|
| 1 | +// Copyright 2026 The Sigstore Authors |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package server |
| 16 | + |
| 17 | +import ( |
| 18 | + "context" |
| 19 | + "crypto/ed25519" |
| 20 | + "crypto/rand" |
| 21 | + "crypto/sha256" |
| 22 | + "fmt" |
| 23 | + "testing" |
| 24 | + |
| 25 | + rekor_pb "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1" |
| 26 | + "github.com/sigstore/rekor-tiles/v2/internal/algorithmregistry" |
| 27 | + "github.com/sigstore/rekor-tiles/v2/internal/tessera" |
| 28 | + pb "github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf" |
| 29 | + "github.com/sigstore/sigstore/pkg/cryptoutils" |
| 30 | + "github.com/stretchr/testify/assert" |
| 31 | + "google.golang.org/grpc/codes" |
| 32 | + "google.golang.org/grpc/status" |
| 33 | +) |
| 34 | + |
| 35 | +func TestCreateIdentityEntry(t *testing.T) { |
| 36 | + pub, priv, err := ed25519.GenerateKey(rand.Reader) |
| 37 | + if err != nil { |
| 38 | + t.Fatal(err) |
| 39 | + } |
| 40 | + pubBytes, err := cryptoutils.MarshalPublicKeyToDER(pub) |
| 41 | + if err != nil { |
| 42 | + t.Fatal(err) |
| 43 | + } |
| 44 | + |
| 45 | + msgHash := sha256.Sum256([]byte("hello world")) |
| 46 | + payload := []byte("c2sp.org/identity-transparency/v1\x00") |
| 47 | + msgDoubleHash := sha256.Sum256(msgHash[:]) |
| 48 | + payload = append(payload, msgDoubleHash[:]...) |
| 49 | + sig := ed25519.Sign(priv, payload) |
| 50 | + |
| 51 | + tests := []struct { |
| 52 | + name string |
| 53 | + req *pb.IdentityRequestV001 |
| 54 | + addFn func() (*rekor_pb.TransparencyLogEntry, error) |
| 55 | + expectError error |
| 56 | + expectedCode codes.Code |
| 57 | + }{ |
| 58 | + { |
| 59 | + name: "valid request", |
| 60 | + req: &pb.IdentityRequestV001{ |
| 61 | + Credential: &pb.IdentityRequestV001_PublicKey{ |
| 62 | + PublicKey: &pb.PublicKeyCredential{ |
| 63 | + PublicKey: pubBytes, |
| 64 | + Signature: sig, |
| 65 | + }, |
| 66 | + }, |
| 67 | + Message: msgHash[:], |
| 68 | + }, |
| 69 | + addFn: func() (*rekor_pb.TransparencyLogEntry, error) { |
| 70 | + return &rekor_pb.TransparencyLogEntry{ |
| 71 | + InclusionProof: &rekor_pb.InclusionProof{ |
| 72 | + LogIndex: 1, |
| 73 | + Checkpoint: &rekor_pb.Checkpoint{Envelope: "checkpoint"}, |
| 74 | + }, |
| 75 | + }, nil |
| 76 | + }, |
| 77 | + }, |
| 78 | + { |
| 79 | + name: "failed validation", |
| 80 | + req: &pb.IdentityRequestV001{ |
| 81 | + Credential: &pb.IdentityRequestV001_PublicKey{ |
| 82 | + PublicKey: &pb.PublicKeyCredential{ |
| 83 | + PublicKey: pubBytes, |
| 84 | + Signature: sig, |
| 85 | + }, |
| 86 | + }, |
| 87 | + Message: make([]byte, 31), // invalid message length |
| 88 | + }, |
| 89 | + addFn: func() (*rekor_pb.TransparencyLogEntry, error) { |
| 90 | + return &rekor_pb.TransparencyLogEntry{}, nil |
| 91 | + }, |
| 92 | + expectError: fmt.Errorf("invalid identity request"), |
| 93 | + expectedCode: codes.InvalidArgument, |
| 94 | + }, |
| 95 | + { |
| 96 | + name: "failed integration", |
| 97 | + req: &pb.IdentityRequestV001{ |
| 98 | + Credential: &pb.IdentityRequestV001_PublicKey{ |
| 99 | + PublicKey: &pb.PublicKeyCredential{ |
| 100 | + PublicKey: pubBytes, |
| 101 | + Signature: sig, |
| 102 | + }, |
| 103 | + }, |
| 104 | + Message: msgHash[:], |
| 105 | + }, |
| 106 | + addFn: func() (*rekor_pb.TransparencyLogEntry, error) { |
| 107 | + return nil, fmt.Errorf("timed out") |
| 108 | + }, |
| 109 | + expectError: fmt.Errorf("failed to integrate entry"), |
| 110 | + expectedCode: codes.Unknown, |
| 111 | + }, |
| 112 | + { |
| 113 | + name: "inclusion proof verification failure", |
| 114 | + req: &pb.IdentityRequestV001{ |
| 115 | + Credential: &pb.IdentityRequestV001_PublicKey{ |
| 116 | + PublicKey: &pb.PublicKeyCredential{ |
| 117 | + PublicKey: pubBytes, |
| 118 | + Signature: sig, |
| 119 | + }, |
| 120 | + }, |
| 121 | + Message: msgHash[:], |
| 122 | + }, |
| 123 | + addFn: func() (*rekor_pb.TransparencyLogEntry, error) { |
| 124 | + return nil, tessera.InclusionProofVerificationError{} |
| 125 | + }, |
| 126 | + expectError: fmt.Errorf("failed to integrate entry"), |
| 127 | + expectedCode: codes.Unknown, |
| 128 | + }, |
| 129 | + } |
| 130 | + for _, test := range tests { |
| 131 | + t.Run(test.name, func(t *testing.T) { |
| 132 | + storage := &mockStorage{addFn: test.addFn} |
| 133 | + algReg, err := algorithmregistry.AlgorithmRegistry([]string{"ed25519"}) |
| 134 | + if err != nil { |
| 135 | + t.Fatal(err) |
| 136 | + } |
| 137 | + server := NewIdentityServer(storage, false, algReg) |
| 138 | + |
| 139 | + gotBody, gotErr := server.CreateEntry(context.Background(), test.req) |
| 140 | + if test.expectError == nil { |
| 141 | + assert.NoError(t, gotErr) |
| 142 | + assert.NotNil(t, gotBody) |
| 143 | + assert.Equal(t, "text/plain", gotBody.ContentType) |
| 144 | + } else { |
| 145 | + s, ok := status.FromError(gotErr) |
| 146 | + assert.True(t, ok) |
| 147 | + assert.Equal(t, test.expectedCode, s.Code()) |
| 148 | + assert.ErrorContains(t, gotErr, test.expectError.Error()) |
| 149 | + } |
| 150 | + }) |
| 151 | + } |
| 152 | +} |
0 commit comments