49 lines
5.4 KiB
JavaScript
49 lines
5.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { createRequire } from "node:module";
|
|
import { fileURLToPath } from "node:url";
|
|
import ts from "../../web/node_modules/typescript/lib/typescript.js";
|
|
|
|
const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const reportPath = path.join(root, "tests/golden/M13-02D/signature-report.json");
|
|
const manifestPath = path.join(root, "tests/golden/M13-02D/manifest.json");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "m13-02d-signature-"));
|
|
const hashFile = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
|
|
const privateKey = crypto.createPrivateKey({ key: Buffer.concat([Buffer.from("302e020100300506032b657004220420", "hex"), Buffer.from("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "hex")]), format: "der", type: "pkcs8" });
|
|
const publicKey = crypto.createPublicKey(privateKey).export({ format: "der", type: "spki" }).subarray(-32).toString("hex");
|
|
const script = (overrides = {}) => ({ id: "clean", name: "clean", entryPath: "scripts/clean.py", sourceByteLength: 128, sourceSha256: "a".repeat(64), publisher: "Team", signature: "0".repeat(128), keyId: "key:new", permissions: ["READ_MAIN"], dependencies: [], module: false, cpuMs: 1000, memoryBytes: 1024 * 1024, wallMs: 5000, network: false, autorun: false, driverExpressions: false, addonInstall: false, ...overrides });
|
|
const policy = (overrides = {}) => ({ schemaVersion: 1, issuer: "web-trust", issuedAt: "2026-01-01T00:00:00.000Z", expiresAt: "2027-01-01T00:00:00.000Z", maxClockSkewMs: 300000, keys: [{ keyId: "key:new", publisher: "Team", algorithm: "ED25519", publicKey, status: "ACTIVE", notBefore: "2026-01-01T00:00:00.000Z", notAfter: "2027-01-01T00:00:00.000Z" }], ...overrides });
|
|
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
|
|
const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
|
|
const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText
|
|
.replace('require("./asset-path")', 'require("./asset-path.cjs")')
|
|
.replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
|
|
fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
|
|
}
|
|
const protocol = createRequire(import.meta.url)(path.join(temporary, "scripting-platform.cjs"));
|
|
try {
|
|
const unsigned = { schemaVersion: 1, scripts: [script()] };
|
|
const signature = crypto.sign(null, Buffer.from(protocol.serializeScriptSignatureInput(unsigned, "clean")), privateKey).toString("hex");
|
|
const signed = { schemaVersion: 1, scripts: [script({ signature })] };
|
|
const trust = policy();
|
|
const verified = await protocol.verifyScriptManifestSignature(signed, "clean", trust, "2026-08-18T12:00:00.000Z");
|
|
const sourceChanged = await protocol.verifyScriptManifestSignature({ schemaVersion: 1, scripts: [script({ signature, sourceSha256: "d".repeat(64) })] }, "clean", trust, "2026-08-18T12:00:00.000Z");
|
|
const signatureChanged = await protocol.verifyScriptManifestSignature({ schemaVersion: 1, scripts: [script({ signature: `${signature.slice(0, -1)}${signature.endsWith("0") ? "1" : "0"}` })] }, "clean", trust, "2026-08-18T12:00:00.000Z");
|
|
const revoked = await protocol.verifyScriptManifestSignature(signed, "clean", policy({ keys: [{ ...trust.keys[0], status: "REVOKED", revokedAt: "2026-06-01T00:00:00.000Z" }] }), "2026-08-18T12:00:00.000Z");
|
|
assert.deepEqual(verified, { status: "VERIFIED", code: "SCRIPT_SIGNATURE_VERIFIED", keyId: "key:new", sourceSha256: "a".repeat(64), inputSha256: verified.inputSha256 });
|
|
assert.equal(sourceChanged.code, "SCRIPT_SIGNATURE_INVALID");
|
|
assert.equal(signatureChanged.code, "SCRIPT_SIGNATURE_INVALID");
|
|
assert.equal(revoked.code, "SCRIPT_POLICY_DENIED");
|
|
assert.notEqual(sourceChanged.inputSha256, verified.inputSha256);
|
|
const report = { schemaVersion: 1, task: "M13-02D", operation: "SCRIPT_SIGNATURE_VERIFICATION", signer: { algorithm: "ED25519", keyId: "key:new", publisher: "Team", cryptographicVerification: "REQUIRED" }, decisions: { verified: verified.code, sourceHashChanged: sourceChanged.code, signatureChanged: signatureChanged.code, revoked: revoked.code }, input: { verifiedSha256: verified.inputSha256, changedSha256: sourceChanged.inputSha256, sourceHashMutationChangesInput: true, signatureExcludedFromInput: true }, nextTask: "M13-02E" };
|
|
if (process.env.UPDATE_M13_02D_REPORT === "1") { fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n"); }
|
|
assert.deepEqual(JSON.parse(fs.readFileSync(reportPath, "utf8")), report);
|
|
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
|
assert.deepEqual({ schemaVersion: manifest.schemaVersion, task: manifest.task, parentTask: manifest.parentTask, nextTask: manifest.nextTask }, { schemaVersion: 1, task: "M13-02D", parentTask: "M13-02C", nextTask: "M13-02E" });
|
|
for (const artifact of Object.values(manifest.artifacts)) assert.equal(hashFile(path.join(root, artifact.path)), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
|
|
process.stdout.write(`script-signature-ok verified=${verified.code} sourceHashChanged=${sourceChanged.code} revoked=${revoked.code} next=${manifest.nextTask}\n`);
|
|
} finally { fs.rmSync(temporary, { recursive: true, force: true }); }
|