# GNU Guix --- Functional package management for GNU
# Copyright © 2013, 2014, 2020 Ludovic Courtès <ludo@gnu.org>
#
# This file is part of GNU Guix.
#
# GNU Guix is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GNU Guix is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

#
# Test the 'guix authenticate' command-line utility.
#

guix authenticate --version

sig="t-signature-$$"
hash="t-hash-$$"
rm -f "$sig" "$hash"

trap 'rm -f "$sig" "$hash"' EXIT

key="$abs_top_srcdir/tests/signing-key.sec"
key_len="`echo -n $key | wc -c`"

# A hexadecimal string as long as a sha256 hash.
hash="2749f0ea9f26c6c7be746a9cff8fa4c2f2a02b000070dba78429e9a11f87c6eb"
hash_len="`echo -n $hash | wc -c`"

echo "sign $key_len:$key $hash_len:$hash" | guix authenticate > "$sig"
test -f "$sig"
case "$(cat $sig)" in
    "0 "*) ;;
    *)     echo "broken signature: $(cat $sig)"
	   exit 42;;
esac

# Remove the leading "0".
sed -i "$sig" -e's/^0 //g'

hash2="$(echo verify $(cat "$sig") | guix authenticate)"
test "$(echo $hash2 | cut -d : -f 2)" = "$hash"

# Detect corrupt signatures.
code="$(echo "verify 5:wrong" | guix authenticate | cut -f1 -d ' ')"
test "$code" -ne 0

# Detect invalid signatures.
# The signature has (payload (data ... (hash sha256 #...#))).  We proceed by
# modifying this hash.
sed -i "$sig"											\
    -e's|#[A-Z0-9]\{64\}#|#0000000000000000000000000000000000000000000000000000000000000000#|g'
code="$(echo "verify $(cat $sig)" | guix authenticate | cut -f1 -d ' ')"
test "$code" -ne 0

# Make sure byte strings are correctly encoded.  The hash string below is
# "café" repeated 8 times.  Libgcrypt would normally choose to write it as a
# string rather than a hex sequence.  We want that string to be Latin-1
# encoded independently of the current locale: <https://bugs.gnu.org/43421>.
hash="636166e9636166e9636166e9636166e9636166e9636166e9636166e9636166e9"
latin1_cafe="caf$(printf '\351')"
echo "sign 21:tests/signing-key.sec 64:$hash" | guix authenticate \
    | LC_ALL=C grep "hash sha256 \"$latin1_cafe"

# Test for <http://bugs.gnu.org/17312>: make sure 'guix authenticate' produces
# valid signatures when run in the C locale.
hash="5eff0b55c9c5f5e87b4e34cd60a2d5654ca1eb78c7b3c67c3179fed1cff07b4c"

LC_ALL=C
export LC_ALL

echo "sign $key_len:$key $hash_len:$hash" | guix authenticate > "$sig"

# Remove the leading "0".
sed -i "$sig" -e's/^0 //g'

echo "verify $(cat $sig)" | guix authenticate
hash2="$(echo "verify $(cat $sig)" | guix authenticate | cut -f2 -d ' ')"
test "$(echo $hash2 | cut -d : -f 2)" = "$hash"
'msg-avail'>...</span></td><td>Pierre Neidhardt</td></tr>
<tr><td><span title='2018-11-23 15:42:00 +0100'>2018-11-23</span></td><td><a href='/guix/commit/m4?id=60e1c1099fc3d73ed7d3235e71aae5d00ab7d773'>Update Guile-SQLite3 URL everywhere.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-09-04 17:25:11 +0200'>2018-09-04</span></td><td><a href='/guix/commit/m4?id=ca719424455465fca4b872c371daf2a46de88b33'>Switch to Guile-Gcrypt.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-06-01 15:35:15 +0200'>2018-06-01</span></td><td><a href='/guix/commit/m4?id=d59e75f3b5b82692bd250a1a3a9965397bb588c5'>build: Check for Guile-SQLite3.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-02-26 18:19:34 +0100'>2018-02-26</span></td><td><a href='/guix/commit/m4?id=1d84d7bf6052c0c80bd212d4524876576e9817d4'>build: Require Guile &gt;= 2.0.13.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-01-06 14:45:01 +0100'>2018-01-06</span></td><td><a href='/guix/commit/m4?id=142182514b84ee233bc27e574df2ca2074291525'>build: Detect broken 'equal?' in Guile 2.2.1.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2017-06-30 00:16:50 +0200'>2017-06-30</span></td><td><a href='/guix/commit/m4?id=1d97fd8cb60f0b5f386f834940f859ff0b0bcc71'>build: Remove check for broken (srfi srfi-37).</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2017-02-20 12:58:07 +0200'>2017-02-20</span></td><td><a href='/guix/commit/m4?id=3b88f3767d9f3ad2cc64173525cd53d429bfe7e7'>gnu: Add bootstrap-binaries for 'aarch64-linux'.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2016-11-25 23:44:20 +0100'>2016-11-25</span></td><td><a href='/guix/commit/m4?id=21531add3205e400707c8fbfd841845f9a71863a'>offload: Use Guile-SSH instead of GNU lsh.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2016-08-10 15:40:22 -0400'>2016-08-10</span></td><td><a href='/guix/commit/m4?id=4ed40a3e6ca030573ded52233bd9e72dcdb85697'>build: Correctly determine the system type for GNU/Hurd systems.</a><span class='msg-avail'>...</span></td><td>Manolis Ragkousis</td></tr>
<tr><td><span title='2016-07-20 11:42:17 +0200'>2016-07-20</span></td><td><a href='/guix/commit/m4?id=7575655212ecfbcd1f04e429c8a7a41f8720d027'>Merge branch 'master' into core-updates</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2016-07-19 00:07:12 +0200'>2016-07-19</span></td><td><a href='/guix/commit/m4?id=721539026dda02e58addbb618f2102b31a2927f8'>Add (guix zlib).</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2016-06-23 17:25:37 +0300'>2016-06-23</span></td><td><a href='/guix/commit/m4?id=875715cabfeb7816cea16269cfbdbad08442a73e'>build: Remove unneeded conditionals for (guix build syscalls).</a><span class='msg-avail'>...</span></td><td>Manolis Ragkousis</td></tr>
<tr><td><span title='2016-03-19 15:07:46 +0100'>2016-03-19</span></td><td><a href='/guix/commit/m4?id=ef5f5c8659b1ca3999e362dfa33478e0a0150ced'>build: Protect against misconfiguration of localstatedir.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>