Skip to content

Commit ae69e2f

Browse files
fmoessbauerjan-kiszka
fmoessbauer
authored and
jan-kiszka
committed
add test for repo signature verification
Signed-off-by: Felix Moessbauer <[email protected]> Signed-off-by: Jan Kiszka <[email protected]>
1 parent 6b32c31 commit ae69e2f

6 files changed

+213
-0
lines changed

‎tests/test_signature_verify.py

+136
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# kas - setup tool for bitbake based projects
2+
#
3+
# Copyright (c) Siemens, 2025
4+
#
5+
# Permission is hereby granted, free of charge, to any person obtaining a copy
6+
# of this software and associated documentation files (the "Software"), to deal
7+
# in the Software without restriction, including without limitation the rights
8+
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
# copies of the Software, and to permit persons to whom the Software is
10+
# furnished to do so, subject to the following conditions:
11+
#
12+
# The above copyright notice and this permission notice shall be
13+
# included in all copies or substantial portions of the Software.
14+
#
15+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
# SOFTWARE.
22+
23+
import pytest
24+
import shutil
25+
import yaml
26+
import gnupg
27+
from pathlib import Path
28+
from subprocess import check_output
29+
from kas import kas
30+
from kas.repos import RepoRefError
31+
from kas.kasusererror import KasUserError
32+
from kas.keyhandler import KeyImportError
33+
34+
35+
@pytest.mark.online
36+
def test_signed_gpg_invalid(monkeykas, tmpdir):
37+
tdir = tmpdir / 'test_signature_verify'
38+
shutil.copytree('tests/test_signature_verify', tdir)
39+
monkeykas.chdir(tdir)
40+
with pytest.raises(RepoRefError):
41+
kas.kas(['checkout', 'test-gpg-wrong-key.yml'])
42+
43+
44+
@pytest.mark.online
45+
def test_signed_gpg_remove_key(monkeykas, tmpdir):
46+
tdir = tmpdir / 'test_signature_verify'
47+
shutil.copytree('tests/test_signature_verify', tdir)
48+
monkeykas.chdir(tdir)
49+
50+
# successfully validate signature
51+
kas.kas(['checkout', 'test-gpg-key-retention.yml'])
52+
53+
# change key in config and try again
54+
with open('test-gpg-key-retention.yml', 'r') as f:
55+
data = yaml.safe_load(f)
56+
# use OEs signing key
57+
data['signers']['jan-kiszka']['fingerprint'] = \
58+
'2AFB13F28FBBB0D1B9DAF63087EB3D32FB631AD9'
59+
with open('test-gpg-key-retention.yml', 'w') as f:
60+
yaml.dump(data, f)
61+
with pytest.raises(RepoRefError):
62+
kas.kas(['checkout', 'test-gpg-key-retention.yml'])
63+
64+
# remove key from config and try again (without deleting the keystore)
65+
with open('test-gpg-key-retention.yml', 'r') as f:
66+
data = yaml.safe_load(f)
67+
del data['signers']
68+
with open('test-gpg-key-retention.yml', 'w') as f:
69+
yaml.dump(data, f)
70+
with pytest.raises(KasUserError):
71+
kas.kas(['checkout', 'test-gpg-key-retention.yml'])
72+
73+
74+
@pytest.mark.online
75+
def test_signed_gpg_local_key(monkeykas, tmpdir):
76+
tdir = tmpdir / 'test_signature_verify'
77+
shutil.copytree('tests/test_signature_verify', tdir)
78+
monkeykas.chdir(tdir)
79+
# we don't want to store keys in this repo, hence download a key,
80+
# export it and pass to kas
81+
KEY_FINGERPRINT = 'CA5F8C00F5FBC85466016C808AD4AC6F7AE5E714'
82+
gnupghome = tdir / 'test_gnupg'
83+
gnupghome.mkdir()
84+
gnupghome.chmod(0o700)
85+
gpg = gnupg.GPG(gnupghome=str(gnupghome))
86+
gpg.recv_keys('keyserver.ubuntu.com', KEY_FINGERPRINT)
87+
gpg.export_keys(KEY_FINGERPRINT, armor=True,
88+
output=str(tdir / 'jan-kiszka.asc'))
89+
90+
with pytest.raises(KeyImportError):
91+
kas.kas(['checkout', 'test-gpg-local-key.yml'])
92+
93+
# remove key definition with wrong fingerprint
94+
with open('test-gpg-local-key.yml', 'r') as f:
95+
data = yaml.safe_load(f)
96+
del data['signers']['wrong-fp']
97+
with open('test-gpg-local-key.yml', 'w') as f:
98+
yaml.dump(data, f)
99+
kas.kas(['checkout', 'test-gpg-local-key.yml'])
100+
101+
102+
def test_signed_ssh_key(monkeykas, tmpdir):
103+
tdir = tmpdir / 'test_signature_verify'
104+
shutil.copytree('tests/test_signature_verify', tdir)
105+
106+
repodir = Path(tdir / 'testrepo')
107+
repodir.mkdir()
108+
# create a new ssh key
109+
sshdir = Path(tdir / 'ssh')
110+
sshdir.mkdir()
111+
sshdir.chmod(0o700)
112+
113+
monkeykas.chdir(repodir)
114+
check_output(['ssh-keygen', '-t', 'rsa', '-N', '', '-C', 'Comment Space',
115+
'-f', str(sshdir / 'testkey')])
116+
# create a git repository with a single commit
117+
check_output(['git', 'init'])
118+
check_output(['git', 'config', 'user.name', 'kas'])
119+
check_output(['git', 'config', 'user.email', '[email protected]'])
120+
check_output(['git', 'config', 'gpg.format', 'ssh'])
121+
check_output(['git', 'config', 'user.signingkey', str(sshdir / 'testkey')])
122+
check_output(['git', 'commit', '-S', '-m', 'initial commit',
123+
'--allow-empty'])
124+
check_output(['git', 'tag', '-s', 'signed-tag', '-m', 'signed tag'])
125+
monkeykas.chdir(tdir)
126+
127+
kas.kas(['checkout', 'test-ssh-key.yml'])
128+
129+
# now replace the ssh key and check if signature verification fails
130+
(sshdir / 'testkey').unlink()
131+
(sshdir / 'testkey.pub').unlink()
132+
check_output(['ssh-keygen', '-t', 'rsa', '-N', '', '-f',
133+
str(sshdir / 'testkey')])
134+
135+
with pytest.raises(RepoRefError):
136+
kas.kas(['checkout', 'test-ssh-key.yml'])

