tests/test_release_034.py

Read-only source from the unchanged 0.3.4 kit. Existing license terms apply.

import copy
import io
import json
import tempfile
import unittest
from contextlib import redirect_stdout
from pathlib import Path
import test_conformance
from ail_ref.packet import verify_identity_packet, verify_trusted_fingerprint, canonical_packet_payload
from ail_ref.cli import main

class Release034Tests(unittest.TestCase):
    def setUp(self):
        self.packet = test_conformance.ConformanceTests()._signed_identity_packet()

    def test_trusted_fingerprint_match(self):
        result = verify_trusted_fingerprint(self.packet, self.packet['public_key']['fingerprint'])
        self.assertTrue(result['valid'])
        self.assertEqual(result['identity_assurance'], 'ail:self_asserted_key')

    def test_same_name_different_key_rejected(self):
        other = test_conformance.ConformanceTests()._signed_identity_packet()
        result = verify_trusted_fingerprint(other, self.packet['public_key']['fingerprint'])
        self.assertFalse(result['valid'])
        self.assertEqual(result['signature_status'], 'ail:cryptographically_verified')
        self.assertEqual(result['trusted_key_status'], 'key_mismatch')

    def test_invalid_expected_fingerprint(self):
        for value in ('', 'sha256:wrong', '0'*64):
            self.assertFalse(verify_trusted_fingerprint(self.packet, value)['valid'])

    def test_tampered_subject_fields(self):
        for field, value in [('role','ail:admin'), ('grant','ail:everything'), ('language','urn:other'), ('identity_assurance','ail:domain_anchored_key'), ('principal',' urn:ail:principal:wakely-wolf')]:
            packet = copy.deepcopy(self.packet)
            packet['subject'][field] = value
            self.assertFalse(verify_identity_packet(packet).valid, field)

    def test_invalid_principal_rejected_before_signing(self):
        for value in ('urn:ail:principal:', 'urn:ail:principal:Bad Name', 'urn:ail:principal:x;grant=all'):
            subject = {**self.packet['subject'], 'principal': value}
            with self.assertRaises(ValueError):
                canonical_packet_payload(subject, 'unused', 'unused', self.packet['created_at'])

    def test_cli_fingerprint_exit_codes(self):
        with tempfile.TemporaryDirectory() as tmp:
            p=Path(tmp)/'packet.json';p.write_text(json.dumps(self.packet))
            for fingerprint, code in [(self.packet['public_key']['fingerprint'],0),('sha256:'+'0'*64,1)]:
                with redirect_stdout(io.StringIO()) as output:
                    actual=main(['verify-packet',str(p),'--trusted-fingerprint',fingerprint])
                self.assertEqual(actual,code)
                self.assertEqual(json.loads(output.getvalue())['valid'],code==0)