78 lines
2.6 KiB
Go
78 lines
2.6 KiB
Go
package aptrepo
|
|
|
|
import (
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestOutputCopyBound(t *testing.T) {
|
|
var b cappedOutput
|
|
_, err := io.Copy(&b, io.LimitReader(strings.NewReader(strings.Repeat("x", 65537)), 65537))
|
|
if err == nil || b.Len() > 65536 {
|
|
t.Fatal("io.Copy bypassed output limit", b.Len(), err)
|
|
}
|
|
}
|
|
|
|
func TestWellFormedPackageTamperNeedsRebinding(t *testing.T) {
|
|
index := fixtureIndex()
|
|
release := fixtureRelease(index)
|
|
changed := []byte(strings.Replace(string(index), "SHA256: a", "SHA256: b", 1))
|
|
if _, err := Resolve(release, changed, "resolute", "amd64", fixturePins(), fixtureNow); err == nil {
|
|
t.Fatal("unbound index accepted")
|
|
}
|
|
if _, err := Resolve(fixtureRelease(changed), changed, "resolute", "amd64", fixturePins(), fixtureNow); err != nil {
|
|
t.Fatal("tamper test masked by parser rejection", err)
|
|
}
|
|
}
|
|
|
|
const goodStatus = "[GNUPG:] NEWSIG\n[GNUPG:] GOODSIG 7EA0A9C3F273FCD8 Docker\n[GNUPG:] VALIDSIG D3306A018370199E527AE7997EA0A9C3F273FCD8 2026-09-24 1790231932 0 4 0 1 10 00 9DC858229FC7DD38854AE2D88D81803C0EBFCD88\n"
|
|
|
|
func TestSignatureStatus(t *testing.T) {
|
|
now := time.Date(2026, 9, 25, 0, 0, 0, 0, time.UTC)
|
|
if err := checkStatus([]byte(goodStatus), now); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, s := range []string{"", "[GNUPG:] GOODSIG key name\n", goodStatus + goodStatus,
|
|
strings.ReplaceAll(goodStatus, dockerFingerprint, strings.Repeat("A", 40)),
|
|
strings.Replace(goodStatus, " 10 00 ", " 2 00 ", 1),
|
|
strings.Replace(goodStatus, "1790231932 0", "1990231932 0", 1),
|
|
strings.Replace(goodStatus, "1790231932 0", "1790231932 1790231933", 1),
|
|
goodStatus + "[GNUPG:] EXPKEYSIG bad\n", goodStatus + "[GNUPG:] BADSIG bad\n",
|
|
} {
|
|
if checkStatus([]byte(s), now) == nil {
|
|
t.Errorf("accepted invalid signature status: %q", s)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestReadStaging(t *testing.T) {
|
|
dir := t.TempDir()
|
|
for _, name := range []string{"docker.asc", "Release", "Release.gpg", "Packages"} {
|
|
if err := os.WriteFile(filepath.Join(dir, name), []byte("bytes"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if _, err := readStaging(dir); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readStaging("relative"); err == nil {
|
|
t.Fatal("relative directory accepted")
|
|
}
|
|
if err := os.WriteFile(filepath.Join(dir, "Release.gpg"), make([]byte, 65537), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := readStaging(dir); err == nil {
|
|
t.Fatal("oversize signature accepted")
|
|
}
|
|
}
|
|
|
|
func TestWrongKeyFailsBeforeExternalProcess(t *testing.T) {
|
|
if err := authenticate(map[string][]byte{"docker.asc": []byte("untrusted")}, time.Now()); err == nil {
|
|
t.Fatal("untrusted key accepted")
|
|
}
|
|
}
|