dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

upstream/container/platform/test/keyring.test.mjs

@@ -0,0 +1,50 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { parseKeyring, validateKeyringTransition, verifyRecoveryKeyring } from '../stage0/lib/keyring.mjs'
+import { document, keyPair, keyring, signature } from './helpers.mjs'
+
+test('accepts a Recovery-signed keyring with derived current and next IDs', () => {
+  const recovery = keyPair()
+  const value = keyring(1, keyPair(), keyPair())
+  const bytes = document(value)
+  assert.deepEqual(verifyRecoveryKeyring(bytes, signature(bytes, recovery), recovery.publicKey), value)
+})
+
+test('rejects a keyring signed by a non-Recovery key or modified after signing', () => {
+  const recovery = keyPair()
+  const other = keyPair()
+  const bytes = document(keyring(1, keyPair(), keyPair()))
+  assert.throws(() => verifyRecoveryKeyring(bytes, signature(bytes, other), recovery.publicKey), {
+    code: 'TRUST_UNKNOWN_KEY',
+  })
+  const signed = signature(bytes, recovery)
+  assert.throws(() => verifyRecoveryKeyring(Buffer.concat([bytes, Buffer.from(' ')]), signed, recovery.publicKey), {
+    code: 'TRUST_BAD_SIGNATURE',
+  })
+})
+
+test('rejects mismatched IDs, duplicate active keys, revoked active keys, and unknown algorithms', () => {
+  const current = keyPair()
+  const next = keyPair()
+  const cases = [
+    { ...keyring(1, current, next), current: { ...keyring(1, current, next).current, keyId: next.keyId } },
+    { ...keyring(1, current, next), next: { ...keyring(1, current, next).current } },
+    { ...keyring(1, current, next), revokedKeyIds: [current.keyId] },
+    { ...keyring(1, current, next), current: { ...keyring(1, current, next).current, algorithm: 'RSA' } },
+  ]
+  for (const value of cases) assert.throws(() => parseKeyring(document(value)))
+})
+
+test('requires transitions to preserve revocations and revoke removed keys', () => {
+  const first = keyPair()
+  const second = keyPair()
+  const third = keyPair()
+  const fourth = keyPair()
+  const initial = parseKeyring(document(keyring(1, first, second)))
+  const rotated = parseKeyring(document(keyring(2, second, third, [first.keyId])))
+  assert.equal(validateKeyringTransition(initial, rotated), rotated)
+  assert.throws(() => validateKeyringTransition(initial, parseKeyring(document(keyring(2, second, third)))))
+  const next = parseKeyring(document(keyring(3, third, fourth, [first.keyId, second.keyId])))
+  assert.equal(validateKeyringTransition(rotated, next), next)
+  assert.throws(() => validateKeyringTransition(next, parseKeyring(document(keyring(4, first, fourth, [second.keyId, third.keyId])))))
+})