diff --git a/cmd/mtc/log/internal/mtcproof/mtcproof.go b/cmd/mtc/log/internal/mtcproof/mtcproof.go index 66ab73426..2b0d8b501 100644 --- a/cmd/mtc/log/internal/mtcproof/mtcproof.go +++ b/cmd/mtc/log/internal/mtcproof/mtcproof.go @@ -19,6 +19,8 @@ import ( "cmp" "crypto/sha256" "crypto/x509" + "encoding/base64" + "encoding/binary" "fmt" "slices" "strings" @@ -58,15 +60,39 @@ type SubtreeSignature struct { // case ml-dsa-44: opaque ml_dsa_44_signature[2420]; // } signature; // } timestamped_signature;" -func NewSubtreeSignatureFromCosig(cosignerID []byte, cosig []byte) (SubtreeSignature, error) { - s := cryptobyte.String(cosig) - var timestamp uint64 - if !s.ReadUint64(×tamp) { - return SubtreeSignature{}, fmt.Errorf("cosignature too short (%d bytes, missing u64 timestamp)", len(cosig)) +func NewSubtreeSignatureFromCosig(cosig []byte) (SubtreeSignature, error) { + l, ok := strings.CutPrefix(string(cosig), "— ") + if !ok { + return SubtreeSignature{}, fmt.Errorf("invalid cosignature format") } + l, ok = strings.CutSuffix(l, "\n") + if !ok { + return SubtreeSignature{}, fmt.Errorf("invalid cosignature format") + } + name, sigB64, ok := strings.Cut(l, " ") + if !ok { + return SubtreeSignature{}, fmt.Errorf("invalid cosignature format") + } + cID, err := ParseCosignerID(name) + if err != nil { + return SubtreeSignature{}, fmt.Errorf("invalid cosigner ID: %v", err) + } + sigRaw, err := base64.StdEncoding.DecodeString(sigB64) + if err != nil { + return SubtreeSignature{}, fmt.Errorf("invalid cosignature base64: %v", err) + } + // Chomp 4 bytes of KeyHash + sigRaw = sigRaw[4:] + // Assert that timestamp is zero, otherwise client will never be able to verify the signature. + if t := binary.BigEndian.Uint64(sigRaw[:8]); t != 0 { + return SubtreeSignature{}, fmt.Errorf("invalid cosignature: timestamp (%d) is not zero", t) + } + // Remove timestamp + sigRaw = sigRaw[8:] + return SubtreeSignature{ - CosignerID: cosignerID, - Signature: s, + CosignerID: cID, + Signature: sigRaw, }, nil } diff --git a/cmd/mtc/log/internal/mtcproof/mtcproof_test.go b/cmd/mtc/log/internal/mtcproof/mtcproof_test.go index 3112095b5..688cfb774 100644 --- a/cmd/mtc/log/internal/mtcproof/mtcproof_test.go +++ b/cmd/mtc/log/internal/mtcproof/mtcproof_test.go @@ -17,8 +17,10 @@ package mtcproof import ( "bytes" "crypto/sha256" + "encoding/base64" "encoding/binary" "errors" + "fmt" "reflect" "strings" "testing" @@ -437,8 +439,21 @@ func TestParseCosignerID(t *testing.T) { } func TestNewSubtreeSignatureFromCosig(t *testing.T) { - cosignerID := []byte{0x2b, 0x06, 0x01, 0x04, 0x01} + partsToSig := func(t *testing.T, name string, hash uint32, timestamp uint64, sig []byte) []byte { + t.Helper() + s := make([]byte, 0, 4+8+len(sig)) + s = binary.BigEndian.AppendUint32(s, hash) + s = binary.BigEndian.AppendUint64(s, timestamp) + s = append(s, sig...) + r := fmt.Appendf(nil, "— %s %s\n", name, base64.StdEncoding.EncodeToString(s)) + t.Logf("sig: %q", string(r)) + return r + } + + cosignerID := []byte{0x01, 0x02, 0x03, 0x04} + cosignerName := "oid/1.3.6.1.4.1.1.2.3.4" rawSig := []byte("raw-signature-bytes") + zeroTimestamp := uint64(0) tests := []struct { name string @@ -447,14 +462,14 @@ func TestNewSubtreeSignatureFromCosig(t *testing.T) { wantErr bool }{ { - name: "valid cosignature with timestamp and signature", - input: append(binary.BigEndian.AppendUint64(nil, 1724867400), rawSig...), + name: "valid cosignature", + input: partsToSig(t, cosignerName, 0, zeroTimestamp, rawSig), want: rawSig, wantErr: