From d84b552a70721549e349dde77d0cf4e958ad208c Mon Sep 17 00:00:00 2001 From: Tom Brow Date: Wed, 14 Oct 2026 13:00:16 -0700 Subject: [PATCH] test(push): generate enrollment leaf certificates at test time Signed-off-by: Tom Brow --- crates/buzz-push-gateway/src/app_attest.rs | 38 ++++++++++++++----- .../tests/fixtures/app-attest-good.json | 2 - .../fixtures/app-attest-wrong-aaguid.json | 2 - .../tests/fixtures/app-attest-wrong-root.json | 4 +- 4 files changed, 29 insertions(+), 17 deletions(-) diff --git a/crates/buzz-push-gateway/src/app_attest.rs b/crates/buzz-push-gateway/src/app_attest.rs index bbfb7fc6c9..a6b5076f11 100644 --- a/crates/buzz-push-gateway/src/app_attest.rs +++ b/crates/buzz-push-gateway/src/app_attest.rs @@ -198,14 +198,32 @@ mod tests { app_id: String, challenge: String, aaguid: String, + #[serde(skip)] attestation_b64: String, + #[serde(skip)] key_id_b64: String, root_cert_pem: String, } fn fixture(json: &str) -> Fixture { - let fixture: Fixture = serde_json::from_str(json).expect("valid App Attest fixture JSON"); + let mut fixture: Fixture = + serde_json::from_str(json).expect("valid App Attest fixture JSON"); assert!(!fixture.description.is_empty()); + // Sign a fresh leaf at test time instead of checking in a certificate + // whose one-year validity will eventually break positive tests. + let generated = super::testing::build_test_attestation_with_auth_data( + &fixture.challenge, + &fixture.app_id, + |auth| { + if fixture.aaguid == "appattestdevelop" { + auth[37..53].copy_from_slice(b"appattestdevelop"); + } else { + assert_eq!(fixture.aaguid, "appattest"); + } + }, + ); + fixture.attestation_b64 = STANDARD.encode(generated.cbor); + fixture.key_id_b64 = generated.key_id; fixture } @@ -267,18 +285,18 @@ mod tests { let good = fixture(GOOD_FIXTURE_JSON); let wrong_root = fixture(WRONG_ROOT_FIXTURE_JSON); assert!(verify_proof( - &wrong_root, - &wrong_root.app_id, - &wrong_root.challenge, - &wrong_root.key_id_b64, - good.root_cert_pem.as_bytes(), + &good, + &good.app_id, + &good.challenge, + &good.key_id_b64, + wrong_root.root_cert_pem.as_bytes(), ) .is_err()); - assert!(verifier(&wrong_root.app_id, good.root_cert_pem.as_bytes()) + assert!