mirror of
https://github.com/clearlinux/swupd-client.git
synced 2026-09-06 05:32:01 +00:00
test: Adding signature checking tests
Signed-off-by: Otavio Pontes <otavio.pontes@intel.com>
This commit is contained in:
Otavio Pontes
committed by
Castulo J. Martinez
Castulo J. Martinez
parent
c2a4763ff3
commit
ccbf2620b5
+2
-2
@@ -17,7 +17,7 @@ env:
|
||||
- GROUP1="$UPDATE_SUBGROUP1"
|
||||
- GROUP2="$UPDATE_SUBGROUP2 $(find test/functional/{checkupdate,hashdump,mirror,usability} -name *.bats -printf '%p ')"
|
||||
- GROUP3="$(find test/functional/{diagnose,search,os-install,repair} -name *.bats -printf '%p ')"
|
||||
- GROUP4="$(find test/functional/{bundleadd,bundleremove,bundlelist} -name *.bats -printf '%p ')"
|
||||
- GROUP4="$(find test/functional/{bundleadd,bundleremove,bundlelist,signature} -name *.bats -printf '%p ')"
|
||||
|
||||
jobs:
|
||||
include:
|
||||
@@ -34,7 +34,7 @@ jobs:
|
||||
name: "Functional Tests - diagnose, os-install, repair, search"
|
||||
script: env TESTS="$GROUP3" make -e check
|
||||
- stage: test
|
||||
name: "Functional Tests - bundle-add, bundle-remove, bundle-list"
|
||||
name: "Functional Tests - bundle-add, bundle-remove, bundle-list, signature"
|
||||
script: env TESTS="$GROUP4" make -e check
|
||||
|
||||
# Pre-install missing build dependencies:
|
||||
|
||||
@@ -267,6 +267,11 @@ BATS = \
|
||||
test/functional/search/search-json.bats \
|
||||
test/functional/search/search-no-disk-space.bats \
|
||||
test/functional/search/search-sort.bats \
|
||||
test/functional/signature/corrupted-certificate.bats \
|
||||
test/functional/signature/invalid-certificate.bats \
|
||||
test/functional/signature/permission-incorrect.bats \
|
||||
test/functional/signature/corrupted-signature.bats \
|
||||
test/functional/signature/no-signature.bats \
|
||||
test/functional/update/update-boot-file.bats \
|
||||
test/functional/update/update-boot-skip.bats \
|
||||
test/functional/update/update-bundle-removed.bats \
|
||||
@@ -310,6 +315,7 @@ BATS = \
|
||||
test/functional/usability/usa-download-retries.bats \
|
||||
test/functional/usability/usa-external-modules.bats
|
||||
|
||||
|
||||
UNIT_TESTS = \
|
||||
test/unit/test_signature.test \
|
||||
test/unit/test_strings.test \
|
||||
|
||||
+49
@@ -0,0 +1,49 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
# Author: Otavio Pontes
|
||||
# Email: otavio.pontes@intel.com
|
||||
|
||||
load "../testlib"
|
||||
|
||||
test_setup() {
|
||||
|
||||
create_test_environment "$TEST_NAME"
|
||||
create_bundle -n test-bundle -f /test-file "$TEST_NAME"
|
||||
write_to_protected_file $TEST_NAME/cert "invalid"
|
||||
|
||||
}
|
||||
|
||||
@test "SIG001: Swupd bundle-add with corrupted certificate" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_SIGNATURE_VERIFICATION_FAILED"
|
||||
expected_output=$(cat <<-EOM
|
||||
Error: Failed to verify certificate: .*
|
||||
EOM
|
||||
)
|
||||
assert_regex_in_output "$expected_output"
|
||||
assert_file_not_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
|
||||
@test "SIG002: Force swupd bundle-add a bundle with corrupted certificate" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert --nosigcheck test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_OK"
|
||||
expected_output=$(cat <<-EOM
|
||||
FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to
|
||||
--nosigcheck, but system security may be compromised
|
||||
Loading required manifests...
