public async Task WhenRepositorySigningIsRequired_FailsValidationOfPackageWhoseRepositorySignatureIsStripped( string resourceName, string packageId, string packageVersion, PackageSigningStatus signingStatus, bool allowSignedPackage) { // Arrange _packageStream = TestResources.GetResourceStream(resourceName); if (allowSignedPackage) { TestUtility.RequireSignedPackage(_corePackageService, packageId, packageVersion, TestResources.Leaf1Thumbprint); } else { TestUtility.RequireUnsignedPackage(_corePackageService, packageId, packageVersion); } _message = new SignatureValidationMessage( packageId, packageVersion, new Uri($"https://unit.test/{TestResources.RepoSignedPackageLeafId.ToLowerInvariant()}"), Guid.NewGuid(), requireRepositorySignature: true); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Failed, signingStatus, shouldExtract: signingStatus == PackageSigningStatus.Valid); Assert.Empty(result.Issues); }
public async Task AcceptsRepositorySignedPackage() { // Arrange _configuration.AllowedRepositorySigningCertificates = new List <string> { TestResources.Leaf1Thumbprint }; _packageStream = TestResources.GetResourceStream(TestResources.RepoSignedPackageLeaf1); TestUtility.RequireUnsignedPackage(_corePackageService, TestResources.RepoSignedPackageLeafId, TestResources.RepoSignedPackageLeaf1Version); _message = new SignatureValidationMessage( TestResources.RepoSignedPackageLeafId, TestResources.RepoSignedPackageLeaf1Version, new Uri($"https://unit.test/{TestResources.RepoSignedPackageLeaf1.ToLowerInvariant()}"), Guid.NewGuid()); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Succeeded, PackageSigningStatus.Valid); Assert.Empty(result.Issues); }
public async Task WhenStripsValidRepositorySignature_StripsAndAcceptsRepositorySignatureWhenRepositorySignatureIsNotRequired( string resourceName, string packageId, string packageVersion, PackageSigningStatus expectedSigningStatus) { // Arrange _configuration.StripValidRepositorySignatures = true; _configuration.AllowedRepositorySigningCertificates = new List <string> { TestResources.Leaf1Thumbprint, TestResources.Leaf2Thumbprint }; _packageStream = TestResources.GetResourceStream(resourceName); if (resourceName == TestResources.RepoSignedPackageLeaf1) { TestUtility.RequireUnsignedPackage(_corePackageService, TestResources.RepoSignedPackageLeafId, TestResources.RepoSignedPackageLeaf1Version); } if (resourceName == TestResources.AuthorAndRepoSignedPackageLeaf1) { TestUtility.RequireSignedPackage(_corePackageService, TestResources.AuthorAndRepoSignedPackageLeafId, TestResources.AuthorAndRepoSignedPackageLeaf1Version, TestResources.Leaf1Thumbprint); } _message = new SignatureValidationMessage( packageId, packageVersion, new Uri($"https://unit.test/{resourceName.ToLowerInvariant()}"), Guid.NewGuid(), requireRepositorySignature: false); Stream uploadedStream = null; _packageFileService .Setup(x => x.SaveAsync(It.IsAny <string>(), It.IsAny <string>(), It.IsAny <Guid>(), It.IsAny <Stream>())) .Returns(Task.CompletedTask) .Callback <string, string, Guid, Stream>((_, __, ___, s) => uploadedStream = s); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Succeeded, expectedSigningStatus, _nupkgUri); Assert.Empty(result.Issues); _packageFileService.Verify( x => x.SaveAsync(_message.PackageId, _message.PackageVersion, _message.ValidationId, It.IsAny <Stream>()), Times.Once); _packageFileService.Verify( x => x.GetReadAndDeleteUriAsync(_message.PackageId, _message.PackageVersion, _message.ValidationId), Times.Once); Assert.IsType <FileStream>(uploadedStream); Assert.Throws <ObjectDisposedException>(() => uploadedStream.Length); }
public async Task StripsAndAcceptsPackagesWithRepositorySignatures( string resourceName, string packageId, string packageVersion, PackageSigningStatus signingStatus, bool allowSignedPackage) { // Arrange _packageStream = TestResources.GetResourceStream(resourceName); if (allowSignedPackage) { TestUtility.RequireSignedPackage(_corePackageService, packageId, TestResources.Leaf1Thumbprint); } else { TestUtility.RequireUnsignedPackage(_corePackageService, packageId); } _message = new SignatureValidationMessage( packageId, packageVersion, new Uri($"https://unit.test/{resourceName.ToLowerInvariant()}"), Guid.NewGuid()); Stream uploadedStream = null; _packageFileService .Setup(x => x.SaveAsync(It.IsAny <string>(), It.IsAny <string>(), It.IsAny <Guid>(), It.IsAny <Stream>())) .Returns(Task.CompletedTask) .Callback <string, string, Guid, Stream>((_, __, ___, s) => uploadedStream = s); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Succeeded, signingStatus, _nupkgUri); Assert.Empty(result.Issues); _packageFileService.Verify( x => x.SaveAsync(_message.PackageId, _message.PackageVersion, _message.ValidationId, It.IsAny <Stream>()), Times.Once); _packageFileService.Verify( x => x.GetReadAndDeleteUriAsync(_message.PackageId, _message.PackageVersion, _message.ValidationId), Times.Once); Assert.IsType <FileStream>(uploadedStream); Assert.Throws <ObjectDisposedException>(() => uploadedStream.Length); }