(verifier(&good.app_id, wrong_root.root_cert_pem.as_bytes()) .verify_attestation( - &wrong_root.attestation_b64, - &wrong_root.key_id_b64, - wrong_root.challenge.as_bytes(), + &good.attestation_b64, + &good.key_id_b64, + good.challenge.as_bytes() ) .is_err()); } diff --git a/crates/buzz-push-gateway/tests/fixtures/app-attest-good.json b/crates/buzz-push-gateway/tests/fixtures/app-attest-good.json index 311f38f292..643cc70692 100644 --- a/crates/buzz-push-gateway/tests/fixtures/app-attest-good.json +++ b/crates/buzz-push-gateway/tests/fixtures/app-attest-good.json @@ -3,7 +3,5 @@ "app_id": "TEAMID.xyz.buzz.test", "challenge": "fixture-enrollment-challenge", "aaguid": "appattest", - "attestation_b64": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZAhAwggIMMIIBs6ADAgECAgh1EiZfFnrRWjAKBggqhkjOPQQDAjBIMSIwIAYDVQQDDBlUZXN0IEFwcCBBdHRlc3RhdGlvbiBDQSAxMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTI2MTAxNDE3MzE0NloXDTI3MTAxNDE3MzE0NlowdzE1MDMGA1UEAwwsUi9DaG5aNUNRYjNNeDhzaENadzMremxyY2ZSZEl2UWdrVkZVYmUzeWg1az0xGjAYBgNVBAsMEUFBQSBDZXJ0aWZpY2F0aW9uMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7bj4oS5sxVsn+hrgWmoa7ApEWHS5zGviJElsnyowqT6Hi/bxkTmfhuub7ZiPj7gFLh4L8Nz0v1jCFwpo2Ha4TaNYMFYwCQYDVR0TBAIwADAUBgNVHSUEDTALBgkqhkiG92NkBBgwMwYJKoZIhvdjZAgCBCYwJKEiBCA9//n/Fd1aZ9360iUFh2B2N5w2YYGFBngIuRfAnI4FKjAKBggqhkjOPQQDAgNHADBEAiBxjdpjMEL3KwFZZ/zKs+Nj7MnsrlgLCWM8abzTLYerAgIgfXSqjaMT/mpJD0grzaSwSOfL0x6l41VWZKSlfQMns71ZAiAwggIcMIIBoaADAgECAhRgzWHHjJ/t8uYuIhDns6/d3mHbtzAKBggqhkjOPQQDAjBLMSUwIwYDVQQDDBxUZXN0IEFwcCBBdHRlc3RhdGlvbiBSb290IENBMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTI2MDIyNzE4NTYxMFoXDTQ2MDIyMjE4NTYxMFowSDEiMCAGA1UEAwwZVGVzdCBBcHAgQXR0ZXN0YXRpb24gQ0EgMTENMAsGA1UECgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFdAlTepmj3MLPbFmmrRnIV9g35akbq4R2374YpFxqOOYmIxgGnE4G2t5wKC8+Wtl1LtSUeGZSDZl1+e+7v4MQijZjBkMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFDMnkM0jEGeMbiOrjBnRmAH7hJiwMB8GA1UdIwQYMBaAFH2/IkB0If/drMqGAZr0lKHktUz4MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNpADBmAjEAnYpP1mxe0S296Y82enkWzIzVYSWLWrO2eOGMNXmodwIXJ2qDyuXYGNfWrBfKX2h1AjEAxeI3ZBaC1sLtWo1SNkV6+fBU/BeCRGv6DqaoqNZVNN+sYMA22QgNeque3wbIJlBbZ3JlY2VpcHRAaGF1dGhEYXRhWKRAwbIqQ4Pi7DICxDUSOKvAz16aJJL6oaGyfnacPhq1xEEAAAAAYXBwYXR0ZXN0AAAAAAAAAAAgR/ChnZ5CQb3Mx8shCZw3+zlrcfRdIvQgkVFUbe3yh5mlAQIDJiABIVgg7bj4oS5sxVsn+hrgWmoa7ApEWHS5zGviJElsnyowqT4iWCCHi/bxkTmfhuub7ZiPj7gFLh4L8Nz0v1jCFwpo2Ha4TQ==", - "key_id_b64": "R/ChnZ5CQb3Mx8shCZw3+zlrcfRdIvQgkVFUbe3yh5k=", "root_cert_pem": "-----BEGIN