Merge pull request #1878 from d4s/wip/d4s/no_gpg

Alternative signing system

tests/libtest.sh

@@ -679,6 +679,43 @@ libtest_cleanup_gpg () {
 }
 libtest_exit_cmds+=(libtest_cleanup_gpg)
 
+has_libsodium () {
+    local ret
+    ${CMD_PREFIX} ostree --version > version.txt
+    grep -q -e '- libsodium' version.txt
+    ret=$?
+    rm -f version.txt
+    return ${ret}
+}
+
+# Keys for ed25519 signing tests
+ED25519PUBLIC=
+ED25519SEED=
+ED25519SECRET=
+
+gen_ed25519_keys ()
+{
+  # Generate private key in PEM format
+  pemfile="$(mktemp -p ${test_tmpdir} ed25519_XXXXXX.pem)"
+  openssl genpkey -algorithm ed25519 -outform PEM -out "${pemfile}"
+
+  # Based on: http://openssl.6102.n7.nabble.com/ed25519-key-generation-td73907.html
+  # Extract the private and public parts from generated key.
+  ED25519PUBLIC="$(openssl pkey -outform DER -pubout -in ${pemfile} | tail -c 32 | base64)"
+  ED25519SEED="$(openssl pkey -outform DER -in ${pemfile} | tail -c 32 | base64)"
+  # Secret key is concantination of SEED and PUBLIC
+  ED25519SECRET="$(echo ${ED25519SEED}${ED25519PUBLIC} | base64 -d | base64 -w 0)"
+
+  echo "Generated ed25519 keys:"
+  echo "public: ${ED25519PUBLIC}"
+  echo "  seed: ${ED25519SEED}"
+}
+
+gen_ed25519_random_public()
+{
+  openssl genpkey -algorithm ED25519 | openssl pkey -outform DER | tail -c 32 | base64
+}
+
 is_bare_user_only_repo () {
   grep -q 'mode=bare-user-only' $1/config
 }

tests/pull-test.sh

@@ -29,7 +29,7 @@ function repo_init() {
     ${CMD_PREFIX} ostree --repo=repo remote add origin $(cat httpd-address)/ostree/gnomerepo "$@"
 }
 
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 
 # See also the copy of this in basic-test.sh
 COMMIT_ARGS=""
@@ -62,7 +62,7 @@ else
 fi
 
 # Try both syntaxes
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main >out.txt
 assert_file_has_content out.txt "[1-9][0-9]* metadata, [1-9][0-9]* content objects fetched"
 ${CMD_PREFIX} ostree --repo=repo pull origin:main > out.txt
@@ -164,7 +164,7 @@ echo "ok pull (bareuseronly mirror)"
 
 # Corruption tests <https://github.com/ostreedev/ostree/issues/1211>
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 if ! is_bare_user_only_repo repo; then
 if ! skip_one_without_user_xattrs; then
     if is_bare_user_only_repo repo; then
@@ -216,7 +216,7 @@ if ! skip_one_without_user_xattrs; then
     done
 
     # And ensure the repo is reinitialized
-    repo_init --no-gpg-verify
+    repo_init --no-sign-verify
     echo "ok corruption"
 fi
 else
@@ -320,7 +320,7 @@ echo "ok pull specific commit"
 
 # test pull -T
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main
 origrev=$(${CMD_PREFIX} ostree --repo=repo rev-parse main)
 # Check we can pull the same commit with timestamp checking enabled
@@ -350,7 +350,7 @@ ${CMD_PREFIX} ostree --repo=repo pull origin main
 echo "ok pull timestamp checking"
 
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main
 ${CMD_PREFIX} ostree --repo=repo fsck
 # Generate a delta from old to current, even though we aren't going to
@@ -375,7 +375,7 @@ ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
 # Explicitly test delta fetches via ref name as well as commit hash
 for delta_target in main ${new_rev}; do
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main@${prev_rev}
 ${CMD_PREFIX} ostree --repo=repo pull --dry-run --require-static-deltas origin ${delta_target} >dry-run-pull.txt
 # Compression can vary, so we support 400-699
@@ -388,7 +388,7 @@ done
 
 # Test pull via file:/// - this should still use the deltas path for testing
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo remote delete origin
 ${CMD_PREFIX} ostree --repo=repo remote add --set=gpg-verify=false origin file://$(pwd)/ostree-srv/gnomerepo
 ${CMD_PREFIX} ostree --repo=repo pull origin main@${prev_rev}
@@ -400,7 +400,7 @@ echo "ok pull file:// + deltas required"
 # Explicitly test delta fetches via ref name as well as commit hash
 for delta_target in main ${new_rev}; do
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main@${prev_rev}
 ${CMD_PREFIX} ostree --repo=repo pull --require-static-deltas origin ${delta_target}
 if test ${delta_target} = main; then
@@ -414,12 +414,12 @@ done
 
 # Test no-op with deltas: https://github.com/ostreedev/ostree/issues/1321
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main
 ${CMD_PREFIX} ostree --repo=repo pull --require-static-deltas origin main
 
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main@${prev_rev}
 ${CMD_PREFIX} ostree --repo=repo pull --disable-static-deltas origin main
 ${CMD_PREFIX} ostree --repo=repo fsck
@@ -437,7 +437,7 @@ cd ${test_tmpdir}
 ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo static-delta generate --swap-endianness main
 ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
 
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main@${prev_rev}
 ${CMD_PREFIX} ostree --repo=repo pull --require-static-deltas --dry-run origin main >byteswapped-dry-run-pull.txt
 ${CMD_PREFIX} ostree --repo=repo fsck
@@ -451,7 +451,7 @@ echo "ok pull byteswapped delta"
 cd ${test_tmpdir}
 rm ostree-srv/gnomerepo/deltas -rf
 ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 if ${CMD_PREFIX} ostree --repo=repo pull --require-static-deltas origin main 2>err.txt; then
     assert_not_reached "--require-static-deltas unexpectedly succeeded"
 fi
@@ -459,7 +459,7 @@ assert_file_has_content err.txt "deltas required, but none found"
 ${CMD_PREFIX} ostree --repo=repo fsck
 
