Skip to content
This repository was archived by the owner on Jul 30, 2024. It is now read-only.

Commit 7a58028

Browse files
joelverhagenjoelverhagen
committed
Move to 4.7.0-preview1.5029 of client APIs (#382)
Progress on NuGet/Engineering#1207
1 parent 2ef3298 commit 7a58028

11 files changed

Lines changed: 73 additions & 66 deletions

‎src/Validation.Common.Job/Validation.Common.Job.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171
<Version>1.1.2</Version>
7272
</PackageReference>
7373
<PackageReference Include="NuGet.Packaging">
74-
<Version>4.7.0-preview1-4886</Version>
74+
<Version>4.7.0-preview1.5029</Version>
7575
</PackageReference>
7676
<PackageReference Include="NuGet.Services.Configuration">
7777
<Version>2.19.1</Version>

‎src/Validation.PackageSigning.ProcessSignature/MinimalSignatureVerificationProvider.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ public class MinimalSignatureVerificationProvider : ISignatureVerificationProvid
1616
{
1717
public Task<PackageVerificationResult> GetTrustResultAsync(
1818
ISignedPackageReader package,
19-
Signature signature,
19+
PrimarySignature signature,
2020
SignedPackageVerifierSettings settings,
2121
CancellationToken token)
2222
{

‎src/Validation.PackageSigning.ProcessSignature/PackageSignatureVerifierFactory.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ public static IPackageSignatureVerifier CreateMinimal()
2424
var settings = new SignedPackageVerifierSettings(
2525
allowUnsigned: true,
2626
allowUntrusted: false, // Invalid format of the signature uses this flag to determine success.
27+
allowUntrustedSelfIssuedCertificate: true,
2728
allowIgnoreTimestamp: true,
2829
allowMultipleTimestamps: true,
2930
allowNoTimestamp: true,
@@ -48,6 +49,7 @@ public static IPackageSignatureVerifier CreateFull()
4849
var settings = new SignedPackageVerifierSettings(
4950
allowUnsigned: false,
5051
allowUntrusted: false,
52+
allowUntrustedSelfIssuedCertificate: false,
5153
allowIgnoreTimestamp: false,
5254
allowMultipleTimestamps: false,
5355
allowNoTimestamp: false,

‎src/Validation.PackageSigning.ProcessSignature/SignaturePartsExtractor.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public async Task ExtractAsync(int packageKey, ISignedPackageReader signedPackag
3838
}
3939

4040
// Read the package signature.
41-
var signature = await signedPackageReader.GetSignatureAsync(token);
41+
var signature = await signedPackageReader.GetPrimarySignatureAsync(token);
4242

4343
// Extract the certificates found in the package signatures.
4444
var extractedCertificates = ExtractCertificates(signature);
@@ -53,7 +53,7 @@ public async Task ExtractAsync(int packageKey, ISignedPackageReader signedPackag
5353
await _entitiesContext.SaveChangesAsync();
5454
}
5555

56-
private ExtractedCertificates ExtractCertificates(Signature signature)
56+
private ExtractedCertificates ExtractCertificates(PrimarySignature signature)
5757
{
5858
if (signature.Timestamps.Count != 1)
5959
{
@@ -76,7 +76,7 @@ private ExtractedCertificates ExtractCertificates(Signature signature)
7676
var signatureParentCertificates = hashedSignatureCertificates.Skip(1).ToList();
7777

7878
var timestampCertificates = SignatureUtility
79-
.GetPrimarySignatureTimestampSignatureCertificates(signature);
79+
.GetPrimarySignatureTimestampCertificates(signature);
8080
if (timestampCertificates == null || !timestampCertificates.Any())
8181
{
8282
throw new ArgumentException(

‎src/Validation.PackageSigning.ProcessSignature/SignatureValidator.cs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ private async Task<SignatureValidatorResult> HandleSignedPackageAsync(
102102
}
103103

104104
// We now know we can safely read the signature.
105-
var packageSignature = await signedPackageReader.GetSignatureAsync(cancellationToken);
105+
var packageSignature = await signedPackageReader.GetPrimarySignatureAsync(cancellationToken);
106106

107107
// Block packages with any unknown signing certificates.
108108
var packageThumbprint = packageSignature
@@ -221,7 +221,8 @@ private async Task<SignatureValidatorResult> GetVerifyResult(
221221
{
222222
var verifyResult = await verifier.VerifySignaturesAsync(
223223
signedPackageReader,
224-
cancellationToken);
224+
cancellationToken,
225+
parentId: Guid.Empty); // Pass an empty GUID, since we don't use client telemetry infrastructure.
225226

