42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestSignFirmwareProducesVerifiableManifest(t *testing.T) {
|
|
content := []byte("deterministic firmware fixture")
|
|
result, err := signFirmware("terminal-a", "rev-b", "1.2.3", content)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
digest := sha256.Sum256(content)
|
|
if result.SHA256 != hex.EncodeToString(digest[:]) || result.Size != len(content) {
|
|
t.Fatalf("digest=%s size=%d", result.SHA256, result.Size)
|
|
}
|
|
for _, fragment := range []string{"model=terminal-a", "hardware_revision=rev-b", "version=1.2.3", "sha256=" + result.SHA256} {
|
|
if !strings.Contains(result.Manifest, fragment) {
|
|
t.Fatalf("manifest missing %q: %s", fragment, result.Manifest)
|
|
}
|
|
}
|
|
publicKey, err := base64.StdEncoding.DecodeString(result.PublicKeyBase64)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
signature, err := base64.StdEncoding.DecodeString(result.SignatureBase64)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !ed25519.Verify(ed25519.PublicKey(publicKey), []byte(result.Manifest), signature) {
|
|
t.Fatal("firmware signature did not verify")
|
|
}
|
|
if ed25519.Verify(ed25519.PublicKey(publicKey), []byte(result.Manifest+"tampered"), signature) {
|
|
t.Fatal("tampered manifest unexpectedly verified")
|
|
}
|
|
}
|