| use assert_matches::assert_matches; |
| use chrono::offset::Utc; |
| use futures_executor::block_on; |
| use tuf::crypto::{Ed25519PrivateKey, HashAlgorithm, PrivateKey}; |
| use tuf::metadata::{ |
| Delegation, Delegations, MetadataDescription, MetadataPath, TargetPath, TargetsMetadataBuilder, |
| }; |
| use tuf::pouf::Pouf1; |
| use tuf::repo_builder::RepoBuilder; |
| use tuf::repository::EphemeralRepository; |
| use tuf::Database; |
| use tuf::Error; |
| |
| const ED25519_1_PK8: &[u8] = include_bytes!("./ed25519/ed25519-1.pk8.der"); |
| const ED25519_2_PK8: &[u8] = include_bytes!("./ed25519/ed25519-2.pk8.der"); |
| const ED25519_3_PK8: &[u8] = include_bytes!("./ed25519/ed25519-3.pk8.der"); |
| const ED25519_4_PK8: &[u8] = include_bytes!("./ed25519/ed25519-4.pk8.der"); |
| const ED25519_5_PK8: &[u8] = include_bytes!("./ed25519/ed25519-5.pk8.der"); |
| const ED25519_6_PK8: &[u8] = include_bytes!("./ed25519/ed25519-6.pk8.der"); |
| |
| #[test] |
| fn simple_delegation() { |
| block_on(async { |
| let now = Utc::now(); |
| |
| let root_key = Ed25519PrivateKey::from_pkcs8(ED25519_1_PK8).unwrap(); |
| let snapshot_key = Ed25519PrivateKey::from_pkcs8(ED25519_2_PK8).unwrap(); |
| let targets_key = Ed25519PrivateKey::from_pkcs8(ED25519_3_PK8).unwrap(); |
| let timestamp_key = Ed25519PrivateKey::from_pkcs8(ED25519_4_PK8).unwrap(); |
| let delegation_key = Ed25519PrivateKey::from_pkcs8(ED25519_5_PK8).unwrap(); |
| |
| let mut repo = EphemeralRepository::new(); |
| let metadata = RepoBuilder::create(&mut repo) |
| .trusted_root_keys(&[&root_key]) |
| .trusted_snapshot_keys(&[&snapshot_key]) |
| .trusted_targets_keys(&[&targets_key]) |
| .trusted_timestamp_keys(&[×tamp_key]) |
| .stage_root() |
| .unwrap() |
| .add_delegation_key(delegation_key.public().clone()) |
| .add_delegation_role( |
| Delegation::builder(MetadataPath::new("delegation").unwrap()) |
| .key(delegation_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .stage_targets() |
| .unwrap() |
| .stage_snapshot_with_builder(|builder| { |
| builder.insert_metadata_description( |
| MetadataPath::new("delegation").unwrap(), |
| MetadataDescription::from_slice(&[0u8], 1, &[HashAlgorithm::Sha256]).unwrap(), |
| ) |
| }) |
| .unwrap() |
| .commit() |
| .await |
| .unwrap(); |
| |
| let mut tuf = Database::<Pouf1>::from_trusted_metadata(&metadata).unwrap(); |
| |
| //// build the targets //// |
| //// build the delegation //// |
| let target_file: &[u8] = b"bar"; |
| let delegation = TargetsMetadataBuilder::new() |
| .insert_target_from_slice( |
| TargetPath::new("foo").unwrap(), |
| target_file, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap() |
| .signed::<Pouf1>(&delegation_key) |
| .unwrap(); |
| let raw_delegation = delegation.to_raw().unwrap(); |
| |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::targets(), |
| &MetadataPath::new("delegation").unwrap(), |
| &raw_delegation, |
| ) |
| .unwrap(); |
| |
| assert!(tuf |
| .target_description(&TargetPath::new("foo").unwrap()) |
| .is_ok()); |
| }) |
| } |
| |
| #[test] |
| fn nested_delegation() { |
| block_on(async { |
| let now = Utc::now(); |
| |
| let root_key = Ed25519PrivateKey::from_pkcs8(ED25519_1_PK8).unwrap(); |
| let snapshot_key = Ed25519PrivateKey::from_pkcs8(ED25519_2_PK8).unwrap(); |
| let targets_key = Ed25519PrivateKey::from_pkcs8(ED25519_3_PK8).unwrap(); |
| let timestamp_key = Ed25519PrivateKey::from_pkcs8(ED25519_4_PK8).unwrap(); |
| let delegation_a_key = Ed25519PrivateKey::from_pkcs8(ED25519_5_PK8).unwrap(); |
| let delegation_b_key = Ed25519PrivateKey::from_pkcs8(ED25519_6_PK8).unwrap(); |
