Skip to content

Commit cac9f84

Browse files
loosebazookaloosebazooka
committed
Cleanup keys parsing, caller specifies type
Signed-off-by: Appu Goundan <[email protected]>
1 parent 7402c14 commit cac9f84

File tree

10 files changed

+116
-202
lines changed

10 files changed

+116
-202
lines changed

‎fuzzing/src/main/java/fuzzing/KeysParsingFuzzer.java

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,31 @@
1616
package fuzzing;
1717

1818
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
19+
import com.google.errorprone.annotations.CanIgnoreReturnValue;
1920
import dev.sigstore.encryption.Keys;
20-
import java.io.IOException;
21-
import java.security.NoSuchAlgorithmException;
21+
import java.security.PublicKey;
2222
import java.security.spec.InvalidKeySpecException;
2323

2424
public class KeysParsingFuzzer {
25+
26+
@FunctionalInterface
27+
interface Parser {
28+
@CanIgnoreReturnValue
29+
PublicKey parse(byte[] contents) throws InvalidKeySpecException;
30+
}
31+
2532
public static void fuzzerTestOneInput(FuzzedDataProvider data) {
2633
try {
27-
byte[] byteArray = data.consumeRemainingAsBytes();
34+
byte[] keyContents = data.consumeRemainingAsBytes();
35+
Parser parser =
36+
data.pickValue(
37+
new Parser[] {
38+
Keys::parseRsaPkcs1, Keys::parseRsa, Keys::parseEcdsa, Keys::parseEd25519,
39+
});
40+
41+
parser.parse(keyContents);
2842

29-
Keys.parsePublicKey(byteArray);
30-
} catch (IOException | InvalidKeySpecException | NoSuchAlgorithmException e) {
43+
} catch (InvalidKeySpecException e) {
3144
// known exceptions
3245
}
3346
}

‎sigstore-java/src/main/java/dev/sigstore/encryption/Keys.java

Lines changed: 52 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -15,95 +15,90 @@
1515
*/
1616
package dev.sigstore.encryption;
1717

18-
import java.io.ByteArrayInputStream;
19-
import java.io.IOException;
20-
import java.io.InputStreamReader;
21-
import java.nio.charset.StandardCharsets;
2218
import java.security.KeyFactory;
2319
import java.security.NoSuchAlgorithmException;
20+
import java.security.NoSuchProviderException;
2421
import java.security.PublicKey;
2522
import java.security.Security;
2623
import java.security.spec.InvalidKeySpecException;
2724
import java.security.spec.RSAPublicKeySpec;
2825
import java.security.spec.X509EncodedKeySpec;
29-
import java.util.List;
3026
import org.bouncycastle.asn1.ASN1Integer;
3127
import org.bouncycastle.asn1.ASN1Sequence;
32-
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
3328
import org.bouncycastle.jce.provider.BouncyCastleProvider;
34-
import org.bouncycastle.openssl.PEMParser;
35-
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
36-
import org.bouncycastle.util.encoders.DecoderException;
3729

3830
/** For internal use. Key related utility functions. */
3931
public class Keys {
4032

41-
private static final List<String> SUPPORTED_KEY_TYPES =
42-
List.of("ECDSA", "EC", "RSA", "Ed25519", "EdDSA");
43-
4433
static {
4534
Security.addProvider(new BouncyCastleProvider());
4635
}
4736

