# GNU Guix --- Functional package management for GNU
# Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
#
# This file is part of GNU Guix.
#
# GNU Guix is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GNU Guix is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

#
# Test the 'guix authenticate' command-line utility.
#

guix authenticate --version

sig="t-signature-$$"
hash="t-hash-$$"
rm -f "$sig" "$hash"

trap 'rm -f "$sig" "$hash"' EXIT

# A hexadecimal string as long as a sha256 hash.
echo "2749f0ea9f26c6c7be746a9cff8fa4c2f2a02b000070dba78429e9a11f87c6eb" \
    > "$hash"

guix authenticate rsautl -sign				\
    -inkey "$abs_top_srcdir/tests/signing-key.sec"	\
    -in "$hash" > "$sig"
test -f "$sig"

hash2="`guix authenticate rsautl -verify		\
          -inkey $abs_top_srcdir/tests/signing-key.pub	\
          -pubin -in $sig`"
test "$hash2" = `cat "$hash"`

# Same thing in a pipeline, using the command line syntax that Nix/Crypto.pm
# uses.
hash2="`						\
  cat "$hash"						\
  | guix authenticate rsautl -sign			\
    -inkey "$abs_top_srcdir/tests/signing-key.sec"	\
  | guix authenticate rsautl -verify			\
          -inkey $abs_top_srcdir/tests/signing-key.pub	\
          -pubin`"
test "$hash2" = `cat "$hash"`

# Detect corrupt signatures.
if guix authenticate rsautl -verify				\
          -inkey "$abs_top_srcdir/tests/signing-key.pub"	\
          -pubin -in /dev/null
then false
else true
fi

# Detect invalid signatures.
# The signature has (payload (data ... (hash sha256 #...#))).  We proceed by
# modifying this hash.
sed -i "$sig"											\
    -e's|#[A-Z0-9]\{64\}#|#0000000000000000000000000000000000000000000000000000000000000000#|g'
if guix authenticate rsautl -verify				\
          -inkey "$abs_top_srcdir/tests/signing-key.pub"	\
          -pubin -in "$sig"
then false
else true
fi


# Test for <http://bugs.gnu.org/17312>: make sure 'guix authenticate' produces
# valid signatures when run in the C locale.
echo "5eff0b55c9c5f5e87b4e34cd60a2d5654ca1eb78c7b3c67c3179fed1cff07b4c" \
    > "$hash"

LC_ALL=C
export LC_ALL

guix authenticate rsautl -sign				\
    -inkey "$abs_top_srcdir/tests/signing-key.sec"	\
    -in "$hash" > "$sig"

guix authenticate rsautl -verify			\
        -inkey "$abs_top_srcdir/tests/signing-key.pub"	\
        -pubin -in "$sig"
hash2="`guix authenticate rsautl -verify		\
          -inkey $abs_top_srcdir/tests/signing-key.pub	\
          -pubin -in $sig`"
test "$hash2" = `cat "$hash"`
ainers.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-10-02 23:28:09 +0200'>2020-10-02</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=0f53c801b91919380a924b402d1ff822bb1dc6ea'>environment: Provide /etc/hosts in containers without '--network'.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-21 23:05:38 +0200'>2020-09-21</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=9b65281de51bcb56714509524f5ae0731c9b96d0'>environment: '--link-profile' uses ~/.guix-profile for environment variables.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-06-20 13:18:11 +0200'>2020-06-20</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=90f496be9ad53802fd260cac3840e7bae24a3e39'>tests: Actually run 'tests/guix-environment-container.sh'.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-10-03 23:48:59 +0200'>2019-10-03</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=5a02f8e3842c19d28f39e5b47d804ef70e1b3160'>environment: '--container' honors '--preserve'.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-08-17 16:23:05 +0200'>2019-08-17</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=75a6f66815db811cc41aadbe93033a6efd3ad62f'>tests: Move 'guix environment -C --no-cwd' test where it belongs.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-04-02 18:15:37 +0200'>2019-04-02</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=1ccc0f807d3f22fa9ade1c607c112e04df833a72'>environment: '-C' creates namespaces where the user is not root.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-03-26 18:11:52 +0100'>2019-03-26</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=952afb6f8c209692e52f9561965ee39e143e1d88'>environment: Create /etc/group in containers.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-03-26 18:11:52 +0100'>2019-03-26</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=8a9922bdee875b3b5e1d928fc8e2121ffa99663a'>environment: Use (gnu build accounts) for /etc/passwd handling.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-03-02 11:55:43 +0100'>2018-03-02</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=e37944d8270cdca5729e3583136c4fe9d487779c'>environment: Add --user.</a><span class='msg-avail'>...</span></td><td>Mike Gerwitz</td></tr>
<tr><td><span title='2018-03-02 11:55:42 +0100'>2018-03-02</span></td><td><a href='/guix/commit/tests/guix-environment-container.sh?id=07ec349229eeae9f733fe92a300c7cfa4cf8e321'>environment: Add --link-profile.</a><span class='msg-avail'>...</span></td><td>Mike Gerwitz</td></tr>