* @brief Exercises signature, machine, expiry, tier, and malformed paths. */
| 94 | * @brief Exercises signature, machine, expiry, tier, and malformed paths. |
| 95 | */ |
| 96 | [[nodiscard]] static int runVerifierChecks() |
| 97 | { |
| 98 | const QByteArray good(kGoodCert); |
| 99 | const QString machine(kTestMachineId); |
| 100 | |
| 101 | int fails = 0; |
| 102 | fails += expect("good certificate accepted", |
| 103 | statusIs(good, machine, kTestNowSecs, Licensing::CertStatus::Valid)); |
| 104 | |
| 105 | auto decoded = QByteArray::fromBase64(good); |
| 106 | decoded[3] = static_cast<char>(decoded[3] ^ 0x01); |
| 107 | fails += expect( |
| 108 | "payload bit-flip rejected (bad signature)", |
| 109 | statusIs(decoded.toBase64(), machine, kTestNowSecs, Licensing::CertStatus::BadSignature)); |
| 110 | |
| 111 | fails += expect( |
| 112 | "wrong machine rejected", |
| 113 | statusIs( |
| 114 | good, QStringLiteral("SS-OTHER"), kTestNowSecs, Licensing::CertStatus::MachineMismatch)); |
| 115 | |
| 116 | fails += expect( |
| 117 | "expired certificate rejected", |
| 118 | statusIs(QByteArray(kExpiredCert), machine, kTestNowSecs, Licensing::CertStatus::Expired)); |
| 119 | |
| 120 | fails += expect( |
| 121 | "empty-tier certificate rejected", |
| 122 | statusIs(QByteArray(kWrongTierCert), machine, kTestNowSecs, Licensing::CertStatus::WrongTier)); |
| 123 | |
| 124 | fails += expect("garbage input rejected (malformed)", |
| 125 | statusIs(QByteArray("!!not a certificate!!"), |
| 126 | machine, |
| 127 | kTestNowSecs, |
| 128 | Licensing::CertStatus::Malformed)); |
| 129 | |
| 130 | fails += expect("truncated certificate rejected (malformed)", |
| 131 | statusIs(good.left(8), machine, kTestNowSecs, Licensing::CertStatus::Malformed)); |
| 132 | return fails; |
| 133 | } |
| 134 | |
| 135 | //-------------------------------------------------------------------------------------------------- |
| 136 | // Clock-rewind floor |
no test coverage detected