226227
var errorIssues = verifyResult
227228
.Results

‎tests/Validation.PackageSigning.Core.Tests/Validation.PackageSigning.Core.Tests.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@
7272
<Version>4.4.0</Version>
7373
</PackageReference>
7474
<PackageReference Include="Test.Utility">
75-
<Version>4.7.0-preview1.4948+f399fefacef3d4cc769a1580e812e1045d1d3b3e</Version>
75+
<Version>4.7.0-preview1.5029</Version>
7676
</PackageReference>
7777
<PackageReference Include="xunit">
7878
<Version>2.3.1</Version>

‎tests/Validation.PackageSigning.ProcessSignature.Tests/SignaturePartsExtractorFacts.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public class SignaturePartsExtractorFacts
2727
private const string BouncyCastleCollection = "Collection";
2828

2929
private static readonly DateTime Leaf1TimestampValue = DateTime
30-
.Parse("2018-01-26T22:08:31.0000000Z")
30+
.Parse("2018-01-26T22:09:01.0000000Z")
3131
.ToUniversalTime();
3232

3333
/// <summary>
@@ -510,16 +510,16 @@ public async Task IgnoreExtraCertificates()
510510
using (var package = TestResources.LoadPackage(TestResources.SignedPackageLeaf1))
511511
using (var unrelatedPackage = TestResources.LoadPackage(TestResources.SignedPackageLeaf2))
512512
{
513-
var originalSignature = await package.GetSignatureAsync(_token);
514-
var unrelatedSignature = await unrelatedPackage.GetSignatureAsync(_token);
513+
var originalSignature = await package.GetPrimarySignatureAsync(_token);
514+
var unrelatedSignature = await unrelatedPackage.GetPrimarySignatureAsync(_token);
515515

516516
var signature = AddCertificates(originalSignature.SignedCms, unrelatedSignature.SignedCms);
517517

518518
_packageMock
519519
.Setup(x => x.IsSignedAsync(It.IsAny<CancellationToken>()))
520520
.ReturnsAsync(true);
521521
_packageMock
522-
.Setup(x => x.GetSignatureAsync(It.IsAny<CancellationToken>()))
522+
.Setup(x => x.GetPrimarySignatureAsync(It.IsAny<CancellationToken>()))
523523
.ReturnsAsync(signature);
524524

525525
// Act
@@ -642,7 +642,7 @@ private void VerifySavedCertificates(ExtractedCertificatesThumbprints expected,
642642
}
643643
}
644644

645-
private static Signature AddCertificates(SignedCms destination, SignedCms source)
645+
private static PrimarySignature AddCertificates(SignedCms destination, SignedCms source)
646646
{
647647
using (var readStream = new MemoryStream(destination.Encode()))
648648
using (var writeStream = new MemoryStream())
@@ -665,7 +665,7 @@ private static Signature AddCertificates(SignedCms destination, SignedCms source
665665
attributeCertificateStore,
666666
writeStream);
667667

668-
return Signature.Load(writeStream.ToArray());
668+
return PrimarySignature.Load(writeStream.ToArray());
669669
}
670670
}
671671

‎tests/Validation.PackageSigning.ProcessSignature.Tests/SignatureValidatorFacts.cs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,13 @@ public ValidateAsync()
5757
_mimialVerifyResult = new VerifySignaturesResult(true);
5858
_mimimalPackageSignatureVerifier = new Mock<IPackageSignatureVerifier>();
5959
_mimimalPackageSignatureVerifier
60-
.Setup(x => x.VerifySignaturesAsync(It.IsAny<ISignedPackageReader>(), It.IsAny<CancellationToken>()))
60+
.Setup(x => x.VerifySignaturesAsync(It.IsAny<ISignedPackageReader>(), It.IsAny<CancellationToken>(), It.IsAny<Guid>()))
6161
.ReturnsAsync(() => _mimialVerifyResult);
6262

6363
_fullVerifyResult = new VerifySignaturesResult(true);
6464
_fullPackageSignatureVerifier = new Mock<IPackageSignatureVerifier>();
6565
_fullPackageSignatureVerifier
66-
.Setup(x => x.VerifySignaturesAsync(It.IsAny<ISignedPackageReader>(), It.IsAny<CancellationToken>()))
66+
.Setup(x => x.VerifySignaturesAsync(It.IsAny<ISignedPackageReader>(), It.IsAny<CancellationToken>(), It.IsAny<Guid>()))
6767
.ReturnsAsync(() => _fullVerifyResult);
6868

6969
_signaturePartsExtractor = new Mock<ISignaturePartsExtractor>();
@@ -183,7 +183,7 @@ await ConfigureKnownSignedPackage(
183183
Validate(result, ValidationStatus.Failed, PackageSigningStatus.Invalid);
184184
Assert.Empty(result.Issues);
185185
_fullPackageSignatureVerifier.Verify(
186-
x => x.VerifySignaturesAsync(It.IsAny<ISignedPackageReader>(), It.IsAny<CancellationToken>()),
186+
x => x.VerifySignaturesAsync(It.IsAny<ISignedPackageReader>(), It.IsAny<CancellationToken>(), It.IsAny<Guid>()),
187187
Times.Never);
188188
}
189189

