44 lines
1.1 KiB
Go
44 lines
1.1 KiB
Go
package credentiallease
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
)
|
|
|
|
func TestLoadPrivateKeyFile(t *testing.T) {
|
|
want := bytes.Repeat([]byte{0x5a}, 32)
|
|
path := filepath.Join(t.TempDir(), "recipient.key")
|
|
if err := os.WriteFile(path, []byte(base64.StdEncoding.EncodeToString(want)), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
secureTestKeyFile(t, path)
|
|
|
|
got, err := LoadPrivateKeyFile(path, len(want))
|
|
if err != nil {
|
|
t.Fatalf("LoadPrivateKeyFile() error = %v", err)
|
|
}
|
|
if !bytes.Equal(got, want) {
|
|
t.Fatal("LoadPrivateKeyFile() returned unexpected key material")
|
|
}
|
|
}
|
|
|
|
func TestLoadPrivateKeyFileRejectsInsecureUnixMode(t *testing.T) {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skip("Windows private-key access is validated from the file DACL")
|
|
}
|
|
path := filepath.Join(t.TempDir(), "recipient.key")
|
|
encoded := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x5a}, 32))
|
|
if err := os.WriteFile(path, []byte(encoded), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
_, err := LoadPrivateKeyFile(path, 32)
|
|
if !errors.Is(err, ErrKey) {
|
|
t.Fatalf("LoadPrivateKeyFile() error = %v, want ErrKey", err)
|
|
}
|
|
}
|