projects/guix·blob ruby-team · refs

270 lines · 10.1 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2020 Ludovic Courtès <[email protected]>
3;;;
4;;; This file is part of GNU Guix.
5;;;
6;;; GNU Guix is free software; you can redistribute it and/or modify it
7;;; under the terms of the GNU General Public License as published by
8;;; the Free Software Foundation; either version 3 of the License, or (at
9;;; your option) any later version.
10;;;
11;;; GNU Guix is distributed in the hope that it will be useful, but
12;;; WITHOUT ANY WARRANTY; without even the implied warranty of
13;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14;;; GNU General Public License for more details.
15;;;
16;;; You should have received a copy of the GNU General Public License
17;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
18
19(define-module (tests-openpgp)
20 #:use-module (guix openpgp)
21 #:use-module (gcrypt base16)
22 #:use-module (gcrypt hash)
23 #:use-module (gcrypt pk-crypto)
24 #:use-module (ice-9 binary-ports)
25 #:use-module (ice-9 match)
26 #:use-module (rnrs bytevectors)
27 #:use-module (srfi srfi-1)
28 #:use-module (srfi srfi-64)
29 #:use-module (srfi srfi-71))
30
31(define %radix-64-sample
32 ;; Example of Radix-64 encoding from Section 6.6 of RFC4880.
33 "\
34-----BEGIN PGP MESSAGE-----
35Version: OpenPrivacy 0.99
36
37yDgBO22WxBHv7O8X7O/jygAEzol56iUKiXmV+XmpCtmpqQUKiQrFqclFqUDBovzS
38vBSFjNSiVHsuAA==
39=njUN
40-----END PGP MESSAGE-----\n")
41
42(define %radix-64-sample/crc-mismatch
43 ;; This time with a wrong CRC24 value.
44 "\
45-----BEGIN PGP MESSAGE-----
46
47yDgBO22WxBHv7O8X7O/jygAEzol56iUKiXmV+XmpCtmpqQUKiQrFqclFqUDBovzS
48vBSFjNSiVHsuAA==
49=AAAA
50-----END PGP MESSAGE-----\n")
51
52(define %binary-sample
53 ;; Same message as %radix-64-sample, decoded into bytevector.
54 (base16-string->bytevector
55 "c838013b6d96c411efecef17ecefe3ca0004ce8979ea250a897995f979a9\
560ad9a9a9050a890ac5a9c945a940c1a2fcd2bc14858cd4a2547b2e00"))
57
58(define %civodul-fingerprint
59 "3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5")
60
61(define %civodul-key-id #x090B11993D9AEBB5) ;civodul.pub
62
63#|
64Test keys in ./tests/keys. They were generated in a container along these lines:
65 guix environment -CP --ad-hoc gnupg pinentry coreutils
66then, within the container:
67 mkdir ~/.gnupg && chmod -R og-rwx ~/.gnupg
68 gpg --batch --passphrase '' --quick-gen-key '<[email protected]>' ed25519
69 gpg --armor --export [email protected]
70 gpg --armor --export-secret-key [email protected]
71 # echo pinentry-program ~/.guix-profile/bin/pinentry-curses > ~/.gnupg/gpg-agent.conf
72or similar.
73|#
74(define %rsa-key-id #xAE25DA2A70DEED59) ;rsa.pub
75(define %dsa-key-id #x587918047BE8BD2C) ;dsa.pub
76(define %ed25519-key-id #x771F49CBFAAE072D) ;ed25519.pub
77
78(define %rsa-key-fingerprint
79 (base16-string->bytevector
80 (string-downcase "385F86CFC86B665A5C165E6BAE25DA2A70DEED59")))
81(define %dsa-key-fingerprint
82 (base16-string->bytevector
83 (string-downcase "2884A980422330A4F33DD97F587918047BE8BD2C")))
84(define %ed25519-key-fingerprint
85 (base16-string->bytevector
86 (string-downcase "44D31E21AF7138F9B632280A771F49CBFAAE072D")))
87
88
89;;; The following are detached signatures created commands like:
90;;; echo 'Hello!' | gpg -sba --digest-algo sha512
91;;; They are detached (no PACKET-ONE-PASS-SIGNATURE) and uncompressed.
92
93(define %hello-signature/rsa
94 ;; Signature of the ASCII string "Hello!\n".
