.minisig -t $'time:9\tfile:server_list.json\thashed' -s secret.key & echo | minisign -SHm server_list.json -x server_list.json.tc_random.minisig -t 'random stuff' -s secret.key & -echo | minisign -SHm server_list-large_time.json -x server_list.json.large_time.minisig -t $'time:4300000000\tfile:server_list.json' -s secret.key & wait -echo | minisign -SHm server_list-no_version.json -x server_list.json.no_version.minisig -t $'time:10\tfile:server_list.json\thashed' -s secret.key & +echo | minisign -SHm server_list.json -x server_list.json.large_time.minisig -t $'time:4300000000\tfile:server_list.json' -s secret.key & echo | minisign -SHm organization_list.json -t $'time:10\tfile:organization_list.json\thashed' -s secret.key & echo | minisign -SHm organization_list.json -x organization_list.json.tc_servlist.minisig -t $'time:10\tfile:server_list.json\thashed' -s secret.key & echo | minisign -SHm other_list.json -t $'time:10\tfile:other_list.json\thashed' -s secret.key & -wait -echo | minisign -SHm other_list.json -x other_list.json.tc_servlist.minisig -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -echo | minisign -SHm no_list.json -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -echo | minisign -SHm random.txt -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -echo | minisign -SHm empty -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -wait - -echo | minisign -SHm wrong_type1.json -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -echo | minisign -SHm wrong_type2.json -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -echo | minisign -SHm wrong_type3.json -t $'time:10\tfile:server_list.json\thashed' -s secret.key & -echo | minisign -SHm server_list.json -x server_list.json.wrong_key.minisig -t $'time:10\tfile:server_list.json\thashed' -s wrong_secret.key +echo | minisign -SHm server_list.json -x server_list.json.wrong_key.minisig -t $'time:10\tfile:server_list.json\thashed' -s wrong_secret.key & wait ./generate_forged.py diff --git a/test_data/dummy/no_list.json b/test_data/dummy/no_list.json deleted file mode 100644 index 6d526d9..0000000 --- a/test_data/dummy/no_list.json +++ /dev/null @@ -1 +0,0 @@ -{"v": 10}
\ No newline at end of file diff --git a/test_data/dummy/no_list.json.minisig b/test_data/dummy/no_list.json.minisig deleted file mode 100644 index b359bb0..0000000 --- a/test_data/dummy/no_list.json.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH34PUZCgq9NLHNO0al3eYW2WIFrWRTopD+reJVDkKfmPCfjUWZoV6FwdDpOVLOe6lRFOurVq8g9TTgDM1Df+VHwo= -trusted comment: time:10 file:server_list.json hashed -6UryYyQ8yOGoZEBb0YFjluikcGgtlbHM+n7kBzKqesogsSwxGgRsyUCpZg6zVXMNA60WifPdTGM3826B0G1iCA== diff --git a/test_data/dummy/organization_list.json b/test_data/dummy/organization_list.json index 40659a6..8c53044 100644 --- a/test_data/dummy/organization_list.json +++ b/test_data/dummy/organization_list.json @@ -1 +1 @@ -{"v": 10, "organization_list": [{}]}
\ No newline at end of file +{"organization_list": [{}]}
\ No newline at end of file diff --git a/test_data/dummy/organization_list.json.minisig b/test_data/dummy/organization_list.json.minisig index 15760af..c345db3 100644 --- a/test_data/dummy/organization_list.json.minisig +++ b/test_data/dummy/organization_list.json.