Skip to content

Commit c32a0fd

Browse files
adityasakyadityasaky
authored
Merge pull request #34 from khalkie/main
2 parents 154aa5b + 60bd7fd commit c32a0fd

File tree

4 files changed

+56
-52
lines changed

4 files changed

+56
-52
lines changed

‎dsse/sign.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ https://github.com/secure-systems-lab/dsse
55
package dsse
66

77
import (
8+
"context"
89
"encoding/base64"
910
"errors"
1011
"fmt"
@@ -77,7 +78,7 @@ using the current algorithm, and the key used (if applicable).
7778
For an example see EcdsaSigner in sign_test.go.
7879
*/
7980
type Signer interface {
80-
Sign(data []byte) ([]byte, error)
81+
Sign(ctx context.Context, data []byte) ([]byte, error)
8182
KeyID() (string, error)
8283
}
8384

@@ -143,7 +144,7 @@ Returned is an envelope as defined here:
143144
https://github.com/secure-systems-lab/dsse/blob/master/envelope.md
144145
One signature will be added for each Signer in the EnvelopeSigner.
145146
*/
146-
func (es *EnvelopeSigner) SignPayload(payloadType string, body []byte) (*Envelope, error) {
147+
func (es *EnvelopeSigner) SignPayload(ctx context.Context, payloadType string, body []byte) (*Envelope, error) {
147148
var e = Envelope{
148149
Payload: base64.StdEncoding.EncodeToString(body),
149150
PayloadType: payloadType,
@@ -152,7 +153,7 @@ func (es *EnvelopeSigner) SignPayload(payloadType string, body []byte) (*Envelop
152153
paeEnc := PAE(payloadType, body)
153154

154155
for _, signer := range es.providers {
155-
sig, err := signer.Sign(paeEnc)
156+
sig, err := signer.Sign(ctx, paeEnc)
156157
if err != nil {
157158
return nil, err
158159
}
@@ -176,8 +177,8 @@ Any domain specific validation such as parsing the decoded body and
176177
validating the payload type is left out to the caller.
177178
Verify returns a list of accepted keys each including a keyid, public and signiture of the accepted provider keys.
178179
*/
179-
func (es *EnvelopeSigner) Verify(e *Envelope) ([]AcceptedKey, error) {
180-
return es.ev.Verify(e)
180+
func (es *EnvelopeSigner) Verify(ctx context.Context, e *Envelope) ([]AcceptedKey, error) {
181+
return es.ev.Verify(ctx, e)
181182
}
182183

183184
/*

‎dsse/sign_test.go‎

Lines changed: 41 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package dsse
22

33
import (
4+
"context"
45
"crypto"
56
"crypto/ecdsa"
67
"crypto/elliptic"
@@ -40,11 +41,11 @@ func TestPAE(t *testing.T) {
4041

4142
type nilsigner int
4243

43-
func (n nilsigner) Sign(data []byte) ([]byte, error) {
44+
func (n nilsigner) Sign(ctx context.Context, data []byte) ([]byte, error) {
4445
return data, nil
4546
}
4647

47-
func (n nilsigner) Verify(data, sig []byte) error {
48+
func (n nilsigner) Verify(ctx context.Context, data, sig []byte) error {
4849
if len(data) != len(sig) {
4950
return errLength
5051
}
@@ -68,11 +69,11 @@ func (n nilsigner) Public() crypto.PublicKey {
6869

6970
type nullsigner int
7071

71-
func (n nullsigner) Sign(data []byte) ([]byte, error) {
72+
func (n nullsigner) Sign(ctx context.Context, data []byte) ([]byte, error) {
7273
return data, nil
7374
}
7475

75-
func (n nullsigner) Verify(data, sig []byte) error {
76+
func (n nullsigner) Verify(ctx context.Context, data, sig []byte) error {
7677
if len(data) != len(sig) {
7778
return errLength
7879
}
@@ -96,11 +97,11 @@ func (n nullsigner) Public() crypto.PublicKey {
9697

9798
type errsigner int
9899

99-
func (n errsigner) Sign(data []byte) ([]byte, error) {
100+
func (n errsigner) Sign(ctx context.Context, data []byte) ([]byte, error) {
100101
return nil, fmt.Errorf("signing error")
101102
}
102103

103-
func (n errsigner) Verify(data, sig []byte) error {
104+
func (n errsigner) Verify(ctx context.Context, data, sig []byte) error {
104105
return errVerify
105106
}
106107