 # Now test with a partial commit
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull --commit-metadata-only origin main@${prev_rev}
 if ${CMD_PREFIX} ostree --repo=repo pull --require-static-deltas origin main 2>err.txt; then
     assert_not_reached "--require-static-deltas unexpectedly succeeded"
@@ -467,7 +467,7 @@ fi
 assert_file_has_content err.txt "deltas required, but none found"
 echo "ok delta required but don't exist"
 
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 ${CMD_PREFIX} ostree --repo=repo pull origin main@${prev_rev}
 if ${CMD_PREFIX} ostree --repo=repo pull --require-static-deltas origin ${new_rev} 2>err.txt; then
     assert_not_reached "--require-static-deltas unexpectedly succeeded"
@@ -595,7 +595,7 @@ if has_gpgme; then
 fi
 
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 mv ostree-srv/gnomerepo/refs/heads/main{,.orig}
 rm ostree-srv/gnomerepo/summary
 (for x in $(seq 20); do echo "lots of html here "; done) > ostree-srv/gnomerepo/refs/heads/main

tests/pull-test2.sh

@@ -29,7 +29,7 @@ function repo_init() {
     ${CMD_PREFIX} ostree --repo=repo remote add origin $(cat httpd-address)/ostree/gnomerepo "$@"
 }
 
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 
 # See also the copy of this in basic-test.sh
 COMMIT_ARGS=""
@@ -48,7 +48,7 @@ fi
 
 echo "1..1"
 cd ${test_tmpdir}
-repo_init --no-gpg-verify
+repo_init --no-sign-verify
 prev_rev=$(ostree --repo=ostree-srv/repo rev-parse ${remote_ref}^)
 rev=$(ostree --repo=ostree-srv/repo rev-parse ${remote_ref})
 ${CMD_PREFIX} ostree --repo=ostree-srv/repo static-delta generate ${remote_ref}

tests/test-local-pull.sh

@@ -28,12 +28,7 @@ unset OSTREE_GPG_HOME
 
 skip_without_user_xattrs
 
-if has_gpgme; then
-    echo "1..8"
-else
-    # Only some tests doesn't need GPG support
-    echo "1..5"
-fi
+echo "1..11"
 
 setup_test_repository "archive"
 echo "ok setup"
@@ -68,6 +63,49 @@ cmp checkout1.files checkout2.files
 cmp checkout1.files checkout3.files
 echo "ok checkouts same"
 
+if has_gpgme; then
+    # These tests are needed GPG support
+    mkdir repo4
+    ostree_repo_init repo4 --mode="archive"
+    ${CMD_PREFIX} ostree --repo=repo4 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
+
+    if ${CMD_PREFIX} ostree --repo=repo4 pull-local --remote=origin --gpg-verify repo test2 2>&1; then
+        assert_not_reached "GPG verification unexpectedly succeeded"
+    fi
+    echo "ok --gpg-verify with no signature"
+
+    ${OSTREE} gpg-sign --gpg-homedir=${TEST_GPG_KEYHOME} test2  ${TEST_GPG_KEYID_1}
+
+    mkdir repo5
+    ostree_repo_init repo5 --mode="archive"
+    ${CMD_PREFIX} ostree --repo=repo5 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
+    ${CMD_PREFIX} ostree --repo=repo5 pull-local --remote=origin --gpg-verify repo test2
+    echo "ok --gpg-verify"
+
+    mkdir repo6
+    ostree_repo_init repo6 --mode="archive"
+    ${CMD_PREFIX} ostree --repo=repo6 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
+    if ${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1; then
+        assert_not_reached "GPG summary verification with no summary unexpectedly succeeded"
+    fi
+
+    ${OSTREE} summary --update
+
+    if ${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1; then
+        assert_not_reached "GPG summary verification with signed no summary unexpectedly succeeded"
+    fi
+
+    ${OSTREE} summary --update --gpg-sign=${TEST_GPG_KEYID_1} --gpg-homedir=${TEST_GPG_KEYHOME}
+
+    ${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1
+
+    echo "ok --gpg-verify-summary"
+else
+    echo "ok --gpg-verify with no signature | # SKIP due GPG unavailability"
+    echo "ok --gpg-verify | # SKIP due GPG unavailability"
+    echo "ok --gpg-verify-summary | # SKIP due GPG unavailability"
+fi
+
 mkdir repo7
 ostree_repo_init repo7 --mode="archive"
 ${CMD_PREFIX} ostree --repo=repo7 pull-local repo
@@ -78,41 +116,36 @@ for src_object in `find repo/objects -name '*.filez'`; do
 done
 echo "ok pull-local z2 to z2 default hardlink"
 
