Skip to content
This repository was archived by the owner on Jul 30, 2024. It is now read-only.

Commit c67227e

Browse files
joelverhagenjoelverhagen
committed
Filter repository signatures from Validate Certificate, Revalidate jobs (#402)
Address NuGet/Engineering#1198
1 parent aad31a4 commit c67227e

7 files changed

Lines changed: 269 additions & 21 deletions

File tree

‎src/NuGet.Services.Validation.Orchestrator/PackageSigning/ValidateCertificate/PackageCertificatesValidator.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,7 @@ private Task<PackageSignature> FindSignatureAsync(IValidationRequest request)
236236
.PackageSignatures
237237
.Include(s => s.EndCertificate)
238238
.Include(s => s.TrustedTimestamps.Select(t => t.EndCertificate))
239+
.Where(s => s.Type == PackageSignatureType.Author)
239240
.SingleAsync(s => s.PackageKey == request.PackageKey);
240241
}
241242

‎src/Validation.PackageSigning.RevalidateCertificate/CertificateRevalidator.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ private async Task<List<PackageSignature>> FindPromotableSignaturesAsync()
7373

7474
var potentialSignatures = await _context.PackageSignatures
7575
.Where(s => s.Status == PackageSignatureStatus.InGracePeriod)
76+
.Where(s => s.Type == PackageSignatureType.Author)
7677
.Include(s => s.EndCertificate)
7778
.Include(s => s.TrustedTimestamps.Select(t => t.EndCertificate))
7879
.OrderBy(s => s.CreatedAt)

‎src/Validation.PackageSigning.ValidateCertificate/CertificateValidationService.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,11 +286,13 @@ private Task<List<PackageSignature>> FindSignaturesAsync(EndCertificate certific
286286
{
287287
case EndCertificateUse.CodeSigning:
288288
packageSignatures = _context.PackageSignatures
289+
.Where(s => s.Type == PackageSignatureType.Author)
289290
.Where(s => s.EndCertificate.Thumbprint == certificate.Thumbprint);
290291
break;
291292

292293
case EndCertificateUse.Timestamping:
293294
packageSignatures = _context.PackageSignatures
295+
.Where(s => s.Type == PackageSignatureType.Author)
294296
.Where(s => s.TrustedTimestamps.Any(t => t.EndCertificate.Thumbprint == certificate.Thumbprint));
295297

296298
break;

‎tests/NuGet.Services.Validation.Orchestrator.Tests/PackageSigning/ValidateCertificate/PackageCertificatesValidatorFacts.cs‎

Lines changed: 112 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,7 @@ public async Task ReturnsExpectedStatusForCertificateValidations(ValidationStatu
160160
PackageKey = PackageKey,
161161
Status = PackageSignatureStatus.Unknown,
162162
EndCertificate = certificate,
163+
Type = PackageSignatureType.Author,
163164
};
164165

165166
certificate.PackageSignatures = new[] { packageSignature };
@@ -271,6 +272,7 @@ public async Task InvalidSignatureFailsValidation(
271272
Status = packageSignatureStatus,
272273
PackageSigningState = packageSigningState,
273274
EndCertificate = certificate,
275+
Type = PackageSignatureType.Author,
274276
};
275277

276278
var timestamp = new TrustedTimestamp
@@ -335,6 +337,7 @@ public static IEnumerable<object[]> ValidSignaturesArePromotedData()
335337
EndCertificate = cert1SecondAgo,
336338
}
337339
},
340+
Type = PackageSignatureType.Author,
338341
},
339342
};
340343

@@ -354,6 +357,7 @@ public static IEnumerable<object[]> ValidSignaturesArePromotedData()
354357
EndCertificate = cert1SecondAgo,
355358
}
356359
},
360+
Type = PackageSignatureType.Author,
357361
},
358362
};
359363

@@ -373,6 +377,7 @@ public static IEnumerable<object[]> ValidSignaturesArePromotedData()
373377
EndCertificate = cert1YearAgo,
374378
}
375379
},
380+
Type = PackageSignatureType.Author,
376381
},
377382
};
378383

