1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
|
#!/usr/bin/env bash
# Tests to ensure that the monkeysphere is working
# Authors:
# Daniel Kahn Gillmor <dkg@fifthhorseman.net>
# Jameson Rollins <jrollins@fifthhorseman.net>
# Micah Anderson <micah@riseup.net>
#
# Copyright: 2008-2019
# License: GPL v3 or later
# these tests should all be able to run as a non-privileged user.
# all subcommands in this script should complete without failure:
set -e
# piped commands should return the code of the first non-zero return
set -o pipefail
declare -a child_procs=($(ps -o pid h --ppid $$))
if [ "${#child_procs[@]}" -gt 1 ]; then
printf 'found %d pre-existing child processes: %s\n' "${#child_procs[@]}" "${child_procs[*]}"
printf "spawning my own subprocess to avoid https://bugs.debian.org/920038...\n"
"$0" "$@"
exit
fi
# make sure the TESTDIR is an absolute path, not a relative one.
export TESTDIR=$(cd $(dirname "$0") && pwd)
source "$TESTDIR"/common
perl -MCrypt::OpenSSL::RSA -e 1 2>/dev/null || { echo "You must have the perl module Crypt::OpenSSL::RSA installed to run this test.
On debian-derived systems, you can set this up with:
apt-get install libcrypt-openssl-rsa-perl" ; exit 1; }
perl -MDigest::SHA -e 1 2>/dev/null || { echo "You must have the perl module Digest::SHA installed to run this test.
On debian-derived systems, you can set this up with:
apt-get install libdigest-sha1-perl" ; exit 1; }
######################################################################
### SETUP VARIABLES
## set up some variables to ensure that we're operating strictly in
## the tests, not system-wide:
mkdir -p "$TESTDIR"/tmp
TEMPDIR=$(mktemp -d "${TMPDIR:-$TESTDIR/tmp}/ms.XXX")
if [ -z "$MONKEYSPHERE_TEST_USE_SYSTEM" ] ; then
mkdir "$TEMPDIR"/bin
ln -s "$TESTDIR"/../src/share/keytrans "$TEMPDIR"/bin/openpgp2ssh
ln -s "$TESTDIR"/../src/share/keytrans "$TEMPDIR"/bin/pem2openpgp
ln -s "$TESTDIR"/../src/share/keytrans "$TEMPDIR"/bin/keytrans
# Use the local copy of executables first, instead of system ones.
# This should help us test without installing.
export PATH="$TEMPDIR"/bin:"$PATH"
else
export PATH=/usr/share/monkeysphere:"$PATH"
fi
## setup trap
trap failed_cleanup EXIT
######################################################################
### TEST KEYTRANS
echo "##################################################"
echo "### generating openpgp key..."
export GNUPGHOME="$TEMPDIR"
chmod 700 "$TEMPDIR"
# create the key with the same preferences that monkeysphere uses.
cat > "$TEMPDIR"/gpg.conf <<EOF
default-preference-list SHA512 SHA384 SHA256 SHA224 RIPEMD160 SHA1 ZLIB BZIP2 ZIP AES256 AES192 AES CAST5 3DES
cert-digest-algo SHA256
list-options show-uid-validity,show-unusable-uids
fixed-list-mode
EOF
cat > "$TEMPDIR"/gpg-agent.conf <<EOF
pinentry-program $TESTDIR/phony-pinentry-nopass
EOF
# generate a key
gpg --batch --$(get_gpg_prng_arg) --gen-key <<EOF
Key-Type: RSA
Key-Length: 3072
Key-Usage: sign
Name-Real: testtest
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit
%echo done
EOF
echo "##################################################"
echo "### retrieving key timestamp..."
timestamp=$(gpg --list-key --with-colons | \
grep ^pub: | cut -d: -f6)
echo "##################################################"
echo "### exporting key to ssh file..."
gpg --export-secret-keys | openpgp2ssh > \
"$TEMPDIR"/test.pem
gpg --export-secret-keys > "$TEMPDIR"/secret.key
PEM2OPENPGP_USAGE_FLAGS=sign,certify \
PEM2OPENPGP_TIMESTAMP="$timestamp" pem2openpgp testtest \
< "$TEMPDIR"/test.pem > "$TEMPDIR"/converted.secret.key
echo "##################################################"
echo "### reconvert key, and compare to key in gpg keyring..."
diff -u \
<(gpg --list-packets < "$TEMPDIR"/secret.key) \
<(gpg --list-packets < "$TEMPDIR"/converted.secret.key)
diff -u \
<(hd "$TEMPDIR"/secret.key) \
<(hd "$TEMPDIR"/converted.secret.key)
KEYFPR=$(gpg --fingerprint --with-colons --list-keys | awk -F: '/^fpr:/{ if (ok) { print $10 } ; ok=0 } /^pub:/{ ok=1 }')
KEYID=$(printf "%s" "$KEYFPR" | cut -b25-40)
echo "conversions look good!"
echo "Now working with key $KEYID at time $timestamp"
gpg --check-trustdb
gpg --list-keys
echo "##################################################"
echo "### test working with two primary keys ... "
ssh-keygen -m PEM -t rsa -b 3072 -N '' -f "$TEMPDIR"/newkey
PEM2OPENPGP_USAGE_FLAGS=authenticate,certify \
PEM2OPENPGP_TIMESTAMP="$(( $timestamp + 1 ))" pem2openpgp fubar \
< "$TEMPDIR"/newkey > "$TEMPDIR"/newkey.gpg
NEWKEYFPR=$(< "$TEMPDIR"/newkey.gpg gpg --with-colons --import-options import-show --dry-run --import | awk -F: '/^fpr:/{ print $10 }' )
NEWKEYID=$( printf "%s" "$NEWKEYFPR" | cut -b25-40)
< "$TEMPDIR"/newkey.gpg gpg --import
gpg --batch --no-tty --faked-system-time "$timestamp" --quick-add-uid "$KEYID" baz
cat >"$TEMPDIR"/expectedout <<EOF
pub:u:3072:1:$KEYID:$timestamp:::u:::scSC
uid:u::::$timestamp::8200BD0425CC70C7D698DF3FE412044EAAB83F94::testtest
sig:!::1:$KEYID:$timestamp::::testtest:13x::$KEYFPR:::8
uid:u::::$timestamp::EDDC32D783E7F4C7B6982D9AE5DC4A61000648BA::baz
sig:!::1:$KEYID:$timestamp::::testtest:13x::$KEYFPR:::8
pub:-:3072:1:$NEWKEYID:$(($timestamp + 1)):::-:::caCA
uid:-::::$(($timestamp + 1))::A0D708F51CC257DEFC01AEDE1E0A5F329DFD8F16::fubar
sig:!::1:$NEWKEYID:$(($timestamp + 1))::::fubar:13x::$NEWKEYFPR:::8
EOF
echo "test: diff expected gpg list output"
diff -u "$TEMPDIR"/expectedout <(gpg --check-sigs --with-colons | grep -vE '^(tru|fpr):' | cut -d: -f1-16 | sed 's/:*$//')
## FIXME: addtest: not testing subkeys at the moment.
trap - EXIT
echo "##################################################"
echo " Monkeysphere keytrans test completed successfully!"
echo "##################################################"
cleanup
|
