The only test that is really useful for an OSV is the one that is run first,
which assumes all content passed in is correct. If that fails, the content
must be bad and an update would fail; if that test passes, then we know
at the very least verification and updates would succeed, and the content
is what we expect it to be. The tests performed after use combinations of
invalid inputs, which of course should all fail, and would raise huge red
flags regarding the OpenSSL implementation if they did not - pointing to
regressions or bugs in OpenSSL itself.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
This script checks that a given data file and signature verify correctly against
a certificate. Without introducing fuzzing, this covers all (8) combinations of
valid and invalid files that may occur, and corrupts them in the more often
seen ways, such as a partially downloaded Manifest, or a wrong signature file.
Signed-off-by: Tudor Marcu <tudor.marcu@intel.com>
Eventually, I want to add scripting to more easily create create/manage
manifests for test cases, but for now this script addresses some of the
overhead.
Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
Tudor Marcu