System tests for mirror create/update with internal PGP implementation

This commit is contained in:
Andrey Smirnov
2017-07-21 00:55:35 +03:00
parent 05a5e69483
commit 3674e1adee
7 changed files with 258 additions and 23 deletions
+80 -23
View File
@@ -15,6 +15,7 @@ import (
"golang.org/x/crypto/openpgp"
"golang.org/x/crypto/openpgp/clearsign"
openpgp_errors "golang.org/x/crypto/openpgp/errors"
"golang.org/x/crypto/openpgp/packet"
"golang.org/x/crypto/ssh/terminal"
)
@@ -25,6 +26,11 @@ var (
_ Verifier = &GoVerifier{}
)
// Internal errors
var (
errWrongPasshprase = errors.New("unable to decrypt the key, passphrase is wrong")
)
// GoSigner is implementation of Signer interface using Go internal OpenPGP library
type GoSigner struct {
keyRef string
@@ -106,41 +112,92 @@ func (g *GoSigner) Init() error {
return fmt.Errorf("looks like there are no keys in gpg, please create one (official manual: http://www.gnupg.org/gph/en/manual.html)")
}
// TODO: pick key by id
g.signer = g.secretKeyring[0]
if g.keyRef == "" {
// no key reference, pick the first key
g.signer = g.secretKeyring[0]
} else {
pickKeyLoop:
for _, signer := range g.secretKeyring {
key := KeyFromUint64(signer.PrimaryKey.KeyId)
if key.Matches(Key(g.keyRef)) {
g.signer = signer
break
}
if g.signer.PrivateKey.Encrypted {
if g.passphrase == "" {
i := 0
for name := range g.signer.Identities {
if i == 0 {
fmt.Printf("openpgp: Passphrase is required to unlock private key \"%s\"\n", name)
} else {
fmt.Printf(" aka \"%s\"\n", name)
for name := range signer.Identities {
if strings.Contains(name, g.keyRef) {
g.signer = signer
break pickKeyLoop
}
i++
}
// TODO: retry passphrase entry
fmt.Print("\nEnter passphrase: ")
var bytePassphrase []byte
bytePassphrase, err = terminal.ReadPassword(int(syscall.Stdin))
if err != nil {
return errors.Wrap(err, "error reading passphare")
}
g.passphrase = string(bytePassphrase)
}
err = g.signer.PrivateKey.Decrypt([]byte(g.passphrase))
if g.signer == nil {
return errors.Errorf("couldn't find key for key reference %v", g.keyRef)
}
}
if g.signer.PrivateKey.Encrypted {
i := 0
for name := range g.signer.Identities {
if i == 0 {
fmt.Printf("openpgp: Passphrase is required to unlock private key \"%s\"\n", name)
} else {
fmt.Printf(" aka \"%s\"\n", name)
}
i++
}
if g.passphrase == "" {
if g.batch {
return errors.New("key is locked with passphrase, but no passphrase was given in batch mode")
}
for attempt := 0; attempt < 3; attempt++ {
fmt.Print("\nEnter passphrase: ")
var bytePassphrase []byte
bytePassphrase, err = terminal.ReadPassword(int(syscall.Stdin))
if err != nil {
return errors.Wrap(err, "error reading passphare")
}
g.passphrase = string(bytePassphrase)
err = g.decryptKey()
if err == nil || err != errWrongPasshprase {
break
}
fmt.Print("\nWrong passphrase, please try again.\n")
}
} else {
err = g.decryptKey()
}
if err != nil {
return errors.Wrap(err, "error unlocking private key")
return err
}
}
return nil
}
func (g *GoSigner) decryptKey() error {
err := g.signer.PrivateKey.Decrypt([]byte(g.passphrase))
if err == nil {
return nil
}
if e, ok := err.(openpgp_errors.StructuralError); ok {
if string(e) == "private key checksum failure" {
return errWrongPasshprase
}
}
return errors.Wrap(err, "error unlocking private key")
}
// DetachedSign signs file with detached signature in ASCII format
func (g *GoSigner) DetachedSign(source string, destination string) error {
fmt.Printf("openpgp: signing file '%s'...\n", filepath.Base(source))
@@ -0,0 +1,8 @@
Downloading http://mirror.yandex.ru/debian/dists/wheezy-backports/InRelease...