-if ! has_gpgme; then
-    exit 0
+if has_libsodium; then
+    gen_ed25519_keys
+
+    mkdir repo8
+    ostree_repo_init repo8 --mode="archive"
+    ${CMD_PREFIX} ostree --repo=repo8 remote add --set=verification-key="${ED25519PUBLIC}" origin repo
+    cat repo8/config
+
+    if ${CMD_PREFIX} ostree --repo=repo8 pull-local --remote=origin --sign-verify repo test2 2>&1; then
+        assert_not_reached "Ed25519 signature verification unexpectedly succeeded"
+    fi
+    echo "ok --sign-verify with no signature"
+
+    ${OSTREE} sign test2 ${ED25519SECRET}
+
+    mkdir repo9
+    ostree_repo_init repo9 --mode="archive"
+    ${CMD_PREFIX} ostree --repo=repo9 remote add --set=verification-key="$(gen_ed25519_random_public)" origin repo
+    if ${CMD_PREFIX} ostree --repo=repo9 pull-local --remote=origin --sign-verify repo test2 2>&1; then
+        assert_not_reached "Ed25519 signature verification unexpectedly succeeded"
+    fi
+    echo "ok --sign-verify with wrong signature"
+
+    mkdir repo10
+    ostree_repo_init repo10 --mode="archive"
+    ${CMD_PREFIX} ostree --repo=repo10 remote add --set=verification-key="${ED25519PUBLIC}" origin repo
+    ${CMD_PREFIX} ostree --repo=repo10 pull-local --remote=origin --sign-verify repo test2
+    echo "ok --sign-verify"
+else
+    echo "ok --sign-verify with no signature | # SKIP due libsodium unavailability"
+    echo "ok --sign-verify with wrong signature | # SKIP due libsodium unavailability"
+    echo "ok --sign-verify | # SKIP libsodium unavailability"
 fi
-
-mkdir repo4
-ostree_repo_init repo4 --mode="archive"
-${CMD_PREFIX} ostree --repo=repo4 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
-if ${CMD_PREFIX} ostree --repo=repo4 pull-local --remote=origin --gpg-verify repo test2 2>&1; then
-    assert_not_reached "GPG verification unexpectedly succeeded"
-fi
-echo "ok --gpg-verify with no signature"
-
-${OSTREE} gpg-sign --gpg-homedir=${TEST_GPG_KEYHOME} test2  ${TEST_GPG_KEYID_1}
-
-mkdir repo5
-ostree_repo_init repo5 --mode="archive"
-${CMD_PREFIX} ostree --repo=repo5 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
-${CMD_PREFIX} ostree --repo=repo5 pull-local --remote=origin --gpg-verify repo test2
-echo "ok --gpg-verify"
-
-mkdir repo6
-ostree_repo_init repo6 --mode="archive"
-${CMD_PREFIX} ostree --repo=repo6 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
-if ${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1; then
-    assert_not_reached "GPG summary verification with no summary unexpectedly succeeded"
-fi
-
-${OSTREE} summary --update
-
-if ${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1; then
-    assert_not_reached "GPG summary verification with signed no summary unexpectedly succeeded"
-fi
-
-${OSTREE} summary --update --gpg-sign=${TEST_GPG_KEYID_1} --gpg-homedir=${TEST_GPG_KEYHOME}
-
-${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1
-
-echo "ok --gpg-verify-summary"

tests/test-pull-mirrorlist.sh

@@ -75,7 +75,7 @@ EOF
 cd ${test_tmpdir}
 mkdir repo
 ostree_repo_init repo
-${CMD_PREFIX} ostree --repo=repo remote add origin --no-gpg-verify \
+${CMD_PREFIX} ostree --repo=repo remote add origin --no-sign-verify \
   mirrorlist=$(cat httpd-address)/ostree/mirrorlist
 ${CMD_PREFIX} ostree --repo=repo pull origin:main
 
@@ -87,7 +87,7 @@ cd ${test_tmpdir}
 rm -rf repo
 mkdir repo
 ostree_repo_init repo
-${CMD_PREFIX} ostree --repo=repo remote add origin --no-gpg-verify \
+${CMD_PREFIX} ostree --repo=repo remote add origin --no-sign-verify \
   --contenturl=mirrorlist=$(cat httpd-address)/ostree/mirrorlist \
   $(cat httpd-address)/ostree/gnomerepo
 ${CMD_PREFIX} ostree --repo=repo pull origin:main
@@ -100,7 +100,7 @@ cd ${test_tmpdir}
 rm -rf repo
 mkdir repo
 ostree_repo_init repo
-${CMD_PREFIX} ostree --repo=repo remote add origin --no-gpg-verify \
+${CMD_PREFIX} ostree --repo=repo remote add origin --no-sign-verify \
   --contenturl=mirrorlist=$(cat httpd-address)/ostree/mirrorlist \
   mirrorlist=$(cat httpd-address)/ostree/mirrorlist
 ${CMD_PREFIX} ostree --repo=repo pull origin:main

tests/test-refs-collections.sh

@@ -112,7 +112,7 @@ mkdir collection-repo
 ostree_repo_init collection-repo --collection-id org.example.RemoteCollection
 mkdir -p adir
 ${CMD_PREFIX} ostree --repo=collection-repo commit --branch=rcommit -m rcommit -s rcommit adir
-${CMD_PREFIX} ostree --repo=repo remote add --no-gpg-verify --collection-id org.example.RemoteCollection collection-repo-remote "file://${test_tmpdir}/collection-repo"
+${CMD_PREFIX} ostree --repo=repo remote add --no-sign-verify --collection-id org.example.RemoteCollection collection-repo-remote "file://${test_tmpdir}/collection-repo"
 ${CMD_PREFIX} ostree --repo=repo pull collection-repo-remote rcommit
 
 ${CMD_PREFIX} ostree --repo=repo refs --collections > refs
@@ -129,7 +129,7 @@ mkdir no-collection-repo
 ostree_repo_init no-collection-repo
 mkdir -p adir2
 ${CMD_PREFIX} ostree --repo=no-collection-repo commit --branch=rcommit2 -m rcommit2 -s rcommit2 adir2
-${CMD_PREFIX} ostree --repo=repo remote add --no-gpg-verify no-collection-repo-remote "file://${test_tmpdir}/no-collection-repo"
+${CMD_PREFIX} ostree --repo=repo remote add --no-sign-verify no-collection-repo-remote "file://${test_tmpdir}/no-collection-repo"
 ${CMD_PREFIX} ostree --repo=repo pull no-collection-repo-remote rcommit2
 ${CMD_PREFIX} ostree --repo=repo refs --collections > refs
 assert_not_file_has_content refs "rcommit2"

tests/test-remote-add.sh

@@ -30,20 +30,20 @@ $OSTREE remote add origin http://example.com/ostree/gnome
 $OSTREE remote show-url origin >/dev/null
 echo "ok config"
 
-$OSTREE remote add --no-gpg-verify another http://another.com/repo
+$OSTREE remote add --no-sign-verify another http://another.com/repo
 $OSTREE remote show-url another >/dev/null
 echo "ok remote no gpg-verify"
 