|
||||
No packs need to be downloaded
|
||||
Starting download of remaining update content. This may take a while...
|
||||
Installing bundle(s) files...
|
||||
Calling post-update helper scripts
|
||||
Successfully installed 1 bundle
|
||||
EOM
|
||||
)
|
||||
assert_in_output "$expected_output"
|
||||
assert_file_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
# Author: Otavio Pontes
|
||||
# Email: otavio.pontes@intel.com
|
||||
|
||||
load "../testlib"
|
||||
|
||||
test_setup() {
|
||||
|
||||
create_test_environment "$TEST_NAME"
|
||||
create_bundle -n test-bundle -f /test-file "$TEST_NAME"
|
||||
|
||||
write_to_protected_file "$WEBDIR/10/Manifest.MoM.sig" "bad signature"
|
||||
|
||||
}
|
||||
|
||||
@test "SIG003: Swupd bundle-add with corrupted MoM signature" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_COULDNT_LOAD_MOM"
|
||||
expected_output=$(cat <<-EOM
|
||||
Error: FAILED TO VERIFY SIGNATURE OF Manifest.MoM version 10!!!
|
||||
Error: Cannot load official manifest MoM for version 10
|
||||
EOM
|
||||
)
|
||||
assert_in_output "$expected_output"
|
||||
assert_file_not_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
|
||||
@test "SIG004: Force swupd bundle-add a bundle with corrupted MoM signature" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS --nosigcheck test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_OK"
|
||||
expected_output=$(cat <<-EOM
|
||||
FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to
|
||||
--nosigcheck, but system security may be compromised
|
||||
Loading required manifests...
|
||||
No packs need to be downloaded
|
||||
Starting download of remaining update content. This may take a while...
|
||||
Installing bundle(s) files...
|
||||
Calling post-update helper scripts
|
||||
Successfully installed 1 bundle
|
||||
EOM
|
||||
)
|
||||
assert_in_output "$expected_output"
|
||||
assert_file_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
+50
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
# Author: Otavio Pontes
|
||||
# Email: otavio.pontes@intel.com
|
||||
|
||||
load "../testlib"
|
||||
|
||||
test_setup() {
|
||||
|
||||
create_test_environment "$TEST_NAME"
|
||||
create_bundle -n test-bundle -f /test-file "$TEST_NAME"
|
||||
sudo sh -c "openssl req -x509 -sha512 -days 1 -newkey rsa:4096 -keyout $TEST_NAME/key -out $TEST_NAME/cert -nodes -subj '/C=US/ST=Oregon/L=Portland/O=Company Name/OU=Org/CN=localhost'"
|
||||
|
||||
}
|
||||
|
||||
@test "SIG005: Swupd bundle-add with invalid certificate" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_COULDNT_LOAD_MOM"
|
||||
expected_output=$(cat <<-EOM
|
||||
Error: FAILED TO VERIFY SIGNATURE OF Manifest.MoM version 10!!!
|
||||
Error: Cannot load official manifest MoM for version 10
|
||||
EOM
|
||||
)
|
||||
assert_in_output "$expected_output"
|
||||
assert_file_not_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
|
||||
@test "SIG006: Force swupd bundle-add a bundle with invalid certificate" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS_NO_CERT -C $TEST_NAME/cert --nosigcheck test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_OK"
|
||||
expected_output=$(cat <<-EOM
|
||||
FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to
|
||||
--nosigcheck, but system security may be compromised
|
||||
Loading required manifests...
|
||||
No packs need to be downloaded
|
||||
Starting download of remaining update content. This may take a while...
|
||||
Installing bundle(s) files...
|
||||
Calling post-update helper scripts
|
||||
Successfully installed 1 bundle
|
||||
EOM
|
||||
)
|
||||
assert_in_output "$expected_output"
|
||||
assert_file_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
Executable
+51
@@ -0,0 +1,51 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
# Author: Otavio Pontes
|
||||
# Email: otavio.pontes@intel.com
|
||||
|
||||
load "../testlib"
|
||||
|
||||
test_setup() {
|
||||
|
||||
create_test_environment "$TEST_NAME"
|
||||
create_bundle -n test-bundle -f /test-file "$TEST_NAME"
|
||||
sudo rm "$WEBDIR"/10/Manifest.MoM.sig
|
||||
|
||||
}
|
||||
|
||||
@test "SIG007: Swupd bundle-add without a MoM signature" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_COULDNT_LOAD_MOM"
|
||||
expected_output=$(cat <<-EOM
|
||||
Warning: Removing corrupt Manifest.MoM artifacts and re-downloading...
