docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable GCP integration test (#82)

Browse Source
This commit is contained in:
James Carnegie
2024-07-09 15:02:49 +01:00
committed by GitHub
parent aaf043e9cd
commit 6b199f027a
2 changed files with 42 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/test.yml vendored
View File

@@ -36,6 +36,14 @@ jobs:
with:
aws-region: "us-east-1"
role-to-assume: arn:aws:iam::175142243308:role/doi-github-actions-signing
- name: auth-with-gcp
if: matrix.os == 'ubuntu-latest' && github.actor != 'dependabot[bot]'
uses: google-github-actions/auth@v2
with:
project_id: 'attest-kms-test'
export_environment_variables: true
workload_identity_provider: 'projects/385966116051/locations/global/workloadIdentityPools/attest-kms-test/providers/attest-kms-test'
service_account: 'attest-kms-test@attest-kms-test.iam.gserviceaccount.com'
- name: Setup Testcontainers Cloud Client
uses: atomicjar/testcontainers-cloud-setup-action@v1
with:

56
pkg/signerverifier/gcp_test.go
View File

@@ -1,5 +1,17 @@
//go:build e2e
package signerverifier
import (
"context"
"crypto/ecdsa"
"testing"
"github.com/docker/attest/internal/util"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
const publicKeyPEM = `-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMswW3iu7PR/rWTQjlhVmUsPK7rF
k2s4SO3XbQ2GG2alm289SUUpmBAuVxvT8muYQ8HC/QzixzyTACTXsBDjQg==
@@ -8,26 +20,26 @@ k2s4SO3XbQ2GG2alm289SUUpmBAuVxvT8muYQ8HC/QzixzyTACTXsBDjQg==
// to run locally, we need to impersonate the GCP service account
// gcloud auth application-default login --impersonate-service-account attest-kms-test@attest-kms-test.iam.gserviceaccount.com
// func TestGCPKMS_Signer(t *testing.T) {
// // create a new signer
// ctx := context.Background()
// ref := "projects/attest-kms-test/locations/us-west1/keyRings/attest-kms-test/cryptoKeys/test-signing-key/cryptoKeyVersions/1"
// signer, err := GetGCPSigner(ctx, ref)
// require.NoError(t, err)
// msg := []byte("hello world")
// hash := util.SHA256(msg)
func TestGCPKMS_Signer(t *testing.T) {
// create a new signer
ctx := context.Background()
ref := "projects/attest-kms-test/locations/us-west1/keyRings/attest-kms-test/cryptoKeys/test-signing-key/cryptoKeyVersions/1"
signer, err := GetGCPSigner(ctx, ref)
require.NoError(t, err)
msg := []byte("hello world")
hash := util.SHA256(msg)
// // sign message digest
// sig, err := signer.Sign(ctx, hash)
// require.NoError(t, err)
// assert.NotEmpty(t, sig)
// // get Key ID from signer
// keyId, err := signer.KeyID()
// require.NoError(t, err)
// assert.NotEmpty(t, keyId)
// publicKey, err := Parse([]byte(publicKeyPEM))
// require.NoError(t, err)
// // verify payload ecdsa signature
// ok := ecdsa.VerifyASN1(publicKey, hash, sig)
// assert.True(t, ok)
// }
// sign message digest
sig, err := signer.Sign(ctx, hash)
require.NoError(t, err)
assert.NotEmpty(t, sig)
// get Key ID from signer
keyId, err := signer.KeyID()
require.NoError(t, err)
assert.NotEmpty(t, keyId)
publicKey, err := Parse([]byte(publicKeyPEM))
require.NoError(t, err)
// verify payload ecdsa signature
ok := ecdsa.VerifyASN1(publicKey, hash, sig)
assert.True(t, ok)
}