4837
/**
49-
* Takes a PEM formatted public key in bytes and constructs a {@code PublicKey} with it.
38+
* Takes a PKIX DER formatted ECDSA public key in bytes and constructs a {@code PublicKey} with
39+
* it.
5040
*
51-
* <p>This method supports the follow public key algorithms: RSA, EdDSA, EC.
41+
* @param contents the public key bytes
42+
* @return a PublicKey object
43+
* @throws InvalidKeySpecException if the public key material is invalid
44+
*/
45+
public static PublicKey parseEcdsa(byte[] contents) throws InvalidKeySpecException {
46+
return parse(contents, "ECDSA");
47+
}
48+
49+
/**
50+
* Takes a PKIX DER formatted Ed25519 public key in bytes and constructs a {@code PublicKey} with
51+
* it.
5252
*
53-
* @throws InvalidKeySpecException if the PEM does not contain just one public key.
54-
* @throws NoSuchAlgorithmException if the public key is using an unsupported algorithm.
53+
* @param contents the public key bytes
54+
* @return a PublicKey object
55+
* @throws InvalidKeySpecException if the public key material is invalid
5556
*/
56-
public static PublicKey parsePublicKey(byte[] keyBytes)
57-
throws InvalidKeySpecException, IOException, NoSuchAlgorithmException {
58-
try (PEMParser pemParser =
59-
new PEMParser(
60-
new InputStreamReader(new ByteArrayInputStream(keyBytes), StandardCharsets.UTF_8))) {
61-
var keyObj = pemParser.readObject(); // throws DecoderException
62-
if (keyObj == null) {
63-
throw new InvalidKeySpecException(
64-
"sigstore public keys must be only a single PEM encoded public key");
65-
}
66-
JcaPEMKeyConverter converter = new JcaPEMKeyConverter();
67-
converter.setProvider(BouncyCastleProvider.PROVIDER_NAME);
68-
if (keyObj instanceof SubjectPublicKeyInfo) {
69-
PublicKey pk = converter.getPublicKey((SubjectPublicKeyInfo) keyObj);
70-
if (!SUPPORTED_KEY_TYPES.contains(pk.getAlgorithm())) {
71-
throw new NoSuchAlgorithmException("Unsupported key type: " + pk.getAlgorithm());
72-
}
73-
return pk;
74-
}
75-
throw new InvalidKeySpecException("Could not parse PEM section into public key");
76-
} catch (DecoderException e) {
77-
throw new InvalidKeySpecException("Invalid key, could not parse PEM section");
78-
}
57+
public static PublicKey parseEd25519(byte[] contents) throws InvalidKeySpecException {
58+
return parse(contents, "Ed25519");
7959
}
8060

8161
/**
82-
* Takes a PKIX DER formatted public key in bytes and constructs a {@code PublicKey} with it.
62+
* Takes a PKIX DER formatted RSA public key in bytes and constructs a {@code PublicKey} with it.
8363
*
84-
* <p>This method is known to work with keys algorithms: RSA, EdDSA, EC.
64+
* @param contents the public key bytes
65+
* @return a PublicKey object
66+
* @throws InvalidKeySpecException if the public key material is invalid
67+
*/
68+
public static PublicKey parseRsa(byte[] contents) throws InvalidKeySpecException {
69+
return parse(contents, "RSA");
70+
}
71+
72+
/**
73+
* Takes a PKCS1 DER formatted RSA public key in bytes and constructs a {@code PublicKey} with it.
8574
*
8675
* @param contents the public key bytes
87-
* @param algorithm the key algorithm
8876
* @return a PublicKey object
89-
* @throws NoSuchAlgorithmException if we don't support the scheme provided
9077
* @throws InvalidKeySpecException if the public key material is invalid
9178
*/
92-
public static PublicKey parsePkixPublicKey(byte[] contents, String algorithm)
93-
throws NoSuchAlgorithmException, InvalidKeySpecException {
94-
X509EncodedKeySpec spec = new X509EncodedKeySpec(contents);
95-
KeyFactory factory = KeyFactory.getInstance(algorithm);
96-
return factory.generatePublic(spec);
79+
public static PublicKey parseRsaPkcs1(byte[] contents) throws InvalidKeySpecException {
80+
try {
81+
ASN1Sequence sequence = ASN1Sequence.getInstance(contents);
82+
ASN1Integer modulus = ASN1Integer.getInstance(sequence.getObjectAt(0));
83+
ASN1Integer exponent = ASN1Integer.getInstance(sequence.getObjectAt(1));
84+
RSAPublicKeySpec keySpec =
85+
new RSAPublicKeySpec(modulus.getPositiveValue(), exponent.getPositiveValue());
86+
KeyFactory factory = KeyFactory.getInstance("RSA", "BC");
87+
return factory.generatePublic(keySpec);
88+
} catch (IllegalArgumentException e) {
89+
throw new InvalidKeySpecException("Failed to parse pkcs1 rsa key", e);
90+
} catch (NoSuchProviderException | NoSuchAlgorithmException e) {
91+
throw new RuntimeException(e);
92+
}
9793
}
9894