false, }, { name: "valid cosignature with timestamp only", - input: binary.BigEndian.AppendUint64(nil, 1724867400), + input: partsToSig(t, cosignerName, 0, zeroTimestamp, []byte{}), want: []byte{}, wantErr: false, }, @@ -472,7 +487,7 @@ func TestNewSubtreeSignatureFromCosig(t *testing.T) { for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - got, err := NewSubtreeSignatureFromCosig(cosignerID, tc.input) + got, err := NewSubtreeSignatureFromCosig(tc.input) if (err != nil) != tc.wantErr { t.Fatalf("NewSubtreeSignatureFromCosig() error = %v, wantErr %v", err, tc.wantErr) } @@ -483,7 +498,7 @@ func TestNewSubtreeSignatureFromCosig(t *testing.T) { t.Errorf("CosignerID = %x, want %x", got.CosignerID, cosignerID) } if !bytes.Equal(got.Signature, tc.want) { - t.Errorf("Signature = %x, want %x", got.Signature, tc.want) + t.Errorf("Signature = %s, want %s", got.Signature, tc.want) } }) } diff --git a/cmd/mtc/log/internal/subtreewitness/gateway.go b/cmd/mtc/log/internal/subtreewitness/gateway.go index 785bb0f33..44c3b56ea 100644 --- a/cmd/mtc/log/internal/subtreewitness/gateway.go +++ b/cmd/mtc/log/internal/subtreewitness/gateway.go @@ -43,9 +43,8 @@ type witnessKey struct { } type witness struct { - client SubtreeWitnessClient - verifier f_note.SubtreeVerifier - cosignerID []byte + client SubtreeWitnessClient + verifier f_note.SubtreeVerifier } // SubtreeWitnessClient defines the interface for calling a witness's sign-subtree endpoint. @@ -85,9 +84,8 @@ func New(httpClient *http.Client, pol policy.TLogPolicy) (*Gateway, error) { slog.WarnContext(context.Background(), "witness verifier does not implement SubtreeVerifier", slog.String("name", w.Name)) continue } - cosignerID, err := mtcproof.ParseCosignerID(sv.Name()) - if err != nil { - return nil, fmt.Errorf("invalid cosigner ID for witness %s: %w", sv.Name(), err) + if _, err := mtcproof.ParseCosignerID(sv.Name()); err != nil { + return nil, fmt.Errorf("invalid cosigner name in subtree verifier %q: %v", sv.Name(), err) } k := witnessKey{name: sv.Name(), keyHash: sv.KeyHash()} if _, exists := witnesses[k]; exists { @@ -95,9 +93,8 @@ func New(httpClient *http.Client, pol policy.TLogPolicy) (*Gateway, error) { } client := wc.NewWitness(w.URL, httpClient) witnesses[k] = witness{ - client: client, - verifier: sv, - cosignerID: cosignerID, + client: client, + verifier: sv, } } @@ -223,7 +220,7 @@ func (gw *Gateway) CosignSubtree(ctx context.Context, origin string, start, end continue } - if !w.verifier.VerifySubtree(0, origin, start, end, subRoot, sigBytes) { + if !w.verifier.VerifySubtree(origin, start, end, subRoot, sigBytes) { slog.ErrorContext(ctx, "Subtree signature verification failed", slog.String("witness", s.Name), slog.Uint64("start", start), @@ -232,7 +229,7 @@ func (gw *Gateway) CosignSubtree(ctx context.Context, origin string, start, end continue } - subSig, err := mtcproof.NewSubtreeSignatureFromCosig(w.cosignerID, sigBytes) + subSig, err := mtcproof.NewSubtreeSignatureFromCosig(sigBytes) if err != nil { slog.ErrorContext(ctx, "Failed to extract raw subtree signature", slog.String("witness", s.Name), diff --git a/cmd/mtc/log/internal/subtreewitness/gateway_test.go b/cmd/mtc/log/internal/subtreewitness/gateway_test.go index 751fefceb..c2f92070b 100644 --- a/cmd/mtc/log/internal/subtreewitness/gateway_test.go +++ b/cmd/mtc/log/internal/subtreewitness/gateway_test.go @@ -42,14 +42,14 @@ func (m *mockSubtreeClient) SignSubtree(ctx context.Context, start, end uint64, // mustSignSubtree signs a subtree