-if $OSTREE remote add --no-gpg-verify another http://another.example.com/anotherrepo 2>err.txt; then
+if $OSTREE remote add --no-sign-verify another http://another.example.com/anotherrepo 2>err.txt; then
     assert_not_reached "Adding duplicate remote unexpectedly succeeded"
 fi
 echo "ok"
 
-$OSTREE remote add --if-not-exists --no-gpg-verify another http://another.example.com/anotherrepo
+$OSTREE remote add --if-not-exists --no-sign-verify another http://another.example.com/anotherrepo
 $OSTREE remote show-url another >/dev/null
 echo "ok"
 
-$OSTREE remote add --if-not-exists --no-gpg-verify another-noexist http://another-noexist.example.com/anotherrepo
+$OSTREE remote add --if-not-exists --no-sign-verify another-noexist http://another-noexist.example.com/anotherrepo
 $OSTREE remote show-url another-noexist >/dev/null
 echo "ok"
 
@@ -69,7 +69,7 @@ cd ${test_tmpdir}
 rm -rf parent-repo
 ostree_repo_init parent-repo
 $OSTREE config set core.parent ${test_tmpdir}/parent-repo
-${CMD_PREFIX} ostree --repo=parent-repo remote add --no-gpg-verify parent-remote http://parent-remote.example.com/parent-remote
+${CMD_PREFIX} ostree --repo=parent-repo remote add --no-sign-verify parent-remote http://parent-remote.example.com/parent-remote
 $OSTREE remote list > list.txt
 assert_file_has_content list.txt "origin"
 assert_file_has_content list.txt "another"

tests/test-remotes-config-dir.js

@@ -94,16 +94,22 @@ print("ok add-in-remotes-config-dir");
 
 // Trying to set a remote config option via write_config() for a remote
 // defined in the config file should succeed
-let [, gpg_verify] = repo.remote_get_gpg_verify('bar');
-assertEquals(gpg_verify, true);
-repoConfig = repo.copy_config();
-repoConfig.set_boolean('remote "bar"', 'gpg-verify', false);
-repo.write_config(repoConfig);
-repo.reload_config(null);
-[, gpg_verify] = repo.remote_get_gpg_verify('bar');
-assertEquals(gpg_verify, false);
-
-print("ok config-remote-in-config-file-succeeds");
+try {
+    let [, gpg_verify] = repo.remote_get_gpg_verify('bar');
+    assertEquals(gpg_verify, true);
+    repoConfig = repo.copy_config();
+    repoConfig.set_boolean('remote "bar"', 'gpg-verify', false);
+    repo.write_config(repoConfig);
+    repo.reload_config(null);
+    [, gpg_verify] = repo.remote_get_gpg_verify('bar');
+    assertEquals(gpg_verify, false);
+    print("ok config-remote-in-config-file-succeeds");
+} catch (e) {
+    // Skip this test if GPG is not supported
+    if (!(e.matches(Gio.IOErrorEnum, Gio.IOErrorEnum.NOT_SUPPORTED)))
+        throw e;
+    print("ok config-remote-in-config-file-succeeds # SKIP due build without GPG support");
+}
 
 // Trying to set a remote config option via write_config() for a remote
 // defined in the config dir should fail with G_IO_ERROR_EXISTS