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+EAlVhHv1I/fTUYFhcvppPBjs4zjh3tVDBRvY2r6WjwjMRo1UGT+/5v1UDKF+IiodwilIWsLZ1e5he8N+fmhwc= +RURMm6vfaPgH31cHjNvTEh+TCqDVCwUgFVZoRdgWYAaQDxH3L3UIsRi9Qb1O4vLI4V1CYPatKzXZnSodSJM/AZgl9v7l/5bfPQ0= trusted comment: time:10 file:organization_list.json hashed -bTuXE4D9qBj/t432EVM6TPGqnhLXOeXm+J61pC62nHsv9sf2XAIfTVbigJEif6oq1Dcn6zV9fQtAJjz3AkiWCg== +8cINvI8MEdXjPHadX7Qk/8sTMyCjSZMR999a074xlSTwsmtMpsBi9blyeIKFaBL7SjA3w9IUTZucLeFi11MXBw== diff --git a/test_data/dummy/organization_list.json.tc_servlist.minisig b/test_data/dummy/organization_list.json.tc_servlist.minisig index 3a495af..44e362b 100644 --- a/test_data/dummy/organization_list.json.tc_servlist.minisig +++ b/test_data/dummy/organization_list.json.tc_servlist.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+EAlVhHv1I/fTUYFhcvppPBjs4zjh3tVDBRvY2r6WjwjMRo1UGT+/5v1UDKF+IiodwilIWsLZ1e5he8N+fmhwc= +RURMm6vfaPgH31cHjNvTEh+TCqDVCwUgFVZoRdgWYAaQDxH3L3UIsRi9Qb1O4vLI4V1CYPatKzXZnSodSJM/AZgl9v7l/5bfPQ0= trusted comment: time:10 file:server_list.json hashed -JLe4dI+Y91aGo/GECbOAMSZyI00IH8KATKHah8sofDNP8IofnerBaFr7EJll1OMDwG8LHERj+N/hxCLTLnAsCA== +ujh/YTcmyY6Sy15I7qCXJA5sGmH0D2L50CwztFQk+cpQhsaQIu7rNapzx2xsQU0VBG/QVrwpZMqe47PofvVQBQ== diff --git a/test_data/dummy/other_list.json b/test_data/dummy/other_list.json index b9173b4..25ba1a8 100644 --- a/test_data/dummy/other_list.json +++ b/test_data/dummy/other_list.json @@ -1 +1 @@ -{"v": 10, "other_list": [{}]}
\ No newline at end of file +{"other_list": [{}]}
\ No newline at end of file diff --git a/test_data/dummy/other_list.json.minisig b/test_data/dummy/other_list.json.minisig index fdcc611..9064f96 100644 --- a/test_data/dummy/other_list.json.minisig +++ b/test_data/dummy/other_list.json.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3zw6RcbqKoo6TF0SC9VSoMXYdlCKv/UYe+MwB02RahrQiz0GRXvjQCTqIk285ACFDa/zvbQT+6Pz9qPdQbFfJwo= +RURMm6vfaPgH366C1RnYeUAgEeX/S5A1Z9qmkV2+GJaVj06FWGd4aMLc+HS7iFMhG69u3TVD4YmzMH12rk7hQrnyCC6ex8ypIQA= trusted comment: time:10 file:other_list.json hashed -0/XK9VogUrpXItEzxgVJQ6up6Q4W+yesOD2MMgxk8BRgyCZMe6OlnynWZ3RjAARVYGInE8DdTFVuGlbvxCdoBg== +ZRufdNNEvGrB6W35I7+w2o/YF1wjg3i3UdVlnp79L3g5SS+jNRVOZUGdZg8B7pHfb5LmfCgoeDSOK0nflDNmBw== diff --git a/test_data/dummy/other_list.json.tc_servlist.minisig b/test_data/dummy/other_list.json.tc_servlist.minisig deleted file mode 100644 index f2305c0..0000000 --- a/test_data/dummy/other_list.json.tc_servlist.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH3zw6RcbqKoo6TF0SC9VSoMXYdlCKv/UYe+MwB02RahrQiz0GRXvjQCTqIk285ACFDa/zvbQT+6Pz9qPdQbFfJwo= -trusted comment: time:10 file:server_list.json hashed -vVRdITGMjSGAw5aVX+Dhyv3qSSF36icev2isJ9BhebG20pXU8h8+y2sTwbrtEYmhbfYz4Zoh6dCPIRTr5VMHDA== diff --git a/test_data/dummy/random.txt.minisig b/test_data/dummy/random.txt.minisig deleted file mode 100644 index 4bebf22..0000000 --- a/test_data/dummy/random.txt.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH35niInKYye9FSII9DPlEUaFThD8gytCLidh6UlwWY1nKrWzj3uJU9Wpixsy4WNTFs+C2U/L6GEL4UpyqmSYxvAs= -trusted comment: time:10 file:server_list.json hashed -ugN/DFNQnfPlaq7mHN3BAA78BiajMx6V6fIMqCzzw2lfZ3CZf5IJqvFoers4nd5mcRU+h0+K1CXtSQ0H3QqrCw== diff --git a/test_data/dummy/server_list-large_time.json b/test_data/dummy/server_list-large_time.json deleted file mode 100644 index dd68dbf..0000000 --- a/test_data/dummy/server_list-large_time.json +++ /dev/null @@ -1 +0,0 @@ -{"v": 4300000000, "server_list": [{}]}
\ No newline at end of file diff --git a/test_data/dummy/server_list-no_version.json b/test_data/dummy/server_list-no_version.json deleted file mode 100644 index 870f603..0000000 --- a/test_data/dummy/server_list-no_version.json +++ /dev/null @@ -1 +0,0 @@ -{"server_list": [{}]}