@@ -117,11 +118,11 @@ type errverifier int
117118
var errVerify = fmt.Errorf("accepted signatures do not match threshold, Found: 0, Expected 1")
118119
var errThreshold = fmt.Errorf("invalid threshold")
119120

120-
func (n errverifier) Sign(data []byte) ([]byte, error) {
121+
func (n errverifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
121122
return data, nil
122123
}
123124

124-
func (n errverifier) Verify(data, sig []byte) error {
125+
func (n errverifier) Verify(ctx context.Context, data, sig []byte) error {
125126
return errVerify
126127
}
127128

@@ -135,11 +136,11 @@ func (n errverifier) Public() crypto.PublicKey {
135136

136137
type badverifier int
137138

138-
func (n badverifier) Sign(data []byte) ([]byte, error) {
139+
func (n badverifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
139140
return append(data, byte(0)), nil
140141
}
141142

142-
func (n badverifier) Verify(data, sig []byte) error {
143+
func (n badverifier) Verify(ctx context.Context, data, sig []byte) error {
143144

144145
if len(data) != len(sig) {
145146
return errLength
@@ -199,7 +200,7 @@ func TestNilSign(t *testing.T) {
199200
signer, err := NewEnvelopeSigner(ns)
200201
assert.Nil(t, err, "unexpected error")
201202

202-
got, err := signer.SignPayload(payloadType, []byte(payload))
203+
got, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
203204
assert.Nil(t, err, "sign failed")
204205
assert.Equal(t, &want, got, "bad signature")
205206
}
@@ -209,7 +210,7 @@ func TestSignError(t *testing.T) {
209210
signer, err := NewEnvelopeSigner(es)
210211
assert.Nil(t, err, "unexpected error")
211212

212-
got, err := signer.SignPayload("t", []byte("d"))
213+
got, err := signer.SignPayload(context.TODO(), "t", []byte("d"))
213214
assert.Nil(t, got, "expected nil")
214215
assert.NotNil(t, err, "error expected")
215216
assert.Equal(t, "signing error", err.Error(), "wrong error")
@@ -252,7 +253,7 @@ type EcdsaSigner struct {
252253
verified bool
253254
}
254255

255-
func (es *EcdsaSigner) Sign(data []byte) ([]byte, error) {
256+
func (es *EcdsaSigner) Sign(ctx context.Context, data []byte) ([]byte, error) {
256257
// Data is complete message, hash it and sign the digest
257258
digest := sha256.Sum256(data)
258259
r, s, err := rfc6979.SignECDSA(es.key, digest[:], sha256.New)
@@ -268,7 +269,7 @@ func (es *EcdsaSigner) Sign(data []byte) ([]byte, error) {
268269
return rawSig, nil
269270
}
270271

271-
func (es *EcdsaSigner) Verify(data, sig []byte) error {
272+
func (es *EcdsaSigner) Verify(ctx context.Context, data, sig []byte) error {
272273
var r big.Int
273274
var s big.Int
274275
digest := sha256.Sum256(data)
@@ -319,12 +320,12 @@ func TestEcdsaSign(t *testing.T) {
319320
signer, err := NewEnvelopeSigner(ecdsa)
320321
assert.Nil(t, err, "unexpected error")
321322

322-
env, err := signer.SignPayload(payloadType, []byte(payload))
323+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
323324
assert.Nil(t, err, "unexpected error")
324325
assert.Equal(t, &want, env, "Wrong envelope generated")
325326

326327
// Now verify
327-
acceptedKeys, err := signer.Verify(env)
328+
acceptedKeys, err := signer.Verify(context.TODO(), env)
328329
assert.Nil(t, err, "unexpected error")
329330
assert.True(t, ecdsa.verified, "verify was not called")
330331
assert.Len(t, acceptedKeys, 1, "unexpected keys")
@@ -384,10 +385,10 @@ func TestVerifyOneProvider(t *testing.T) {
384385
signer, err := NewEnvelopeSigner(ns)
385386
assert.Nil(t, err, "unexpected error")
386387

387-
env, err := signer.SignPayload(payloadType, []byte(payload))
388+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
388389
assert.Nil(t, err, "sign failed")
389390

