0ae29ae342
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 16s
validate / JSON Schema (ajv) (push) Successful in 20s
build-images / signing-service image (push) Successful in 24s
validate / DB (migrate up/down dry-run) (push) Failing after 26s
validate / Go (vet + test) (push) Successful in 1m16s
Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
94 lines
2.5 KiB
Go
94 lines
2.5 KiB
Go
package registry
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/pem"
|
|
"errors"
|
|
"testing"
|
|
)
|
|
|
|
func TestStatic_RegisterAndLookup(t *testing.T) {
|
|
pub, _, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
t.Fatalf("gen: %v", err)
|
|
}
|
|
s := NewStatic()
|
|
s.Register("k1", pub)
|
|
got, err := s.Lookup(context.Background(), "k1")
|
|
if err != nil {
|
|
t.Fatalf("lookup: %v", err)
|
|
}
|
|
if !pub.Equal(got) {
|
|
t.Fatalf("key mismatch")
|
|
}
|
|
if _, err := s.Lookup(context.Background(), "unknown"); !errors.Is(err, ErrUnknownKey) {
|
|
t.Fatalf("want ErrUnknownKey, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoadFromSpec_Hex(t *testing.T) {
|
|
pub, _, _ := ed25519.GenerateKey(rand.Reader)
|
|
spec := "trust-api/approval-signer-2026-q4=hex:" + hex.EncodeToString(pub)
|
|
s := NewStatic()
|
|
if err := s.LoadFromSpec(spec); err != nil {
|
|
t.Fatalf("load hex: %v", err)
|
|
}
|
|
got, err := s.Lookup(context.Background(), "trust-api/approval-signer-2026-q4")
|
|
if err != nil || !got.Equal(pub) {
|
|
t.Fatalf("lookup after hex load: %v / equal=%v", err, got.Equal(pub))
|
|
}
|
|
}
|
|
|
|
func TestLoadFromSpec_B64AndB64URL(t *testing.T) {
|
|
pub, _, _ := ed25519.GenerateKey(rand.Reader)
|
|
spec := "k1=b64:" + base64.StdEncoding.EncodeToString(pub) +
|
|
",k2=b64u:" + base64.RawURLEncoding.EncodeToString(pub)
|
|
s := NewStatic()
|
|
if err := s.LoadFromSpec(spec); err != nil {
|
|
t.Fatalf("load b64: %v", err)
|
|
}
|
|
for _, id := range []string{"k1", "k2"} {
|
|
got, err := s.Lookup(context.Background(), id)
|
|
if err != nil || !got.Equal(pub) {
|
|
t.Fatalf("lookup %s: %v", id, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLoadFromSpec_PEM(t *testing.T) {
|
|
pub, _, _ := ed25519.GenerateKey(rand.Reader)
|
|
der, err := x509.MarshalPKIXPublicKey(pub)
|
|
if err != nil {
|
|
t.Fatalf("marshal pkix: %v", err)
|
|
}
|
|
pemBlock := pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: der})
|
|
spec := "pem-key=pem:" + string(pemBlock)
|
|
s := NewStatic()
|
|
if err := s.LoadFromSpec(spec); err != nil {
|
|
t.Fatalf("load pem: %v", err)
|
|
}
|
|
got, err := s.Lookup(context.Background(), "pem-key")
|
|
if err != nil || !got.Equal(pub) {
|
|
t.Fatalf("pem lookup: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoadFromSpec_RejectsBadFormat(t *testing.T) {
|
|
s := NewStatic()
|
|
for _, bad := range []string{
|
|
"missing-equals",
|
|
"no-prefix=rawbytes",
|
|
"k1=hex:xxyyzz",
|
|
"k1=hex:" + hex.EncodeToString(make([]byte, 10)), // wrong length
|
|
"k1=rsa:deadbeef", // unsupported
|
|
} {
|
|
if err := s.LoadFromSpec(bad); err == nil {
|
|
t.Fatalf("expected error for %q", bad)
|
|
}
|
|
}
|
|
}
|