\ No newline at end of file diff --git a/test_data/dummy/server_list.json b/test_data/dummy/server_list.json index cd7a2fc..67c4c8d 100644 --- a/test_data/dummy/server_list.json +++ b/test_data/dummy/server_list.json @@ -1,4 +1,3 @@ { -"v": 10, "server_list": [{}] }
\ No newline at end of file diff --git a/test_data/dummy/server_list.json.blake2b b/test_data/dummy/server_list.json.blake2b Binary files differindex fa518b0..5d2ca5a 100644 --- a/test_data/dummy/server_list.json.blake2b +++ b/test_data/dummy/server_list.json.blake2b diff --git a/test_data/dummy/server_list.json.forged_keyid.minisig b/test_data/dummy/server_list.json.forged_keyid.minisig index 47bf07c..7516453 100644 --- a/test_data/dummy/server_list.json.forged_keyid.minisig +++ b/test_data/dummy/server_list.json.forged_keyid.minisig @@ -1,4 +1,4 @@ untrusted comment: this signature was created with wrong_secret.key but has key ID changed to that of public.key -RURMm6vfaPgH34YqePnvXzZNdensQNeTgKBNU/VlClWSLnReSChya50QL1IDQ5HIcvoldxQXIsN5lPq26QXCyo20n1SSJdHBdgA= +RURMm6vfaPgH35aarz3NMq4gbv6JvzOnjG003bDe6USu+HT/JzuxHjQcQGE/KBPdyCF6BDDwwFu+NVmi5jotYCJHWOEqSBU70gE= trusted comment: time:10 file:server_list.json hashed -TkBoQ63jJwklgf33e1VFNTMaEgCF69Z+bcWpy/1phkJ4Dkol0Z/pYniK3ffjWOg3Y4vysNvzsMmZbbayd4nzCw== +tKsH1t7JeYjOkVfWmpCaaZUJtCDa0WSuRFVYERkF5cMtVQqEZqC7dKYLssrqUtzCi7RLld9dGlkzCaV17jKhBg== diff --git a/test_data/dummy/server_list.json.forged_pure.minisig b/test_data/dummy/server_list.json.forged_pure.minisig index 821e5bf..d8a2fe7 100644 --- a/test_data/dummy/server_list.json.forged_pure.minisig +++ b/test_data/dummy/server_list.json.forged_pure.minisig @@ -1,4 +1,4 @@ untrusted comment: this signature has ED changed to Ed -RWRMm6vfaPgH3468S+WQnqA/CiMM4vnRHpRhc+/EiZ6oJIUm8L6YFLohddvAluuIHrxUF8xHYrcFMEV3nwZp8zETYilf7Jf/YAM= +RWRMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 file:server_list.json hashed -PZKFWM7fEW/JuAN7NU06D0izv5gs1E1jknwcmw/KsW27G0byCt/BE7gp57WGsiYf95dfEQ/kCXrlyt0DI4UTCA== +NU05nB8NlklbSac5agwbfwjKYRMrK2g9vSwBSAIPXgiwQSvKvSduFG10ZksMzaJIxDENCbF7ADEzTU9SjbSXCw== diff --git a/test_data/dummy/server_list.json.large_time.minisig b/test_data/dummy/server_list.json.large_time.minisig index 716533c..3392415 100644 --- a/test_data/dummy/server_list.json.large_time.minisig +++ b/test_data/dummy/server_list.json.large_time.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3xz7UhLjwbpWw7WZZN/GnSx2nOsrJsaDWhuNuK0WOzlWBwnYUrjFiLTPYtQa+go6/N/2EXM02EQyj0ELqV3K0wk= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:4300000000 file:server_list.json -rGuS5UfZfWGBaJoDPNIP7/tmO9++5iifsldkuESjTfFgll2MxgesjAxnVZsAYSFOWRav2n2P6i9K2vhAvk3LCQ== +TtTWB1mfCPIchyH5IrdVJqSFWT4uFCZjODzuHiEpMd2i5xNNTjXRK9ZlUnLmjO292Re2WUcwH3hplahHCF8lAA== diff --git a/test_data/dummy/server_list.json.minisig b/test_data/dummy/server_list.json.minisig index 97841ff..d4b7447 100644 --- a/test_data/dummy/server_list.json.minisig +++ b/test_data/dummy/server_list.json.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 file:server_list.json hashed -P12W9POiQIpCupKMatkUFbX5aaY85rsE9UEvgUpc7AN0icIAh7P8s/obhlJlq9vAtg+l9vxVamZAJBI0R2FuBw== +NU05nB8NlklbSac5agwbfwjKYRMrK2g9vSwBSAIPXgiwQSvKvSduFG10ZksMzaJIxDENCbF7ADEzTU9SjbSXCw== diff --git a/test_data/dummy/server_list.json.no_version.minisig b/test_data/dummy/server_list.json.no_version.minisig deleted file mode 100644 index 1ee89eb..0000000 --- a/test_data/dummy/server_list.json.no_version.