jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-28 04:51:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(push): generate enrollment leaf certificates at test time

Browse Source 
Signed-off-by: Tom Brow <tomb@block.xyz>
This commit is contained in:
Tom Brow
2026-10-14 13:00:16 -07:00
parent 5bafc24334
commit d84b552a70
4 changed files with 29 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
crates/buzz-push-gateway/src/app_attest.rs
View File

@@ -198,14 +198,32 @@ mod tests {
app_id: String,
challenge: String,
aaguid: String,
#[serde(skip)]
attestation_b64: String,
#[serde(skip)]
key_id_b64: String,
root_cert_pem: String,
}
fn fixture(json: &str) -> Fixture {
let fixture: Fixture = serde_json::from_str(json).expect("valid App Attest fixture JSON");
let mut fixture: Fixture =
serde_json::from_str(json).expect("valid App Attest fixture JSON");
assert!(!fixture.description.is_empty());
// Sign a fresh leaf at test time instead of checking in a certificate
// whose one-year validity will eventually break positive tests.
let generated = super::testing::build_test_attestation_with_auth_data(
&fixture.challenge,
&fixture.app_id,
|auth| {
if fixture.aaguid == "appattestdevelop" {
auth[37..53].copy_from_slice(b"appattestdevelop");
} else {
assert_eq!(fixture.aaguid, "appattest");
}
},
);
fixture.attestation_b64 = STANDARD.encode(generated.cbor);
fixture.key_id_b64 = generated.key_id;
fixture
}
@@ -267,18 +285,18 @@ mod tests {
let good = fixture(GOOD_FIXTURE_JSON);
let wrong_root = fixture(WRONG_ROOT_FIXTURE_JSON);
assert!(verify_proof(
&wrong_root,
&wrong_root.app_id,
&wrong_root.challenge,
&wrong_root.key_id_b64,
good.root_cert_pem.as_bytes(),
&good,
&good.app_id,
&good.challenge,
&good.key_id_b64,
wrong_root.root_cert_pem.as_bytes(),
)
.is_err());
assert!(verifier(&wrong_root.app_id, good.root_cert_pem.as_bytes())
assert!(verifier(&good.app_id, wrong_root.root_cert_pem.as_bytes())
.verify_attestation(
&wrong_root.attestation_b64,
&wrong_root.key_id_b64,
wrong_root.challenge.as_bytes(),
&good.attestation_b64,
&good.key_id_b64,
good.challenge.as_bytes()
)
.is_err());
}

2
crates/buzz-push-gateway/tests/fixtures/app-attest-good.json vendored
View File

