75 lines
2.9 KiB
Rust
75 lines
2.9 KiB
Rust
//! 官方历史签名向量与目录哈希检查，独立于自签测试对端。
|
|
|
|
use super::*;
|
|
use base64::{Engine, engine::general_purpose::STANDARD};
|
|
use std::io::{Cursor, Write};
|
|
|
|
#[test]
|
|
fn official_inclusion_and_consistency_vectors_reject_each_tampered_hash() {
|
|
let evidence: Evidence = serde_json::from_str(include_str!("sumdb_uuid.json")).unwrap();
|
|
let verified = evidence.verify(&Verifier::official()).unwrap();
|
|
assert!(verified.contains("github.com/google/uuid", "1.6.0"));
|
|
assert!(evidence.verify(&fixture::verifier()).is_err());
|
|
assert_eq!(
|
|
sumdb::mod_hash(b"module github.com/google/uuid\n"),
|
|
"h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo="
|
|
);
|
|
for index in 0..evidence.records[0].inclusion.len() {
|
|
let mut changed = evidence.clone();
|
|
changed.records[0].inclusion[index] = STANDARD.encode([0; 32]);
|
|
assert!(changed.verify(&Verifier::official()).is_err());
|
|
}
|
|
for index in 0..evidence.consistency.len() {
|
|
let mut changed = evidence.clone();
|
|
changed.consistency[index] = STANDARD.encode([0; 32]);
|
|
assert!(changed.verify(&Verifier::official()).is_err());
|
|
}
|
|
let mut changed = evidence.clone();
|
|
changed.records[0].go_mod.push_str("// tampered\n");
|
|
assert!(changed.verify(&Verifier::official()).is_err());
|
|
let mut changed = evidence.clone();
|
|
changed.checkpoint = changed.checkpoint.replace("go.sum", "no.sum");
|
|
assert!(changed.verify(&Verifier::official()).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn hashzip_tracks_directory_names_but_not_compression_or_order() {
|
|
let archive = |reverse: bool, directory: bool| {
|
|
let mut zip = zip::ZipWriter::new(Cursor::new(Vec::new()));
|
|
let mut names = vec!["value.go", "LICENSE"];
|
|
if reverse {
|
|
names.reverse();
|
|
}
|
|
for name in names {
|
|
zip.start_file(
|
|
format!("example.com/Mixed@v1.0.0/{name}"),
|
|
zip::write::SimpleFileOptions::default().compression_method(if reverse {
|
|
zip::CompressionMethod::Deflated
|
|
} else {
|
|
zip::CompressionMethod::Stored
|
|
}),
|
|
)
|
|
.unwrap();
|
|
zip.write_all(b"same bytes").unwrap();
|
|
}
|
|
if directory {
|
|
zip.add_directory(
|
|
"example.com/Mixed@v1.0.0/empty/",
|
|
zip::write::SimpleFileOptions::default(),
|
|
)
|
|
.unwrap();
|
|
}
|
|
zip.finish().unwrap().into_inner()
|
|
};
|
|
let first = sumdb::zip_hash("example.com/Mixed", "1.0.0", &archive(false, false)).unwrap();
|
|
assert_eq!(
|
|
first,
|
|
sumdb::zip_hash("example.com/Mixed", "1.0.0", &archive(true, false)).unwrap()
|
|
);
|
|
assert_ne!(
|
|
first,
|
|
sumdb::zip_hash("example.com/Mixed", "1.0.0", &archive(false, true)).unwrap()
|
|
);
|
|
assert!(sumdb::zip_hash("example.com/mixed", "1.0.0", &archive(false, false)).is_err());
|
|
}
|