390-
acceptedKeys, err := signer.Verify(env)
391+
acceptedKeys, err := signer.Verify(context.TODO(), env)
391392
assert.Nil(t, err, "unexpected error")
392393
assert.Len(t, acceptedKeys, 1, "unexpected keys")
393394
assert.Equal(t, acceptedKeys[0].KeyID, "nil", "unexpected keyid")
@@ -402,10 +403,10 @@ func TestVerifyMultipleProvider(t *testing.T) {
402403
signer, err := NewEnvelopeSigner(ns, null)
403404
assert.Nil(t, err, "unexpected error")
404405

405-
env, err := signer.SignPayload(payloadType, []byte(payload))
406+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
406407
assert.Nil(t, err, "sign failed")
407408

408-
acceptedKeys, err := signer.Verify(env)
409+
acceptedKeys, err := signer.Verify(context.TODO(), env)
409410
assert.Nil(t, err, "unexpected error")
410411
assert.Len(t, acceptedKeys, 2, "unexpected keys")
411412
}
@@ -418,10 +419,10 @@ func TestVerifyMultipleProviderThreshold(t *testing.T) {
418419
var null nullsigner
419420
signer, err := NewMultiEnvelopeSigner(2, ns, null)
420421
assert.Nil(t, err)
421-
env, err := signer.SignPayload(payloadType, []byte(payload))
422+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
422423
assert.Nil(t, err, "sign failed")
423424

424-
acceptedKeys, err := signer.Verify(env)
425+
acceptedKeys, err := signer.Verify(context.TODO(), env)
425426
assert.Nil(t, err, "unexpected error")
426427
assert.Len(t, acceptedKeys, 2, "unexpected keys")
427428
}
@@ -443,10 +444,10 @@ func TestVerifyErr(t *testing.T) {
443444
signer, err := NewEnvelopeSigner(errv)
444445
assert.Nil(t, err, "unexpected error")
445446

446-
env, err := signer.SignPayload(payloadType, []byte(payload))
447+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
447448
assert.Nil(t, err, "sign failed")
448449

449-
_, err = signer.Verify(env)
450+
_, err = signer.Verify(context.TODO(), env)
450451
assert.Equal(t, errVerify, err, "wrong error")
451452
}
452453

@@ -458,10 +459,10 @@ func TestBadVerifier(t *testing.T) {
458459
signer, err := NewEnvelopeSigner(badv)
459460
assert.Nil(t, err, "unexpected error")
460461

461-
env, err := signer.SignPayload(payloadType, []byte(payload))
462+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
462463
assert.Nil(t, err, "sign failed")
463464

464-
_, err = signer.Verify(env)
465+
_, err = signer.Verify(context.TODO(), env)
465466
assert.NotNil(t, err, "expected error")
466467
}
467468

@@ -472,7 +473,7 @@ func TestVerifyNoSig(t *testing.T) {
472473

473474
env := &Envelope{}
474475

475-
_, err = signer.Verify(env)
476+
_, err = signer.Verify(context.TODO(), env)
476477
assert.Equal(t, ErrNoSignature, err, "wrong error")
477478
}
478479

@@ -489,7 +490,7 @@ func TestVerifyBadBase64(t *testing.T) {
489490
},
490491
}
491492

492-
_, err := signer.Verify(env)
493+
_, err := signer.Verify(context.TODO(), env)
493494
assert.IsType(t, base64.CorruptInputError(0), err, "wrong error")
494495
})
495496

@@ -503,7 +504,7 @@ func TestVerifyBadBase64(t *testing.T) {
503504
},
504505
}
505506

506-
_, err := signer.Verify(env)
507+
_, err := signer.Verify(context.TODO(), env)
507508
assert.IsType(t, base64.CorruptInputError(0), err, "wrong error")
508509
})
509510
}
@@ -527,7 +528,7 @@ func TestVerifyNoMatch(t *testing.T) {
527528
},
528529
}
529530

530-
_, err = signer.Verify(env)
531+
_, err = signer.Verify(context.TODO(), env)
531532
assert.NotNil(t, err, "expected error")
532533
}
533534

@@ -537,11 +538,11 @@ type interceptSigner struct {
537538
verifyCalled bool
538539
}
539540

540-
func (i *interceptSigner) Sign(data []byte) ([]byte, error) {
541+
func (i *interceptSigner) Sign(ctx context.Context, data []byte) ([]byte, error) {
541542
return data, nil
542543
}
543544

