diff --git a/image/signature/fixtures/invalid-cleartext.signature b/image/signature/fixtures/invalid-cleartext.signature new file mode 100644 index 0000000000..abdb2166db --- /dev/null +++ b/image/signature/fixtures/invalid-cleartext.signature @@ -0,0 +1,19 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +This is not JSON +-----BEGIN PGP SIGNATURE----- +Comment: generated with `gpg --homedir . --output invalid-cleartext.signature -u 08CD26E446E2E95249B7A405E932F44B23E8DD43 --clear-sign <<< "This is not JSON"` + +iQGzBAEBCgAdFiEECM0m5Ebi6VJJt6QF6TL0SyPo3UMFAmi3YlcACgkQ6TL0SyPo +3UMjQwv/TGivmwhYT8p9F5akuyZ0vkPhB+K4vr+M2VX1vIFGzL6edDWiiRYmysiY +KtTdrRNnCZo6YbcOgdeL2OUpNWeoEshGhV0TqI/kstUa4vRs30NQ3kHX23+mcaf4 +iWI0RDmc05MHFXmOzMaWlb91hZBTGhHwvvPinqMg24QRNH1z1OEsuyJ2oBxdSj/Y +dvGaSy0j8FimbfZS9mbf4+wfAUzkQi4PNBg+21l0QnEgl663VgcOQXK412WKNWcW +vQkSXRFkpJNFF3lWjT4asiAV3T/KHUEq+QZE9rOa945wB0hoE7bZPx2hfZw4Se9/ +KH9O/ZM5WR5GyKbQV/ELNQJkJaDLcM56rBAl2l8eUV+bd8a7QrULjKP0dAffg8t8 +TKWyCSKddtiuJnuidCPV/A1iij0sZiSMzxb+Y33zgIrWThnfggpi0Oo9MYlF5hqF +kD3b4zV1+7EW5YCEGT8sYhPpp96c1JnJbXZX2ii0KECdhLNB/iv44rSjOcl82nOY +pa03tP/x +=RDU4 +-----END PGP SIGNATURE----- diff --git a/image/signature/mechanism_gpgme_test.go b/image/signature/mechanism_gpgme_test.go index 05888c57c7..b45d6e70d8 100644 --- a/image/signature/mechanism_gpgme_test.go +++ b/image/signature/mechanism_gpgme_test.go @@ -48,3 +48,17 @@ func TestGPGMESigningMechanismSupportsSigning(t *testing.T) { err = mech.SupportsSigning() assert.NoError(t, err) } + +func TestGPGMESigningMechanismVerifyCleartext(t *testing.T) { + mech, err := newGPGSigningMechanismInDirectory(testGPGHomeDirectory) + require.NoError(t, err) + defer mech.Close() + + // Successful verification of a cleartext signature + signature, err := os.ReadFile("./fixtures/invalid-cleartext.signature") + require.NoError(t, err) + content, signingFingerprint, err := mech.Verify(signature) + require.NoError(t, err) + assert.Equal(t, []byte("This is not JSON\n"), content) + assert.Equal(t, TestKeyFingerprint, signingFingerprint) +} diff --git a/image/signature/mechanism_sequoia_test.go b/image/signature/mechanism_sequoia_test.go index 134d4d343e..e0b38a7f96 100644 --- a/image/signature/mechanism_sequoia_test.go +++ b/image/signature/mechanism_sequoia_test.go @@ -3,6 +3,7 @@ package signature import ( + "os" "testing" "github.com/stretchr/testify/assert" @@ -34,3 +35,17 @@ func TestSequoiaSigningMechanismSign(t *testing.T) { assert.Error(t, err) assert.IsType(t, SigningNotSupportedError(""), err) } + +func TestSequoiaSigningMechanismVerifyCleartext(t *testing.T) { + mech, err := newGPGSigningMechanismInDirectory(testGPGHomeDirectory) + require.NoError(t, err) + defer mech.Close() + + // Successful verification of a cleartext signature + signature, err := os.ReadFile("./fixtures/invalid-cleartext.signature") + require.NoError(t, err) + content, signingFingerprint, err := mech.Verify(signature) + require.NoError(t, err) + assert.Equal(t, []byte("This is not JSON\n"), content) + assert.Equal(t, TestKeyFingerprint, signingFingerprint) +}