commit 81795edb66fa13510d9d008927381a5b88d1bde6
parent ecf462e61c1a5bcaf8475b43764c37399ccea08d
Author: mauricefisher64 <92736594+mauricefisher64@users.noreply.github.com>
Date: Wed, 15 Jun 2022 15:01:35 -0400
Adjust temp signer reserved sizes to account for large timestamps (#45)
* Fix bug in verify_from_buffer
* make_test fixes
adjust signature box reserved size to account for large timestamps
* change tsa to tsa_url
* Fix make images in makefile
* remove debug printlns
Co-authored-by: Gavin Peacock <gpeacock@adobe.com>
Diffstat:
7 files changed, 15 insertions(+), 21 deletions(-)
diff --git a/Makefile b/Makefile
@@ -39,7 +39,7 @@ doc:
# Builds a set of test images using the make_test_images example
# Outputs to release/test-images
images:
- cargo run --release --example make_test_images
+ cargo run --release --bin make_test_images
# Runs the client example using test image and output to target/tmp/client.jpg
client:
diff --git a/make_test_images/src/make_test_images.rs b/make_test_images/src/make_test_images.rs
@@ -39,8 +39,10 @@ fn fixture_path(file_name: &str) -> PathBuf {
path.push(file_name);
path
}
+
/// Defines an operation for creating a test image
#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
pub struct Recipe {
/// The operation to perform:
///
@@ -62,12 +64,12 @@ pub struct Recipe {
/// Configuration
#[derive(Debug, Deserialize)]
-#[serde(default)]
+#[serde(default, deny_unknown_fields)]
pub struct Config {
/// The signing algorithm to use
pub alg: String,
- /// A url to a time authority if desired
- pub ta: Option<String>,
+ /// A url to a time stamp authority if desired
+ pub tsa_url: Option<String>,
/// The output folder for the generated files
pub output_path: String,
/// Extension to add to filenames if none was given
@@ -83,7 +85,7 @@ impl Default for Config {
fn default() -> Self {
Self {
alg: "ps256".to_owned(),
- ta: None,
+ tsa_url: None,
output_path: "target/images".to_owned(),
default_ext: "jpg".to_owned(),
author: None,
@@ -264,9 +266,9 @@ impl MakeTestImages {
manifest.add_assertion(&actions)?; // extra get required here, since actions is an array
// now create store; sign claim and embed in target
- let cert_dir: PathBuf = fixture_path("certs");
+ let certs_dir = fixture_path("certs");
let (signer, _) =
- get_temp_signer_by_alg(&cert_dir, &self.config.alg, self.config.ta.clone());
+ get_temp_signer_by_alg(&certs_dir, &self.config.alg, self.config.tsa_url.clone());
manifest.embed(&dst_path, &dst_path, signer.as_ref())?;
@@ -382,7 +384,7 @@ pub mod tests {
use super::*;
const TESTS: &str = r#"{
"alg": "ps256",
- "tsa": "http://timestamp.digicert.com",
+ "tsa_url": "http://timestamp.digicert.com",
"output_path": "../target/tmp",
"default_ext": "jpg",
"author": "Gavin Peacock",
diff --git a/make_test_images/tests.json b/make_test_images/tests.json
@@ -1,6 +1,6 @@
{
"alg": "ps256",
- "tsa": "http://timestamp.digicert.com",
+ "tsa_url": "http://timestamp.digicert.com",
"output_path": "target/images",
"default_ext": "jpg",
"author": "Gavin Peacock",
@@ -24,7 +24,7 @@
{ "op": "sig", "parent": "CA", "output": "E-sig-CA" },
{ "op": "uri", "parent": "CA", "output": "E-uri-CA" },
{ "op": "clm", "parent": "CAICAI", "output": "E-clm-CAICAI" },
- { "op": "make", "ingredient": ["E-sig-CA"], "output": "CIE-sig-CA" },
+ { "op": "make", "ingredients": ["E-sig-CA"], "output": "CIE-sig-CA" },
{ "op": "uri", "parent": "CIE-sig-CA", "output": "E-uri-CIE-sig-CA" },
{ "op": "make", "parent": "A.jpg", "ingredients": ["C", "A.jpg", "I.jpg", "CA", "CI", "CAI", "CICA"], "output": "CAIAIIICAICIICAIICICA" }
]
diff --git a/sdk/src/openssl/ec_signer.rs b/sdk/src/openssl/ec_signer.rs
@@ -75,7 +75,7 @@ impl ConfigurableSigner for EcSigner {
signcerts,
pkey,
certs_size,
- timestamp_size: 4096, // todo: call out to TSA to get actual timestamp and use that size
+ timestamp_size: 10000, // todo: call out to TSA to get actual timestamp and use that size
alg,
tsa_url,
})
diff --git a/sdk/src/openssl/ed_signer.rs b/sdk/src/openssl/ed_signer.rs
@@ -73,7 +73,7 @@ impl ConfigurableSigner for EdSigner {
signcerts,
pkey,
certs_size,
- timestamp_size: 4096, // todo: call out to TSA to get actual timestamp and use that size
+ timestamp_size: 10000, // todo: call out to TSA to get actual timestamp and use that size
alg: "ed25519".to_string(),
tsa_url,
})
diff --git a/sdk/src/openssl/rsa_signer.rs b/sdk/src/openssl/rsa_signer.rs
@@ -99,7 +99,7 @@ impl ConfigurableSigner for RsaSigner {
signcerts,
pkey,
certs_size: signcert.len(),
- timestamp_size: 4096, // todo: call out to TSA to get actual timestamp and use that size
+ timestamp_size: 10000, // todo: call out to TSA to get actual timestamp and use that size
ocsp_size: Cell::new(0),
alg,
tsa_url,
diff --git a/sdk/src/openssl/temp_signer.rs b/sdk/src/openssl/temp_signer.rs
@@ -189,8 +189,6 @@ pub fn get_rsa_signer<P: AsRef<Path>>(
}
}
- println!("path: {}", path.as_ref().display());
-
let mut sign_cert_path = path.as_ref().to_path_buf();
sign_cert_path.push(alg);
sign_cert_path.set_extension("pub");
@@ -207,12 +205,6 @@ pub fn get_rsa_signer<P: AsRef<Path>>(
);
}
- println!(
- "path: {}, {}",
- sign_cert_path.display(),
- pem_key_path.display()
- );
-
(
RsaSigner::from_files(&sign_cert_path, &pem_key_path, alg.to_string(), tsa_url).unwrap(),
sign_cert_path,
