0ae29ae342
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 16s
validate / JSON Schema (ajv) (push) Successful in 20s
build-images / signing-service image (push) Successful in 24s
validate / DB (migrate up/down dry-run) (push) Failing after 26s
validate / Go (vet + test) (push) Successful in 1m16s
Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
58 lines
1.7 KiB
Go
58 lines
1.7 KiB
Go
package dsse
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"errors"
|
|
"testing"
|
|
)
|
|
|
|
func TestVerify_HappyPath(t *testing.T) {
|
|
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
t.Fatalf("generate: %v", err)
|
|
}
|
|
env := Sign("application/vnd.in-toto+json", []byte(`{"_type":"x"}`), "k1", priv)
|
|
payload, kid, err := Verify(env, Keyring{"k1": pub})
|
|
if err != nil {
|
|
t.Fatalf("verify: %v", err)
|
|
}
|
|
if kid != "k1" {
|
|
t.Fatalf("keyid: want k1, got %q", kid)
|
|
}
|
|
if string(payload) != `{"_type":"x"}` {
|
|
t.Fatalf("payload: want %q, got %q", `{"_type":"x"}`, payload)
|
|
}
|
|
}
|
|
|
|
func TestVerify_UnknownKey(t *testing.T) {
|
|
_, priv, _ := ed25519.GenerateKey(rand.Reader)
|
|
otherPub, _, _ := ed25519.GenerateKey(rand.Reader)
|
|
env := Sign("application/vnd.in-toto+json", []byte("x"), "k1", priv)
|
|
_, _, err := Verify(env, Keyring{"k2": otherPub})
|
|
if !errors.Is(err, ErrUnknownKey) {
|
|
t.Fatalf("want ErrUnknownKey, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestVerify_InvalidSignature(t *testing.T) {
|
|
pub, priv, _ := ed25519.GenerateKey(rand.Reader)
|
|
env := Sign("application/vnd.in-toto+json", []byte("x"), "k1", priv)
|
|
// Flip one bit of the signature.
|
|
raw, _ := base64.RawURLEncoding.DecodeString(env.Signatures[0].Sig)
|
|
raw[0] ^= 0xff
|
|
env.Signatures[0].Sig = base64.RawURLEncoding.EncodeToString(raw)
|
|
_, _, err := Verify(env, Keyring{"k1": pub})
|
|
if !errors.Is(err, ErrSignatureInvalid) {
|
|
t.Fatalf("want ErrSignatureInvalid, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestVerify_EmptySignatures(t *testing.T) {
|
|
env := Envelope{PayloadType: "application/vnd.in-toto+json", Payload: ""}
|
|
_, _, err := Verify(env, Keyring{})
|
|
if !errors.Is(err, ErrNoSignatures) {
|
|
t.Fatalf("want ErrNoSignatures, got %v", err)
|
|
}
|
|
}
|