openpgp: RSA key ID 8B48AD6246925553
openpgp: Good signature from "Debian Archive Automatic Signing Key (7.0/wheezy) <ftpmaster@debian.org>"
openpgp: RSA key ID 7638D0442B90D010
openpgp: Good signature from "Debian Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>"
Mirror [mirror9]: http://mirror.yandex.ru/debian/ wheezy-backports successfully added.
You can run 'aptly mirror update mirror9' to download repository contents.
+10
View File
@@ -0,0 +1,10 @@
opengpg: failure opening keyring '${HOME}/.gnupg/aptlytest.gpg': open ${HOME}/.gnupg/aptlytest.gpg: no such file or directory
Looks like your keyring with trusted keys is empty. You might consider importing some keys.
Downloading http://mirror.yandex.ru/debian-backports/dists/squeeze-backports/InRelease...
openpgp: Signature made Sun, 13 Mar 2016 12:02:54 MSK using RSA key ID 8B48AD6246925553
openpgp: Can't check signature: public key not found
Downloading http://mirror.yandex.ru/debian-backports/dists/squeeze-backports/Release...
Downloading http://mirror.yandex.ru/debian-backports/dists/squeeze-backports/Release.gpg...
openpgp: Signature made Sun, 13 Mar 2016 12:02:54 MSK using RSA key ID 8B48AD6246925553
openpgp: Can't check signature: public key not found
ERROR: unable to fetch mirror: failed to verify detached signature: openpgp: signature made by unknown entity
+10
View File
@@ -0,0 +1,10 @@
Downloading http://mirror.yandex.ru/debian/dists/wheezy/InRelease...
Downloading http://mirror.yandex.ru/debian/dists/wheezy/Release...
Downloading http://mirror.yandex.ru/debian/dists/wheezy/Release.gpg...
openpgp: RSA key ID 8B48AD6246925553
openpgp: Good signature from "Debian Archive Automatic Signing Key (7.0/wheezy) <ftpmaster@debian.org>"
openpgp: RSA key ID 7638D0442B90D010
openpgp: Good signature from "Debian Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>"
Mirror [mirror11]: http://mirror.yandex.ru/debian/ wheezy successfully added.
You can run 'aptly mirror update mirror11' to download repository contents.
+96
View File
@@ -0,0 +1,96 @@
Building download queue...
Download queue: 84 items (138.29 MiB)
Downloading & parsing package files...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/InRelease...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/Packages.bz2...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/Release...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/Release.gpg...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/jags_4.0.0-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/jags_4.0.0-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/jags_4.0.0-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/littler_0.3.2-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy-doc_1.0.3-30~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy2_2.5.6-1~jessiecran.3.2.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy2_2.5.6-1~jessiecran.3.2.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy2_2.5.6-1~jessiecran.3.2.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy_1.0.3-30~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy_1.0.3-30~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/python-rpy_1.0.3-30~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-core-dbg_3.3.3-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-core-dbg_3.3.3-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-core-dbg_3.3.3-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-core_3.3.3-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-core_3.3.3-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-core_3.3.3-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-dev_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base-html_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-base_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-boot_1.3-18-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-boot_1.3-18-2~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-class_7.3-14-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-class_7.3-14-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-class_7.3-14-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-cluster_2.0.5-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-cluster_2.0.5-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-cluster_2.0.5-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-coda_0.18-1-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-codetools_0.2-14-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-codetools_0.2-15-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-foreign_0.8.67-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-foreign_0.8.67-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-foreign_0.8.67-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-kernsmooth_2.23-15-2~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-kernsmooth_2.23-15-2~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-kernsmooth_2.23-15-2~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-lattice_0.20-34-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-lattice_0.20-34-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-lattice_0.20-34-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-littler_0.3.2-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