99-
public static PublicKey parsePkcs1RsaPublicKey(byte[] contents)
100-
throws NoSuchAlgorithmException, InvalidKeySpecException {
101-
ASN1Sequence sequence = ASN1Sequence.getInstance(contents);
102-
ASN1Integer modulus = ASN1Integer.getInstance(sequence.getObjectAt(0));
103-
ASN1Integer exponent = ASN1Integer.getInstance(sequence.getObjectAt(1));
104-
RSAPublicKeySpec keySpec =
105-
new RSAPublicKeySpec(modulus.getPositiveValue(), exponent.getPositiveValue());
106-
KeyFactory factory = KeyFactory.getInstance("RSA");
107-
return factory.generatePublic(keySpec);
95+
private static PublicKey parse(byte[] contents, String type) throws InvalidKeySpecException {
96+
try {
97+
var keySpec = new X509EncodedKeySpec(contents);
98+
var factory = KeyFactory.getInstance(type, BouncyCastleProvider.PROVIDER_NAME);
99+
return factory.generatePublic(keySpec);
100+
} catch (NoSuchProviderException | NoSuchAlgorithmException e) {
101+
throw new RuntimeException(e);
102+
}
108103
}
109104
}

‎sigstore-java/src/main/java/dev/sigstore/trustroot/PublicKey.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,13 @@ public abstract class PublicKey {
3333
public java.security.PublicKey toJavaPublicKey()
3434
throws NoSuchAlgorithmException, InvalidKeySpecException {
3535
if (getKeyDetails().equals("PKIX_ECDSA_P256_SHA_256")) {
36-
return Keys.parsePkixPublicKey(getRawBytes(), "EC");
36+
return Keys.parseEcdsa(getRawBytes());
37+
}
38+
if (getKeyDetails().startsWith("PKIX_RSA")) {
39+
return Keys.parseRsa(getRawBytes());
3740
}
3841
if (getKeyDetails().equals("PKCS1_RSA_PKCS1V5")) {
39-
return Keys.parsePkcs1RsaPublicKey(getRawBytes());
42+
return Keys.parseRsaPkcs1(getRawBytes());
4043
}
4144
throw new InvalidKeySpecException("Unsupported key algorithm: " + getKeyDetails());
4245
}

‎sigstore-java/src/test/java/dev/sigstore/encryption/KeysTest.java

Lines changed: 30 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -15,116 +15,68 @@
1515
*/
1616
package dev.sigstore.encryption;
1717

18-
import static org.junit.jupiter.api.Assertions.*;
19-
20-
import com.google.common.io.Resources;
21-
import java.io.IOException;
22-
import java.nio.charset.StandardCharsets;
23-
import java.security.NoSuchAlgorithmException;
24-
import java.security.PublicKey;
2518
import java.security.spec.InvalidKeySpecException;
2619
import org.bouncycastle.util.encoders.Base64;
2720
import org.junit.jupiter.api.Assertions;
2821
import org.junit.jupiter.api.Test;
2922