95 "\
96-----BEGIN PGP SIGNATURE-----
97
98iQEzBAABCAAdFiEEOF+Gz8hrZlpcFl5rriXaKnDe7VkFAl4SRF0ACgkQriXaKnDe
997VlIyQf/TU5rGUK42/C1ULoWvvm25Mjwh6xxoPPkuBxvos8bE6yKr/vJZePU3aSE
100mjbVFcO7DioxHMqLd49j803bUtdllJVU18ex9MkKbKjapkgEGkJsuTTzqyONprgk
1017xtZGBWuxkP1M6hJICJkA3Ys+sTdKalux/pzr5OWAe+gxytTF/vr/EyJzdmBxbJv
102/fhd1SeVIXSw4c5gf2Wcvcgfy4N5CiLaUb7j4646KBTvDvmUMcDZ+vmKqC/XdQeQ
103PrjArGKt40ErVd98fwvNHZnw7VQMx0A3nL3joL5g7/RckDOUb4mqKoqLsLd0wPHP
104y32DiDUY9s3sy5OMzX4Y49em8vxvlg==
105=ASEm
106-----END PGP SIGNATURE-----")
107
108
109(define %hello-signature/dsa
110 "\
111-----BEGIN PGP SIGNATURE-----
112
113iHUEABEIAB0WIQQohKmAQiMwpPM92X9YeRgEe+i9LAUCXhJFpQAKCRBYeRgEe+i9
114LDAaAQC0lXPQepvZBANAUtRLMZuOwL9NQPkfhIwUXtLEBBzyFQD/So8DcybXpRBi
115JKOiyAQQjMs/GJ6qMEQpRAhyyJRAock=
116=iAEc
117-----END PGP SIGNATURE-----")
118
119
120(define %hello-signature/ed25519/sha256 ;digest-algo: sha256
121 "\
122-----BEGIN PGP SIGNATURE-----
123
124iHUEABYIAB0WIQRE0x4hr3E4+bYyKAp3H0nL+q4HLQUCXqRADAAKCRB3H0nL+q4H
125LUImAP9/foaSjPFC/MSr52LNV5ROSL9haea4jPpUP+N6ViFGowEA+AE/xpXPIqsz
126R6CdxMevURuqUpqQ7rHeiMmdUepeewU=
127=tLXy
128-----END PGP SIGNATURE-----")
129
130(define %hello-signature/ed25519/sha512 ;digest-algo: sha512
131 "\
132-----BEGIN PGP SIGNATURE-----
133
134iHUEABYKAB0WIQRE0x4hr3E4+bYyKAp3H0nL+q4HLQUCXqRAGgAKCRB3H0nL+q4H
135LTeKAP0S8LiiosJXOARlYNdhfGw9j26lHrbwJh5CORGlaqqIJAEAoMYcmtNa2b6O
136inlEwB/KQM88O9RwA8xH7X5a0rodOw4=
137=68r/
138-----END PGP SIGNATURE-----")
139
140(define %hello-signature/ed25519/sha1 ;digest-algo: sha1
141 "\
142-----BEGIN PGP SIGNATURE-----
143
144iHUEABYCAB0WIQRE0x4hr3E4+bYyKAp3H0nL+q4HLQUCXqRALQAKCRB3H0nL+q4H
145LdhEAQCfkdYhIVRa43oTNw9EL/TDFGQjXSHNRFVU0ktjkWbkQwEAjIXhvj2sqy79
146Pz7oopeN72xgggYUNT37ezqN3MeCqw0=
147=AE4G
148-----END PGP SIGNATURE-----")
149
150
151(test-begin "openpgp")
152
153(test-equal "read-radix-64"
154 '(#t "PGP MESSAGE")
155 (let ((data type (call-with-input-string %radix-64-sample read-radix-64)))
156 (list (bytevector? data) type)))
157
158(test-equal "read-radix-64, CRC mismatch"
159 '(#f "PGP MESSAGE")
160 (call-with-values
161 (lambda ()
162 (call-with-input-string %radix-64-sample/crc-mismatch
163 read-radix-64))
164 list))
165
166(test-assert "port-ascii-armored?, #t"
167 (call-with-input-string %radix-64-sample port-ascii-armored?))