@@ -3,7 +3,5 @@
"app_id": "TEAMID.xyz.buzz.test",
"challenge": "fixture-enrollment-challenge",
"aaguid": "appattest",
"attestation_b64": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZAhAwggIMMIIBs6ADAgECAgh1EiZfFnrRWjAKBggqhkjOPQQDAjBIMSIwIAYDVQQDDBlUZXN0IEFwcCBBdHRlc3RhdGlvbiBDQSAxMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTI2MTAxNDE3MzE0NloXDTI3MTAxNDE3MzE0NlowdzE1MDMGA1UEAwwsUi9DaG5aNUNRYjNNeDhzaENadzMremxyY2ZSZEl2UWdrVkZVYmUzeWg1az0xGjAYBgNVBAsMEUFBQSBDZXJ0aWZpY2F0aW9uMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7bj4oS5sxVsn+hrgWmoa7ApEWHS5zGviJElsnyowqT6Hi/bxkTmfhuub7ZiPj7gFLh4L8Nz0v1jCFwpo2Ha4TaNYMFYwCQYDVR0TBAIwADAUBgNVHSUEDTALBgkqhkiG92NkBBgwMwYJKoZIhvdjZAgCBCYwJKEiBCA9//n/Fd1aZ9360iUFh2B2N5w2YYGFBngIuRfAnI4FKjAKBggqhkjOPQQDAgNHADBEAiBxjdpjMEL3KwFZZ/zKs+Nj7MnsrlgLCWM8abzTLYerAgIgfXSqjaMT/mpJD0grzaSwSOfL0x6l41VWZKSlfQMns71ZAiAwggIcMIIBoaADAgECAhRgzWHHjJ/t8uYuIhDns6/d3mHbtzAKBggqhkjOPQQDAjBLMSUwIwYDVQQDDBxUZXN0IEFwcCBBdHRlc3RhdGlvbiBSb290IENBMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTI2MDIyNzE4NTYxMFoXDTQ2MDIyMjE4NTYxMFowSDEiMCAGA1UEAwwZVGVzdCBBcHAgQXR0ZXN0YXRpb24gQ0EgMTENMAsGA1UECgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFdAlTepmj3MLPbFmmrRnIV9g35akbq4R2374YpFxqOOYmIxgGnE4G2t5wKC8+Wtl1LtSUeGZSDZl1+e+7v4MQijZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFDMnkM0jEGeMbiOrjBnRmAH7hJiwMB8GA1UdIwQYMBaAFH2/IkB0If/drMqGAZr0lKHktUz4MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNpADBmAjEAnYpP1mxe0S296Y82enkWzIzVYSWLWrO2eOGMNXmodwIXJ2qDyuXYGNfWrBfKX2h1AjEAxeI3ZBaC1sLtWo1SNkV6+fBU/BeCRGv6DqaoqNZVNN+sYMA22QgNeque3wbIJlBbZ3JlY2VpcHRAaGF1dGhEYXRhWKRAwbIqQ4Pi7DICxDUSOKvAz16aJJL6oaGyfnacPhq1xEEAAAAAYXBwYXR0ZXN0AAAAAAAAAAAgR/ChnZ5CQb3Mx8shCZw3+zlrcfRdIvQgkVFUbe3yh5mlAQIDJiABIVgg7bj4oS5sxVsn+hrgWmoa7ApEWHS5zGviJElsnyowqT4iWCCHi/bxkTmfhuub7ZiPj7gFLh4L8Nz0v1jCFwpo2Ha4TQ==",
"key_id_b64": "R/ChnZ5CQb3Mx8shCZw3+zlrcfRdIvQgkVFUbe3yh5k=",
"root_cert_pem": "-----BEGIN CERTIFICATE-----\nMIICNzCCAb6gAwIBAgIUFeZt+1JiuWUm7RJtzNA3etiyaTgwCgYIKoZIzj0EAwIw\nSzElMCMGA1UEAwwcVGVzdCBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTENMAsGA1UE\nCgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNjAyMjcxODU2MTBaFw00\nNjAyMjIxODU2MTBaMEsxJTAjBgNVBAMMHFRlc3QgQXBwIEF0dGVzdGF0aW9uIFJv\nb3QgQ0ExDTALBgNVBAoMBFRlc3QxEzARBgNVBAgMCkNhbGlmb3JuaWEwdjAQBgcq\nhkjOPQIBBgUrgQQAIgNiAAT2cBxT0pWtGUECFzUn+Hdx6MaDyVoOHFcjsd+wqlKZ\nIKNg+bopRItVz79g5Rn3F7126h7Q6ZEosNMCMiV2u1t47NBVGAvs0FtM/gqN2hZv\n4vy3F2l3Vwd2TatWzpRC0iKjYzBhMB0GA1UdDgQWBBR9vyJAdCH/3azKhgGa9JSh\n5LVM+DAfBgNVHSMEGDAWgBR9vyJAdCH/3azKhgGa9JSh5LVM+DAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNnADBkAjBi8yL62XLW\ng604KgEaEn9IFxR2c4vx+K0ZhYjPq6OU8X4pq9757JityNdJW1THgxgCMAo9bL44\nUUoFJPTgvmKobdPOIUQ1oRNRYnGmtfovWa31WM2IK0mOs+lpWYncFZOr3Q==\n-----END CERTIFICATE-----\n"
}

2
crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-aaguid.json vendored
View File