and formats the signature as a note-style signature line. func mustSignSubtree(t *testing.T, s f_note.SubtreeSigner, origin string, start, end uint64, root []byte) (rawSig []byte, sigLine []byte) { t.Helper() - noteSig, err := s.SignSubtree(0, origin, start, end, root) + noteSig, err := s.SignSubtree(origin, start, end, root) if err != nil { t.Fatalf("SignSubtree: %v", err) } buf := binary.BigEndian.AppendUint32(nil, s.KeyHash()) buf = append(buf, noteSig...) sigLine = fmt.Appendf(nil, "— %s %s\n", s.Name(), base64.StdEncoding.EncodeToString(buf)) - sigObj, err := mtcproof.NewSubtreeSignatureFromCosig(nil, noteSig) + sigObj, err := mtcproof.NewSubtreeSignatureFromCosig(noteSig) if err != nil { t.Fatalf("NewSubtreeSignatureFromCosig: %v", err) } @@ -202,8 +202,8 @@ func TestGateway_CosignSubtree(t *testing.T) { rawSubSig, subSigLine := mustSignSubtree(t, signer1, origin, start, end, root) - corruptNoteSig, _ := signer1.SignSubtree(0, origin, start, end, root) - corruptNoteSig[len(corruptNoteSig)-1] ^= 0xff + corruptNoteSig, _ := signer1.SignSubtree(origin, start, end, root) + corruptNoteSig[len(corruptNoteSig)-4] ^= 0xff corruptBuf := binary.BigEndian.AppendUint32(nil, signer1.KeyHash()) corruptBuf = append(corruptBuf, corruptNoteSig...) corruptSubSigLine := fmt.Appendf(nil, "— %s %s\n", signer1.Name(), base64.StdEncoding.EncodeToString(corruptBuf)) @@ -239,8 +239,7 @@ func TestGateway_CosignSubtree(t *testing.T) { return subSigLine, nil }, }, - verifier: ver1, - cosignerID: []byte{0x01}, + verifier: ver1, }, }, policy: policy1, @@ -257,8 +256,7 @@ func TestGateway_CosignSubtree(t *testing.T) { return append(bytes.Clone(subSigLine), subSigLine...), nil }, }, - verifier: ver1, - cosignerID: []byte{0x01}, + verifier: ver1, }, }, policy: policy1, @@ -275,8 +273,7 @@ func TestGateway_CosignSubtree(t *testing.T) { return subSigLine, nil }, }, - verifier: ver1, - cosignerID: []byte{0x01}, + verifier: ver1, }, }, policy: policy1, @@ -293,8 +290,7 @@ func TestGateway_CosignSubtree(t *testing.T) { return corruptSubSigLine, nil }, }, - verifier: ver1, - cosignerID: []byte{0x01}, + verifier: ver1, }, }, policy: policy1, @@ -311,8 +307,7 @@ func TestGateway_CosignSubtree(t *testing.T) { return nil, errors.New("witness down") }, }, - verifier: ver1, - cosignerID: []byte{0x01}, + verifier: ver1, }, }, policy: policy1, diff --git a/cmd/mtc/log/mtc.go b/cmd/mtc/log/mtc.go index 2c76f5b8e..40fe0f318 100644 --- a/cmd/mtc/log/mtc.go +++ b/cmd/mtc/log/mtc.go @@ -498,11 +498,11 @@ func (l *MTCLog) getSubtreeSigs(ctx context.Context, start, end uint64, rawCp [] return nil, fmt.Errorf("cannot compute subtree root for [%d, %d): %v", start, end, err) } - selfSig, err := l.subtreeSigner.SignSubtree(0, l.origin, start, end, subRoot) + selfSig, err := l.subtreeSigner.SignSubtree(l.origin, start, end, subRoot) if err != nil { return nil, fmt.Errorf("cannot sign subtree [%d, %d): %v", start, end, err) } - selfSubSig, err := mtcproof.NewSubtreeSignatureFromCosig(l.logCosignerID, selfSig) + selfSubSig, err := mtcproof.NewSubtreeSignatureFromCosig(selfSig) if err != nil { return nil, fmt.Errorf("cannot format self subtree signature: %w", err) } diff --git a/cmd/mtc/log/mtc_test.go b/cmd/mtc/log/mtc_test.go index 6cab026b6..938efafe7 100644 --- a/cmd/mtc/log/mtc_test.go +++ b/cmd/mtc/log/mtc_test.go @@ -902,7 +902,7 @@ func setupTestWitness(t *testing.T) (policy.TLogPolicy, note.SubtreeVerifier) { http.Error(w, fmt.Sprintf("decode subRoot: %v", err), http.StatusBadRequest) return } - rawSig, err := signer.SignSubtree(0, testOrigin, start, end, subRoot) + rawSig, err := signer.SignSubtree(testOrigin, start, end, subRoot) if err != nil { http.Error(w, fmt.Sprintf("sign subtree: %v", err), http.StatusInternalServerError) return @@ -1092,16 +1092,22 @@ func TestMTCLog_AddTBS(t *testing.T) { // SubtreeSignature.Signature contains the raw signature. // SPEC: https://c2sp.org/tlog-cosignature // note.SubtreeVerifier expects a C2SP timestamped_signature prefixed with the 8-byte u64 timestamp. - reconstructCosig := func(rawSig []byte) []byte { - return append(make([]byte, 8), rawSig...) + reconstructCosig := func(v note.SubtreeVerifier, rawSig []byte) []byte { + s := make([]byte, 4+8+len(rawSig)) + binary.BigEndian.PutUint32(s[0:], v.KeyHash()) + binary.BigEndian.PutUint64(s[4:], 0) + copy(s[12:], rawSig) + r := fmt.Appendf(nil, "— %s %s\n", v.Name(), base64.StdEncoding.EncodeToString(s)) + t.Logf("reconstructed sig: %s", r) + return r } - if !mtcLog.subtreeSigner.Verifier().VerifySubtree(0, mtcLog.origin, tc.wantStart, tc.wantEnd, subRoot, reconstructCosig(proofData.Signatures[0].Signature)) { + if !mtcLog.subtreeSigner.Verifier().VerifySubtree(mtcLog.origin, tc.wantStart, tc.wantEnd, subRoot, reconstructCosig(mtcLog.subtreeSigner.Verifier(), proofData.Signatures[0].Signature)) { t.Errorf("VerifySubtree failed for log signature on entry%d", tc.entryIdx) } if !bytes.Equal(proofData.Signatures[0].CosignerID, mtcLog.logCosignerID) { t.Errorf("CosignerID = %x, want %x", proofData.Signatures[0].CosignerID, mtcLog.logCosignerID) } - if !witVerifier.VerifySubtree(0, mtcLog.origin, tc.wantStart, tc.wantEnd, subRoot, reconstructCosig(proofData.Signatures[1].Signature)) { + if !witVerifier.VerifySubtree(mtcLog.origin, tc.wantStart, tc.wantEnd, subRoot, reconstructCosig(witVerifier, proofData.Signatures[1].Signature)) { t.Errorf("VerifySubtree failed for witness signature on entry%d", tc.entryIdx) } }) diff --git a/go.mod b/go.mod index ff43fa593..b541972ff 100644 --- a/go.mod +++ b/go.mod @@ -25,9 +25,9 @@ require ( github.com/hashicorp/golang-lru/v2 v2.0.7 github.com/muesli/termenv v0.16.0 github.com/rivo/tview v0.42.0 - github.com/transparency-dev/formats v0.1.2-0.20260805102052-38e6e69c4152 + github.com/transparency-dev/formats v0.1.2-0.20260916152522-091ce41666c0 github.com/transparency-dev/merkle v0.0.3-0.20260727102338-4491f478b7dc - github.com/transparency-dev/witness v0.0.0-20260814155820-ed55fd2d54a0 + github.com/transparency-dev/witness v0.0.0-20260917140356-67c4b6b76572 go.opentelemetry.io/contrib/detectors/aws/ec2/v2 v2.5.3 go.opentelemetry.io/contrib/detectors/aws/ecs v1.46.0 go.opentelemetry.io/contrib/detectors/gcp v1.46.0 @@ -93,7 +93,7 @@ require ( modernc.org/libc v1.74.4 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.11.0 // indirect - modernc.org/sqlite v1.56.0 // indirect + modernc.org/sqlite v1.57.0 // indirect mvdan.cc/sh/v3 v3.7.0 // indirect ) @@ -127,13 +127,13 @@ require ( go.opentelemetry.io/otel v1.46.0 go.opentelemetry.io/otel/metric v1.46.0 go.opentelemetry.io/otel/trace v1.46.0 - golang.org/x/crypto v0.56.0 + golang.org/x/crypto v0.57.0 golang.org/x/net v0.58.0 golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.23.0 - golang.org/x/sys v0.47.0 // indirect - golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.41.