@@ -300,13 +300,13 @@ await ConfigureKnownSignedPackage(
300300
public async Task RejectsSignedPackagesWithUnknownCertificates()
301301
{
302302
// Arrange
303-
var signature = await TestResources.SignedPackageLeaf1Reader.GetSignatureAsync(CancellationToken.None);
303+
var signature = await TestResources.SignedPackageLeaf1Reader.GetPrimarySignatureAsync(CancellationToken.None);
304304

305305
_packageMock
306306
.Setup(x => x.IsSignedAsync(It.IsAny<CancellationToken>()))
307307
.ReturnsAsync(true);
308308
_packageMock
309-
.Setup(x => x.GetSignatureAsync(It.IsAny<CancellationToken>()))
309+
.Setup(x => x.GetPrimarySignatureAsync(It.IsAny<CancellationToken>()))
310310
.ReturnsAsync(signature);
311311
_certificates
312312
.Setup(x => x.GetAll())
@@ -347,13 +347,13 @@ public async Task AcceptsUnsignedPackages()
347347

348348
private async Task ConfigureKnownSignedPackage(ISignedPackageReader package, string thumbprint)
349349
{
350-
var signature = await package.GetSignatureAsync(CancellationToken.None);
350+
var signature = await package.GetPrimarySignatureAsync(CancellationToken.None);
351351

352352
_packageMock
353353
.Setup(x => x.IsSignedAsync(It.IsAny<CancellationToken>()))
354354
.ReturnsAsync(true);
355355
_packageMock
356-
.Setup(x => x.GetSignatureAsync(It.IsAny<CancellationToken>()))
356+
.Setup(x => x.GetPrimarySignatureAsync(It.IsAny<CancellationToken>()))
357357
.ReturnsAsync(signature);
358358
_certificates
359359
.Setup(x => x.GetAll())

‎tests/Validation.PackageSigning.ProcessSignature.Tests/SignatureValidatorIntegrationTests.cs‎

Lines changed: 35 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
using System.Text;
1313
using System.Threading;
1414
using System.Threading.Tasks;
15+
using ICSharpCode.SharpZipLib.Zip;
1516
using Microsoft.Extensions.Logging;
1617
using Moq;
1718
using NuGet.Jobs.Validation.PackageSigning.Messages;
@@ -139,7 +140,7 @@ public async Task RejectsUntrustedSigningCertificate()
139140
VerifyPackageSigningStatus(result, ValidationStatus.Failed, PackageSigningStatus.Invalid);
140141
var issue = Assert.Single(result.Issues);
141142
var clientIssue = Assert.IsType<ClientSigningVerificationFailure>(issue);
142-
Assert.Equal("NU3021", clientIssue.ClientCode);
143+
Assert.Equal("NU3012", clientIssue.ClientCode);
143144
Assert.Equal(
144145
"A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.",
145146
clientIssue.ClientMessage);
@@ -398,7 +399,7 @@ public async Task RejectsInvalidSignedCms()
398399
Assert.Equal(ValidationIssueCode.ClientSigningVerificationFailure, issue.IssueCode);
399400
var typedIssue = Assert.IsType<ClientSigningVerificationFailure>(issue);
400401
Assert.Equal("NU3003", typedIssue.ClientCode);
401-
Assert.Equal("The package signature is invalid.", typedIssue.ClientMessage);
402+
Assert.Equal("The package signature is invalid or cannot be verified on this platform.", typedIssue.ClientMessage);
402403
}
403404

404405
[Fact]
@@ -429,7 +430,7 @@ public async Task RejectsMultipleSignatures()
429430
Assert.Equal(ValidationIssueCode.ClientSigningVerificationFailure, issue.IssueCode);
430431
var typedIssue = Assert.IsType<ClientSigningVerificationFailure>(issue);
431432
Assert.Equal("NU3009", typedIssue.ClientCode);
432-
Assert.Equal("The package signature contains multiple primary signatures.", typedIssue.ClientMessage);
433+
Assert.Equal("The package signature file does not contain exactly one primary signature.", typedIssue.ClientMessage);
433434
}
434435

