Function TestLoadKeyFromPath

cmd/docker-trust/trust/key_load_test.go:115–157

(t *testing.T)

}

func TestLoadKeyFromPath(t *testing.T) {
	skip.If(t, runtime.GOOS == "windows")
	for keyID, keyBytes := range testKeys {
		t.Run(fmt.Sprintf("load-key-id-%s-from-path", keyID), func(t *testing.T) {
			privKeyFilepath := filepath.Join(t.TempDir(), "privkey.pem")
			assert.NilError(t, os.WriteFile(privKeyFilepath, keyBytes, notary.PrivNoExecPerms))

			keyStorageDir := t.TempDir()

			keyFileStore, err := storage.NewPrivateKeyFileStorage(keyStorageDir, notary.KeyExtension)
			assert.NilError(t, err)
			privKeyImporters := []trustmanager.Importer{keyFileStore}

			// get the privKeyBytes
			privKeyBytes, err := getPrivKeyBytesFromPath(privKeyFilepath)
			assert.NilError(t, err)

			// import the key to our keyStorageDir
			assert.Check(t, loadPrivKeyBytesToStore(privKeyBytes, privKeyImporters, privKeyFilepath, "signer-name", testPassRetriever))

			// check that the appropriate ~/<trust_dir>/private/<key_id>.key file exists
			expectedImportKeyPath := filepath.Join(keyStorageDir, notary.PrivDir, keyID+"."+notary.KeyExtension)
			_, err = os.Stat(expectedImportKeyPath)
			assert.NilError(t, err)

			// verify the key content
			from, _ := os.OpenFile(expectedImportKeyPath, os.O_RDONLY, notary.PrivExecPerms)
			defer from.Close()
			fromBytes, _ := io.ReadAll(from)
			keyPEM, _ := pem.Decode(fromBytes)
			assert.Check(t, is.Equal("signer-name", keyPEM.Headers["role"]))
			// the default GUN is empty
			assert.Check(t, is.Equal("", keyPEM.Headers["gun"]))
			// assert encrypted header
			assert.Check(t, is.Equal("ENCRYPTED PRIVATE KEY", keyPEM.Type))

			decryptedKey, err := tufutils.ParsePKCS8ToTufKey(keyPEM.Bytes, []byte(testPass))
			assert.NilError(t, err)
			fixturePEM, _ := pem.Decode(keyBytes)
			assert.Check(t, is.DeepEqual(fixturePEM.Bytes, decryptedKey.Private()))
		})
	}
}

func TestLoadKeyTooPermissive(t *testing.T) {
	skip.If(t, runtime.GOOS == "windows")