public async Task DoesNotUploadPackageWhenValidationFailed() { // Arrange _packageStream = TestResources.GetResourceStream(TestResources.AuthorAndRepoSignedPackageLeaf1); TestUtility.RequireUnsignedPackage(_corePackageService, _message.PackageId); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Failed, PackageSigningStatus.Invalid); _packageFileService.Verify( x => x.SaveAsync(It.IsAny <string>(), It.IsAny <string>(), It.IsAny <Guid>(), It.IsAny <Stream>()), Times.Never); }
public async Task StripsRepositorySignatures() { // Arrange _message = new SignatureValidationMessage( TestResources.UnsignedPackageId, TestResources.UnsignedPackageVersion, new Uri($"https://unit.test/validation/{TestResources.UnsignedPackage.ToLowerInvariant()}"), Guid.NewGuid()); var packageBytes = await _fixture.GenerateSignedPackageBytesAsync( TestResources.GetResourceStream(TestResources.UnsignedPackage), new RepositorySignPackageRequest( await _fixture.GetSigningCertificateAsync(), NuGetHashAlgorithmName.SHA256, NuGetHashAlgorithmName.SHA256, new Uri("https://example-source/v3/index.json"), new[] { "nuget", "microsoft" }), await _fixture.GetTimestampServiceUrlAsync(), _output); var packageStream = new MemoryStream(packageBytes); TestUtility.RequireUnsignedPackage(_corePackageService, TestResources.UnsignedPackageId); // Act var result = await _target.ValidateAsync( _packageKey, packageStream, _message, _token); // Assert VerifyPackageSigningStatus(result, ValidationStatus.Succeeded, PackageSigningStatus.Unsigned); Assert.Empty(result.Issues); Assert.Equal(_nupkgUri, result.NupkgUri); Assert.NotNull(_savedPackageBytes); using (var savedPackageStream = new MemoryStream(_savedPackageBytes)) using (var packageReader = new SignedPackageArchive(savedPackageStream, Stream.Null)) { Assert.Equal("TestUnsigned", packageReader.NuspecReader.GetId()); Assert.Equal("1.0.0", packageReader.NuspecReader.GetVersion().ToNormalizedString()); Assert.False(await packageReader.IsSignedAsync(CancellationToken.None), "The package should no longer be signed."); } }
public async Task WhenStripsValidRepositorySignature_AcceptsRepositorySignatureWhenRepositorySignatureIsRequired( string resourceName, string packageId, string packageVersion, PackageSigningStatus expectedSigningStatus) { // Arrange _configuration.StripValidRepositorySignatures = true; _configuration.AllowedRepositorySigningCertificates = new List <string> { TestResources.Leaf1Thumbprint, TestResources.Leaf2Thumbprint }; _packageStream = TestResources.GetResourceStream(resourceName); if (resourceName == TestResources.RepoSignedPackageLeaf1) { TestUtility.RequireUnsignedPackage(_corePackageService, TestResources.RepoSignedPackageLeafId, TestResources.RepoSignedPackageLeaf1Version); } if (resourceName == TestResources.AuthorAndRepoSignedPackageLeaf1) { TestUtility.RequireSignedPackage(_corePackageService, TestResources.AuthorAndRepoSignedPackageLeafId, TestResources.AuthorAndRepoSignedPackageLeaf1Version, TestResources.Leaf1Thumbprint); } _message = new SignatureValidationMessage( packageId, packageVersion, new Uri($"https://unit.test/{resourceName.ToLowerInvariant()}"), Guid.NewGuid(), requireRepositorySignature: true); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Succeeded, expectedSigningStatus); Assert.Empty(result.Issues); }
public async Task WhenPackageRequiresUnsignedPackages_AcceptsUnsignedPackages() { // Arrange _packageStream = TestResources.GetResourceStream(TestResources.UnsignedPackage); TestUtility.RequireUnsignedPackage(_corePackageService, TestResources.UnsignedPackageId); _message = new SignatureValidationMessage( TestResources.UnsignedPackageId, TestResources.UnsignedPackageVersion, new Uri($"https://unit.test/{TestResources.UnsignedPackage.ToLowerInvariant()}"), Guid.NewGuid()); // Act var result = await _target.ValidateAsync( _packageKey, _packageStream, _message, _cancellationToken); // Assert Validate(result, ValidationStatus.Succeeded, PackageSigningStatus.Unsigned); Assert.Empty(result.Issues); }