harald
fba7f305e3
- SA-01: Container-DoS / KDF-Amplification Schutz mit Pre-KDF Validierung, max 2 Slots (nur 0 und 1), Slot 0 Pflicht und strikten BLOB-Laengen - SA-02: Release-Signierung in CI entkoppelt (getrennte build und sign-and-release Jobs, Secret-Isolation) - SA-03: Pinned Download-Integritaet fuer minisign.exe in CI via SHA-256 - SA-04: Immutable Action-Pinning (@sha) und Toolchain-Pinning (1.85.0) in CI - SA-05: Session-Token vollstaendig aus URIs verbannt (403 Forbidden bei Vorkommen im Pfad/Query) - SA-06: Constant-Time Token- und Auth-Vergleiche via subtle::ConstantTimeEq - SA-07: Dokumentations-Klarstellung bzgl. logischem Shredding vs. physischer SSD/FTL/CoW-Persistenz
78 lines
2.9 KiB
Rust
78 lines
2.9 KiB
Rust
use sanctum::upgrade::{
|
|
run_upgrade, verify_minisign_signature, UpgradeOptions, SANCTUM_RELEASE_PUBKEY,
|
|
};
|
|
|
|
#[test]
|
|
fn test_minisign_signature_valid() {
|
|
let payload = b"Hello Sanctum Release 0.7.0 Security Testing\n";
|
|
let sig_text = "\
|
|
untrusted comment: signature from minisign secret key\n\
|
|
RUSsVphPgr8155LCucDq8RzDmWMzWElzhBmHrS5p+qJlOCGU4AQpn2F28MVPFrnoGPYEHx7/6TlKg2b45DlYuBQ0+ASeLIzMLwc=\n\
|
|
trusted comment: timestamp:1789750897\tfile:test_payload.txt\thashed\n\
|
|
0l7KsNJkDTo2uOKL8UAiaJOWuhwhGTVZ5fn0JFMdxXE9riYixQO9YnBpSVqz8iCDhWrz8hJBnmUrIWnaRaXVCA==\n";
|
|
|
|
let res = verify_minisign_signature(payload, sig_text, SANCTUM_RELEASE_PUBKEY);
|
|
assert!(
|
|
res.is_ok(),
|
|
"Gültige Minisign-Signatur muss erfolgreich verifiziert werden: {:?}",
|
|
res.err()
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_minisign_signature_tampered_payload() {
|
|
let tampered_payload = b"Hello Sanctum Release 0.7.0 Tampered Payload!\n";
|
|
let sig_text = "\
|
|
untrusted comment: signature from minisign secret key\n\
|
|
RUSsVphPgr8155LCucDq8RzDmWMzWElzhBmHrS5p+qJlOCGU4AQpn2F28MVPFrnoGPYEHx7/6TlKg2b45DlYuBQ0+ASeLIzMLwc=\n\
|
|
trusted comment: timestamp:1789750897\tfile:test_payload.txt\thashed\n\
|
|
0l7KsNJkDTo2uOKL8UAiaJOWuhwhGTVZ5fn0JFMdxXE9riYixQO9YnBpSVqz8iCDhWrz8hJBnmUrIWnaRaXVCA==\n";
|
|
|
|
let res = verify_minisign_signature(tampered_payload, sig_text, SANCTUM_RELEASE_PUBKEY);
|
|
assert!(
|
|
res.is_err(),
|
|
"Manipulierte Binärdaten müssen die Minisign-Prüfung verfehlen"
|
|
);
|
|
assert!(res.unwrap_err().to_string().contains("FEHLGESCHLAGEN"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_minisign_signature_wrong_key() {
|
|
let payload = b"Hello Sanctum Release 0.7.0 Security Testing\n";
|
|
let sig_text = "\
|
|
untrusted comment: signature from minisign secret key\n\
|
|
RUSsVphPgr8155LCucDq8RzDmWMzWElzhBmHrS5p+qJlOCGU4AQpn2F28MVPFrnoGPYEHx7/6TlKg2b45DlYuBQ0+ASeLIzMLwc=\n\
|
|
trusted comment: timestamp:1789750897\tfile:test_payload.txt\thashed\n\
|
|
0l7KsNJkDTo2uOKL8UAiaJOWuhwhGTVZ5fn0JFMdxXE9riYixQO9YnBpSVqz8iCDhWrz8hJBnmUrIWnaRaXVCA==\n";
|
|
|
|
// Ein anderer, unautorisierter Public Key
|
|
let other_key = "RWSb0a70vF1X8qIjc7xi28Gmw+cIWbMipOy4L6ToJEUPkWDw3c0qIjc7";
|
|
let res = verify_minisign_signature(payload, sig_text, other_key);
|
|
assert!(
|
|
res.is_err(),
|
|
"Signaturprüfung mit fremdem Schlüssel muss fehlschlagen"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_upgrade_blocks_unofficial_url_without_insecure_flag() {
|
|
let options = UpgradeOptions {
|
|
check_only: true,
|
|
yes: false,
|
|
force: false,
|
|
base_url: "https://evil-attacker.org/sanctum".into(),
|
|
insecure_url: false,
|
|
};
|
|
|
|
let res = run_upgrade(&options);
|
|
assert!(
|
|
res.is_err(),
|
|
"Inoffizielle Server-URL ohne --insecure-url muss blockiert werden"
|
|
);
|
|
let err_msg = res.unwrap_err().to_string();
|
|
assert!(
|
|
err_msg.contains("Sicherheitsverstoß") || err_msg.contains("nicht vertrauenswürdig"),
|
|
"Fehler muss Sicherheitsverstoß anzeigen: {err_msg}"
|
|
);
|
|
}
|