Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
project = developer_tool.create_new_project(project_name, metadata_directory)
self.assertTrue(isinstance(project, developer_tool.Project))
self.assertTrue(project.layout_type == 'repo-like')
self.assertTrue(project.prefix == '')
self.assertTrue(project.project_name == project_name)
self.assertTrue(project.metadata_directory ==
os.path.join(metadata_directory,METADATA_DIRECTORY_NAME))
self.assertTrue(project.targets_directory ==
os.path.join(metadata_directory,TARGETS_DIRECTORY_NAME))
# Create a blank project without a valid metadata directory.
self.assertRaises(securesystemslib.exceptions.FormatError, developer_tool.create_new_project,
0, metadata_directory, location_in_repository)
self.assertRaises(securesystemslib.exceptions.FormatError, developer_tool.create_new_project,
project_name, 0, location_in_repository)
self.assertRaises(securesystemslib.exceptions.FormatError, developer_tool.create_new_project,
project_name, metadata_directory, 0)
# Create a new project with a flat layout.
targets_directory = tempfile.mkdtemp(dir = local_tmp)
metadata_directory = tempfile.mkdtemp(dir = local_tmp)
project = developer_tool.create_new_project(project_name, metadata_directory,
location_in_repository, targets_directory)
self.assertTrue(isinstance(project, developer_tool.Project))
self.assertTrue(project.layout_type == 'flat')
self.assertTrue(project.prefix == location_in_repository)
self.assertTrue(project.project_name == project_name)
self.assertTrue(project.metadata_directory == metadata_directory)
self.assertTrue(project.targets_directory == targets_directory)
# Finally, check that if targets_directory is set, it is valid.
def test_wrong_expected_materials(self):
"""Test that the material rule validators catch malformed ones."""
item = SupplyChainItem()
with self.assertRaises(securesystemslib.exceptions.FormatError):
item.expected_materials = [["NONFOO"]]
item._validate_expected_materials()
with self.assertRaises(securesystemslib.exceptions.FormatError):
item.validate()
with self.assertRaises(securesystemslib.exceptions.FormatError):
item.expected_materials = "PFF"
item._validate_expected_materials()
with self.assertRaises(securesystemslib.exceptions.FormatError):
item.validate()
# for more thorough tests, check the test_rulelib.py module
item.expected_materials = [["CREATE", "foo"]]
item._validate_expected_materials()
item.validate()
def check_match(self, object):
if self._string != object:
message = 'Expected: '+repr(self._string)
raise securesystemslib.exceptions.FormatError(message)
# Is 'scheme' properly formatted?
securesystemslib.formats.RSA_SCHEME_SCHEMA.check_match(scheme)
# Read the contents of the key file that should be in PEM format and contains
# the public portion of the RSA key.
with open(filepath, 'rb') as file_object:
rsa_pubkey_pem = file_object.read().decode('utf-8')
# Convert 'rsa_pubkey_pem' to 'securesystemslib.formats.RSAKEY_SCHEMA' format.
try:
rsakey_dict = securesystemslib.keys.import_rsakey_from_public_pem(
rsa_pubkey_pem, scheme)
except securesystemslib.exceptions.FormatError as e:
raise securesystemslib.exceptions.Error('Cannot import improperly formatted'
' PEM file.' + repr(str(e)))
return rsakey_dict
private = private_key
signature = None
# An if-clause is not strictly needed here, since 'ed25519' is the only
# currently supported scheme. Nevertheless, include the conditional
# statement to accommodate schemes that might be added in the future.
if scheme == 'ed25519':
try:
nacl_key = nacl.signing.SigningKey(private)
nacl_sig = nacl_key.sign(data)
signature = nacl_sig.signature
# The unit tests expect required libraries to be installed.
except NameError: # pragma: no cover
raise securesystemslib.exceptions.UnsupportedLibraryError('The PyNaCl'
' library and/or its dependencies unavailable.')
except (ValueError, TypeError, nacl.exceptions.CryptoError) as e:
raise securesystemslib.exceptions.CryptoError('An "ed25519" signature'
' could not be created with PyNaCl.' + str(e))
# This is a defensive check for a valid 'scheme', which should have already
# been validated in the check_match() above.
else: #pragma: no cover
raise securesystemslib.exceptions.UnsupportedAlgorithmError('Unsupported'
' signature scheme is specified: ' + repr(scheme))
return signature, scheme
def _validate_run(self):
"""Private method to check that the expected command is correct."""
if type(self.run) != list:
raise securesystemslib.exceptions.FormatError(
"The run field is malformed!")
securesystemslib.exceptions.FormatError, if 'repository_name' is improperly formatted.
securesystemslib.exceptions.InvalidNameError, if 'repository_name' already exists.
None.
None.
"""
# Is 'repository_name' properly formatted? Raise 'securesystemslib.exceptions.FormatError' if not.
securesystemslib.formats.NAME_SCHEMA.check_match(repository_name)
if repository_name in _keydb_dict:
raise securesystemslib.exceptions.InvalidNameError('Repository name already exists:'
' ' + repr(repository_name))
_keydb_dict[repository_name] = {}
def _validate_signed(self):
"""Private method to check if the 'signed' attribute contains a valid
Layout or Link object. """
if not (isinstance(self.signed, Layout) or isinstance(self.signed, Link)):
raise securesystemslib.exceptions.FormatError("The Metblock's 'signed'"
" property has has to be of type 'Link' or 'Layout'.")
# If the signed object is a Link or Layout object validate it.
self.signed.validate()
securesystemslib.formats.GPG_SIGNATURE_SCHEMA,
pubkey_info does not match securesystemslib.formats.GPG_RSA_PUBKEY_SCHEMA
securesystemslib.exceptions.UnsupportedLibraryError if:
the cryptography module is unavailable
ValueError:
if the passed hash_algorithm_id is not supported (see
securesystemslib.gpg.util.get_hashing_class)
True if signature verification passes and False otherwise
"""
if not CRYPTO: # pragma: no cover
raise securesystemslib.exceptions.UnsupportedLibraryError(NO_CRYPTO_MSG)
securesystemslib.formats.GPG_SIGNATURE_SCHEMA.check_match(signature_object)
securesystemslib.formats.GPG_RSA_PUBKEY_SCHEMA.check_match(pubkey_info)
hasher = securesystemslib.gpg.util.get_hashing_class(hash_algorithm_id)
pubkey_object = create_pubkey(pubkey_info)
# zero-pad the signature due to a discrepancy between the openssl backend
# and the gnupg interpretation of PKCSv1.5. Read more at:
# https://github.com/in-toto/in-toto/issues/171#issuecomment-440039256
# we are skipping this if on the tests because well, how would one test this
# deterministically.
pubkey_length = len(pubkey_info['keyval']['public']['n'])
signature_length = len(signature_object['signature'])
if pubkey_length != signature_length: # pragma: no cover