diff options
Diffstat (limited to 'test/rubygems/test_gem_security_policy.rb')
-rw-r--r-- | test/rubygems/test_gem_security_policy.rb | 109 |
1 files changed, 77 insertions, 32 deletions
diff --git a/test/rubygems/test_gem_security_policy.rb b/test/rubygems/test_gem_security_policy.rb index 22f5375dbf..568bf69d08 100644 --- a/test/rubygems/test_gem_security_policy.rb +++ b/test/rubygems/test_gem_security_policy.rb @@ -31,6 +31,7 @@ class TestGemSecurityPolicy < Gem::TestCase @sha1 = OpenSSL::Digest::SHA1 @trust_dir = Gem::Security.trust_dir.dir # HACK use the object + @no = Gem::Security::NoSecurity @almost_no = Gem::Security::AlmostNoSecurity @low = Gem::Security::LowSecurity @high = Gem::Security::HighSecurity @@ -220,73 +221,108 @@ class TestGemSecurityPolicy < Gem::TestCase def test_verify Gem::Security.trust_dir.trust_cert PUBLIC_CERT - assert @almost_no.verify [PUBLIC_CERT] + assert @almost_no.verify [PUBLIC_CERT], nil, *dummy_signatures end def test_verify_chain_signatures Gem::Security.trust_dir.trust_cert PUBLIC_CERT - data = digest 'hello' - digest = { 'SHA1' => { 0 => data } } - signature = { 0 => sign(data, PRIVATE_KEY) } - - assert @high.verify [PUBLIC_CERT], nil, digest, signature + assert @high.verify [PUBLIC_CERT], nil, *dummy_signatures end def test_verify_chain_key - assert @almost_no.verify [PUBLIC_CERT], PRIVATE_KEY + @almost_no.verify [PUBLIC_CERT], PRIVATE_KEY, *dummy_signatures end - def test_verify_signatures_chain - data = digest 'hello' - digest = { 'SHA1' => { 0 => data } } - signature = { 0 => sign(data, CHILD_KEY) } + def test_verify_no_digests + Gem::Security.trust_dir.trust_cert PUBLIC_CERT + + _, signatures = dummy_signatures + + e = assert_raises Gem::Security::Exception do + @almost_no.verify [PUBLIC_CERT], nil, {}, signatures + end + + assert_equal 'no digests provided (probable bug)', e.message + end + + def test_verify_no_digests_no_security + Gem::Security.trust_dir.trust_cert PUBLIC_CERT + + _, signatures = dummy_signatures + + e = assert_raises Gem::Security::Exception do + @no.verify [PUBLIC_CERT], nil, {}, signatures + end + + assert_equal 'missing digest for 0', e.message + end + + def test_verify_not_enough_signatures + Gem::Security.trust_dir.trust_cert PUBLIC_CERT + + digests, signatures = dummy_signatures + + data = digest 'goodbye' + + signatures[1] = PRIVATE_KEY.sign @sha1.new, data.digest + + e = assert_raises Gem::Security::Exception do + @almost_no.verify [PUBLIC_CERT], nil, digests, signatures + end + assert_equal 'missing digest for 1', e.message + end + + def test_verify_wrong_digest_type + Gem::Security.trust_dir.trust_cert PUBLIC_CERT + + sha512 = OpenSSL::Digest::SHA512 + + data = sha512.new + data << 'hello' + + digests = { 'SHA512' => { 0 => data } } + signature = PRIVATE_KEY.sign sha512.new, data.digest + signatures = { 0 => signature } + + e = assert_raises Gem::Security::Exception do + @almost_no.verify [PUBLIC_CERT], nil, digests, signatures + end + + assert_equal 'no digests provided (probable bug)', e.message + end + + def test_verify_signatures_chain @spec.cert_chain = [PUBLIC_CERT, CHILD_CERT] - assert @chain.verify_signatures @spec, digest, signature + assert @chain.verify_signatures @spec, *dummy_signatures(CHILD_KEY) end def test_verify_signatures_data - data = digest 'hello' - digest = { 'SHA1' => { 0 => data } } - signature = { 0 => sign(data) } - @spec.cert_chain = [PUBLIC_CERT] - @almost_no.verify_signatures @spec, digest, signature + @almost_no.verify_signatures @spec, *dummy_signatures end def test_verify_signatures_root - data = digest 'hello' - digest = { 'SHA1' => { 0 => data } } - signature = { 0 => sign(data, CHILD_KEY) } - @spec.cert_chain = [PUBLIC_CERT, CHILD_CERT] - assert @root.verify_signatures @spec, digest, signature + assert @root.verify_signatures @spec, *dummy_signatures(CHILD_KEY) end def test_verify_signatures_signer - data = digest 'hello' - digest = { 'SHA1' => { 0 => data } } - signature = { 0 => sign(data) } - @spec.cert_chain = [PUBLIC_CERT] - assert @low.verify_signatures @spec, digest, signature + assert @low.verify_signatures @spec, *dummy_signatures end def test_verify_signatures_trust Gem::Security.trust_dir.trust_cert PUBLIC_CERT - data = digest 'hello' - digest = { 'SHA1' => { 0 => data } } - signature = { 0 => sign(data, PRIVATE_KEY) } - @spec.cert_chain = [PUBLIC_CERT] - assert @high.verify_signatures @spec, digest, signature + assert @high.verify_signatures @spec, *dummy_signatures end def test_verify_signatures @@ -372,5 +408,14 @@ class TestGemSecurityPolicy < Gem::TestCase key.sign @sha1.new, data.digest end + def dummy_signatures key = PRIVATE_KEY + data = digest 'hello' + + digests = { 'SHA1' => { 0 => data } } + signatures = { 0 => sign(data, key) } + + return digests, signatures + end + end |