@@ -396,6 +401,7 @@ public static IEnumerable<object[]> ValidSignaturesArePromotedData()
396401
EndCertificate = cert1YearAgo,
397402
}
398403
},
404+
Type = PackageSignatureType.Author,
399405
},
400406
};
401407

@@ -415,6 +421,7 @@ public static IEnumerable<object[]> ValidSignaturesArePromotedData()
415421
EndCertificate = cert1SecondAgo,
416422
}
417423
},
424+
Type = PackageSignatureType.Author,
418425
},
419426
};
420427
}
@@ -489,7 +496,8 @@ public async Task ThrowsIfValidSignaturesHasTimestampWithRevokedCertificate()
489496
var signature = new PackageSignature
490497
{
491498
PackageKey = PackageKey,
492-
Status = PackageSignatureStatus.Unknown
499+
Status = PackageSignatureStatus.Unknown,
500+
Type = PackageSignatureType.Author,
493501
};
494502

495503
var timestamp = new TrustedTimestamp
@@ -630,7 +638,8 @@ public async Task ReturnsSucceededIfAllCertificatesAlreadyValidated()
630638
var packageSignature = new PackageSignature
631639
{
632640
PackageKey = PackageKey,
633-
Status = PackageSignatureStatus.Valid
641+
Status = PackageSignatureStatus.Valid,
642+
Type = PackageSignatureType.Author,
634643
};
635644

636645
var timestamp = new TrustedTimestamp
@@ -712,7 +721,8 @@ public async Task ReturnsIncompleteIfThereAreCertificatesToValidate()
712721
var packageSignature = new PackageSignature
713722
{
714723
PackageKey = PackageKey,
715-
Status = PackageSignatureStatus.Valid
724+
Status = PackageSignatureStatus.Valid,
725+
Type = PackageSignatureType.Author,
716726
};
717727

718728
var timestamp = new TrustedTimestamp
@@ -792,7 +802,8 @@ public async Task CertificateRevokedAfterPackageWasSignedDoesntInvalidateSignatu
792802
var packageSignature = new PackageSignature
793803
{
794804
PackageKey = PackageKey,
795-
Status = PackageSignatureStatus.Valid
805+
Status = PackageSignatureStatus.Valid,
806+
Type = PackageSignatureType.Author,
796807
};
797808

798809
var timestamp = new TrustedTimestamp
@@ -875,7 +886,8 @@ public async Task InvalidCertificatesAlwaysInvalidateSignature()
875886
var packageSignature = new PackageSignature
876887
{
877888
PackageKey = PackageKey,
878-
Status = PackageSignatureStatus.Valid
889+
Status = PackageSignatureStatus.Valid,
890+
Type = PackageSignatureType.Author,
879891
};
880892

881893
var timestamp = new TrustedTimestamp
@@ -1051,7 +1063,8 @@ public async Task OnRevalidationAllNonRevokedCertificatesAreVerified(
10511063
var packageSignature = new PackageSignature
10521064
{
10531065
PackageKey = PackageKey,
1054-
Status = PackageSignatureStatus.Valid
1066+
Status = PackageSignatureStatus.Valid,
1067+
Type = PackageSignatureType.Author,
10551068
};
10561069

10571070
var timestamp = new TrustedTimestamp
@@ -1122,6 +1135,7 @@ public async Task RevokedSignaturesAreInvalidated()
11221135
{
11231136
PackageKey = PackageKey,
11241137
Status = PackageSignatureStatus.Valid,
1138+
Type = PackageSignatureType.Author,
11251139
};
11261140

11271141
var timestamp = new TrustedTimestamp
@@ -1167,6 +1181,98 @@ public async Task RevokedSignaturesAreInvalidated()
11671181
Assert.Equal(PackageSigningStatus.Invalid, packageSigningState.SigningStatus);
11681182
}
11691183

