From d418c9e19970f62143b27b433c44215a249f1a9c Mon Sep 17 00:00:00 2001 From: Michał Górny Date: Sat, 5 Sep 2020 16:13:28 +0200 Subject: openpgp: Verify key validity for signatures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Require keys to have at least minimal validity for signature verification to be successful. Appropriately mark imported keys ultimately trusted/valid by default. Closes: https://github.com/mgorny/gemato/issues/17 Signed-off-by: Michał Górny --- tests/test_openpgp.py | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) (limited to 'tests/test_openpgp.py') diff --git a/tests/test_openpgp.py b/tests/test_openpgp.py index edeb0b9..dbb71e5 100644 --- a/tests/test_openpgp.py +++ b/tests/test_openpgp.py @@ -22,10 +22,10 @@ from gemato.exceptions import ( OpenPGPKeyImportError, OpenPGPKeyRefreshError, OpenPGPRuntimeError, + OpenPGPUntrustedSigFailure, ) from gemato.manifest import ManifestFile from gemato.openpgp import ( - GNUPG, OpenPGPEnvironment, OpenPGPSystemEnvironment, ) @@ -338,11 +338,8 @@ class OpenPGPMockedSystemEnvironment(OpenPGPSystemEnvironment): self._tmpdir = None os.environ.pop('GNUPGHOME', None) - def import_key(self, keyfile): - exitst, out, err = self._spawn_gpg( - [GNUPG, '--batch', '--import'], keyfile.read()) - if exitst != 0: - raise OpenPGPKeyImportError(err.decode('utf8')) + def import_key(self, keyfile, trust=True): + OpenPGPEnvironment.import_key(self, keyfile, trust=trust) @pytest.fixture(params=[OpenPGPEnvironment, @@ -420,6 +417,19 @@ def test_verify_manifest(openpgp_env, manifest_var, key_var, expected): pytest.skip(str(e)) +def test_verify_untrusted_key(): + try: + openpgp_env = OpenPGPMockedSystemEnvironment() + with io.BytesIO(VALID_PUBLIC_KEY) as f: + openpgp_env.import_key(f, trust=False) + + with io.StringIO(SIGNED_MANIFEST) as f: + with pytest.raises(OpenPGPUntrustedSigFailure): + openpgp_env.verify_file(f) + except OpenPGPNoImplementation as e: + pytest.skip(str(e)) + + @pytest.mark.parametrize('manifest_var,key_var,expected', MANIFEST_VARIANTS) def test_manifest_load(openpgp_env, manifest_var, key_var, expected): -- cgit v1.2.3