| |
| let mut repo = EphemeralRepository::new(); |
| let metadata = RepoBuilder::create(&mut repo) |
| .trusted_root_keys(&[&root_key]) |
| .trusted_snapshot_keys(&[&snapshot_key]) |
| .trusted_targets_keys(&[&targets_key]) |
| .trusted_timestamp_keys(&[×tamp_key]) |
| .stage_root() |
| .unwrap() |
| .add_delegation_key(delegation_a_key.public().clone()) |
| .add_delegation_role( |
| Delegation::builder(MetadataPath::new("delegation-a").unwrap()) |
| .key(delegation_a_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .stage_targets() |
| .unwrap() |
| .stage_snapshot_with_builder(|builder| { |
| builder |
| .insert_metadata_description( |
| MetadataPath::new("delegation-a").unwrap(), |
| MetadataDescription::from_slice(&[0u8], 1, &[HashAlgorithm::Sha256]) |
| .unwrap(), |
| ) |
| .insert_metadata_description( |
| MetadataPath::new("delegation-b").unwrap(), |
| MetadataDescription::from_slice(&[0u8], 1, &[HashAlgorithm::Sha256]) |
| .unwrap(), |
| ) |
| }) |
| .unwrap() |
| .commit() |
| .await |
| .unwrap(); |
| |
| let mut tuf = Database::<Pouf1>::from_trusted_metadata(&metadata).unwrap(); |
| |
| //// build delegation B //// |
| |
| let delegations = Delegations::builder() |
| .key(delegation_b_key.public().clone()) |
| .role( |
| Delegation::builder(MetadataPath::new("delegation-b").unwrap()) |
| .key(delegation_b_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .build() |
| .unwrap(); |
| |
| let delegation = TargetsMetadataBuilder::new() |
| .delegations(delegations) |
| .signed::<Pouf1>(&delegation_a_key) |
| .unwrap(); |
| let raw_delegation = delegation.to_raw().unwrap(); |
| |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::targets(), |
| &MetadataPath::new("delegation-a").unwrap(), |
| &raw_delegation, |
| ) |
| .unwrap(); |
| |
| //// build delegation B //// |
| |
| let target_file: &[u8] = b"bar"; |
| |
| let delegation = TargetsMetadataBuilder::new() |
| .insert_target_from_slice( |
| TargetPath::new("foo").unwrap(), |
| target_file, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap() |
| .signed::<Pouf1>(&delegation_b_key) |
| .unwrap(); |
| let raw_delegation = delegation.to_raw().unwrap(); |
| |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::new("delegation-a").unwrap(), |
| &MetadataPath::new("delegation-b").unwrap(), |
| &raw_delegation, |
| ) |
| .unwrap(); |
| |
| assert!(tuf |
| .target_description(&TargetPath::new("foo").unwrap()) |
| .is_ok()); |
| }) |
| } |
| |
| #[test] |
| fn rejects_bad_delegation_signatures() { |
| block_on(async { |
| let now = Utc::now(); |
| |
| let root_key = Ed25519PrivateKey::from_pkcs8(ED25519_1_PK8).unwrap(); |
| let snapshot_key = Ed25519PrivateKey::from_pkcs8(ED25519_2_PK8).unwrap(); |
| let targets_key = Ed25519PrivateKey::from_pkcs8(ED25519_3_PK8).unwrap(); |
| let timestamp_key = Ed25519PrivateKey::from_pkcs8(ED25519_4_PK8).unwrap(); |
| let delegation_key = Ed25519PrivateKey::from_pkcs8(ED25519_5_PK8).unwrap(); |
| let bad_delegation_key = Ed25519PrivateKey::from_pkcs8(ED25519_6_PK8).unwrap(); |
| |
| let mut repo = EphemeralRepository::new(); |
| let metadata = RepoBuilder::create(&mut repo) |
| .trusted_root_keys(&[&root_key]) |
| .trusted_snapshot_keys(&[&snapshot_key]) |
| .trusted_targets_keys(&[&targets_key]) |
| .trusted_timestamp_keys(&[×tamp_key]) |
| .stage_root() |
| .unwrap() |
| .add_delegation_key(delegation_key.public().clone()) |
| .add_delegation_role( |
| Delegation::builder(MetadataPath::new("delegation").unwrap()) |
| .key(delegation_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .stage_targets() |
