@@ -8,17 +8,25 @@ package verifier
88
99import (
1010 "context"
11+ "crypto/ecdsa"
12+ "crypto/ed25519"
13+ "crypto/rand"
14+ "crypto/sha256"
15+ "crypto/x509"
16+ "encoding/pem"
1117 "fmt"
1218 "os"
1319 "path/filepath"
1420 "testing"
1521 "time"
1622
23+ bccsputils "github.com/hyperledger/fabric-lib-go/bccsp/utils"
24+ "github.com/hyperledger/fabric-protos-go-apiv2/msp"
1725 "github.com/hyperledger/fabric-x-common/common/policydsl"
1826 "github.com/hyperledger/fabric-x-common/core/config/configtest"
19- "github.com/hyperledger/fabric/integration/nwo"
20- "github.com/hyperledger/fabric/protoutil"
27+ "github.com/hyperledger/fabric-x-common/protoutil"
2128 "github.com/stretchr/testify/require"
29+ "google.golang.org/protobuf/proto"
2230
2331 "github.com/hyperledger/fabric-x-committer/api/protoblocktx"
2432 "github.com/hyperledger/fabric-x-committer/api/protosigverifierservice"
@@ -156,21 +164,21 @@ func TestSignatureRule(t *testing.T) {
156164 err = stream .Send (& protosigverifierservice.Batch {Update : update })
157165 require .NoError (t , err )
158166
159- signingIdentities := make ([]* nwo. SigningIdentity , 2 )
167+ signingIdentities := make ([]* signingIdentity , 2 )
160168
161169 for i , org := range []string {"Org1" , "Org2" } {
162- signingIdentities [i ] = & nwo. SigningIdentity {
170+ signingIdentities [i ] = & signingIdentity {
163171 CertPath : filepath .Join (configtest .GetDevConfigDir (), "crypto/" + org + "/users/User1@" + org + "/msp" ,
164172 "signcerts" , "User1@" + org + "-cert.pem" ),
165173 KeyPath : filepath .Join (configtest .GetDevConfigDir (), "crypto/" + org + "/users/User1@" + org + "/msp" ,
166- "keystore" , "key.pem " ),
174+ "keystore" , "priv_sk " ),
167175 MSPID : org ,
168176 }
169177 }
170178
171179 serializedSigningIdentities := make ([][]byte , len (signingIdentities ))
172180 for i , si := range signingIdentities {
173- serializedIdentity , serr := si .Serialize ()
181+ serializedIdentity , serr := si .serialize ()
174182 require .NoError (t , serr )
175183 serializedSigningIdentities [i ] = serializedIdentity
176184 }
@@ -206,7 +214,7 @@ func TestSignatureRule(t *testing.T) {
206214 mspIDs := make ([][]byte , len (signingIdentities ))
207215 certsBytes := make ([][]byte , len (signingIdentities ))
208216 for i , si := range signingIdentities {
209- s , serr := si .Sign (data )
217+ s , serr := si .sign (data )
210218 require .NoError (t , serr )
211219 signatures [i ] = s
212220
@@ -603,3 +611,57 @@ func createVerifierClientWithTLS(
603611 t .Helper ()
604612 return test .CreateClientWithTLS (t , ep , tlsCfg , protosigverifierservice .NewVerifierClient )
605613}
614+
615+ // A signingIdentity represents an MSP signing identity.
616+ type signingIdentity struct {
617+ CertPath string
618+ KeyPath string
619+ MSPID string
620+ }
621+
622+ // serialize returns the probobuf encoding of an msp.SerializedIdenity.
623+ func (s * signingIdentity ) serialize () ([]byte , error ) {
624+ cert , err := os .ReadFile (s .CertPath )
625+ if err != nil {
626+ return nil , err
627+ }
628+ return proto .Marshal (& msp.SerializedIdentity {
629+ Mspid : s .MSPID ,
630+ IdBytes : cert ,
631+ })
632+ }
633+
634+ // sign computes a SHA256 message digest if key is ECDSA,
635+ // signs it with the associated private key, and returns the
636+ // signature. Low-S normlization is applied for ECDSA signatures.
637+ func (s * signingIdentity ) sign (msg []byte ) ([]byte , error ) {
638+ digest := sha256 .Sum256 (msg )
639+ pemKey , err := os .ReadFile (s .KeyPath )
640+ if err != nil {
641+ return nil , err
642+ }
643+ block , _ := pem .Decode (pemKey )
644+ if block .Type != "EC PRIVATE KEY" && block .Type != "PRIVATE KEY" {
645+ return nil , fmt .Errorf ("file %s does not contain a private key" , s .KeyPath )
646+ }
647+ key , err := x509 .ParsePKCS8PrivateKey (block .Bytes )
648+ if err != nil {
649+ return nil , err
650+ }
651+ switch k := key .(type ) {
652+ case * ecdsa.PrivateKey :
653+ r , _s , err := ecdsa .Sign (rand .Reader , k , digest [:])
654+ if err != nil {
655+ return nil , err
656+ }
657+ sig , err := bccsputils .MarshalECDSASignature (r , _s )
658+ if err != nil {
659+ return nil , err
660+ }
661+ return bccsputils .SignatureToLowS (& k .PublicKey , sig )
662+ case ed25519.PrivateKey :
663+ return ed25519 .Sign (k , msg ), nil
664+ default :
665+ return nil , fmt .Errorf ("unexpected key type: %T" , key )
666+ }
667+ }
0 commit comments