3023
class KeysTest {
3124

32-
static final String RSA_PUB_PATH = "dev/sigstore/samples/keys/test-rsa.pub";
33-
static final String RSA_PUB_PKCS1_PATH = "dev/sigstore/samples/keys/test-rsa-pkcs1.pub";
34-
static final String EC_PUB_PATH = "dev/sigstore/samples/keys/test-ec.pub";
35-
static final String ED25519_PUB_PATH = "dev/sigstore/samples/keys/test-ed25519.pub";
36-
static final String DSA_PUB_PATH = "dev/sigstore/samples/keys/test-dsa.pub";
37-
38-
static final String ECDSA_SHA2_NISTP256 =
39-
"dev/sigstore/samples/keys/test-ecdsa-sha2-nistp256.pub";
40-
41-
@Test
42-
void parsePublicKey_invalid() {
43-
var key =
44-
"-----BEGIN Ã-----\nMGMGB1gFB00gFM0EEEEEEEzEEEEEEEEEEEEEEEEEEEEEEEEEEEEEFB00gFM0EEEEEEEzEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEFGB1g070v129B1700372=\n-----END ïI";
45-
Assertions.assertThrows(
46-
IOException.class, () -> Keys.parsePublicKey(key.getBytes(StandardCharsets.UTF_8)));
47-
}
48-
49-
@Test
50-
void parsePublicKey_rsa() throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
51-
PublicKey result =
52-
Keys.parsePublicKey(Resources.toByteArray(Resources.getResource(RSA_PUB_PATH)));
53-
assertEquals("RSA", result.getAlgorithm());
54-
}
55-
56-
@Test
57-
void parsePublicKey_rsaPkcs1()
58-
throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
59-
PublicKey result =
60-
Keys.parsePublicKey(Resources.toByteArray(Resources.getResource(RSA_PUB_PKCS1_PATH)));
61-
assertEquals("RSA", result.getAlgorithm());
62-
}
63-
64-
@Test
65-
void parsePublicKey_ec() throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
66-
PublicKey result =
67-
Keys.parsePublicKey(Resources.toByteArray(Resources.getResource(EC_PUB_PATH)));
68-
assertEquals("ECDSA", result.getAlgorithm());
69-
}
70-
7125
@Test
72-
void parsePublicKey_ed25519()
73-
throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
74-
PublicKey result =
75-
Keys.parsePublicKey(Resources.toByteArray(Resources.getResource(ED25519_PUB_PATH)));
76-
// BouncyCastle names the algorithm differently than the JDK (Ed25519 vs EdDSA) but we
77-
// force the converter to use BouncyCastle always.
78-
assertEquals("Ed25519", result.getAlgorithm());
26+
void parseRsa() throws InvalidKeySpecException {
27+
var base64Key =
28+
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAghWkDAnX9F5QZZ9NxIWg9vcjULtD/kkbQwlcSm22e06FrgOdiFy1fKN/Ng32qEk1ZIKyi0HFzZxzPIcvg7eaFTRb7+AQiG6eMDmUzPGr67Jp0Di2ncH9+uOZmv4PVKovvQLq7qnEwbDk0HttxUscLQ2e36Lfv/2lpGW7apVmHVMoC5kwZ3KTiAk/DUtDhD4VQjU2rBy6OneO6pm6vdNzG4Jktjc0uUKFCRRUzydGEh05PgC9vSQu/EOiU+7aQPV1ZDUGpjg9tOM0SgaTOU3YSUfGiXZNHoiS2HwLyQPaxiHR2NPVH75bwnUFBHhdMxT1rhU+yLhXaweDQW6GQ0ti8wIDAQAB";
29+
Assertions.assertEquals("RSA", Keys.parseRsa(Base64.decode(base64Key)).getAlgorithm());
7930
}
8031