‎tests/test_signature_verify/oe-init-build-env

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/sh
2+
3+
true

‎tests/test_signature_verify/test-gpg-key-retention.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
header:
2+
version: 19
3+
4+
signers:
5+
jan-kiszka:
6+
fingerprint: CA5F8C00F5FBC85466016C808AD4AC6F7AE5E714
7+
gpg_keyserver: keyserver.ubuntu.com
8+
9+
repos:
10+
this:
11+
kas:
12+
url: https://github.com/siemens/kas.git
13+
tag: '4.3'
14+
commit: f650ebe2495a9cbe2fdf4a2c8becc7b3db470d55
15+
signed: true
16+
# use the wrong key to test the error message
17+
allowed_signers:
18+
- jan-kiszka

‎tests/test_signature_verify/test-gpg-local-key.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
header:
2+
version: 19
3+
4+
signers:
5+
jan-kiszka:
6+
repo: this
7+
path: jan-kiszka.asc
8+
wrong-fp:
9+
repo: this
10+
path: jan-kiszka.asc
11+
fingerprint: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
12+
13+
repos:
14+
this:
15+
kas:
16+
url: https://github.com/siemens/kas.git
17+
tag: '4.3'
18+
commit: f650ebe2495a9cbe2fdf4a2c8becc7b3db470d55
19+
signed: true
20+
allowed_signers:
21+
- jan-kiszka

‎tests/test_signature_verify/test-gpg-wrong-key.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
header:
2+
version: 19
3+
4+
signers:
5+
YoctoBuildandRelease:
6+
fingerprint: 2AFB13F28FBBB0D1B9DAF63087EB3D32FB631AD9
7+
gpg_keyserver: keyserver.ubuntu.com
8+
9+
repos:
10+
this:
11+
kas:
12+
url: https://github.com/siemens/kas.git
13+
tag: '4.3'
14+
commit: f650ebe2495a9cbe2fdf4a2c8becc7b3db470d55
15+
signed: true
16+
# use the wrong key to test the error message
17+
allowed_signers:
18+
- YoctoBuildandRelease

‎tests/test_signature_verify/test-ssh-key.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
header:
2+
version: 19
3+
4+
signers:
5+
testkey:
6+
type: ssh
7+
repo: this
8+
path: ssh/testkey.pub
9+
10+
repos:
11+
this:
12+
local:
13+
path: testrepo
14+
tag: signed-tag
15+
signed: true
16+
allowed_signers:
17+
- testkey

0 commit comments

Comments
 (0)