Package: guix-patches;
Reported by: Attila Lendvai <attila <at> lendvai.name>
Date: Sun, 26 Sep 2021 10:26:01 UTC
Severity: important
Tags: patch
Message #114 received at 50814 <at> debbugs.gnu.org (full text, mbox):
From: Attila Lendvai <attila <at> lendvai.name> To: 50814 <at> debbugs.gnu.org Cc: Attila Lendvai <attila <at> lendvai.name> Subject: [PATCH 5/5] tests: Add test for .guix-authorizations and channel intro. Date: Mon, 18 Oct 2021 17:57:34 +0200
This test used to fail before a recent fix to authenticate-repository.
* tests/git-authenticate.scm: New test "signed commits, .guix-authorizations,
channel-introduction".
---
tests/git-authenticate.scm | 150 +++++++++++++++++++++++++++++++++++++
1 file changed, 150 insertions(+)
diff --git a/tests/git-authenticate.scm b/tests/git-authenticate.scm
index f66ef191b0..25b4962ea4 100644
--- a/tests/git-authenticate.scm
+++ b/tests/git-authenticate.scm
@@ -18,6 +18,7 @@
(define-module (test-git-authenticate)
#:use-module (git)
+ #:use-module (guix diagnostics)
#:use-module (guix git)
#:use-module (guix git-authenticate)
#:use-module (guix openpgp)
@@ -28,6 +29,10 @@ (define-module (test-git-authenticate)
#:use-module (srfi srfi-34)
#:use-module (srfi srfi-64)
#:use-module (rnrs bytevectors)
+ #:use-module ((rnrs conditions)
+ #:select (warning?))
+ #:use-module ((rnrs exceptions)
+ #:select (with-exception-handler))
#:use-module (rnrs io ports))
;; Test the (guix git-authenticate) tools.
@@ -226,6 +231,151 @@ (define (correct? c commit)
#:keyring-reference "master")
#f)))))))
+(unless (gpg+git-available?) (test-skip 1))
+(test-assert "signed commits, .guix-authorizations, channel-introduction"
+ (let* ((result #true)
+ (key1 %ed25519-public-key-file)
+ (key2 %ed25519-2-public-key-file)
+ (key3 %ed25519-3-public-key-file))
+ (with-fresh-gnupg-setup (list key1 %ed25519-secret-key-file
+ key2 %ed25519-2-secret-key-file
+ key3 %ed25519-3-secret-key-file)
+ (with-temporary-git-repository dir
+ `((checkout "keyring" orphan)
+ (add "signer1.key" ,(call-with-input-file key1 get-string-all))
+ (add "signer2.key" ,(call-with-input-file key2 get-string-all))
+ (add "signer3.key" ,(call-with-input-file key3 get-string-all))
+ (commit "keyring commit")
+
+ (checkout "main" orphan)
+ (add "noise0")
+ (add ".guix-authorizations"
+ ,(object->string
+ `(authorizations
+ (version 0)
+ ((,(key-fingerprint key1) (name "Alice"))
+ ;; Notice that key2 is not authorized at this point.
+ (,(key-fingerprint key3) (name "Charlie"))))))
+ (commit "commit 0" (signer ,(key-fingerprint key3)))
+ (add "noise1")
+ (commit "commit 1" (signer ,(key-fingerprint key1)))
+ (add "noise2")
+ (commit "commit 2" (signer ,(key-fingerprint key1))))
+ (with-repository dir repo
+ (let* ((commit-0 (find-commit repo "commit 0"))
+ (check-from
+ (lambda* (commit #:key (should-fail? #false) (key key1)
+ (historical-authorizations
+ ;; Let's mark key3 to be trusted
+ ;; unconditionally, so that it authorizes
+ ;; commit 0.
+ (list (key-fingerprint-vector key3))))
+ (guard (c ((unauthorized-commit-error? c)
+ (if should-fail?
+ c
+ (let ((port (current-output-port)))
+ (format port "FAILURE: Unexpected exception at commit '~s':~%"
+ commit)
+ (print-exception port (stack-ref (make-stack #t) 1)
+ c (exception-args c))
+ (set! result #false)
+ '()))))
+ (format #true "~%~%Checking ~s, should-fail? ~s, repo commits:~%"
+ commit should-fail?)