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/term v0.46.0 // indirect + golang.org/x/text v0.42.0 // indirect golang.org/x/time v0.16.0 google.golang.org/genproto v0.0.0-20260715232425-e75dac1f907d // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect diff --git a/go.sum b/go.sum index 3e7244b82..ef65b6318 100644 --- a/go.sum +++ b/go.sum @@ -242,12 +242,12 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= -github.com/transparency-dev/formats v0.1.2-0.20260805102052-38e6e69c4152 h1:jFazCl2KpcnLhYTmWtk8gXL9eB2ppVUg5b6keOzbMiM= -github.com/transparency-dev/formats v0.1.2-0.20260805102052-38e6e69c4152/go.mod h1:P0kg1ftMVew4S2XrFP+u+CZsF50yFGSstDFBKgA6XYk= +github.com/transparency-dev/formats v0.1.2-0.20260916152522-091ce41666c0 h1:4DbKePWYXXMREYF/A9dcBEOTvZ2E4NHzh866NnbdSqM= +github.com/transparency-dev/formats v0.1.2-0.20260916152522-091ce41666c0/go.mod h1:94kWdZfyStngLTYo2R0k1zM+n7FXldAkih6W04vyTnc= github.com/transparency-dev/merkle v0.0.3-0.20260727102338-4491f478b7dc h1:DaUOzC/KJOVtUqxKoFiEAQhoRu+TV8GaMKXQg94zRqs= github.com/transparency-dev/merkle v0.0.3-0.20260727102338-4491f478b7dc/go.mod h1:E+iHk6bS+tIgIJGD4TMeAjSjhQ9wPfL/ST4pXyITjdU= -github.com/transparency-dev/witness v0.0.0-20260814155820-ed55fd2d54a0 h1:DshcPJELtOa5NjPUsUwnzLsMTvFPu5VbgYBHL/LOKck= -github.com/transparency-dev/witness v0.0.0-20260814155820-ed55fd2d54a0/go.mod h1:gJ5Vu6rZhFNEjQ7xTuMHSewS0M/VpxRMlFFXzc0hz7U= +github.com/transparency-dev/witness v0.0.0-20260917140356-67c4b6b76572 h1:OJla2bPwBEF97s6ekbpn+JXVIAmWa1huYk3YzUegbog= +github.com/transparency-dev/witness v0.0.0-20260917140356-67c4b6b76572/go.mod h1:/jLSvnpaCUkqTIvWOS+TkbOZ830HxQr1jVhX1xiowGQ= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= @@ -296,8 +296,8 @@ go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= -golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw= golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ= @@ -340,20 +340,20 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -430,8 +430,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg= modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns= modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w= modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE= -modernc.org/sqlite v1.56.0 h1:/D8e2RfFqoy/Zc6PuC76U28zFwmI/sYx1Kjm4yEn9e0= -modernc.org/sqlite v1.56.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ= +modernc.org/sqlite v1.57.0 h1:qNQP6xnx5M0ISNtlnxoOX0+cD5bJ0/gr9aMmndFczzg= +modernc.org/sqlite v1.57.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ= modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= diff --git a/mirror_lifecycle_test.go b/mirror_lifecycle_test.go index 0dd2c6b8a..874724c22 100644 --- a/mirror_lifecycle_test.go +++ b/mirror_lifecycle_test.go @@ -1007,21 +1007,8 @@ func TestMirrorTarget_SignSubtree(t *testing.T) { if len(got) == 0 { t.Fatalf("got empty cosig, want non-empty") } - sigLine := strings.TrimSpace(string(got)) - parts := strings.Split(sigLine, " ") - if len(parts) != 3 || parts[0] != "—" { - t.Fatalf("unexpected cosig format: %q", sigLine) - } - sigWithHash, err := base64.StdEncoding.DecodeString(parts[2]) - if err != nil { - t.Fatalf("failed to decode sig base64: %v", err) - } - if len(sigWithHash) < 4 { - t.Fatalf("sig too short: %d bytes", len(sigWithHash)) - } - sig := sigWithHash[4:] - if !testMirrorVerifier.VerifySubtree(0, testPendingCPOrigin, test.start, test.end, test.subRoot, sig) { - t.Errorf("VerifySubtree failed for generated cosignature") + if !testMirrorVerifier.VerifySubtree(testPendingCPOrigin, test.start, test.end, test.subRoot, got) { + t.Errorf("VerifySubtree failed for generated cosignature(got %q)", got) } } else { if len(got) != 0 {