| .unwrap() |
| .stage_snapshot_with_builder(|builder| { |
| builder.insert_metadata_description( |
| MetadataPath::new("delegation").unwrap(), |
| MetadataDescription::from_slice(&[0u8], 1, &[HashAlgorithm::Sha256]).unwrap(), |
| ) |
| }) |
| .unwrap() |
| .commit() |
| .await |
| .unwrap(); |
| |
| let mut tuf = Database::<Pouf1>::from_trusted_metadata(&metadata).unwrap(); |
| |
| //// build the delegation //// |
| let target_file: &[u8] = b"bar"; |
| let delegation = TargetsMetadataBuilder::new() |
| .insert_target_from_slice( |
| TargetPath::new("foo").unwrap(), |
| target_file, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap() |
| .signed::<Pouf1>(&bad_delegation_key) |
| .unwrap(); |
| let raw_delegation = delegation.to_raw().unwrap(); |
| |
| assert_matches!( |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::targets(), |
| &MetadataPath::new("delegation").unwrap(), |
| &raw_delegation |
| ), |
| Err(Error::MetadataMissingSignatures { |
| role, |
| number_of_valid_signatures: 0, |
| threshold: 1, |
| }) |
| if role == MetadataPath::new("delegation").unwrap() |
| ); |
| |
| let target_path = TargetPath::new("foo").unwrap(); |
| assert_matches!( |
| tuf.target_description(&target_path), |
| Err(Error::TargetNotFound(p)) if p == target_path |
| ); |
| }) |
| } |
| |
| #[test] |
| fn diamond_delegation() { |
| block_on(async { |
| let now = Utc::now(); |
| |
| let etc_key = Ed25519PrivateKey::from_pkcs8(ED25519_1_PK8).unwrap(); |
| let targets_key = Ed25519PrivateKey::from_pkcs8(ED25519_2_PK8).unwrap(); |
| let delegation_a_key = Ed25519PrivateKey::from_pkcs8(ED25519_3_PK8).unwrap(); |
| let delegation_b_key = Ed25519PrivateKey::from_pkcs8(ED25519_4_PK8).unwrap(); |
| let delegation_c_key = Ed25519PrivateKey::from_pkcs8(ED25519_5_PK8).unwrap(); |
| |
| // Given delegations a, b, and c, targets delegates "foo" to delegation-a and "bar" to |
| // delegation-b. |
| // |
| // targets |
| // / \ |
| // delegation-a delegation-b |
| // \ / |
| // delegation-c |
| // |
| // if delegation-a delegates "foo" to delegation-c, and |
| // delegation-b delegates "bar" to delegation-c, but |
| // delegation-b's signature is invalid, then delegation-c |
| // can contain target "bar" which is unaccessible and target "foo" which is. |
| // |
| // Verify tuf::Database handles this situation correctly. |
| |
| //// build delegation A //// |
| |
| let delegations_a = Delegations::builder() |
| .key(delegation_c_key.public().clone()) |
| .role( |
| Delegation::builder(MetadataPath::new("delegation-c").unwrap()) |
| .key(delegation_c_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .build() |
| .unwrap(); |
| |
| let delegation_a = TargetsMetadataBuilder::new() |
| .delegations(delegations_a) |
| .signed::<Pouf1>(&delegation_a_key) |
| .unwrap(); |
| let raw_delegation_a = delegation_a.to_raw().unwrap(); |
| |
| //// build delegation B //// |
| |
| let delegations_b = Delegations::builder() |
| .key(delegation_c_key.public().clone()) |
| .role( |
| Delegation::builder(MetadataPath::new("delegation-c").unwrap()) |
| // oops, wrong key. |
| .key(delegation_b_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .build() |
| .unwrap(); |
| |
| let delegation_b = TargetsMetadataBuilder::new() |
| .delegations(delegations_b) |
| .signed::<Pouf1>(&delegation_b_key) |
| .unwrap(); |
| let raw_delegation_b = delegation_b.to_raw().unwrap(); |
| |
| //// build delegation C //// |
| |
| let foo_target_file: &[u8] = b"foo contents"; |
| let bar_target_file: &[u8] = b"bar contents"; |
| |