-littler_0.3.2-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-littler_0.3.2-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-mass_7.3-45-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-mass_7.3-45-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-mass_7.3-45-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-matrix_1.2-8-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-matrix_1.2-8-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-matrix_1.2-8-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-mgcv_1.8-16-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-mgcv_1.8-16-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-mgcv_1.8-16-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-nlme_3.1.131-2~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-nlme_3.1.131-2~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-nlme_3.1.131-2~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-nnet_7.3-12-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-nnet_7.3-12-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-nnet_7.3-12-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rjags_4-6-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rjags_4-6-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rjags_4-6-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rodbc_1.3-14-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rodbc_1.3-14-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rodbc_1.3-14-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rpart_4.1-10-2~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rpart_4.1-10-2~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-rpart_4.1-10-2~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-spatial_7.3-11-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-spatial_7.3-11-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-spatial_7.3-11-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-survival_2.40-1-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-survival_2.40-1-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-cran-survival_2.40-1-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-doc-html_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-doc-info_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-doc-pdf_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-mathlib_3.3.3-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-mathlib_3.3.3-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-mathlib_3.3.3-1~jessiecran.0_i386.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/r-recommended_3.3.3-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/rkward-data_0.6.5-1~jessiecran.0_all.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/rkward_0.6.5-1~jessiecran.0_amd64.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/rkward_0.6.5-1~jessiecran.0_armel.deb...
Downloading https://cloud.r-project.org/bin/linux/debian/jessie-cran3/rkward_0.6.5-1~jessiecran.0_i386.deb...
Mirror `flat` has been successfully updated.
openpgp: Good signature from "Johannes Ranke (CRAN Debian archive) <jranke@uni-bremen.de>"
openpgp: DSA key ID 06F90DE5381BA480
+38
View File
@@ -357,3 +357,41 @@ class CreateMirror28Test(BaseTest):
self.check_output()
self.check_cmd_output("aptly mirror show mirror28", "mirror_show", match_prepare=removeDates)
class CreateMirror29Test(BaseTest):
"""
create mirror: repo with InRelease verification (internal GPG implementation)
"""
runCmd = "aptly mirror create --keyring=aptlytest.gpg mirror9 http://mirror.yandex.ru/debian/ wheezy-backports"
configOverride = {"gpgProvider": "internal"}
fixtureGpg = True
def outputMatchPrepare(_, s):
return re.sub(r'Signature made .* using', '', s)
class CreateMirror30Test(BaseTest):
"""
create mirror: repo with InRelease verification, failure (internal GPG implementation)
"""
runCmd = "aptly mirror create --keyring=aptlytest.gpg mirror10 http://mirror.yandex.ru/debian-backports/ squeeze-backports"
configOverride = {"gpgProvider": "internal"}
gold_processor = BaseTest.expand_environ
fixtureGpg = False
expectedCode = 1
def outputMatchPrepare(_, s):
return re.sub(r'Signature made .* using', '', s)
class CreateMirror31Test(BaseTest):
"""
create mirror: repo with Release + Release.gpg verification (internal GPG implementation)
"""
runCmd = "aptly mirror create --keyring=aptlytest.gpg mirror11 http://mirror.yandex.ru/debian/ wheezy"
configOverride = {"gpgProvider": "internal"}
fixtureGpg = True
def outputMatchPrepare(_, s):
return re.sub(r'Signature made .* using', '', s)
+16
View File
@@ -327,3 +327,19 @@ class UpdateMirror19Test(BaseTest):
def output_processor(self, output):
return "\n".join(line for line in output.split("\n") if ".deb" not in line)
class UpdateMirror20Test(BaseTest):
"""
update mirrors: flat repository (internal GPG implementation)
"""
fixtureGpg = True
fixtureCmds = [
"aptly mirror create --keyring=aptlytest.gpg -architectures=amd64 flat https://cloud.r-project.org/bin/linux/debian jessie-cran3/",
]
configOverride = {"gpgProvider": "internal"}
runCmd = "aptly mirror update --keyring=aptlytest.gpg flat"
outputMatchPrepare = filterOutSignature
def output_processor(self, output):
return "\n".join(sorted(output.split("\n")))