tests/test-signed-commit.sh

@@ -0,0 +1,193 @@
+#!/bin/bash
+#
+# Copyright (C) 2019 Collabora Ltd.
+#
+# SPDX-License-Identifier: LGPL-2.0+
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+# Boston, MA 02111-1307, USA.
+
+set -euo pipefail
+
+. $(dirname $0)/libtest.sh
+
+echo "1..10"
+
+mkdir ${test_tmpdir}/repo
+ostree_repo_init repo --mode="archive"
+
+echo "Unsigned commit" > file.txt
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo commit -b main -s 'Unsigned commit'
+COMMIT="$(ostree --repo=${test_tmpdir}/repo rev-parse main)"
+
+# Test `ostree sign` with dummy module first
+DUMMYSIGN="dummysign"
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=dummy ${COMMIT} ${DUMMYSIGN}
+
+# Ensure that detached metadata really contain expected string
+EXPECTEDSIGN="$(echo $DUMMYSIGN | hexdump -n 9 -e '8/1 "0x%.2x, " 1/1 " 0x%.2x"')"
+${CMD_PREFIX} ostree --repo=repo show ${COMMIT} --print-detached-metadata-key=ostree.sign.dummy | grep -q -e "${EXPECTEDSIGN}"
+echo "ok Detached dummy signature added"
+
+# Verify vith sign mechanism
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --sign-type=dummy --verify ${COMMIT} ${DUMMYSIGN}
+echo "ok dummy signature verified"
+
+echo "Signed commit with dummy key: ${DUMMYSIGN}" >> file.txt
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo commit -b main -s 'Signed with dummy module' --sign=${DUMMYSIGN} --sign-type=dummy 
+COMMIT="$(ostree --repo=${test_tmpdir}/repo rev-parse main)"
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=dummy --verify ${COMMIT} ${DUMMYSIGN}
+echo "ok commit with dummy signing"
+
+# tests below require libsodium support
+if ! has_libsodium; then
+    echo "ok Detached ed25519 signature # SKIP due libsodium unavailability"
+    echo "ok ed25519 signature verified # SKIP due libsodium unavailability"
+    echo "ok multiple signing # SKIP due libsodium unavailability"
+    echo "ok verify ed25519 keys file # SKIP due libsodium unavailability"
+    echo "ok sign with ed25519 keys file # SKIP due libsodium unavailability"
+    echo "ok verify ed25519 system-wide configuration # SKIP due libsodium unavailability"
+    echo "ok verify ed25519 revoking keys mechanism # SKIP due libsodium unavailability"
+    exit 0
+fi
+
+# Test ostree sign with 'ed25519' module
+gen_ed25519_keys
+PUBLIC=${ED25519PUBLIC}
+SEED=${ED25519SEED}
+SECRET=${ED25519SECRET}
+
+WRONG_PUBLIC="$(gen_ed25519_random_public)"
+
+echo "SEED = $SEED"
+echo "PUBLIC = $PUBLIC"
+
+echo "Signed commit with ed25519: ${SECRET}" >> file.txt
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo commit -b main -s "Signed with ed25519 module" --sign="${SECRET}" --sign-type=ed25519
+COMMIT="$(ostree --repo=${test_tmpdir}/repo rev-parse main)"
+
+# Ensure that detached metadata contain signature
+${CMD_PREFIX} ostree --repo=repo show ${COMMIT} --print-detached-metadata-key=ostree.sign.ed25519 &>/dev/null
+echo "ok Detached ed25519 signature added"
+
+# Verify vith sign mechanism
+if ${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} ${WRONG_PUBLIC}; then
+    exit 1
+fi
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} ${PUBLIC}
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} ${PUBLIC} ${PUBLIC}
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} $(gen_ed25519_random_public) ${PUBLIC}
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} $(gen_ed25519_random_public) $(gen_ed25519_random_public) ${PUBLIC}
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} ${PUBLIC} $(gen_ed25519_random_public) $(gen_ed25519_random_public)
+${CMD_PREFIX} ostree  --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} $(gen_ed25519_random_public) $(gen_ed25519_random_public) ${PUBLIC} $(gen_ed25519_random_public) $(gen_ed25519_random_public)
+echo "ok ed25519 signature verified"
+
+# Check if we able to use all available modules to sign the same commit
+echo "Unsigned commit for multi-sign" >> file.txt
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo commit -b main -s 'Unsigned commit'
+COMMIT="$(ostree --repo=${test_tmpdir}/repo rev-parse main)"
+# Check if we have no signatures
+for mod in "dummy" "ed25519"; do
+    if ostree --repo=repo show ${COMMIT} --print-detached-metadata-key=ostree.sign.${mod}; then
+        echo "Unexpected signature for ${mod} found"
+        exit 1
+    fi
+done
+
+# Sign with all available modules
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=dummy ${COMMIT} ${DUMMYSIGN}
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=ed25519 ${COMMIT} ${SECRET}
+# and verify
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 ${COMMIT} ${PUBLIC}
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=dummy --verify ${COMMIT} ${DUMMYSIGN}
+echo "ok multiple signing "
+
+# Prepare files with public ed25519 signatures
+PUBKEYS="$(mktemp -p ${test_tmpdir} ed25519_XXXXXX.ed25519)"
+
+# Test if file contain no keys
+if ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT}; then
+    exit 1
+fi
+
+# Test if have a problem with file object
+if ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${test_tmpdir} ${COMMIT}; then
+    exit 1
+fi
+
+# Test with single key in list
+echo ${PUBLIC} > ${PUBKEYS}
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT}
+
+# Test the file with multiple keys without a valid public key
+for((i=0;i<100;i++)); do
+    # Generate a list with some public signatures
+    gen_ed25519_random_public
+done > ${PUBKEYS}
+# Check if file contain no valid signatures
+if ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT}; then
+    exit 1
+fi
+# Check if no valid signatures provided via args&file
+if ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT} ${WRONG_PUBLIC}; then
+    exit 1
+fi
+
+#Test keys file and public key
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT} ${PUBLIC}
+
+# Add correct key into the list
+echo ${PUBLIC} >> ${PUBKEYS}
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT}
+
+echo "ok verify ed25519 keys file"
+
+# Check ed25519 signing with secret file
+echo "Unsigned commit for secret file usage" >> file.txt
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo commit -b main -s 'Unsigned commit'
+COMMIT="$(ostree --repo=${test_tmpdir}/repo rev-parse main)"
+
+KEYFILE="$(mktemp -p ${test_tmpdir} secret_XXXXXX.ed25519)"
+echo "${SECRET}" > ${KEYFILE}
+# Sign
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --sign-type=ed25519 --keys-file=${KEYFILE} ${COMMIT}
+# Verify
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-file=${PUBKEYS} ${COMMIT}
+echo "ok sign with ed25519 keys file"
+
+# Check the well-known places mechanism
+mkdir -p ${test_tmpdir}/{trusted,revoked}.ed25519.d
+for((i=0;i<100;i++)); do
+    # Generate some key files with random public signatures
+    gen_ed25519_random_public
+done
+# Check no valid public keys are available
+if ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-dir=${test_tmpdir} ${COMMIT}; then
+    exit 1
+fi
+echo ${PUBLIC} > ${test_tmpdir}/trusted.ed25519.d/correct
+# Verify with correct key
+${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-dir=${test_tmpdir} ${COMMIT}
+
+echo "ok verify ed25519 system-wide configuration"
+
+# Add the public key into revoked list
+echo ${PUBLIC} > ${test_tmpdir}/revoked.ed25519.d/correct
+# Check if public key is not valid anymore
+if ${CMD_PREFIX} ostree --repo=${test_tmpdir}/repo sign --verify --sign-type=ed25519 --keys-dir=${test_tmpdir} ${COMMIT}; then
+    exit 1
+fi
+rm -rf ${test_tmpdir}/{trusted,revoked}.ed25519.d
+echo "ok verify ed25519 revoking keys mechanism"