| let delegation_c = TargetsMetadataBuilder::new() |
| .insert_target_from_slice( |
| TargetPath::new("foo").unwrap(), |
| foo_target_file, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap() |
| .insert_target_from_slice( |
| TargetPath::new("bar").unwrap(), |
| bar_target_file, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap() |
| .signed::<Pouf1>(&delegation_c_key) |
| .unwrap(); |
| let raw_delegation_c = delegation_c.to_raw().unwrap(); |
| |
| //// construct the database //// |
| |
| let mut repo = EphemeralRepository::new(); |
| let metadata = RepoBuilder::create(&mut repo) |
| .trusted_root_keys(&[&etc_key]) |
| .trusted_snapshot_keys(&[&etc_key]) |
| .trusted_targets_keys(&[&targets_key]) |
| .trusted_timestamp_keys(&[&etc_key]) |
| .stage_root() |
| .unwrap() |
| .add_delegation_key(delegation_a_key.public().clone()) |
| .add_delegation_key(delegation_b_key.public().clone()) |
| .add_delegation_role( |
| Delegation::builder(MetadataPath::new("delegation-a").unwrap()) |
| .key(delegation_a_key.public()) |
| .delegate_path(TargetPath::new("foo").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .add_delegation_role( |
| Delegation::builder(MetadataPath::new("delegation-b").unwrap()) |
| .key(delegation_b_key.public()) |
| .delegate_path(TargetPath::new("bar").unwrap()) |
| .build() |
| .unwrap(), |
| ) |
| .stage_targets() |
| .unwrap() |
| .stage_snapshot_with_builder(|builder| { |
| builder |
| .insert_metadata_description( |
| MetadataPath::new("delegation-a").unwrap(), |
| MetadataDescription::from_slice( |
| raw_delegation_a.as_bytes(), |
| 1, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap(), |
| ) |
| .insert_metadata_description( |
| MetadataPath::new("delegation-b").unwrap(), |
| MetadataDescription::from_slice( |
| raw_delegation_b.as_bytes(), |
| 1, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap(), |
| ) |
| .insert_metadata_description( |
| MetadataPath::new("delegation-c").unwrap(), |
| MetadataDescription::from_slice( |
| raw_delegation_c.as_bytes(), |
| 1, |
| &[HashAlgorithm::Sha256], |
| ) |
| .unwrap(), |
| ) |
| }) |
| .unwrap() |
| .commit() |
| .await |
| .unwrap(); |
| |
| let mut tuf = Database::<Pouf1>::from_trusted_metadata(&metadata).unwrap(); |
| |
| //// Verify we can trust delegation-a and delegation-b.. |
| |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::targets(), |
| &MetadataPath::new("delegation-a").unwrap(), |
| &raw_delegation_a, |
| ) |
| .unwrap(); |
| |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::targets(), |
| &MetadataPath::new("delegation-b").unwrap(), |
| &raw_delegation_b, |
| ) |
| .unwrap(); |
| |
| //// Verify delegation-c is valid, but only when updated through delegation-a. |
| |
| assert_matches!( |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::new("delegation-b").unwrap(), |
| &MetadataPath::new("delegation-c").unwrap(), |
| &raw_delegation_c |
| ), |
| Err(Error::MetadataMissingSignatures { |
| role, |
| number_of_valid_signatures: 0, |
| threshold: 1, |
| }) |
| if role == MetadataPath::new("delegation-c").unwrap() |
| ); |
| |
| tuf.update_delegated_targets( |
| &now, |
| &MetadataPath::new("delegation-a").unwrap(), |
| &MetadataPath::new("delegation-c").unwrap(), |
| &raw_delegation_c, |
| ) |
| .unwrap(); |
| |
| assert!(tuf |
| .target_description(&TargetPath::new("foo").unwrap()) |
| .is_ok()); |
| |
| let target_path = TargetPath::new("bar").unwrap(); |
| assert_matches!( |
| tuf.target_description(&target_path), |
| Err(Error::TargetNotFound(p)) if p == target_path |
| ); |
| }) |
| } |