CERTIFICATE-----\nMIICNzCCAb6gAwIBAgIUFeZt+1JiuWUm7RJtzNA3etiyaTgwCgYIKoZIzj0EAwIw\nSzElMCMGA1UEAwwcVGVzdCBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTENMAsGA1UE\nCgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNjAyMjcxODU2MTBaFw00\nNjAyMjIxODU2MTBaMEsxJTAjBgNVBAMMHFRlc3QgQXBwIEF0dGVzdGF0aW9uIFJv\nb3QgQ0ExDTALBgNVBAoMBFRlc3QxEzARBgNVBAgMCkNhbGlmb3JuaWEwdjAQBgcq\nhkjOPQIBBgUrgQQAIgNiAAT2cBxT0pWtGUECFzUn+Hdx6MaDyVoOHFcjsd+wqlKZ\nIKNg+bopRItVz79g5Rn3F7126h7Q6ZEosNMCMiV2u1t47NBVGAvs0FtM/gqN2hZv\n4vy3F2l3Vwd2TatWzpRC0iKjYzBhMB0GA1UdDgQWBBR9vyJAdCH/3azKhgGa9JSh\n5LVM+DAfBgNVHSMEGDAWgBR9vyJAdCH/3azKhgGa9JSh5LVM+DAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNnADBkAjBi8yL62XLW\ng604KgEaEn9IFxR2c4vx+K0ZhYjPq6OU8X4pq9757JityNdJW1THgxgCMAo9bL44\nUUoFJPTgvmKobdPOIUQ1oRNRYnGmtfovWa31WM2IK0mOs+lpWYncFZOr3Q==\n-----END CERTIFICATE-----\n" } diff --git a/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-aaguid.json b/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-aaguid.json index baa7199ed6..fb6eae36d1 100644 --- a/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-aaguid.json +++ b/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-aaguid.json @@ -3,7 +3,5 @@ "app_id": "TEAMID.xyz.buzz.test", "challenge": "fixture-enrollment-challenge", "aaguid": "appattestdevelop", - "attestation_b64": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZAhEwggINMIIBs6ADAgECAghwzLB5jqA0VDAKBggqhkjOPQQDAjBIMSIwIAYDVQQDDBlUZXN0IEFwcCBBdHRlc3RhdGlvbiBDQSAxMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTI2MTAxNDE3MzE0NloXDTI3MTAxNDE3MzE0NlowdzE1MDMGA1UEAwwsY2FkcGFuNG93cDIxYll4Z1l2cWhUQW5Ic1hzOWlqTm9LRVdXQWFMYU5STT0xGjAYBgNVBAsMEUFBQSBDZXJ0aWZpY2F0aW9uMQ0wCwYDVQQKDARUZXN0MRMwEQYDVQQIDApDYWxpZm9ybmlhMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEA7MYfoZIHJFQvgiqzxPu3RUVI2aMTYVxmAjgFZK30WowShI7JR3yrJ4cAnoOnFjm/cKPvSeR4P4CxxLxWUjLwqNYMFYwCQYDVR0TBAIwADAUBgNVHSUEDTALBgkqhkiG92NkBBgwMwYJKoZIhvdjZAgCBCYwJKEiBCC5fPFFXiJqTp5Ubq5CV/Z33MFi21au+UdD+QpOqDGXsTAKBggqhkjOPQQDAgNIADBFAiEAmFm+5rmXjmr2gx4vGOeOuZyzDR3s9lkLRFzYfXGZQmoCIBXSOkx5RbUUYEQcD5K2CyrRrm1TzS0wD/+Fwkm1MS9NWQIgMIICHDCCAaGgAwIBAgIUYM1hx4yf7fLmLiIQ57Ov3d5h27cwCgYIKoZIzj0EAwIwSzElMCMGA1UEAwwcVGVzdCBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTENMAsGA1UECgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNjAyMjcxODU2MTBaFw00NjAyMjIxODU2MTBaMEgxIjAgBgNVBAMMGVRlc3QgQXBwIEF0