aboutsummaryrefslogtreecommitdiff
path: root/object/signed/commit/integration_test.go
diff options
context:
space:
mode:
Diffstat (limited to 'object/signed/commit/integration_test.go')
-rw-r--r--object/signed/commit/integration_test.go138
1 files changed, 0 insertions, 138 deletions
diff --git a/object/signed/commit/integration_test.go b/object/signed/commit/integration_test.go
deleted file mode 100644
index 82b34b14..00000000
--- a/object/signed/commit/integration_test.go
+++ /dev/null
@@ -1,138 +0,0 @@
-package signedcommit_test
-
-import (
- "bytes"
- "os"
- "os/exec"
- "path/filepath"
- "testing"
-
- "codeberg.org/lindenii/furgit/internal/testgit"
- objectid "codeberg.org/lindenii/furgit/object/id"
- signedcommit "codeberg.org/lindenii/furgit/object/signed/commit"
-)
-
-func setupSSHSignedCommit(
- t *testing.T,
- algo objectid.Algorithm,
-) (payload []byte, allowedSignersPath string, signaturePath string) {
- t.Helper()
-
- testRepo := testgit.NewRepo(t, testgit.RepoOptions{ObjectFormat: algo})
-
- signDir := t.TempDir()
-
- signRoot, err := os.OpenRoot(signDir)
- if err != nil {
- t.Fatalf("os.OpenRoot(%q): %v", signDir, err)
- }
-
- t.Cleanup(func() { _ = signRoot.Close() })
-
- privateKeyPath := filepath.Join(signDir, "signing_key")
- allowedSignersPath = filepath.Join(signDir, "allowed_signers")
- signaturePath = filepath.Join(signDir, "commit.sig")
-
- cmd := exec.Command( //nolint:noctx
- "ssh-keygen",
- "-q",
- "-t", "ed25519",
- "-N", "",
- "-C", "runxiyu@umich.edu",
- "-f", privateKeyPath,
- ) //#nosec G204
-
- out, err := cmd.CombinedOutput()
- if err != nil {
- t.Fatalf("ssh-keygen generate failed: %v\n%s", err, out)
- }
-
- publicKey, err := signRoot.ReadFile("signing_key.pub")
- if err != nil {
- t.Fatalf("ReadFile(signing_key.pub): %v", err)
- }
-
- err = signRoot.WriteFile(
- "allowed_signers",
- append([]byte("runxiyu@umich.edu "), publicKey...),
- 0o600,
- )
- if err != nil {
- t.Fatalf("WriteFile(allowed_signers): %v", err)
- }
-
- testRepo.Run(t, "config", "gpg.format", "ssh")
- testRepo.Run(t, "config", "user.signingkey", privateKeyPath)
-
- testRepo.WriteFile(t, "file.txt", []byte("signed\n"), 0o644)
- testRepo.Run(t, "add", "file.txt")
- testRepo.Run(t, "commit", "-S", "-m", "signed commit")
-
- commitID := testRepo.RevParse(t, "HEAD^{commit}")
- body := testRepo.CatFile(t, "commit", commitID)
-
- commit, err := signedcommit.Parse(body)
- if err != nil {
- t.Fatalf("Parse: %v", err)
- }
-
- signature, ok := commit.AppendSignature(nil, algo)
- if !ok {
- t.Fatalf("missing %s signature", algo)
- }
-
- err = signRoot.WriteFile("commit.sig", signature, 0o600)
- if err != nil {
- t.Fatalf("WriteFile(commit.sig): %v", err)
- }
-
- return commit.AppendPayload(nil), allowedSignersPath, signaturePath
-}
-
-func TestSSHSignedCommitIntegration(t *testing.T) {
- t.Parallel()
-
- testgit.ForEachAlgorithm(t, func(t *testing.T, algo objectid.Algorithm) { //nolint:thelper
- payload, allowedSignersPath, signaturePath := setupSSHSignedCommit(t, algo)
-
- cmd := exec.Command( //nolint:noctx
- "ssh-keygen",
- "-Y", "verify",
- "-n", "git",
- "-f", allowedSignersPath,
- "-I", "runxiyu@umich.edu",
- "-s", signaturePath,
- ) //#nosec G204
- cmd.Stdin = bytes.NewReader(payload)
-
- out, err := cmd.CombinedOutput()
- if err != nil {
- t.Fatalf("ssh-keygen verify failed: %v\n%s", err, out)
- }
- })
-}
-
-func TestSSHSignedCommitIntegrationRejectsTamperedPayload(t *testing.T) {
- t.Parallel()
-
- testgit.ForEachAlgorithm(t, func(t *testing.T, algo objectid.Algorithm) { //nolint:thelper
- payload, allowedSignersPath, signaturePath := setupSSHSignedCommit(t, algo)
- payload = append([]byte(nil), payload...)
- payload[len(payload)-2] ^= 1
-
- cmd := exec.Command( //nolint:noctx
- "ssh-keygen",
- "-Y", "verify",
- "-n", "git",
- "-f", allowedSignersPath,
- "-I", "runxiyu@umich.edu",
- "-s", signaturePath,
- ) //#nosec G204
- cmd.Stdin = bytes.NewReader(payload)
-
- out, err := cmd.CombinedOutput()
- if err == nil {
- t.Fatalf("ssh-keygen verify unexpectedly succeeded:\n%s", out)
- }
- })
-}