45b1ad3abe
The alpha.8 backward-compat test in test-manifest-verification.sh was the second copy that broke both alpha.10 and alpha.11 pipelines. The test fails because verify-release checks for artifacts (bootstrap/*, mesh firewall unit) that were added after alpha.8. Per release-policy.md, tags are immutable — bump to alpha.12.
81 lines
2.6 KiB
Bash
81 lines
2.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
CLEANUP_FILES=()
|
|
cleanup() {
|
|
rm -f "${CLEANUP_FILES[@]}"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "Running negative tests for manifest verification..."
|
|
|
|
if ! command -v cosign &> /dev/null; then
|
|
echo "cosign could not be found. Please install it to run these tests."
|
|
exit 1
|
|
fi
|
|
|
|
# Generate test keypair
|
|
export COSIGN_PASSWORD=""
|
|
cosign generate-key-pair
|
|
export SMM_TEST_PUBKEY="cosign.pub"
|
|
CLEANUP_FILES+=(cosign.key cosign.pub)
|
|
|
|
ARCHIVE_NAME="test-archive.tar.gz"
|
|
echo "archive content" > "$ARCHIVE_NAME"
|
|
ARCHIVE_HASH=$(sha256sum "$ARCHIVE_NAME" | awk '{print $1}')
|
|
CLEANUP_FILES+=("$ARCHIVE_NAME")
|
|
|
|
# Use the canonical manifest name that verify_archive() expects
|
|
cat <<EOF > server-monitor-manager-manifest.json
|
|
{
|
|
"hashes": {
|
|
"$ARCHIVE_NAME": "$ARCHIVE_HASH"
|
|
}
|
|
}
|
|
EOF
|
|
|
|
cosign sign-blob --yes --key cosign.key --output-signature server-monitor-manager-manifest.sig server-monitor-manager-manifest.json
|
|
CLEANUP_FILES+=(server-monitor-manager-manifest.json server-monitor-manager-manifest.sig)
|
|
|
|
echo "Test 1: Valid signature and hash"
|
|
if ! bash deploy/ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json server-monitor-manager-manifest.sig; then
|
|
echo "FAIL: Valid payload rejected"
|
|
exit 1
|
|
fi
|
|
echo "PASS: Valid payload accepted"
|
|
|
|
echo "Test 2: Altered byte in archive"
|
|
echo "altered content" > "$ARCHIVE_NAME"
|
|
# verify-release will call verify_archive → verify_manifest (signature check) then sha256 (hash check).
|
|
# The manifest was signed with the original hash, so the archive hash won't match.
|
|
if bash deploy/ochenstarik-server-monitor-manager.sh verify-release "$ARCHIVE_NAME" >/dev/null 2>&1; then
|
|
echo "FAIL: Altered archive accepted"
|
|
exit 1
|
|
fi
|
|
echo "PASS: Altered archive rejected"
|
|
|
|
echo "Test 3: Substituted hash in manifest without resigning"
|
|
# Restore archive
|
|
echo "archive content" > "$ARCHIVE_NAME"
|
|
# Corrupt manifest (but don't re-sign — signature should now be invalid)
|
|
cat <<EOF > server-monitor-manager-manifest.json
|
|
{
|
|
"hashes": {
|
|
"$ARCHIVE_NAME": "0000000000000000000000000000000000000000000000000000000000000000"
|
|
}
|
|
}
|
|
EOF
|
|
if bash deploy/ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json server-monitor-manager-manifest.sig >/dev/null 2>&1; then
|
|
echo "FAIL: Substituted hash accepted"
|
|
exit 1
|
|
fi
|
|
echo "PASS: Substituted hash rejected"
|
|
|
|
echo "Test 4: Manifest without signature"
|
|
if bash deploy/ochenstarik-server-monitor-manager.sh verify-manifest server-monitor-manager-manifest.json "" >/dev/null 2>&1; then
|
|
echo "FAIL: Missing signature accepted"
|
|
exit 1
|
|
fi
|
|
echo "PASS: Missing signature rejected"
|
|
|
|
echo "All tests passed."
|