dGVzdGF0aW9uIENBIDExDTALBgNVBAoMBFRlc3QxEzARBgNVBAgMCkNhbGlmb3JuaWEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARXQJU3qZo9zCz2xZpq0ZyFfYN+WpG6uEdt++GKRcajjmJiMYBpxOBtrecCgvPlrZdS7UlHhmUg2Zdfnvu7+DEIo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQzJ5DNIxBnjG4jq4wZ0ZgB+4SYsDAfBgNVHSMEGDAWgBR9vyJAdCH/3azKhgGa9JSh5LVM+DAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwIDaQAwZgIxAJ2KT9ZsXtEtvemPNnp5FsyM1WEli1qztnjhjDV5qHcCFydqg8rl2BjX1qwXyl9odQIxAMXiN2QWgtbC7VqNUjZFevnwVPwXgkRr+g6mqKjWVTTfrGDANtkIDXqrnt8GyCZQW2dyZWNlaXB0QGhhdXRoRGF0YVikQMGyKkOD4uwyAsQ1EjirwM9emiSS+qGhsn52nD4atcRBAAAAAGFwcGF0dGVzdGRldmVsb3AAIHGnaWp+KMKdtW2MYGL6oUwJx7F7PYozaChFlgGi2jUTpQECAyYgASFYIAOzGH6GSByRUL4Iqs8T7t0VFSNmjE2FcZgI4BWSt9FqIlggMEoSOyUd8qyeHAJ6DpxY5v3Cj70nkeD+AscS8VlIy8I=", - "key_id_b64": "cadpan4owp21bYxgYvqhTAnHsXs9ijNoKEWWAaLaNRM=", "root_cert_pem": "-----BEGIN CERTIFICATE-----\nMIICNzCCAb6gAwIBAgIUFeZt+1JiuWUm7RJtzNA3etiyaTgwCgYIKoZIzj0EAwIw\nSzElMCMGA1UEAwwcVGVzdCBBcHAgQXR0ZXN0YXRpb24gUm9vdCBDQTENMAsGA1UE\nCgwEVGVzdDETMBEGA1UECAwKQ2FsaWZvcm5pYTAeFw0yNjAyMjcxODU2MTBaFw00\nNjAyMjIxODU2MTBaMEsxJTAjBgNVBAMMHFRlc3QgQXBwIEF0dGVzdGF0aW9uIFJv\nb3QgQ0ExDTALBgNVBAoMBFRlc3QxEzARBgNVBAgMCkNhbGlmb3JuaWEwdjAQBgcq\nhkjOPQIBBgUrgQQAIgNiAAT2cBxT0pWtGUECFzUn+Hdx6MaDyVoOHFcjsd+wqlKZ\nIKNg+bopRItVz79g5Rn3F7126h7Q6ZEosNMCMiV2u1t47NBVGAvs0FtM/gqN2hZv\n4vy3F2l3Vwd2TatWzpRC0iKjYzBhMB0GA1UdDgQWBBR9vyJAdCH/3azKhgGa9JSh\n5LVM+DAfBgNVHSMEGDAWgBR9vyJAdCH/3azKhgGa9JSh5LVM+DAPBgNVHRMBAf8E\nBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNnADBkAjBi8yL62XLW\ng604KgEaEn9IFxR2c4vx+K0ZhYjPq6OU8X4pq9757JityNdJW1THgxgCMAo9bL44\nUUoFJPTgvmKobdPOIUQ1oRNRYnGmtfovWa31WM2IK0mOs+lpWYncFZOr3Q==\n-----END CERTIFICATE-----\n" } diff --git a/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-root.json b/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-root.json index 7129b63939..bb648e35e8 100644 --- a/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-root.json +++ b/crates/buzz-push-gateway/tests/fixtures/app-attest-wrong-root.json @@ -1,9 +1,7 @@ { - "description": "Internally valid synthetic attestation signed by an unrelated root; the verifier configured with the good fixture root must reject it.", + "description": "Unrelated root: must reject the fresh synthetic enrollment signed by the test