86 lines
2.8 KiB
Bash
Executable File
86 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
SIGNING_ENV="$ROOT_DIR/scripts/macos/signing-env.sh"
|
|
TMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
mkdir -p "$TMP_DIR/bin"
|
|
printf '%s\n%s\n' \
|
|
'untrusted comment: minisign encrypted secret key' \
|
|
'mock-key-material' > "$TMP_DIR/private.key"
|
|
|
|
cat > "$TMP_DIR/bin/security" <<'EOF'
|
|
#!/usr/bin/env sh
|
|
if [ -n "${MOCK_KEYCHAIN_PASSWORD:-}" ]; then
|
|
printf '%s\n' "$MOCK_KEYCHAIN_PASSWORD"
|
|
exit 0
|
|
fi
|
|
exit 44
|
|
EOF
|
|
chmod +x "$TMP_DIR/bin/security"
|
|
|
|
source_script() {
|
|
env -u TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
|
|
PATH="$TMP_DIR/bin:$PATH" \
|
|
TTREE_UPDATER_KEY_PATH="$TMP_DIR/private.key" \
|
|
MOCK_KEYCHAIN_PASSWORD="${MOCK_KEYCHAIN_PASSWORD:-}" \
|
|
sh -c '. "$1"' _ "$SIGNING_ENV"
|
|
}
|
|
|
|
expect_failure() {
|
|
local description="$1"
|
|
shift
|
|
if "$@" >/dev/null 2>&1; then
|
|
echo "expected failure: $description" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
expect_no_key_export_after_failure() {
|
|
env -u TAURI_SIGNING_PRIVATE_KEY \
|
|
-u TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
|
|
PATH="$TMP_DIR/bin:$PATH" \
|
|
TTREE_UPDATER_KEY_PATH="$TMP_DIR/private.key" \
|
|
MOCK_KEYCHAIN_PASSWORD="" \
|
|
sh -c '. "$1" >/dev/null 2>&1 || true; [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ]' \
|
|
_ "$SIGNING_ENV"
|
|
}
|
|
|
|
expect_stale_exports_cleared_after_failure() {
|
|
TAURI_SIGNING_PRIVATE_KEY="stale-key" \
|
|
TAURI_SIGNING_PRIVATE_KEY_PATH="/tmp/stale-key" \
|
|
TAURI_SIGNING_PRIVATE_KEY_PASSWORD="" \
|
|
PATH="$TMP_DIR/bin:$PATH" \
|
|
TTREE_UPDATER_KEY_PATH="$TMP_DIR/private.key" \
|
|
MOCK_KEYCHAIN_PASSWORD="" \
|
|
sh -c '. "$1" >/dev/null 2>&1 || true; [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ] && [ -z "${TAURI_SIGNING_PRIVATE_KEY_PATH:-}" ] && [ -z "${TAURI_SIGNING_PRIVATE_KEY_PASSWORD:-}" ]' \
|
|
_ "$SIGNING_ENV"
|
|
}
|
|
|
|
MOCK_KEYCHAIN_PASSWORD="" expect_failure "missing updater passphrase" source_script
|
|
expect_no_key_export_after_failure
|
|
expect_stale_exports_cleared_after_failure
|
|
MOCK_KEYCHAIN_PASSWORD="too-short" expect_failure "weak updater passphrase" source_script
|
|
MOCK_KEYCHAIN_PASSWORD="Updater-Key-Password-2026!" source_script >/dev/null
|
|
|
|
printf '%s\n' 'untrusted comment: minisign secret key' > "$TMP_DIR/private.key"
|
|
MOCK_KEYCHAIN_PASSWORD="Updater-Key-Password-2026!" \
|
|
expect_failure "unencrypted updater key" source_script
|
|
|
|
RSIGN_KEY="$(printf '%s\n%s\n' \
|
|
'untrusted comment: rsign encrypted secret key' \
|
|
'mock-key-material' | openssl base64 -A)"
|
|
printf '%s' "$RSIGN_KEY" > "$TMP_DIR/private.key"
|
|
env -u TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
|
|
PATH="$TMP_DIR/bin:$PATH" \
|
|
TTREE_UPDATER_KEY_PATH="$TMP_DIR/private.key" \
|
|
MOCK_KEYCHAIN_PASSWORD="Updater-Key-Password-2026!" \
|
|
EXPECTED_KEY="$RSIGN_KEY" \
|
|
sh -c '. "$1" >/dev/null; [ "$TAURI_SIGNING_PRIVATE_KEY" = "$EXPECTED_KEY" ]' \
|
|
_ "$SIGNING_ENV"
|
|
|
|
echo "signing-env tests passed"
|