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH32KZmkXL8p9XSeoCfrxvEt1kTYz4pM6+CJqgQXzNIxXJcfqlq9jjfpaXS2txPZVvmBZbzHzdSO16KikdzuWKnAk= -trusted comment: time:10 file:server_list.json hashed -ZmvB/bPjBxt7iJquAIEfd8YK8VTLIcdr848MEY/is8f+c1yUFJM+VLtiSbwCFRyUA6QxVOhL2uzAoJobFRNSBw== diff --git a/test_data/dummy/server_list.json.pure.minisig b/test_data/dummy/server_list.json.pure.minisig index 9dee5ed..e52b959 100644 --- a/test_data/dummy/server_list.json.pure.minisig +++ b/test_data/dummy/server_list.json.pure.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RWRMm6vfaPgH33qxh/XhkHg66QQ+h62gXr0tzFexMBWpehd0OKb5EtSyXCvx3WuUqEPvv0ybFIqkSiyK6d5BdqKA3hCJoh/HYwQ= +RWRMm6vfaPgH3zQ/rcq2GMsNz1SYySz+olupm0I+nzNpOkPyUHTBwig3Pep4biOk/bH73bH+0sLNoZPcDk1f2Acn8JINc9MWMw4= trusted comment: time:10 file:server_list.json -a5AITiKYoSwoxKJNZXynQT9QzImQbVDbrYRZACmoTKo1a+IT39KYFf+J2jTmvmtCY5SiwxllpL3geqyLI2f6DA== +e8ylfwod0cRHyydeqPMhZwGCO6zItvSFaU3OgDFbop1wDgFc6keO4EV29psMv4QV6Zt+rD8UEWVJAxp76kmhAA== diff --git a/test_data/dummy/server_list.json.tc_earliertime.minisig b/test_data/dummy/server_list.json.tc_earliertime.minisig index 7f1aa5e..dd5ace6 100644 --- a/test_data/dummy/server_list.json.tc_earliertime.minisig +++ b/test_data/dummy/server_list.json.tc_earliertime.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:9 file:server_list.json hashed -Ba+AQWYfoujiqymAllki84OmuSqPKSD4CKSN2yKlirAOhNG0FSkMZ+j521ffVcTRlkvs1ryp4GGrZi6MNmk1Aw== +i30ktGatqQIOf0Q9w39OVpUNihHRxKC4WSJyZ/SLeS8yCQgPxaJhmq/hW0/bOT27yrqUCAta3gNgUHWxv/76CA== diff --git a/test_data/dummy/server_list.json.tc_emptyfile.minisig b/test_data/dummy/server_list.json.tc_emptyfile.minisig index 7b0e610..e9d56ef 100644 --- a/test_data/dummy/server_list.json.tc_emptyfile.minisig +++ b/test_data/dummy/server_list.json.tc_emptyfile.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 file: hashed -jjmfi1WClEhVrKAWDi9aogmy8uJe9uzp431AsuWXWKUID1SPOmDE93ev+gKI3eciXg6K3me/H+95/C+78tkDBA== +yeuMUAEVlZfbcQKhOvNMBDdOLyRd5PfO38q3NZZA8dkYTYs5o9Y3UsOkVvIByZqEeYdMErm022VzmZINyYBfDQ== diff --git a/test_data/dummy/server_list.json.tc_emptytime.minisig b/test_data/dummy/server_list.json.tc_emptytime.minisig index d88c650..7bce05a 100644 --- a/test_data/dummy/server_list.json.tc_emptytime.minisig +++ b/test_data/dummy/server_list.json.tc_emptytime.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time: file:server_list.json hashed -t87/shYCuHQD4UlmpgGCoCtBiaB40Vk4+bQhB8eHDQiIoMD8TrMppmwbzWEYycTMK87uIZkHpqWwRvxwcCNBCw== +ufDlzH1c6IwWN07Ieb475NHSLVxN7dnsUq7LHYwW1rfJ1EUUzxl2xWN6p+y4R+vgDuClZpcCiI74mXGgfIBsDA== diff --git a/test_data/dummy/server_list.json.tc_latertime.minisig b/test_data/dummy/server_list.json.tc_latertime.minisig index c3d02cd..ba8502c 100644 --- a/test_data/dummy/server_list.json.tc_latertime.minisig +++ b/test_data/dummy/server_list.json.tc_latertime.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:20 file:server_list.json hashed -Rvt3o0yRvL1eMwR8611IsK9Mbm/Z6cYXZQ78QFOtw7qaRtsxYCJ19VCeadZpRTyb7mcCuhYIO0xKn2bBxDgKDw== +vCc6yqClkju2KcbExajjLH0YDK8U5k7v45jDS6yB7GhyA+6OrI6fMVfQqFlC4TDuUMBRqF8p7wIy5sAlkMKsBw== diff --git a/test_data/dummy/server_list.json.tc_nofile.minisig b/test_data/dummy/server_list.json.tc_nofile.minisig index 62fb2fe..447ed9b 100644 --- a/test_data/dummy/server_list.json.tc_nofile.minisig +++ b/test_data/dummy/server_list.json.tc_nofile.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 hashed -60ix9wuVi+SUredNvcMmFkbrawnZdI4bvwp/C6lpzSX+tKxD5lQwvPRkxCTIB5A6YYqz7Bj3kxwE2B5rMvNMAw== +2i+2JsAuMwNL3y6ILubgCiLTCub3oPVa2PJDOfiAzg89zGCJjxejHdmHxNxEAxte/2Ki8bYjuhMw5hx9Xr+jCw== diff --git a/test_data/dummy/server_list.json.tc_nohashed.minisig b/test_data/dummy/server_list.json.tc_nohashed.minisig index 4d86e7c..8d6d015 100644 --- a/test_data/dummy/server_list.json.tc_nohashed.minisig +++ b/test_data/dummy/server_list.json.tc_nohashed.