(t *testing.T)
| 32 | ) |
| 33 | |
| 34 | func TestVerifyBundle(t *testing.T) { |
| 35 | ca, err := os.ReadFile("testdata/ca.pub") |
| 36 | require.NoError(t, err) |
| 37 | certs, err := cryptoutils.LoadCertificatesFromPEM(bytes.NewReader(ca)) |
| 38 | require.NoError(t, err) |
| 39 | roots := &TrustedRoot{Keys: map[string][]*x509.Certificate{ |
| 40 | "2a522d9652e0933d2a1237c395bc116e012f86dffff13122da59f76e0d2abe27": certs, |
| 41 | }} |
| 42 | |
| 43 | cases := []struct { |
| 44 | name string |
| 45 | roots *TrustedRoot |
| 46 | bundle string |
| 47 | expectErr string |
| 48 | // expectSentinel, when set, is asserted with errors.Is in addition to |
| 49 | // (or instead of) the substring match. |
| 50 | expectSentinel error |
| 51 | }{ |
| 52 | { |
| 53 | name: "invalid bundle, but still verifiable", |
| 54 | roots: roots, |
| 55 | bundle: "testdata/bundle_wrongversion.json", |
| 56 | }, |
| 57 | { |
| 58 | name: "valid bundle", |
| 59 | roots: roots, |
| 60 | bundle: "testdata/bundle_valid.json", |
| 61 | }, |
| 62 | { |
| 63 | name: "valid bundle without verification material", |
| 64 | roots: roots, |
| 65 | bundle: "testdata/bundle_valid_nomaterial.json", |
| 66 | expectErr: "missing material", |
| 67 | expectSentinel: ErrMissingVerificationMaterial, |
| 68 | }, |
| 69 | { |
| 70 | name: "corrupted bundle", |
| 71 | roots: roots, |
| 72 | bundle: "testdata/bundle_invalid.json", |
| 73 | expectErr: "validating the DSSE envelope", |
| 74 | }, |
| 75 | { |
| 76 | name: "legacy DSSE envelope (not a bundle)", |
| 77 | roots: roots, |
| 78 | bundle: "testdata/dsse_envelope.json", |
| 79 | expectErr: "invalid bundle", |
| 80 | }, |
| 81 | { |
| 82 | // a cert-less bundle carrying only a timestamp must never be reported as verified. |
| 83 | // It is rejected at the mandatory-signature gate before timestamp validation runs, |
| 84 | // so the timestamp can never be the deciding factor. |
| 85 | name: "timestamp-only bundle (no signing key) is rejected", |
| 86 | roots: roots, |
| 87 | bundle: "testdata/bundle_with_bad_timestamp.json", |
| 88 | expectErr: "missing material", |
| 89 | expectSentinel: ErrMissingVerificationMaterial, |
| 90 | }, |
| 91 | { |
nothing calls this directly
no test coverage detected