tests/test-signed-pull-summary.sh

@@ -0,0 +1,287 @@
+#!/bin/bash
+#
+# Copyright (C) 2019 Collabora Ltd.
+#
+# SPDX-License-Identifier: LGPL-2.0+
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+# Boston, MA 02111-1307, USA.
+
+# Based on test-pull-summary-sigs.sh test.
+
+set -euo pipefail
+
+. $(dirname $0)/libtest.sh
+
+echo "1..14"
+
+repo_reinit () {
+    ARGS="$*"
+    cd ${test_tmpdir}
+    rm -rf repo
+    mkdir repo
+    ostree_repo_init repo --mode=archive
+    ${OSTREE} --repo=repo remote add \
+        --set=gpg-verify=false --set=gpg-verify-summary=false \
+        --set=sign-verify=false --set=sign-verify-summary=true \
+        ${ARGS} origin $(cat httpd-address)/ostree/gnomerepo
+}
+
+for engine in dummy ed25519
+do
+    case "${engine}" in
+        dummy)
+            # Tests with dummy engine
+            SIGN_KEY="dummysign"
+            PUBLIC_KEY="dummysign"
+            ;;
+        ed25519)
+            if ! has_libsodium; then
+                echo "ok ${engine} pull mirror summary # SKIP due libsodium unavailability"
+                echo "ok ${engine} pull with signed summary # SKIP due libsodium unavailability"
+                echo "ok ${engine} prune summary cache # SKIP due libsodium unavailability"
+                echo "ok ${engine} pull with signed summary and cachedir # SKIP due libsodium unavailability"
+                echo "ok ${engine} pull with invalid ${engine} summary signature fails # SKIP due libsodium unavailability"
+                echo "ok ${engine} pull delta with signed summary # SKIP due libsodium unavailability"
+
+                continue
+            fi
+            gen_ed25519_keys
+            SIGN_KEY="${ED25519SECRET}"
+            PUBLIC_KEY="${ED25519PUBLIC}"
+            ;;
+        *)
+            fatal "Unsupported engine ${engine}"
+            ;;
+    esac
+
+    COMMIT_SIGN="--sign-type=${engine} --sign=${SIGN_KEY}"
+
+    # clenup the testdir prior the next engine
+    rm -rf ${test_tmpdir}/ostree-srv ${test_tmpdir}/gnomerepo ${test_tmpdir}/httpd ${test_tmpdir}/repo ${test_tmpdir}/cachedir\
+        ${test_tmpdir}/main-copy ${test_tmpdir}/other-copy ${test_tmpdir}/yet-another-copy 
+
+    setup_fake_remote_repo1 "archive" "${COMMIT_SIGN}"
+
+    # Now, setup multiple branches
+    mkdir ${test_tmpdir}/ostree-srv/other-files
+    cd ${test_tmpdir}/ostree-srv/other-files
+    echo 'hello world another object' > hello-world
+    ${CMD_PREFIX} ostree  --repo=${test_tmpdir}/ostree-srv/gnomerepo commit ${COMMIT_SIGN} -b other -s "A commit" -m "Another Commit body"
+
+    mkdir ${test_tmpdir}/ostree-srv/yet-other-files
+    cd ${test_tmpdir}/ostree-srv/yet-other-files
+    echo 'hello world yet another object' > yet-another-hello-world
+    ${CMD_PREFIX} ostree  --repo=${test_tmpdir}/ostree-srv/gnomerepo commit ${COMMIT_SIGN} -b yet-another -s "A commit" -m "Another Commit body"
+
+    ${CMD_PREFIX} ostree --repo=${test_tmpdir}/ostree-srv/gnomerepo summary -u
+
+    prev_dir=`pwd`
+    cd ${test_tmpdir}
+    ostree_repo_init repo --mode=archive
+    ${CMD_PREFIX} ostree --repo=repo remote add \
+        --set=gpg-verify=false --set=gpg-verify-summary=false \
+        --set=sign-verify=false --set=sign-verify-summary=false \
+        origin $(cat httpd-address)/ostree/gnomerepo
+    ${CMD_PREFIX} ostree --repo=repo pull --mirror origin
+    assert_has_file repo/summary
+    ${CMD_PREFIX} ostree --repo=repo checkout -U main main-copy
+    assert_file_has_content main-copy/baz/cow "moo"
+    ${CMD_PREFIX} ostree --repo=repo checkout -U other other-copy
+    assert_file_has_content other-copy/hello-world "hello world another object"
+    ${CMD_PREFIX} ostree --repo=repo checkout -U yet-another yet-another-copy
+    assert_file_has_content yet-another-copy/yet-another-hello-world "hello world yet another object"
+    ${CMD_PREFIX} ostree --repo=repo fsck
+    echo "ok ${engine} pull mirror summary"
+
+
+    cd $prev_dir
+
+    ${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo summary -u ${COMMIT_SIGN}
+
+    cd ${test_tmpdir}
+    repo_reinit --set=verification-key=${PUBLIC_KEY}
+    ${OSTREE} --repo=repo pull origin main
+    assert_has_file repo/tmp/cache/summaries/origin
+    assert_has_file repo/tmp/cache/summaries/origin.sig
+
+    rm repo/tmp/cache/summaries/origin
+    ${OSTREE} --repo=repo pull origin main
+    assert_has_file repo/tmp/cache/summaries/origin
+
+    echo "ok ${engine} pull with signed summary"
+
+    touch repo/tmp/cache/summaries/foo
+    touch repo/tmp/cache/summaries/foo.sig
+    ${OSTREE} --repo=repo prune
+    assert_not_has_file repo/tmp/cache/summaries/foo
+    assert_not_has_file repo/tmp/cache/summaries/foo.sig
+    assert_has_file repo/tmp/cache/summaries/origin
+    assert_has_file repo/tmp/cache/summaries/origin.sig
+    echo "ok ${engine} prune summary cache"
+
+    cd ${test_tmpdir}
+    repo_reinit --set=verification-key=${PUBLIC_KEY}
+    mkdir cachedir
+    ${OSTREE} --repo=repo pull --cache-dir=cachedir origin main
+    assert_not_has_file repo/tmp/cache/summaries/origin
+    assert_not_has_file repo/tmp/cache/summaries/origin.sig
+    assert_has_file cachedir/summaries/origin
+    assert_has_file cachedir/summaries/origin.sig
+
+    rm cachedir/summaries/origin
+    ${OSTREE} --repo=repo pull --cache-dir=cachedir origin main
+    assert_not_has_file repo/tmp/cache/summaries/origin
+    assert_has_file cachedir/summaries/origin
+
+    echo "ok ${engine} pull with signed summary and cachedir"
+
+    cd ${test_tmpdir}
+    repo_reinit --set=verification-key=${PUBLIC_KEY}
+    mv ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{,.good}
+    echo invalid > ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig
+    if ${OSTREE} --repo=repo pull origin main 2>err.txt; then
+        assert_not_reached "Successful pull with invalid ${engine} signature"
+    fi
+    assert_file_has_content err.txt "signed with unknown key"
+    mv ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{.good,}
+    echo "ok ${engine} pull with invalid ${engine} summary signature fails"
+
+    # Generate a delta
+    ${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo static-delta generate --empty main
+    ${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo summary -u ${COMMIT_SIGN}
+
+    cd ${test_tmpdir}
+    repo_reinit --set=verification-key=${PUBLIC_KEY}
+    ${OSTREE} --repo=repo pull origin main
+    echo "ok ${engine} pull delta with signed summary"
+
+done
+
+if ! has_libsodium; then
+    echo "ok ${engine} pull with signed summary remote old summary # SKIP due libsodium unavailability"
+    echo "ok ${engine} pull with signed summary broken cache # SKIP due libsodium unavailability"
+    exit 0
+fi
+
+gen_ed25519_keys
+SIGN_KEY="${ED25519SECRET}"
+PUBLIC_KEY="${ED25519PUBLIC}"
+COMMIT_SIGN="--sign-type=${engine} --sign=${SIGN_KEY}"
+
+
+# Verify 'ostree remote summary' output.
+${OSTREE} --repo=repo remote summary origin > summary.txt
+assert_file_has_content summary.txt "* main"
+assert_file_has_content summary.txt "* other"
+assert_file_has_content summary.txt "* yet-another"
+grep static-deltas summary.txt > static-deltas.txt
+assert_file_has_content static-deltas.txt \
+    $(${OSTREE} --repo=repo rev-parse origin:main)
+
+## Tests for handling of cached summaries while racing with remote summary updates
+
+# Make 2 different but valid summary/signature pairs to test races with
+${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo summary -u ${COMMIT_SIGN}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary{,.1}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{,.1}
+mkdir ${test_tmpdir}/ostree-srv/even-another-files
+cd ${test_tmpdir}/ostree-srv/even-another-files
+echo 'hello world even another object' > even-another-hello-world
+${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo commit ${COMMIT_SIGN} -b even-another -s "A commit" -m "Another Commit body"
+${OSTREE} --repo=${test_tmpdir}/ostree-srv/gnomerepo summary -u ${COMMIT_SIGN}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary{,.2}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{,.2}
+cd ${test_tmpdir}
+
+# Reset to the old valid summary and pull to cache it
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary{.1,}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{.1,}
+repo_reinit --set=verification-key=${PUBLIC_KEY}
+${OSTREE} --repo=repo pull origin main
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.1 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.1 >&2
+
+# Simulate a pull race where the client gets the old summary and the new
+# summary signature since it was generated on the server between the
+# requests
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{.2,}
+if ${OSTREE} --repo=repo pull origin main 2>err.txt; then
+    assert_not_reached "Successful pull with old summary"
+fi
+assert_file_has_content err.txt "signed with unknown key"
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.1 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.1 >&2
+
+# Publish correct summary and check that subsequent pull succeeds
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary{.2,}
+${OSTREE} --repo=repo pull origin main
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.2 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.2 >&2
+
+echo "ok ${engine} pull with signed summary remote old summary"
+
+
+# Reset to the old valid summary and pull to cache it
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary{.1,}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{.1,}
+repo_reinit --set=verification-key=${PUBLIC_KEY}
+${OSTREE} --repo=repo pull origin main
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.1 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.1 >&2
+
+# Simulate a broken summary cache to see if it can be recovered from.
+# Prior to commit c4c2b5eb the client would save the summary to the
+# cache before validating the signature. That would mean the cache would
+# have mismatched summary and signature and ostree would remain
+# deadlocked there until the remote published a new signature.
+#
+# First pull with OSTREE_REPO_TEST_ERROR=invalid-cache to see the
+# invalid cache is detected. Then pull again to check if it can be
+# recovered from.
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.2 repo/tmp/cache/summaries/origin
+if OSTREE_REPO_TEST_ERROR=invalid-cache ${OSTREE} --repo=repo pull origin main 2>err.txt; then
+    assert_not_reached "Should have hit OSTREE_REPO_TEST_ERROR_INVALID_CACHE"
+fi
+assert_file_has_content err.txt "OSTREE_REPO_TEST_ERROR_INVALID_CACHE"
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.2 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.1 >&2
+${OSTREE} --repo=repo pull origin main
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.1 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.1 >&2
+
+# Publish new signature and check that subsequent pull succeeds
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary{.2,}
+cp ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig{.2,}
+${OSTREE} --repo=repo pull origin main
+assert_has_file repo/tmp/cache/summaries/origin
+assert_has_file repo/tmp/cache/summaries/origin.sig
+cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.2 >&2
+cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.2 >&2
+
+echo "ok ${engine} pull with signed summary broken cache"
+