544-
func (i *interceptSigner) Verify(data, sig []byte) error {
545+
func (i *interceptSigner) Verify(ctx context.Context, data, sig []byte) error {
545546
i.verifyCalled = true
546547

547548
if i.verifyRes {
@@ -573,10 +574,10 @@ func TestVerifyOneFail(t *testing.T) {
573574
signer, err := NewEnvelopeSigner(s1, s2)
574575
assert.Nil(t, err, "unexpected error")
575576

576-
env, err := signer.SignPayload(payloadType, []byte(payload))
577+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
577578
assert.Nil(t, err, "sign failed")
578579

579-
acceptedKeys, err := signer.Verify(env)
580+
acceptedKeys, err := signer.Verify(context.TODO(), env)
580581
assert.Nil(t, err, "expected error")
581582
assert.True(t, s1.verifyCalled, "verify not called")
582583
assert.True(t, s2.verifyCalled, "verify not called")
@@ -599,10 +600,10 @@ func TestVerifySameKeyID(t *testing.T) {
599600
signer, err := NewEnvelopeSigner(s1, s2)
600601
assert.Nil(t, err, "unexpected error")
601602

602-
env, err := signer.SignPayload(payloadType, []byte(payload))
603+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
603604
assert.Nil(t, err, "sign failed")
604605

605-
acceptedKeys, err := signer.Verify(env)
606+
acceptedKeys, err := signer.Verify(context.TODO(), env)
606607
assert.Nil(t, err, "expected error")
607608
assert.True(t, s1.verifyCalled, "verify not called")
608609
assert.True(t, s2.verifyCalled, "verify not called")
@@ -627,10 +628,10 @@ func TestVerifyEmptyKeyID(t *testing.T) {
627628
signer, err := NewEnvelopeSigner(s1, s2)
628629
assert.Nil(t, err, "unexpected error")
629630

630-
env, err := signer.SignPayload(payloadType, []byte(payload))
631+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
631632
assert.Nil(t, err, "sign failed")
632633

633-
acceptedKeys, err := signer.Verify(env)
634+
acceptedKeys, err := signer.Verify(context.TODO(), env)
634635
assert.Nil(t, err, "expected error")
635636
// assert.True(t, s1.verifyCalled, "verify not called")
636637
// assert.True(t, s2.verifyCalled, "verify not called")
@@ -658,10 +659,10 @@ func TestVerifyPublicKeyID(t *testing.T) {
658659
signer, err := NewEnvelopeSigner(s1, s2)
659660
assert.Nil(t, err, "unexpected error")
660661

661-
env, err := signer.SignPayload(payloadType, []byte(payload))
662+
env, err := signer.SignPayload(context.TODO(), payloadType, []byte(payload))
662663
assert.Nil(t, err, "sign failed")
663664

664-
acceptedKeys, err := signer.Verify(env)
665+
acceptedKeys, err := signer.Verify(context.TODO(), env)
665666
assert.Nil(t, err, "expected error")
666667
assert.Len(t, acceptedKeys, 1, "unexpected keys")
667668
assert.Equal(t, acceptedKeys[0].KeyID, keyID, "unexpected keyid")

‎dsse/verify.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package dsse
22

33
import (
4+
"context"
45
"crypto"
56
"errors"
67
"fmt"
@@ -15,7 +16,7 @@ must perform the same steps.
1516
If KeyID returns successfully, only signature matching the key ID will be verified.
1617
*/
1718
type Verifier interface {
18-
Verify(data, sig []byte) error
19+
Verify(ctx context.Context, data, sig []byte) error
1920
KeyID() (string, error)
2021
Public() crypto.PublicKey
2122
}
@@ -31,7 +32,7 @@ type AcceptedKey struct {
3132
Sig Signature
3233
}
3334

34-
func (ev *EnvelopeVerifier) Verify(e *Envelope) ([]AcceptedKey, error) {
35+
func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]AcceptedKey, error) {
3536
if e == nil {
3637
return nil, errors.New("cannot verify a nil envelope")
3738
}
@@ -78,7 +79,7 @@ func (ev *EnvelopeVerifier) Verify(e *Envelope) ([]AcceptedKey, error) {
7879
continue
7980
}
8081

81-
err = v.Verify(paeEnc, sig)
82+
err = v.Verify(ctx, paeEnc, sig)
8283
if err != nil {
8384
continue
8485
}

0 commit comments

Comments
 (0)