@@ -3,7 +3,5 @@
"app_id": "TEAMID.xyz.buzz.test",
"challenge": "fixture-enrollment-challenge",
"aaguid": "appattestdevelop",
"attestation_b64": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZAhEwggINMIIBs6ADAgECAghwzLB5jqA0VDAKBggqhkjOPQQDAjBIMSIwIAYDVQQDDBlUZXN0IEFwcCBBdHRlc3RhdGlvbiBDQSAxMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTI2MTAxNDE3MzE0NloXDTI3MTAxNDE3MzE0NlowdzE1MDMGA1UEAwwsY2FkcGFuNG93cDIxYll4Z1l2cWhUQW5Ic1hzOWlqTm9LRVdXQWFMYU5STT0xGjAYBgNVBAsMEUFBQSBDZXJ0aWZpY2F0aW9uMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEA7MYfoZIHJFQvgiqzxPu3RUVI2aMTYVxmAjgFZK30WowShI7JR3yrJ4cAnoOnFjm/cKPvSeR4P4CxxLxWUjLwqNYMFYwCQYDVR0TBAIwADAUBgNVHSUEDTALBgkqhkiG92NkBBgwMwYJKoZIhvdjZAgCBCYwJKEiBCC5fPFFXiJqTp5Ubq5CV/Z33MFi21au+UdD+QpOqDGXsTAKBggqhkjOPQQDAgNIADBFAiEAmFm+5rmXjmr2gx4vGOeOuZyzDR3s9lkLRFzYfXGZQmoCIBXSOkx5RbUUYEQcD5K2CyrRrm1TzS0wD/+Fwkm1MS9NWQIgMIICHDCCAaGgAwIBAgIUYM1hx4yf7fLmLiIQ57Ov3d5h27cwCgYIKoZIzj0EAwIwSzElMCMGA1UEAwwcVGVzdCBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTENMAsGA1UECgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNjAyMjcxODU2MTBaFw00NjAyMjIxODU2MTBaMEgxIjAgBgNVBAMMGVRlc3QgQXBwIEF0dGVzdGF0aW9uIENBIDExDTALBgNVBAoMBFRlc3QxEzARBgNVBAgMCkNhbGlmb3JuaWEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARXQJU3qZo9zCz2xZpq0ZyFfYN+WpG6uEdt++GKRcajjmJiMYBpxOBtrecCgvPlrZdS7UlHhmUg2Zdfnvu7+DEIo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQzJ5DNIxBnjG4jq4wZ0ZgB+4SYsDAfBgNVHSMEGDAWgBR9vyJAdCH/3azKhgGa9JSh5LVM+DAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDaQAwZgIxAJ2KT9ZsXtEtvemPNnp5FsyM1WEli1qztnjhjDV5qHcCFydqg8rl2BjX1qwXyl9odQIxAMXiN2QWgtbC7VqNUjZFevnwVPwXgkRr+g6mqKjWVTTfrGDANtkIDXqrnt8GyCZQW2dyZWNlaXB0QGhhdXRoRGF0YVikQMGyKkOD4uwyAsQ1EjirwM9emiSS+qGhsn52nD4atcRBAAAAAGFwcGF0dGVzdGRldmVsb3AAIHGnaWp+KMKdtW2MYGL6oUwJx7F7PYozaChFlgGi2jUTpQECAyYgASFYIAOzGH6GSByRUL4Iqs8T7t0VFSNmjE2FcZgI4BWSt9FqIlggMEoSOyUd8qyeHAJ6DpxY5v3Cj70nkeD+AscS8VlIy8I=",
"key_id_b64": "cadpan4owp21bYxgYvqhTAnHsXs9ijNoKEWWAaLaNRM=",
"root_cert_pem": "-----BEGIN CERTIFICATE-----\nMIICNzCCAb6gAwIBAgIUFeZt+1JiuWUm7RJtzNA3etiyaTgwCgYIKoZIzj0EAwIw\nSzElMCMGA1UEAwwcVGVzdCBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTENMAsGA1UE\nCgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNjAyMjcxODU2MTBaFw00\nNjAyMjIxODU2MTBaMEsxJTAjBgNVBAMMHFRlc3QgQXBwIEF0dGVzdGF0aW9uIFJv\nb3QgQ0ExDTALBgNVBAoMBFRlc3QxEzARBgNVBAgMCkNhbGlmb3JuaWEwdjAQBgcq\nhkjOPQIBBgUrgQQAIgNiAAT2cBxT0pWtGUECFzUn+Hdx6MaDyVoOHFcjsd+wqlKZ\nIKNg+bopRItVz79g5Rn3F7126h7Q6ZEosNMCMiV2u1t47NBVGAvs0FtM/gqN2hZv\n4vy3F2l3Vwd2TatWzpRC0iKjYzBhMB0GA1UdDgQWBBR9vyJAdCH/3azKhgGa9JSh\n5LVM+DAfBgNVHSMEGDAWgBR9vyJAdCH/3azKhgGa9JSh5LVM+DAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNnADBkAjBi8yL62XLW\ng604KgEaEn9IFxR2c4vx+K0ZhYjPq6OU8X4pq9757JityNdJW1THgxgCMAo9bL44\nUUoFJPTgvmKobdPOIUQ1oRNRYnGmtfovWa31WM2IK0mOs+lpWYncFZOr3Q==\n-----END CERTIFICATE-----\n"
}

4
crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-root.json vendored
View File