1184+
[Theory]
1185+
[InlineData(PackageSignatureType.Repository)]
1186+
[InlineData((PackageSignatureType)0)]
1187+
public async Task NonAuthorSignaturesAreIgnored(PackageSignatureType type)
1188+
{
1189+
// Arrange
1190+
var validatorStatus = new ValidatorStatus
1191+
{
1192+
ValidationId = ValidationId,
1193+
ValidatorName = nameof(PackageCertificatesValidator),
1194+
PackageKey = PackageKey,
1195+
State = ValidationStatus.NotStarted,
1196+
ValidatorIssues = new List<ValidatorIssue>(),
1197+
};
1198+
1199+
var packageSigningState = new PackageSigningState
1200+
{
1201+
PackageKey = PackageKey,
1202+
PackageId = PackageId,
1203+
PackageNormalizedVersion = PackageNormalizedVersion,
1204+
SigningStatus = PackageSigningStatus.Valid,
1205+
};
1206+
1207+
var authorPackageSignature = new PackageSignature
1208+
{
1209+
PackageKey = PackageKey,
1210+
Status = PackageSignatureStatus.Valid,
1211+
Type = PackageSignatureType.Author,
1212+
};
1213+
1214+
var repositoryPackageSignature = new PackageSignature
1215+
{
1216+
PackageKey = PackageKey,
1217+
Status = PackageSignatureStatus.Unknown,
1218+
Type = type,
1219+
};
1220+
1221+
var timestamp = new TrustedTimestamp
1222+
{
1223+
Value = DateTime.UtcNow.AddDays(-10)
1224+
};
1225+
1226+
var signatureCertificate = new EndCertificate
1227+
{
1228+
Key = 123,
1229+
Status = EndCertificateStatus.Good,
1230+
StatusUpdateTime = DateTime.UtcNow.AddSeconds(-10),
1231+
NextStatusUpdateTime = DateTime.UtcNow.AddDays(1),
1232+
LastVerificationTime = DateTime.UtcNow.AddSeconds(-10),
1233+
RevocationTime = null,
1234+
ValidationFailures = 0,
1235+
};
1236+
1237+
var timestampCertificate = new EndCertificate
1238+
{
1239+
Key = 456,
1240+
Status = EndCertificateStatus.Good,
1241+
StatusUpdateTime = DateTime.UtcNow.AddSeconds(-10),
1242+
NextStatusUpdateTime = DateTime.UtcNow.AddDays(1),
1243+
LastVerificationTime = DateTime.UtcNow.AddSeconds(-10),
1244+
RevocationTime = null,
1245+
ValidationFailures = 0,
1246+
};
1247+
1248+
packageSigningState.PackageSignatures = new[] { authorPackageSignature, repositoryPackageSignature };
1249+
authorPackageSignature.PackageSigningState = packageSigningState;
1250+
authorPackageSignature.TrustedTimestamps = new[] { timestamp };
1251+
authorPackageSignature.EndCertificate = signatureCertificate;
1252+
timestamp.EndCertificate = timestampCertificate;
1253+
signatureCertificate.PackageSignatures = new[] { authorPackageSignature };
1254+
timestampCertificate.TrustedTimestamps = new[] { timestamp };
1255+
1256+
_validationContext.Mock(
1257+
validatorStatuses: new[] { validatorStatus },
1258+
packageSigningStates: new[] { packageSigningState },
1259+
packageSignatures: new[] { authorPackageSignature, repositoryPackageSignature },
1260+
trustedTimestamps: new[] { timestamp },
1261+
endCertificates: new[] { signatureCertificate, timestampCertificate });
1262+
1263+
// Act & Assert
1264+
var actual = await _target.StartAsync(_validationRequest.Object);
1265+
1266+
_certificateVerifier.Verify(v => v.EnqueueVerificationAsync(It.IsAny<IValidationRequest>(), It.IsAny<EndCertificate>()), Times.Never);
1267+
_validationContext.Verify(c => c.SaveChangesAsync(), Times.Once);
1268+
_telemetryService.Verify(
1269+
x => x.TrackDurationToStartPackageCertificatesValidator(It.IsAny<TimeSpan>()),
1270+
Times.Never);
1271+
1272+
Assert.Equal(ValidationStatus.Succeeded, actual.Status);
1273+
Assert.Equal(ValidationStatus.Succeeded, validatorStatus.State);
1274+
}
1275+
11701276
public static IEnumerable<object[]> ValidationStatusesThatAreStarted = validationStatusesThatAreStarted.Select(s => new object[] { s });
11711277
}
11721278