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 file:server_list.json -EfjNa5Ak0MuLrrSphUufzx87bdfz651Pvz7zN0+1a4UUmHbQ0mTRn3PfL59PiGRbHg+di+pvLcSMSxrigvafBQ== +o6t2i6Nm3F5/zcWhwc+rmFqYlmbJ8bBpQx4CYq4kK0Kl+mU+Gl4DbicxHoq0S001J848pmHHFdjnu6qviqKvCA== diff --git a/test_data/dummy/server_list.json.tc_notime.minisig b/test_data/dummy/server_list.json.tc_notime.minisig index 83d3283..39625c3 100644 --- a/test_data/dummy/server_list.json.tc_notime.minisig +++ b/test_data/dummy/server_list.json.tc_notime.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: file:server_list.json hashed -nsZv4GCgaiy0raGkUDKqJeWBj3p6ow19b0wh6rObu9rC8H6JkWnUgbfq2yYfsccQ/8XWv53xUgji0x0GqpqLBA== +dMhb+0Y0KAO2tzI4g0ukL/VdMiLVopmXa9BS1RQBY8bYwzmebdIM4DAIZrhtO1avkpdy0prZehuhA1No6cOSAw== diff --git a/test_data/dummy/server_list.json.tc_orglist.minisig b/test_data/dummy/server_list.json.tc_orglist.minisig index 3dae307..20f5a84 100644 --- a/test_data/dummy/server_list.json.tc_orglist.minisig +++ b/test_data/dummy/server_list.json.tc_orglist.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 file:organization_list.json hashed -SPpurupiw2y7GZy1dDbrTZKWTwT0vYPJ7ftkAm5x7BevzgQ+kuTHvNhIWTbNLBeZBXVlpjAZCmuHUWejmOC0Ag== +WoL798ts/9cZuvFlq02mCgIE/0wJmK2uaPHLCKF+WF8LbbyL1/iOolIV/T5BeIxraeu1xopOF1cXcs0vwZBCDA== diff --git a/test_data/dummy/server_list.json.tc_otherfile.minisig b/test_data/dummy/server_list.json.tc_otherfile.minisig index 4e7011d..9145d2c 100644 --- a/test_data/dummy/server_list.json.tc_otherfile.minisig +++ b/test_data/dummy/server_list.json.tc_otherfile.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: time:10 file:otherfile hashed -LbomTAg8fzAaluRuFrcn8BE6Bhd9WdRDsy1aAUNIgnT3AKnnmth+JGhy+sPcIg1Bg8E5OV223FjuHIXD/X4PAw== +cZmbKG0pnPMBdnOjTrBOCEML+4UhUKJ17SKIsZ9J9aLGzS/N06RL4z+cRuyu8XMZBkPIH+8Elco8zYbwhGN9DQ== diff --git a/test_data/dummy/server_list.json.tc_random.minisig b/test_data/dummy/server_list.json.tc_random.minisig index cc4eecd..7240980 100644 --- a/test_data/dummy/server_list.json.tc_random.minisig +++ b/test_data/dummy/server_list.json.tc_random.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= trusted comment: random stuff -HojIsfIJs5MXT9/WemRXzAVQ+avpb2aqrb8IrI3SPFExwrkms4bVIkrmUt7BRe7jCI4iYKQLTZZw0rYReJK2DQ== +szGsyESH0EizTXH6n0yuQg6sHTKXr+TJW/Er9ZNJYgQV+1hVM+fc5q1EmVsJlA3kW4Rt/d1p9F0ShLIIgW2vAA== diff --git a/test_data/dummy/server_list.json.tc_timestamp.minisig b/test_data/dummy/server_list.json.tc_timestamp.minisig index 7bed9c0..143585b 100644 --- a/test_data/dummy/server_list.json.tc_timestamp.minisig +++ b/test_data/dummy/server_list.json.tc_timestamp.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RURMm6vfaPgH3+eU+m5mSKM6lHt8iJ3ZpT6Cpz9DFsVPN6P8mmvkVZzsPH3L4PukBxglWAlppOBPkFc4rOJZT/Wr2FGGuqTZywY= -trusted comment: timestamp:10 file:server_list.json -dphTJl5m8jQhkYWHRGe1yKID3zima1pFcBfKQ3e/5KffrekPEbElSXpM/4jtylwpKP/xRHsnjd5jfq/UIsE5BQ== +RURMm6vfaPgH3997FX/cHwhXJpcluwbNiznrfYV83WS/Gsd3BeO/g10Mo7Z9N5rMSXcpGrmT2CagiEEm5zSw/MEnTqs4YWICdQs= +trusted comment: timestamp:10 file:server_list.json hashed +oK41aX7rmpbO2ohF3v3+JGgSexQaVlfWvYPzaKEkDlJm8mVZtuK/h26SCRuL6PbTR92DLZU59rw8ckICUH/ADw== diff --git a/test_data/dummy/server_list.json.wrong_key.minisig b/test_data/dummy/server_list.json.wrong_key.minisig index 9d70d07..6ce87a8 100644 --- a/test_data/dummy/server_list.json.wrong_key.minisig +++ b/test_data/dummy/server_list.json.wrong_key.minisig @@ -1,4 +1,4 @@ untrusted comment: signature from minisign secret key -RUTQvDHvQuYCCIYqePnvXzZNdensQNeTgKBNU/VlClWSLnReSChya50QL1IDQ5HIcvoldxQXIsN5lPq26QXCyo20n1SSJdHBdgA= +RUTQvDHvQuYCCJaarz3NMq4gbv6JvzOnjG003bDe6USu+HT/JzuxHjQcQGE/KBPdyCF6BDDwwFu+NVmi5jotYCJHWOEqSBU70gE= trusted comment: time:10 file:server_list.json hashed -TkBoQ63jJwklgf33e1VFNTMaEgCF69Z+bcWpy/1phkJ4Dkol0Z/pYniK3ffjWOg3Y4vysNvzsMmZbbayd4nzCw== +tKsH1t7JeYjOkVfWmpCaaZUJtCDa0WSuRFVYERkF5cMtVQqEZqC7dKYLssrqUtzCi7RLld9dGlkzCaV17jKhBg== diff --git a/test_data/dummy/wrong_type1.json b/test_data/dummy/wrong_type1.json deleted file mode 100644 index 8241718..0000000 --- a/test_data/dummy/wrong_type1.json +++ /dev/null @@ -1 +0,0 @@ -{"v": {}, "server_list": [{}]}
\ No newline at end of file diff --git a/test_data/dummy/wrong_type1.json.minisig b/test_data/dummy/wrong_type1.json.minisig deleted file mode 100644 index 369a3c7..0000000 --- a/test_data/dummy/wrong_type1.json.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH31l/yZFL9ZtzF0uopg94DkRwFhqivDFdhwyC3KeeiyWC2+k4RFcxXQ70nbiPiiUvYhZDelNQE9eiuwR8Msz5RwQ= -trusted comment: time:10 file:server_list.json hashed -dGVmCcH0TgagA304aH+mU1lfVGQfjyNBdRLNV0AgN5+av4Doo1MvlN/6iqj5uqhj1JxuKioFHimQJMZxjRMuAw== diff --git a/test_data/dummy/wrong_type2.json b/test_data/dummy/wrong_type2.json deleted file mode 100644 index 224f9f8..0000000 --- a/test_data/dummy/wrong_type2.json +++ /dev/null @@ -1 +0,0 @@ -{"v": 10, "server_list": 42}
\ No newline at end of file diff --git a/test_data/dummy/wrong_type2.json.minisig b/test_data/dummy/wrong_type2.json.minisig deleted file mode 100644 index b507c06..0000000 --- a/test_data/dummy/wrong_type2.json.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH34jiRAX3xRpwqO5RT2PoE8G4mu47CXqzBGxBGvR/MnnFGB8ikiXVaVdOlNw2bkY302JuLrnDH9guN2yJejeX0Ao= -trusted comment: time:10 file:server_list.json hashed -bgA9ykDic66+AKw2cWC+uY5uFzzeHGDqpvQn/lAxL9/VTOLU8pO/NkHbuwtz1hCqlr3e7w1IYYo/opDz4s4pAg== diff --git a/test_data/dummy/wrong_type3.json b/test_data/dummy/wrong_type3.json deleted file mode 100644 index f70d7bb..0000000 --- a/test_data/dummy/wrong_type3.json +++ /dev/null @@ -1 +0,0 @@ -42
\ No newline at end of file diff --git a/test_data/dummy/wrong_type3.json.minisig b/test_data/dummy/wrong_type3.json.minisig deleted file mode 100644 index 136a5a8..0000000 --- a/test_data/dummy/wrong_type3.json.minisig +++ /dev/null @@ -1,4 +0,0 @@ -untrusted comment: signature from minisign secret key -RURMm6vfaPgH37A7gjExlbC4/GAkHE+YjPIOri/ojanNWI0GcvEO6kjphC7eoQNFHht1bDjN+CSGwKC5aG+6uXxkIo1KHCS7BwE= -trusted comment: time:10 file:server_list.json hashed -tk3DOFgX+GdVgo0amxZO1luPVbw0qxC8iRzVjMmKYmOuGyw0LUGr7sEYkWXhA6RnN4SK42T15Qe9XQsoBtK7Bw== @@ -1,7 +1,6 @@ package eduvpn_verify import ( - "encoding/json" "fmt" "github.com/jedisct1/go-minisign" ) @@ -27,15 +26,13 @@ func Verify(signatureFileContent string, signedJson []byte, expectedFileName str return valid, err } -// verifyWithKeys verifies the Minisign signature in signatureFileContent (minisig file format) over the server_list/organization_list JSON in signedJson (UTF-8). +// verifyWithKeys verifies the Minisign signature in signatureFileContent (minisig file format) over the server_list/organization_list JSON in signedJson. // // Verification is performed using a matching key in allowedPublicKeys. // The signature is checked to be a Blake2b-prehashed Ed25519 Minisign signature with a valid trusted comment. // The file type that is verified is indicated by expectedFileName, which must be one of server_list.json/organization_list.json. // The trusted comment is checked to be of the form "time<(stamp)>:<timestamp>\tfile:<expectedFileName>", optionally suffixed by something, e.g. "\thashed". -// The JSON file and signature are checked to have a timestamp with a value of at least minSignTime, which is a UNIX timestamp without milliseconds; -// more precisely: min sign time <= sign time from trusted comment <= time from JSON 'v' tag. -// The JSON file is checked to be valid JSON and contain a tag with key server_list/organization_list, depending on expectedFileName. +// The signature is checked to have a timestamp with a value of at least minSignTime, which is a UNIX timestamp without milliseconds; // // The return value will either be (true, nil) on success or (false, err) on failure. func verifyWithKeys(signatureFileContent string, signedJson []byte, expectedFileName string, minSignTime uint64, allowedPublicKeys []string) (bool, error) { @@ -88,49 +85,11 @@ func verifyWithKeys(signatureFileContent string, signedJson []byte, expectedFile fmt.Sprintf("signature was on file %q instead of expected %q", sigFileName, expectedFileName), nil} } - // Technically redundant due to checks below if signTime < minSignTime { return false, VerifyError{ErrTooOld, fmt.Sprintf("signature was created at %v < minimum time (%v)", signTime, minSignTime), nil} } - var signedData struct { - Time uint64 `json:"v"` - ServerList interface{} `json:"server_list"` - OrganizationList interface{} `json:"organization_list"` - } - err = json.Unmarshal(signedJson, &signedData) - if err != nil { - return false, VerifyError{ErrWrongFileContent, "failed to parse JSON", err} - } - - if signedData.Time == 0 { - // Field absent or 0 - return false, VerifyError{ErrWrongFileContent, "JSON file must have nonzero 'v' field", nil} - } - - if signedData.Time > signTime { - return false, VerifyError{ErrWrongFileContent, fmt.Sprintf( - "list was created at %v > signature time (%v), which should be impossible", - signedData.Time, signTime), nil} - } - - if signedData.Time < minSignTime { - return false, VerifyError{ErrTooOld, - fmt.Sprintf("list was created at %v < minimum time (%v)", signedData.Time, minSignTime), nil} - } - - switch expectedFileName { - case "server_list.json": - if _, isServerList := signedData.ServerList.([]interface{}); !isServerList { - return false, VerifyError{ErrWrongFileContent, "JSON file does not have a server_list", nil} - } - case "organization_list.json": - if _, isOrganizationList := signedData.OrganizationList.([]interface{}); !isOrganizationList { - return false, VerifyError{ErrWrongFileContent, "JSON file does not have an organization_list", nil} - } - } - return true, nil } @@ -147,7 +106,6 @@ const ( ErrInvalidSignature ErrInvalidTrustedComment ErrWrongFileName - ErrWrongFileContent ErrTooOld ErrWrongKey ) diff --git a/verify_test.go b/verify_test.go index 6951525..7547e29 100644 --- a/verify_test.go +++ b/verify_test.go @@ -79,35 +79,22 @@ func Test_verifyWithKeys(t *testing.T) { {ok, "TC later time", "server_list.json.tc_latertime.minisig", "server_list.json", "server_list.json", 10, pk}, {ErrWrongFileName, "server_list TC file:organization_list", "server_list.json.tc_orglist.minisig", "server_list.json", "server_list.json", 10, pk}, {ErrWrongFileName, "organization_list as server_list", "organization_list.json.minisig", "organization_list.