8132
@Test
82-
void parsePublicKey_dsaShouldFail() {
33+
void parseRsa_bad() {
34+
var base64Key =
35+
"MIIBIjANBgkqhkiG8w0BAQEFAAOCAQ8AMIIBCgKCAQEAghWkDAnX9F5QZZ9NxIWg9vcjULtD/kkbQwlcSm22e06FrgOdiFy1fKN/Ng32qEk1ZIKyi0HFzZxzPIcvg7eaFTRb7+AQiG6eMDmUzPGr67Jp0Di2ncH9+uOZmv4PVKovvQLq7qnEwbDk0HttxUscLQ2e36Lfv/2lpGW7apVmHVMoC5kwZ3KTiAk/DUtDhD4VQjU2rBy6OneO6pm6vdNzG4Jktjc0uUKFCRRUzydGEh05PgC9vSQu/EOiU+7aQPV1ZDUGpjg9tOM0SgaTOU3YSUfGiXZNHoiS2HwLyQPaxiHR2NPVH75bwnUFBHhdMxT1rhU+yLhXaweDQW6GQ0ti8wIDAQAB";
8336
Assertions.assertThrows(
84-
NoSuchAlgorithmException.class,
85-
() -> Keys.parsePublicKey(Resources.toByteArray(Resources.getResource(DSA_PUB_PATH))));
37+
InvalidKeySpecException.class, () -> Keys.parseRsa(Base64.decode(base64Key)));
8638
}
8739

8840
@Test
89-
void parseTufPublicKeyPemEncoded_sha2_nistp256()
90-
throws IOException, InvalidKeySpecException, NoSuchAlgorithmException {
91-
PublicKey result =
92-
Keys.parsePublicKey(Resources.toByteArray(Resources.getResource(ECDSA_SHA2_NISTP256)));
93-
assertEquals("ECDSA", result.getAlgorithm());
94-
}
95-
96-
@Test
97-
void parsePkixPublicKey_rsa() throws NoSuchAlgorithmException, InvalidKeySpecException {
41+
void parseRsaPkcs1() throws InvalidKeySpecException {
9842
var base64Key =
99-
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAghWkDAnX9F5QZZ9NxIWg9vcjULtD/kkbQwlcSm22e06FrgOdiFy1fKN/Ng32qEk1ZIKyi0HFzZxzPIcvg7eaFTRb7+AQiG6eMDmUzPGr67Jp0Di2ncH9+uOZmv4PVKovvQLq7qnEwbDk0HttxUscLQ2e36Lfv/2lpGW7apVmHVMoC5kwZ3KTiAk/DUtDhD4VQjU2rBy6OneO6pm6vdNzG4Jktjc0uUKFCRRUzydGEh05PgC9vSQu/EOiU+7aQPV1ZDUGpjg9tOM0SgaTOU3YSUfGiXZNHoiS2HwLyQPaxiHR2NPVH75bwnUFBHhdMxT1rhU+yLhXaweDQW6GQ0ti8wIDAQAB";
100-
Assertions.assertNotNull(Keys.parsePkixPublicKey(Base64.decode(base64Key), "RSA"));
43+
"MIICCgKCAgEA27A2MPQXm0I0v7/Ly5BIauDjRZF5Jor9vU+QheoE2UIIsZHcyYq3slHzSSHy2lLj1ZD2d91CtJ492ZXqnBmsr4TwZ9jQ05tW2mGIRI8u2DqN8LpuNYZGz/f9SZrjhQQmUttqWmtu3UoLfKz6NbNXUnoo+NhZFcFRLXJ8VporVhuiAmL7zqT53cXR3yQfFPCUDeGnRksnlhVIAJc3AHZZSHQJ8DEXMhh35TVv2nYhTI3rID7GwjXXw4ocz7RGDD37ky6p39Tl5NB71gT1eSqhZhGHEYHIPXraEBd5+3w9qIuLWlp5Ej/K6Mu4ELioXKCUimCbwy+Cs8UhHFlqcyg4AysOHJwIadXIa8LsY51jnVSGrGOEBZevopmQPNPtyfFY3dmXSS+6Z3RD2Gd6oDnNGJzpSyEk410Ag5uvNDfYzJLCWX9tU8lIxNwdFYmIwpd89HijyRyoGnoJ3entd63cvKfuuix5r+GHyKp1Xm1L5j5AWM6P+z0xigwkiXnt+adexAl1J9wdDxv/pUFEESRF4DG8DFGVtbdH6aR1A5/vD4krO4tC1QYUSeyL5Mvsw8WRqIFHcXtgybtxylljvNcGMV1KXQC8UFDmpGZVDSHx6v3e/BHMrZ7gjoCCfVMZ/cFcQi0W2AIHPYEMH/C95J2r4XbHMRdYXpovpOoT5Ca78gsCAwEAAQ==";
44+
Assertions.assertEquals("RSA", Keys.parseRsaPkcs1(Base64.decode(base64Key)).getAlgorithm());
10145
}
10246