168
169(test-assert "port-ascii-armored?, #f"
170 (not (port-ascii-armored? (open-bytevector-input-port %binary-sample))))
171
172(test-assert "get-openpgp-keyring"
173 (let* ((key (search-path %load-path "tests/keys/openpgp/civodul.pub"))
174 (keyring (get-openpgp-keyring
175 (open-bytevector-input-port
176 (call-with-input-file key read-radix-64))))
177 (primary packets (lookup-key-by-id keyring %civodul-key-id))
178 (fingerprint (openpgp-public-key-fingerprint primary)))
179 (and (= (openpgp-public-key-id primary) %civodul-key-id)
180 (not (openpgp-public-key-subkey? primary))
181 (string=? (openpgp-format-fingerprint fingerprint)
182 %civodul-fingerprint)
183 (string=? (openpgp-user-id-value (find openpgp-user-id? packets))
184 "Ludovic Courtès <[email protected]>")
185 (eq? primary (lookup-key-by-fingerprint keyring fingerprint)))))
186
187(test-equal "get-openpgp-detached-signature/ascii"
188 (list `(,%dsa-key-id ,%dsa-key-fingerprint dsa sha256)
189 `(,%rsa-key-id ,%rsa-key-fingerprint rsa sha256)
190 `(,%ed25519-key-id ,%ed25519-key-fingerprint eddsa sha256)
191 `(,%ed25519-key-id ,%ed25519-key-fingerprint eddsa sha512)
192 `(,%ed25519-key-id ,%ed25519-key-fingerprint eddsa sha1))
193 (map (lambda (str)
194 (let ((signature (get-openpgp-detached-signature/ascii
195 (open-input-string str))))
196 (list (openpgp-signature-issuer-key-id signature)
197 (openpgp-signature-issuer-fingerprint signature)
198 (openpgp-signature-public-key-algorithm signature)
199 (openpgp-signature-hash-algorithm signature))))
200 (list %hello-signature/dsa
201 %hello-signature/rsa
202 %hello-signature/ed25519/sha256
203 %hello-signature/ed25519/sha512
204 %hello-signature/ed25519/sha1)))
205
206(test-equal "verify-openpgp-signature, missing key"
207 `(missing-key ,%rsa-key-fingerprint)
208 (let* ((keyring (get-openpgp-keyring (%make-void-port "r")))
209 (signature (string->openpgp-packet %hello-signature/rsa))
210 (port (open-input-string "Hello!\n"))
211 (status key (verify-openpgp-signature signature keyring port)))
212 (list status key)))
213
214(test-equal "verify-openpgp-signature, good signatures"
215 `((good-signature ,%rsa-key-id)
216 (good-signature ,%dsa-key-id)
217 (good-signature ,%ed25519-key-id)
218 (good-signature ,%ed25519-key-id)
219 (good-signature ,%ed25519-key-id))
220 (map (lambda (key signature)
221 (let* ((key (search-path %load-path key))
222 (keyring (get-openpgp-keyring
223 (open-bytevector-input-port
224 (call-with-input-file key read-radix-64))))
225 (signature (string->openpgp-packet signature))
226 (port (open-input-string "Hello!\n"))
227 (status key (verify-openpgp-signature signature keyring port)))
228 (list status (openpgp-public-key-id key))))
229 (list "tests/keys/openpgp/rsa.pub"
230 "tests/keys/openpgp/dsa.pub"
231 "tests/keys/openpgp/ed25519.pub"
232 "tests/keys/openpgp/ed25519.pub"
233 "tests/keys/openpgp/ed25519.pub")
234 (list %hello-signature/rsa
235 %hello-signature/dsa
236 %hello-signature/ed25519/sha256
237 %hello-signature/ed25519/sha512
238 %hello-signature/ed25519/sha1)))
239
240(test-equal "verify-openpgp-signature, bad signature"
241 `((bad-signature ,%rsa-key-id)
242 (bad-signature ,%dsa-key-id)
243 (bad-signature ,%ed25519-key-id)
244 (bad-signature ,%ed25519-key-id)
245 (bad-signature ,%ed25519-key-id))
246 (let ((keyring (fold (lambda (key keyring)
247 (let ((key (search-path %load-path key)))
248 (get-openpgp-keyring
249 (open-bytevector-input-port
250 (call-with-input-file key read-radix-64))
251 keyring)))
252 %empty-keyring
253 '("tests/keys/openpgp/rsa.pub"
254 "tests/keys/openpgp/dsa.pub"
255 "tests/keys/openpgp/ed25519.pub"
256 "tests/keys/openpgp/ed25519.pub"
257 "tests/keys/openpgp/ed25519.pub"))))
258 (map
259 (lambda (signature)
260 (let* ((signature (string->openpgp-packet signature))
261 (port (open-input-string "What?!"))
262 (status key (verify-openpgp-signature signature keyring port)))
263 (list status (openpgp-public-key-id key))))
264 (list %hello-signature/rsa
265 %hello-signature/dsa
266 %hello-signature/ed25519/sha256
267 %hello-signature/ed25519/sha512
268 %hello-signature/ed25519/sha1))))
269
270(test-end "openpgp")