|
||||
Error: FAILED TO VERIFY SIGNATURE OF Manifest.MoM version 10!!!
|
||||
Error: Cannot load official manifest MoM for version 10
|
||||
EOM
|
||||
)
|
||||
assert_is_output "$expected_output"
|
||||
assert_file_not_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
|
||||
@test "SIG008: Force swupd bundle-add a bundle without a MoM signature" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS --nosigcheck test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_OK"
|
||||
expected_output=$(cat <<-EOM
|
||||
FAILED TO VERIFY SIGNATURE OF Manifest.MoM. Operation proceeding due to
|
||||
--nosigcheck, but system security may be compromised
|
||||
Loading required manifests...
|
||||
No packs need to be downloaded
|
||||
Starting download of remaining update content. This may take a while...
|
||||
Installing bundle(s) files...
|
||||
Calling post-update helper scripts
|
||||
Successfully installed 1 bundle
|
||||
EOM
|
||||
)
|
||||
assert_in_output "$expected_output"
|
||||
assert_file_exists "$TARGETDIR"/test-file
|
||||
|
||||
}
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
# Author: Otavio Pontes
|
||||
# Email: otavio.pontes@intel.com
|
||||
|
||||
load "../testlib"
|
||||
|
||||
test_setup() {
|
||||
|
||||
create_test_environment "$TEST_NAME"
|
||||
create_bundle -n test-bundle -f /test-file "$TEST_NAME"
|
||||
|
||||
}
|
||||
|
||||
@test "SIG009: Swupd bundle-add without a MoM signature" {
|
||||
|
||||
run sudo sh -c "$SWUPD bundle-add $SWUPD_OPTS test-bundle"
|
||||
|
||||
assert_status_is "$SWUPD_OK"
|
||||
assert_file_exists "$TARGETDIR"/test-file
|
||||
|
||||
run sudo sh -c "stat -c '%a' $STATEDIR"
|
||||
assert_status_is 0
|
||||
assert_in_output "700"
|
||||
|
||||
}
|
||||
@@ -409,7 +409,7 @@ set_env_variables() { # swupd_function
|
||||
# different options for swupd
|
||||
export SWUPD_OPTS="-S $testfs_path/state -p $testfs_path/target-dir -F staging -C $FUNC_DIR/Swupd_Root.pem -I"
|
||||
export SWUPD_OPTS_KEEPCACHE="$SWUPD_OPTS --keepcache"
|
||||
export SWUPD_OPTS_NO_CERT="-S $testfs_path/state -p $testfs_path/target-dir -F staging"
|
||||
export SWUPD_OPTS_NO_CERT="-S $testfs_path/state -p $testfs_path/target-dir -F staging -I"
|
||||
export SWUPD_OPTS_MIRROR="-p $testfs_path/target-dir"
|
||||
export SWUPD_OPTS_NO_FMT="-S $testfs_path/state -p $testfs_path/target-dir -C $FUNC_DIR/Swupd_Root.pem -I"
|
||||
export SWUPD_OPTS_NO_PATH="-S $testfs_path/state -F staging -C $FUNC_DIR/Swupd_Root.pem -I"
|
||||
@@ -3039,6 +3039,7 @@ get_next_available_id() { # swupd_function
|
||||
mirror) group=MIR;;
|
||||
completion) group=USA;;
|
||||
usability) group=USA;;
|
||||
signature) group=SIG;;
|
||||
autoupdate) group=AUT;;
|
||||
info) group=INF;;
|
||||
clean) group=CLN;;
|
||||
|
||||
Reference in New Issue
Block a user