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "organization_list as server_list TC file:server_list", "organization_list.json.tc_servlist.minisig", "organization_list.json", "server_list.json", 10, pk}, {ErrWrongFileName, "TC file:otherfile", "server_list.json.tc_otherfile.minisig", "server_list.json", "server_list.json", 10, pk}, {ErrInvalidTrustedComment, "TC no file", "server_list.json.tc_nofile.minisig", "server_list.json", "server_list.json", 10, pk}, {ErrInvalidTrustedComment, "TC no time", "server_list.json.tc_notime.minisig", "server_list.json", "server_list.json", 10, pk}, {errAny, "TC empty time", "server_list.json.tc_emptytime.minisig", "server_list.json", "server_list.json", 10, pk}, {errAny, "TC empty file", "server_list.json.tc_emptyfile.minisig", "server_list.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "TC earlier time", "server_list.json.tc_earliertime.minisig", "server_list.json", "server_list.json", 9, pk}, {ErrInvalidTrustedComment, "TC random", "server_list.json.tc_random.minisig", "server_list.json", "server_list.json", 10, pk}, - {ok, "large time", "server_list.json.large_time.minisig", "server_list-large_time.json", "server_list.json", 43e8, pk}, - {ErrWrongFileContent, "no version", "server_list.json.no_version.minisig", "server_list-no_version.json", "server_list.json", 10, pk}, + {ok, "large time", "server_list.json.large_time.minisig", "server_list.json", "server_list.json", 43e8, pk}, {ok, "lower min time", "server_list.json.minisig", "server_list.json", "server_list.json", 5, pk}, {ErrTooOld, "higher min time", "server_list.json.minisig", "server_list.json", "server_list.json", 11, pk}, - {ErrTooOld, "higher min time < signature time", "server_list.json.tc_latertime.minisig", "server_list.json", "server_list.json", 15, pk}, {ok, "valid organization_list", "organization_list.json.minisig", "organization_list.json", "organization_list.json", 10, pk}, {ErrWrongFileName, "organization_list TC file:server_list", "organization_list.json.tc_servlist.minisig", "organization_list.json", "organization_list.json", 10, pk}, {ErrWrongFileName, "server_list as organization_list", "server_list.json.minisig", "server_list.json", "organization_list.json", 10, pk}, - {ErrWrongFileContent, "server_list as organization_list TC file:organization_list", "server_list.json.tc_orglist.minisig", "server_list.json", "organization_list.json", 10, pk}, {ErrUnknownExpectedFileName, "valid other_list", "other_list.json.minisig", "other_list.json", "other_list.json", 10, pk}, - {ErrWrongFileName, "JSON other_list as server_list", "other_list.json.minisig", "other_list.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "JSON other_list as server_list TC file:server_list", "other_list.json.tc_servlist.minisig", "other_list.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "JSON no list", "no_list.json.minisig", "no_list.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "non-JSON file", "random.txt.minisig", "random.txt", "server_list.json", 10, pk}, - {ErrWrongFileContent, "empty file", "empty.minisig", "empty", "server_list.json", 10, pk}, - - {ErrWrongFileContent, "JSON wrong type 1", "wrong_type1.json.minisig", "wrong_type1.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "JSON wrong type 2", "wrong_type2.json.minisig", "wrong_type2.json", "server_list.json", 10, pk}, - {ErrWrongFileContent, "JSON wrong type 3", "wrong_type3.json.minisig", "wrong_type3.json", "server_list.json", 10, pk}, + {ErrWrongFileName, "other_list as server_list", "other_list.json.minisig", "other_list.json", "server_list.json", 10, pk}, {ErrInvalidSignatureFormat, "invalid signature file", "random.txt", "server_list.json", "server_list.json", 10, pk}, {ErrInvalidSignatureFormat, "empty signature file", "empty", "server_list.json", "server_list.json", 10, pk}, |