435436
[Theory]
@@ -649,14 +650,23 @@ private void SetSignatureFileContent(Stream packageStream, byte[] fileContent)
649650
{
650651
try
651652
{
652-
using (var zipArchive = new ZipArchive(packageStream, ZipArchiveMode.Update, leaveOpen: true))
653-
using (var entryStream = zipArchive.GetEntry(".signature.p7s").Open())
653+
using (var zipFile = new ICSharpCode.SharpZipLib.Zip.ZipFile(packageStream))
654654
{
655-
entryStream.Position = 0;
656-
entryStream.SetLength(0);
657-
entryStream.Write(fileContent, 0, fileContent.Length);
655+
zipFile.IsStreamOwner = false;
656+
657+
zipFile.BeginUpdate();
658+
zipFile.Delete(SigningSpecifications.V1.SignaturePath);
659+
zipFile.CommitUpdate();
660+
zipFile.BeginUpdate();
661+
zipFile.Add(
662+
new StreamDataSource(new MemoryStream(fileContent)),
663+
SigningSpecifications.V1.SignaturePath,
664+
CompressionMethod.Stored);
665+
zipFile.CommitUpdate();
658666
}
659667

668+
packageStream.Position = 0;
669+
660670
_package = new SignedPackageArchive(packageStream, packageStream);
661671
}
662672
catch
@@ -666,6 +676,7 @@ private void SetSignatureFileContent(Stream packageStream, byte[] fileContent)
666676
}
667677
}
668678

679+
669680
private void ModifySignatureContent(Stream packageStream, Action<SignedCms> configuredSignedCms = null)
670681
{
671682
SignedCms signedCms;
@@ -674,7 +685,7 @@ private void ModifySignatureContent(Stream packageStream, Action<SignedCms> conf
674685
using (var zipArchive = new ZipArchive(packageStream, ZipArchiveMode.Read, leaveOpen: true))
675686
using (var entryStream = zipArchive.GetEntry(".signature.p7s").Open())
676687
{
677-
var signature = Signature.Load(entryStream);
688+
var signature = PrimarySignature.Load(entryStream);
678689
signedCms = signature.SignedCms;
679690
}
680691
}
@@ -751,5 +762,20 @@ public void Dispose()
751762
{
752763
_package?.Dispose();
753764
}
765+
766+
private class StreamDataSource : IStaticDataSource
767+
{
768+
private readonly Stream _stream;
769+
770+
public StreamDataSource(Stream stream)
771+
{
772+
_stream = stream;
773+
}
774+
775+
public Stream GetSource()
776+
{
777+
return _stream;
778+
}
779+
}
754780
}
755781
}

‎tests/Validation.PackageSigning.ProcessSignature.Tests/Support/CertificateIntegrationTestFixture.cs‎

Lines changed: 12 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -88,41 +88,19 @@ public async Task<byte[]> GenerateSignedPackageBytesAsync(
8888
var timestampProvider = new Rfc3161TimestampProvider(timestampUri);
8989
var signatureProvider = new X509SignatureProvider(timestampProvider);
9090

91-
var unsignedBytes = await OperateOnSignerAsync(
92-
TestResources.GetResourceStream(resourceName),
93-
signatureProvider,
94-
x => x.RemoveSignaturesAsync(testLogger, CancellationToken.None));
95-
96-
var signedBytes = await OperateOnSignerAsync(
97-
new MemoryStream(unsignedBytes),
98-
signatureProvider,
99-
x =>
100-
{
101-
var request = new AuthorSignPackageRequest(certificate, HashAlgorithmName.SHA256);
102-
return x.SignAsync(request, testLogger, CancellationToken.None);
103-
});
104-
105-
return signedBytes;
106-
}
107-
108-
private static async Task<byte[]> OperateOnSignerAsync(
109-
Stream packageReadStream,
110-
X509SignatureProvider signatureProvider,
111-
Func<Signer, Task> executeAsync)
112-
{
113-
using (packageReadStream)
114-
using (var packageWriteStream = new MemoryStream())
91+
using (var outputPackageStream = new MemoryStream())
11592
{
116-
packageReadStream.CopyTo(packageWriteStream);
117-
118-
using (var signedPackage = new SignedPackageArchive(packageReadStream, packageWriteStream))
119-
{
120-
var signer = new Signer(signedPackage, signatureProvider);
121-
122-
await executeAsync(signer);
123-
124-
return packageWriteStream.ToArray();
125-
}
93+
await SigningUtility.SignAsync(
94+
new SigningOptions(
95+
inputPackageStream: new Lazy<Stream>(() => TestResources.GetResourceStream(resourceName)),
96+
outputPackageStream: new Lazy<Stream>(() => outputPackageStream),
97+
overwrite: true,
98+
signatureProvider: signatureProvider,
99+
logger: testLogger),
100+
new AuthorSignPackageRequest(certificate, HashAlgorithmName.SHA256),
101+
CancellationToken.None);
102+
103+
return outputPackageStream.ToArray();
126104
}
127105
}
128106

0 commit comments

Comments
 (0)