‎tests/Validation.PackageSigning.RevalidateCertificate.Tests/CertificateRevalidatorFacts.cs‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,26 @@ public async Task DoesNoPromotionsIfNonePromotable()
5555
Assert.Equal(PackageSignatureStatus.InGracePeriod, signature2.Status);
5656
}
5757

58+
[Theory]
59+
[InlineData(PackageSignatureType.Repository)]
60+
[InlineData((PackageSignatureType)0)]
61+
public async Task DoesNotPromoteNonAuthorSignatures(PackageSignatureType type)
62+
{
63+
// Arrange - make signature nonpromotable due to repository type.
64+
var signature = PromotableSignature;
65+
66+
signature.Type = type;
67+
68+
_context.Mock(packageSignatures: new[] { signature });
69+
70+
// Act & Assert
71+
await _target.PromoteSignaturesAsync();
72+
73+
_context.Verify(c => c.SaveChangesAsync(), Times.Never);
74+
75+
Assert.Equal(PackageSignatureStatus.InGracePeriod, signature.Status);
76+
}
77+
5878
[Fact]
5979
public async Task PromotesSignaturesIfPossible()
6080
{
@@ -371,7 +391,9 @@ public Base()
371391
StatusUpdateTime = DateTime.UtcNow,
372392
}
373393
}
374-
}
394+
},
395+
396+
Type = PackageSignatureType.Author,
375397
};
376398

377399
protected EndCertificate StaleCertificate =>

‎tests/Validation.PackageSigning.ValidateCertificate.Tests/CertificateValidationMessageHandlerIntegrationTests.cs‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,21 @@ public async Task ValidateSigningCertificate(
7272
var packageSigningState2 = new PackageSigningState { SigningStatus = PackageSigningStatus.Valid };
7373
var packageSigningState3 = new PackageSigningState { SigningStatus = PackageSigningStatus.Valid };
7474

75-
var signatureAtIngestion = new PackageSignature { Status = PackageSignatureStatus.Unknown };
76-
var signatureInGracePeriod = new PackageSignature { Status = PackageSignatureStatus.InGracePeriod };
77-
var signatureAfterGracePeriod = new PackageSignature { Status = PackageSignatureStatus.Valid };
75+
var signatureAtIngestion = new PackageSignature
76+
{
77+
Status = PackageSignatureStatus.Unknown,
78+
Type = PackageSignatureType.Author,
79+
};
80+
var signatureInGracePeriod = new PackageSignature
81+
{
82+
Status = PackageSignatureStatus.InGracePeriod,
83+
Type = PackageSignatureType.Author,
84+
};
85+
var signatureAfterGracePeriod = new PackageSignature
86+
{
87+
Status = PackageSignatureStatus.Valid,
88+
Type = PackageSignatureType.Author,
89+
};
7890

7991
var trustedTimestamp1 = new TrustedTimestamp { Status = TrustedTimestampStatus.Valid, Value = signatureTime };
8092
var trustedTimestamp2 = new TrustedTimestamp { Status = TrustedTimestampStatus.Valid, Value = signatureTime };
@@ -212,9 +224,21 @@ public async Task ValidateTimestampingCertificate()
212224

213225
var packageSigningState = new PackageSigningState { SigningStatus = PackageSigningStatus.Valid };
214226

215-
var signatureAtIngestion = new PackageSignature { Status = PackageSignatureStatus.Unknown };
216-
var signatureInGracePeriod = new PackageSignature { Status = PackageSignatureStatus.InGracePeriod };
217-
var signatureAfterGracePeriod = new PackageSignature { Status = PackageSignatureStatus.Valid };
227+
var signatureAtIngestion = new PackageSignature
228+
{
229+
Status = PackageSignatureStatus.Unknown,
230+
Type = PackageSignatureType.Author,
231+
};
232+
var signatureInGracePeriod = new PackageSignature
233+
{
234+
Status = PackageSignatureStatus.InGracePeriod,
235+
Type = PackageSignatureType.Author,
236+
};
237+
var signatureAfterGracePeriod = new PackageSignature
238+
{
239+
Status = PackageSignatureStatus.Valid,
240+
Type = PackageSignatureType.Author,
241+
};
218242

219243
var endCertificate = new EndCertificate
220244
{

0 commit comments

Comments
 (0)