+ ;; To be able to inspect git's state in the logs.
+ (invoke "git" "-C" dir "log" "--reverse" "--pretty=oneline" "main")
+ (set! commit (find-commit repo commit))
+ (authenticate-repository repo
+ (commit-id commit)
+ (key-fingerprint-vector key)
+ #:historical-authorizations
+ historical-authorizations)
+ (when should-fail?
+ (format #t "FAILURE: Authenticating commit '~s' should have failed.~%" commit)
+ (set! result #false))
+ '()))))
+ (check-from "commit 0" #:key key3)
+ (check-from "commit 1")
+ (check-from "commit 2")
+ (with-git-repository dir
+ `((add "noise 3")
+ (commit "commit 3" (signer ,(key-fingerprint key2))))
+ ;; This should fail because it is signed by key2, i.e. an
+ ;; unauthorized key.
+ (check-from "commit 3" #:should-fail? #true)
+ ;; Specify commit 3 as a channel-introduction signed with
+ ;; key2. This is valid, but it should warn the user, because
+ ;; .guix-authorizations is not updated to include key2, which
+ ;; means that any subsequent commits with the same key will be
+ ;; rejected.
+ (set! result
+ (and (let ((signalled? #false))
+ (with-exception-handler
+ (lambda (c)
+ (cond
+ ((not (warning? c))
+ (raise c))
+ ((formatted-message? c)
+ (format #true "warning (expected): ~a~%"
+ (apply format #false
+ (formatted-message-string c)
+ (formatted-message-arguments c)))
+ (set! signalled? #true)))
+ '())
+ (lambda ()
+ (check-from "commit 3" #:key key2)
+ (unless signalled?
+ (format #t "FAILURE: No warning signalled for commit 3~%"))
+ signalled?)))
+ result)))
+ (with-git-repository dir
+ ;; Drop the faulty commit 3
+ `((reset ,(oid->string (commit-id (find-commit repo "commit 2"))))
+ (add "noise 4")
+ (add ".guix-authorizations"
+ ,(object->string
+ ;; Remove key3, add key2.
+ `(authorizations
+ (version 0)
+ ((,(key-fingerprint key1) (name "Alice"))
+ (,(key-fingerprint key2) (name "Bob"))))))
+ (commit "commit 4" (signer ,(key-fingerprint key2))))
+ ;; This should fail because even though commit 4 adds key2 to
+ ;; .guix-authorizations, but commit 1 was created prior to that,
+ ;; therefore it is not authorized.
+ (check-from "commit 1" #:should-fail? #true)
+ ;; This should pass, because it's a valid channel intro at commit 4
+ (check-from "commit 4" #:key key2))
+ (with-git-repository dir
+ `((add "noise 5")
+ (commit "commit 5" (signer ,(key-fingerprint key2))))
+ ;; It is not very intuitive why commit 1 and 2 should be trusted
+ ;; at this point: commit 4 has previously been used as a channel
+ ;; intro, thus it got marked as trusted in the ~/.cache/.
+ ;; Because commit 1 and 2 are among its parents, it should also
+ ;; be trusted at this point because of the cache. Note that
+ ;; it's debatable whether this semantics is a good idea, but
+ ;; this is how git-authenticate is and has been implemented for
+ ;; a while (modulo failing to update the cache in the past when
+ ;; taking certain code paths).
+ (check-from "commit 1")
+ (check-from "commit 2")
+ ;; Should still be fine, but only when starting from commit 4
+ (check-from "commit 4" #:key key2))
+ (with-git-repository dir
+ `((add "noise 6")
+ (commit "commit 6" (signer ,(key-fingerprint key1))))
+ (check-from "commit 1")
+ (check-from "commit 2")
+ (check-from "commit 4" #:key key2))
+ (with-git-repository dir
+ `((add "noise 7")
+ (commit "commit 7" (signer ,(key-fingerprint key3))))
+ ;; This should fail because key3 is not among the authorized
+ ;; keys anymore, and commit 7 is signed by it.
+ (check-from "commit 6" #:should-fail? #true))))))
+ result))
+
(unless (gpg+git-available?) (test-skip 1))
(test-assert "signed commits, .guix-authorizations, authorized merge"
(with-fresh-gnupg-setup (list %ed25519-public-key-file
--
2.33.0
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.