tests/test-signed-pull.sh

@@ -0,0 +1,139 @@
+#!/bin/bash
+#
+# Copyright (C) 2019 Collabora Ltd.
+#
+# SPDX-License-Identifier: LGPL-2.0+
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+# Boston, MA 02111-1307, USA.
+
+set -euo pipefail
+
+. $(dirname $0)/libtest.sh
+
+echo "1..11"
+
+setup_fake_remote_repo1 "archive"
+
+repo_mode="archive"
+
+function repo_init() {
+    cd ${test_tmpdir}
+    rm repo -rf
+    mkdir repo
+    ostree_repo_init repo --mode=${repo_mode}
+    ${CMD_PREFIX} ostree --repo=repo remote add --set=gpg-verify=false --set=sign-verify-summary=false origin $(cat httpd-address)/ostree/gnomerepo "$@"
+}
+
+function test_signed_pull() {
+    local sign_type="$1"
+    local comment="$2"
+    cd ${test_tmpdir}
+    ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo commit ${COMMIT_ARGS} \
+        -b main -s "A signed commit" --tree=ref=main
+
+    ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
+    # make sure gpg verification is correctly on
+    csum=$(${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo rev-parse main)
+    objpath=objects/${csum::2}/${csum:2}.commitmeta
+    remotesig=ostree-srv/gnomerepo/$objpath
+    localsig=repo/$objpath
+    mv $remotesig $remotesig.bak
+    if ${CMD_PREFIX} ostree --repo=repo --depth=0 pull origin main; then
+        assert_not_reached "pull with sign-verify unexpectedly succeeded?"
+    fi
+    # ok now check that we can pull correctly
+    mv $remotesig.bak $remotesig
+    ${CMD_PREFIX} ostree --repo=repo pull origin main
+    echo "ok ${sign_type}${comment} pull signed commit"
+    rm $localsig
+    ${CMD_PREFIX} ostree --repo=repo pull origin main
+    test -f $localsig
+    echo "ok ${sign_type}${comment} re-pull signature for stored commit"
+}
+
+DUMMYSIGN="dummysign"
+COMMIT_ARGS="--sign=${DUMMYSIGN} --sign-type=dummy"
+repo_init --set=sign-verify=true
+
+# Check if verification-key and verification-file options throw error with wrong keys
+cd ${test_tmpdir}
+${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo commit ${COMMIT_ARGS} \
+    -b main -s "A signed commit" --tree=ref=main
+${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
+if ${CMD_PREFIX} ostree --repo=repo pull origin main; then
+    assert_not_reached "pull without keys unexpectedly succeeded"
+fi
+echo "ok pull failure without keys preloaded"
+
+${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-key "somewrongkey"
+if ${CMD_PREFIX} ostree --repo=repo pull origin main; then
+    assert_not_reached "pull with unknown key unexpectedly succeeded"
+fi
+echo "ok pull failure with incorrect key option"
+
+${CMD_PREFIX} ostree --repo=repo config unset 'remote "origin"'.verification-key
+${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-file "/non/existing/file"
+if ${CMD_PREFIX} ostree --repo=repo pull origin main; then
+    assert_not_reached "pull with unknown keys file unexpectedly succeeded"
+fi
+echo "ok pull failure with incorrect keys file option"
+
+# Test with correct dummy key
+${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-key "${DUMMYSIGN}"
+test_signed_pull "dummy" ""
+
+if ! has_libsodium; then
+    echo "ok ed25519-key pull signed commit # SKIP due libsodium unavailability"
+    echo "ok ed25519-key re-pull signature for stored commit # SKIP due libsodium unavailability"
+    echo "ok ed25519-key+file pull signed commit # SKIP due libsodium unavailability"
+    echo "ok ed25519-key+file re-pull signature for stored commit # SKIP due libsodium unavailability"
+    echo "ok ed25519-file pull signed commit # SKIP due libsodium unavailability"
+    echo "ok ed25519-file re-pull signature for stored commit # SKIP due libsodium unavailability"
+    exit 0
+fi
+
+# Test ostree sign with 'ed25519' module
+gen_ed25519_keys
+PUBLIC=${ED25519PUBLIC}
+SEED=${ED25519SEED}
+SECRET=${ED25519SECRET}
+
+COMMIT_ARGS="--sign=${SECRET} --sign-type=ed25519"
+
+repo_init --set=sign-verify=true
+${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-key "${PUBLIC}"
+test_signed_pull "ed25519" "key"
+
+# Prepare files with public ed25519 signatures
+PUBKEYS="$(mktemp -p ${test_tmpdir} ed25519_XXXXXX.ed25519)"
+
+# Test the file with multiple keys without a valid public key
+for((i=0;i<100;i++)); do
+    # Generate a list with some public signatures
+    gen_ed25519_random_public
+done > ${PUBKEYS}
+
+# Test case with the file containing incorrect signatures and with the correct key set
+${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-file "${PUBKEYS}"
+test_signed_pull "ed25519" "key+file"
+
+# Add correct key into the list
+echo ${PUBLIC} >> ${PUBKEYS}
+
+repo_init --set=sign-verify=true
+${CMD_PREFIX} ostree --repo=repo config set 'remote "origin"'.verification-file "${PUBKEYS}"
+test_signed_pull "ed25519" "file"
+

tests/test-summary-collections.sh

@@ -63,7 +63,7 @@ mkdir collection-repo
 ostree_repo_init collection-repo --collection-id org.example.RemoteCollection
 mkdir -p adir
 ${CMD_PREFIX} ostree --repo=collection-repo commit --branch=rcommit -m rcommit -s rcommit adir
-${CMD_PREFIX} ostree --repo=repo remote add --no-gpg-verify --collection-id org.example.RemoteCollection collection-repo-remote "file://${test_tmpdir}/collection-repo"
+${CMD_PREFIX} ostree --repo=repo remote add --no-sign-verify --collection-id org.example.RemoteCollection collection-repo-remote "file://${test_tmpdir}/collection-repo"
 ${CMD_PREFIX} ostree --repo=repo pull collection-repo-remote rcommit
 ${CMD_PREFIX} ostree --repo=repo summary --update
 
@@ -75,7 +75,7 @@ mkdir no-collection-repo
 ostree_repo_init no-collection-repo
 mkdir -p adir2
 ${CMD_PREFIX} ostree --repo=no-collection-repo commit --branch=rcommit2 -m rcommit2 -s rcommit2 adir2
-${CMD_PREFIX} ostree --repo=repo remote add --no-gpg-verify no-collection-repo-remote "file://${test_tmpdir}/no-collection-repo"
+${CMD_PREFIX} ostree --repo=repo remote add --no-sign-verify no-collection-repo-remote "file://${test_tmpdir}/no-collection-repo"
 ${CMD_PREFIX} ostree --repo=repo pull no-collection-repo-remote rcommit2
 ${CMD_PREFIX} ostree --repo=repo summary --update