1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
// Copyright The gittuf Authors
// SPDX-License-Identifier: Apache-2.0
package gitinterface
import (
"context"
"os"
"path/filepath"
"testing"
"github.com/gittuf/gittuf/internal/signerverifier/gpg"
"github.com/gittuf/gittuf/internal/signerverifier/ssh"
artifacts "github.com/gittuf/gittuf/internal/testartifacts"
"github.com/stretchr/testify/assert"
)
func TestGetTagTarget(t *testing.T) {
tempDir := t.TempDir()
repo := CreateTestGitRepository(t, tempDir, false)
treeBuilder := NewTreeBuilder(repo)
// Write empty tree
emptyTreeID, err := treeBuilder.WriteTreeFromEntries(nil)
if err != nil {
t.Fatal(err)
}
commitID, err := repo.Commit(emptyTreeID, "refs/heads/main", "Initial commit\n", true)
if err != nil {
t.Fatal(err)
}
tagID, err := repo.TagUsingSpecificKey(commitID, "test-tag", "test-tag\n", artifacts.SSHED25519Private)
if err != nil {
t.Fatal(err)
}
targetID, err := repo.GetTagTarget(tagID)
assert.Nil(t, err)
assert.Equal(t, commitID, targetID)
}
func TestRepositoryVerifyTag(t *testing.T) {
tempDir := t.TempDir()
repo := CreateTestGitRepository(t, tempDir, false)
treeBuilder := NewTreeBuilder(repo)
// Write empty tree
emptyTreeID, err := treeBuilder.WriteTreeFromEntries(nil)
if err != nil {
t.Fatal(err)
}
commitID, err := repo.Commit(emptyTreeID, "refs/heads/main", "Initial commit\n", true)
if err != nil {
t.Fatal(err)
}
sshSignedTag, err := repo.TagUsingSpecificKey(commitID, "test-tag-ssh", "test-tag-ssh\n", artifacts.SSHED25519Private)
if err != nil {
t.Fatal(err)
}
keyDir := t.TempDir()
keyPath := filepath.Join(keyDir, "ssh-key.pub")
if err := os.WriteFile(keyPath, artifacts.SSHED25519PublicSSH, 0o600); err != nil {
t.Fatal(err)
}
sshKey, err := ssh.NewKeyFromFile(keyPath)
if err != nil {
t.Fatal(err)
}
gpgSignedTag, err := repo.TagUsingSpecificKey(commitID, "test-tag-gpg", "test-tag-gpg\n", artifacts.GPGKey1Private)
if err != nil {
t.Fatal(err)
}
gpgKey, err := gpg.LoadGPGKeyFromBytes(artifacts.GPGKey1Public)
if err != nil {
t.Fatal(err)
}
t.Run("ssh signed tag, verify with ssh key", func(t *testing.T) {
err = repo.verifyTagSignature(context.Background(), sshSignedTag, sshKey)
assert.Nil(t, err)
})
t.Run("gpg signed tag, verify with gpg key", func(t *testing.T) {
err = repo.verifyTagSignature(context.Background(), gpgSignedTag, gpgKey)
assert.Nil(t, err)
})
}
|
