aboutsummaryrefslogtreecommitdiff
path: root/cmd/sigsum
diff options
context:
space:
mode:
authorLinus Nordberg <linus@nordberg.se>2022-03-23 12:08:18 +0100
committerLinus Nordberg <linus@nordberg.se>2022-03-23 12:08:18 +0100
commitcdc373563cb620068a6c436678bba3f276be015b (patch)
treea02a089ba02802324f4ad4905293fd4de4fbba09 /cmd/sigsum
parentf7d2c65559a5149e4923554695a99540abdcc56f (diff)
add support for signing with ssh-keygen
TODO: add tests
Diffstat (limited to 'cmd/sigsum')
-rw-r--r--cmd/sigsum/test/keys/ssh7
-rw-r--r--cmd/sigsum/test/keys/ssh.pub1
-rwxr-xr-xcmd/sigsum/test/ssh.sh53
3 files changed, 61 insertions, 0 deletions
diff --git a/cmd/sigsum/test/keys/ssh b/cmd/sigsum/test/keys/ssh
new file mode 100644
index 0000000..2bbd974
--- /dev/null
+++ b/cmd/sigsum/test/keys/ssh
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACC/0wdPezO/W1upVq2RduQ/ieEHn0r6LgwkXEINfJ52fQAAAJCRqZKpkamS
+qQAAAAtzc2gtZWQyNTUxOQAAACC/0wdPezO/W1upVq2RduQ/ieEHn0r6LgwkXEINfJ52fQ
+AAAEClIbTUqSPBTrfD9MCpwTF1Fwit4NXU2ci3R57uq4Aic7/TB097M79bW6lWrZF25D+J
+4QefSvouDCRcQg18nnZ9AAAACmxpbnVzQGJlc2sBAgM=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/cmd/sigsum/test/keys/ssh.pub b/cmd/sigsum/test/keys/ssh.pub
new file mode 100644
index 0000000..14588ac
--- /dev/null
+++ b/cmd/sigsum/test/keys/ssh.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL/TB097M79bW6lWrZF25D+J4QefSvouDCRcQg18nnZ9 linus@besk
diff --git a/cmd/sigsum/test/ssh.sh b/cmd/sigsum/test/ssh.sh
new file mode 100755
index 0000000..56cae70
--- /dev/null
+++ b/cmd/sigsum/test/ssh.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+set -eu
+trap cleanup EXIT
+
+priv=keys/ssh
+pub=keys/ssh.pub
+domain_hint=_sigsum_v0.ssh.test.sigsum.org
+msg=msg-$(date +%s)
+num_msg=3
+
+function cleanup() {
+ set +e
+
+ rm -f sigsum
+ for i in $(seq 1 $num_msg); do
+ rm -f $msg-$i{,.trunnel,.sig}
+ done
+
+ exit
+}
+
+go build ../
+
+files=""
+for i in $(seq 1 $num_msg); do
+ echo $msg-$i > $msg-$i
+ if ! openssl dgst -binary $msg-$i | ssh-keygen \
+ -Y sign \
+ -O hashalg=sha256 \
+ -f $priv \
+ -n $(./sigsum namespace) > $msg-$i.sig ; then
+ echo "[FAIL] sign for $num_msg ssh message(s)" >&2
+ exit 1
+ fi
+ files=$(echo -n $files $msg-$i)
+done
+
+echo "[PASS] sign for $num_msg ssh message(s)" >&2
+
+if ! ./sigsum bundle -t ssh -k $pub -d $domain_hint $files; then
+ echo "[FAIL] bundle for $num_msg ssh message(s)" >&2
+ exit 1
+fi
+
+echo "[PASS] bundle for $num_msg ssh message(s)" >&2
+
+if ! ./sigsum verify -t ssh -k $pub $files; then
+ echo "[FAIL] verify for $num_msg ssh message(s)" >&2
+ exit 1
+fi
+
+echo "[PASS] verify for $num_msg ssh message(s)" >&2