CA.", "app_id": "TEAMID.xyz.buzz.mobile", "challenge": "buzz-app-attest-strict-verifier-fixture", "aaguid": "appattest", - "attestation_b64": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZAdcwggHTMIIBeaADAgECAhBGe4kbr8X3vBBmRW24fEPWMAoGCCqGSM49BAMCMD4xLTArBgNVBAMMJEJ1enogQXBwIEF0dGVzdCBGaXh0dXJlIEludGVybWVkaWF0ZTENMAsGA1UECgwEQnV6ejAeFw0yNjA4MDIwNTI3MDJaFw00NjA4MDIwNTI3MDJaMDwxKzApBgNVBAMMIkJ1enogQXBwIEF0dGVzdCBGaXh0dXJlIENyZWRlbnRpYWwxDTALBgNVBAoMBEJ1enowWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ3NUd9f8Ma88b5fiKPmvgL0akkZfv3Q5v2jJMGVQ+pDY2ZFkZTQnzTfAPydFBFtVQE9HpPLlx22e/8eixSUFdLo1swWTAMBgNVHRMBAf8EAjAAMBQGA1UdJQQNMAsGCSqGSIb3Y2QEGDAzBgkqhkiG92NkCAIEJjAkoSIEIF7PDSiNaYyhbJlVGsubqOBUPUSS4sT5PJ0Ri8mGDRjSMAoGCCqGSM49BAMCA0gAMEUCIQCSjdrbcQurd+avRl+OcRIZPusoJBNVGLun3Rda9tJ5NwIgOFEcGxdOZi3atz7Nwzwe409oVcu4GdXOVo9N86pOu8dZAb8wggG7MIIBQaADAgECAhEAx1cRnQUJhJKCUll92sLeGDAKBggqhkjOPQQDAzA7MSowKAYDVQQDDCFVbnJlbGF0ZWQgQXBwIEF0dGVzdCBGaXh0dXJlIFJvb3QxDTALBgNVBAoMBEJ1enowHhcNMjYwODAyMDUyNzAyWhcNNDYwODAyMDUyNzAyWjA+MS0wKwYDVQQDDCRCdXp6IEFwcCBBdHRlc3QgRml4dHVyZSBJbnRlcm1lZGlhdGUxDTALBgNVBAoMBEJ1enowWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASz7MX/nc9MaCmjSQ3f+L8SCsgNdFEcDyZ7FxREEPu4bGUujA+P5exSwDuA8L64WrznNITC1J8sZ98VZ/tTNWFtoyMwITAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNoADBlAjEA8ABjGCavBGyl6FgO9u58hV/xzRnhdlFiTUPiN/XCvmfxDkOyYwzLk06/k4JmdqfCAjBADKJsa+9138UAMZgU8iYWTOY+FO96DHsdC+8H9vBoLBE/DxzQHsX2Wd/DEbggUGJncmVjZWlwdEBoYXV0aERhdGFYVx+ZxXyjGbPKrCxKmb+J+2rRCcbxtKB1ow28nC/zubSZQQAAAABhcHBhdHRlc3QAAAAAAAAAACCvcDv+nttQP9RSSwBycpsL+NiE13xuEsfU7iKqeRaTsQ==", - "key_id_b64": "r3A7/p7bUD/UUksAcnKbC/jYhNd8bhLH1O4iqnkWk7E=", "root_cert_pem": "-----BEGIN CERTIFICATE-----\nMIIB1DCCAVugAwIBAgIRALE3l3fzQ4wPjIL/IjBs02IwCgYIKoZIzj0EAwMwOzEq\nMCgGA1UEAwwhVW5yZWxhdGVkIEFwcCBBdHRlc3QgRml4dHVyZSBSb290MQ0wCwYD\nVQQKDARCdXp6MB4XDTI2MDgwMjA1MjcwMloXDTQ2MDgwMjA1MjcwMlowOzEqMCgG\nA1UEAwwhVW5yZWxhdGVkIEFwcCBBdHRlc3QgRml4dHVyZSBSb290MQ0wCwYDVQQK\nDARCdXp6MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPa8SWuDIcjNVDwTXlTQnWbKj\n5Vt8TCiGGH0CiSJajPOlevvjHBEYuVHf7bFYa5N/7OzXQ3qkZomCyizJ6nc5tBEN\nGL3rkz7vZjb9J3QPfixkBwyUHFHmx1WJ84fgAYcDoyMwITAPBgNVHRMBAf8EBTAD\nAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNnADBkAjAMO0cvuHHJSqWj\n4DxJorq8LH7VH9ILTGjcZmz91rLlO7w4oDqiewFQE+GVFl9boekCMBhaa0a/WiW2\nyf2j5d04SOkXREM1NkbHsd1yH1jqSOCuj6PU3Z6zDSSXy1z3HjQIBg==\n-----END CERTIFICATE-----\n" }