@@ -1,9 +1,7 @@
{
"description": "Internally valid synthetic attestation signed by an unrelated root; the verifier configured with the good fixture root must reject it.",
"description": "Unrelated root: must reject the fresh synthetic enrollment signed by the test CA.",
"app_id": "TEAMID.xyz.buzz.mobile",
"challenge": "buzz-app-attest-strict-verifier-fixture",
"aaguid": "appattest",
"attestation_b64": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZAdcwggHTMIIBeaADAgECAhBGe4kbr8X3vBBmRW24fEPWMAoGCCqGSM49BAMCMD4xLTArBgNVBAMMJEJ1enogQXBwIEF0dGVzdCBGaXh0dXJlIEludGVybWVkaWF0ZTENMAsGA1UECgwEQnV6ejAeFw0yNjA4MDIwNTI3MDJaFw00NjA4MDIwNTI3MDJaMDwxKzApBgNVBAMMIkJ1enogQXBwIEF0dGVzdCBGaXh0dXJlIENyZWRlbnRpYWwxDTALBgNVBAoMBEJ1enowWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ3NUd9f8Ma88b5fiKPmvgL0akkZfv3Q5v2jJMGVQ+pDY2ZFkZTQnzTfAPydFBFtVQE9HpPLlx22e/8eixSUFdLo1swWTAMBgNVHRMBAf8EAjAAMBQGA1UdJQQNMAsGCSqGSIb3Y2QEGDAzBgkqhkiG92NkCAIEJjAkoSIEIF7PDSiNaYyhbJlVGsubqOBUPUSS4sT5PJ0Ri8mGDRjSMAoGCCqGSM49BAMCA0gAMEUCIQCSjdrbcQurd+avRl+OcRIZPusoJBNVGLun3Rda9tJ5NwIgOFEcGxdOZi3atz7Nwzwe409oVcu4GdXOVo9N86pOu8dZAb8wggG7MIIBQaADAgECAhEAx1cRnQUJhJKCUll92sLeGDAKBggqhkjOPQQDAzA7MSowKAYDVQQDDCFVbnJlbGF0ZWQgQXBwIEF0dGVzdCBGaXh0dXJlIFJvb3QxDTALBgNVBAoMBEJ1enowHhcNMjYwODAyMDUyNzAyWhcNNDYwODAyMDUyNzAyWjA+MS0wKwYDVQQDDCRCdXp6IEFwcCBBdHRlc3QgRml4dHVyZSBJbnRlcm1lZGlhdGUxDTALBgNVBAoMBEJ1enowWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASz7MX/nc9MaCmjSQ3f+L8SCsgNdFEcDyZ7FxREEPu4bGUujA+P5exSwDuA8L64WrznNITC1J8sZ98VZ/tTNWFtoyMwITAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNoADBlAjEA8ABjGCavBGyl6FgO9u58hV/xzRnhdlFiTUPiN/XCvmfxDkOyYwzLk06/k4JmdqfCAjBADKJsa+9138UAMZgU8iYWTOY+FO96DHsdC+8H9vBoLBE/DxzQHsX2Wd/DEbggUGJncmVjZWlwdEBoYXV0aERhdGFYVx+ZxXyjGbPKrCxKmb+J+2rRCcbxtKB1ow28nC/zubSZQQAAAABhcHBhdHRlc3QAAAAAAAAAACCvcDv+nttQP9RSSwBycpsL+NiE13xuEsfU7iKqeRaTsQ==",
"key_id_b64": "r3A7/p7bUD/UUksAcnKbC/jYhNd8bhLH1O4iqnkWk7E=",
"root_cert_pem": "-----BEGIN CERTIFICATE-----\nMIIB1DCCAVugAwIBAgIRALE3l3fzQ4wPjIL/IjBs02IwCgYIKoZIzj0EAwMwOzEq\nMCgGA1UEAwwhVW5yZWxhdGVkIEFwcCBBdHRlc3QgRml4dHVyZSBSb290MQ0wCwYD\nVQQKDARCdXp6MB4XDTI2MDgwMjA1MjcwMloXDTQ2MDgwMjA1MjcwMlowOzEqMCgG\nA1UEAwwhVW5yZWxhdGVkIEFwcCBBdHRlc3QgRml4dHVyZSBSb290MQ0wCwYDVQQK\nDARCdXp6MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPa8SWuDIcjNVDwTXlTQnWbKj\n5Vt8TCiGGH0CiSJajPOlevvjHBEYuVHf7bFYa5N/7OzXQ3qkZomCyizJ6nc5tBEN\nGL3rkz7vZjb9J3QPfixkBwyUHFHmx1WJ84fgAYcDoyMwITAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNnADBkAjAMO0cvuHHJSqWj\n4DxJorq8LH7VH9ILTGjcZmz91rLlO7w4oDqiewFQE+GVFl9boekCMBhaa0a/WiW2\nyf2j5d04SOkXREM1NkbHsd1yH1jqSOCuj6PU3Z6zDSSXy1z3HjQIBg==\n-----END CERTIFICATE-----\n"
}