| #!/usr/bin/env python -tt |
| |
| """ |
| unittests.test_security |
| """ |
| |
| try: |
| import unittest2 as unittest |
| except ImportError: |
| import unittest |
| |
| import logging |
| import os |
| # import sys |
| |
| import dbsign.logger as L |
| import dbsign.security as S |
| import dbsign.shell as sh |
| |
| log = L.get_logger(__name__) |
| |
| |
| @unittest.skip("need to mock identity/p12 file") |
| class TestIdentity(unittest.TestCase): |
| def setUp(self): |
| self.keyfile = S.keychain_to_file("debugsign_test") |
| self.password = "12345" |
| self.identity = 'debug_codesign' |
| |
| # store and override loglevel |
| self.init_loglevel = L._root.level |
| L.set_level(logging.CRITICAL) |
| |
| # create test keychain |
| self.assertTrue(S.create_keychain(self.keyfile, self.password)) |
| |
| def tearDown(self): |
| # restore loglevel |
| L.set_level(self.init_loglevel) |
| |
| # force remove test keychain |
| if os.path.exists(self.keyfile): |
| os.remove(self.keyfile) |
| |
| @unittest.skip("need to mock p12 file") |
| def test_import_exists(self): # type: () -> () |
| keydb = self.keyfile |
| passwd = self.password |
| ident = self.identity |
| id_file = None |
| |
| self.assertFalse(S.find_identity(keydb, ident)) |
| self.assertTrue(S.import_identity(keydb, ident, id_file, passwd)) |
| self.assertTrue(S.find_identity(keydb, ident)) |
| |
| @unittest.skip("need to mock p12 file") |
| @unittest.skipUnless(os.getenv(S.UNSAFE_FLAG), "Requires --unsafe") |
| def test_trust(self): # type: () -> () |
| keydb = self.keyfile |
| passwd = self.password |
| ident = self.identity |
| id_file = None |
| |
| self.assertTrue(S.import_identity(keydb, ident, id_file, passwd)) |
| self.assertTrue(S.find_identity(keydb, ident)) |
| self.assertTrue(S.trust_identity(keydb, ident)) |
| |
| @unittest.skip("need to mock a trusted identity") |
| def test_verify(self): # type: () -> () |
| self.fail() |
| |
| @unittest.skip("need to mock a trusted identity") |
| def test_verify_filename(self): # type: () -> () |
| self.fail() |
| |
| @unittest.skip("need to mock p12 file") |
| def test_delete(self): # type: () -> () |
| self.fail() |
| |
| |
| class TestKeychain(unittest.TestCase): |
| def setUp(self): |
| self.keyfile = S.keychain_to_file("debugsign_test") |
| self.password = "12345" |
| self.init_loglevel = L._root.level |
| L.set_level(logging.CRITICAL) |
| |
| def tearDown(self): |
| L.set_level(self.init_loglevel) |
| if os.path.exists(self.keyfile): |
| os.remove(self.keyfile) |
| |
| def test_keychain_to_file(self): |
| ext = S._KEYCHAIN_EXT |
| login_path = os.path.expanduser( |
| os.path.join("~/Library/Keychains", "login." + ext)) |
| self.assertTrue(login_path, S.keychain_to_file('login')) |
| |
| def test_derive_keychain_extension(self): |
| """ |
| Because the tested method is itself guesswork, |
| the test is rather simplistic: |
| - generate expected location of user's login keychain |
| - verify that "$HOME/Library/Keychains/login.${keychain_extension}" |
| exists and is valid |
| """ |
| login_keychain = os.path.expanduser( |
| "~/Library/Keychains/login.{}".format( |
| S.derive_keychain_extension())) |
| self.assertTrue(os.path.exists(login_keychain)) |
| self.assertTrue(os.access(login_keychain, os.R_OK)) |
| |
| def test_keychain_exists(self): |
| """ |
| - assert existing keychain => True |
| - assert non-existent keychain => False |
| """ |
| valid_keychain = S.keychain_to_file("login") |
| with self.subTest(keychain=valid_keychain): |
| self.assertTrue(S.keychain_exists(valid_keychain)) |
| |
| invalid_keychain = S.keychain_to_file("invalid") |
| with self.subTest(keychain=invalid_keychain): |
| self.assertFalse(S.keychain_exists(invalid_keychain)) |
| |
| def test_keychain_operations(self): |
| """ |
| - assert keychain does not exist |
| - create keychain and assert exists |
| - lock keychain |
| - unlock keychain and assert exists |
| """ |
| keyfile = self.keyfile |
| password = self.password |
| |
| # some assorted negatives |
| self.assertFalse(S.create_keychain('/tmp', password)) |
| |
| # assert keychain does not exist |
| self.assertFalse(S.keychain_exists(keyfile)) |
| |
| # create and assert success |
| res_create = S.create_keychain(keyfile, password) |
| self.assertTrue(res_create) |
| self.assertTrue(S.keychain_exists(keyfile)) |
| |
| # assert second creation succeeds |
| self.assertTrue(S.create_keychain(keyfile, password)) |
| |
| # keychain is unlocked at creation; lock it to test unlocking |
| cmd_lock = sh.run(['security', 'lock-keychain', keyfile]) |
| self.assertTrue(cmd_lock) |
| self.assertFalse(S.unlock_keychain(keyfile, '')) |
| self.assertTrue(S.unlock_keychain(keyfile, password)) |
| |
| # ensure keychain settings were set correctly |
| cmd_info = sh.run(['security', 'show-keychain-info', keyfile]) |
| self.assertTrue(cmd_info) |
| self.assertRegexpMatches(cmd_info.stderr, r"\bno-timeout\b", cmd_info) |
| |
| # delete with backup |
| res_delete = S.delete_keychain(keyfile, backup=True) |
| self.assertTrue(res_delete) |
| backup_file = res_delete.value |
| # assert backup was made |
| self.assertTrue(os.path.exists(backup_file)) |
| # assert keychain is gone |
| self.assertFalse(S.keychain_exists(keyfile)) |
| self.assertFalse(os.path.exists(keyfile)) |
| # cleanup backup file |
| os.unlink(backup_file) |