10347
@Test
104-
void parsePkixPublicKey_rsaKeyButWrongAlgorithm() {
48+
void parseRsaPkcs1_bad() throws InvalidKeySpecException {
10549
var base64Key =
106-
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAghWkDAnX9F5QZZ9NxIWg9vcjULtD/kkbQwlcSm22e06FrgOdiFy1fKN/Ng32qEk1ZIKyi0HFzZxzPIcvg7eaFTRb7+AQiG6eMDmUzPGr67Jp0Di2ncH9+uOZmv4PVKovvQLq7qnEwbDk0HttxUscLQ2e36Lfv/2lpGW7apVmHVMoC5kwZ3KTiAk/DUtDhD4VQjU2rBy6OneO6pm6vdNzG4Jktjc0uUKFCRRUzydGEh05PgC9vSQu/EOiU+7aQPV1ZDUGpjg9tOM0SgaTOU3YSUfGiXZNHoiS2HwLyQPaxiHR2NPVH75bwnUFBHhdMxT1rhU+yLhXaweDQW6GQ0ti8wIDAQAB";
50+
"MIIBIjANBgkqikiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAghWkDAnX9F5QZZ9NxIWg9vcjULtD/kkbQwlcSm22e06FrgOdiFy1fKN/Ng32qEk1ZIKyi0HFzZxzPIcvg7eaFTRb7+AQiG6eMDmUzPGr67Jp0Di2ncH9+uOZmv4PVKovvQLq7qnEwbDk0HttxUscLQ2e36Lfv/2lpGW7apVmHVMoC5kwZ3KTiAk/DUtDhD4VQjU2rBy6OneO6pm6vdNzG4Jktjc0uUKFCRRUzydGEh05PgC9vSQu/EOiU+7aQPV1ZDUGpjg9tOM0SgaTOU3YSUfGiXZNHoiS2HwLyQPaxiHR2NPVH75bwnUFBHhdMxT1rhU+yLhXaweDQW6GQ0ti8wIDAQAB";
10751
Assertions.assertThrows(
108-
InvalidKeySpecException.class,
109-
() -> Keys.parsePkixPublicKey(Base64.decode(base64Key), "EC"));
52+
InvalidKeySpecException.class, () -> Keys.parseRsaPkcs1(Base64.decode(base64Key)));
11053
}
11154

11255
@Test
113-
void parsePkixPublicKey_eddsa() throws NoSuchAlgorithmException, InvalidKeySpecException {
56+
void parseEd25519() throws InvalidKeySpecException {
11457
var base64Key = "MCowBQYDK2VwAyEAixzZOnx34hveTZ69J5iBCkmerK5Oh7EzJqTh3YY55jI=";
115-
Assertions.assertNotNull(Keys.parsePkixPublicKey(Base64.decode(base64Key), "EdDSA"));
58+
Assertions.assertEquals("Ed25519", Keys.parseEd25519(Base64.decode(base64Key)).getAlgorithm());
11659
}
11760

11861
@Test
119-
void parsePkixPublicKey_ecdsa() throws NoSuchAlgorithmException, InvalidKeySpecException {
62+
void parseEd25519_bad() {
63+
var base64Key = "MCowBQYDK2VxAyEAixzZOnx34hveTZ69J5iBCkmerK5Oh7EzJqTh3YY55jI=";
64+
Assertions.assertThrows(
65+
InvalidKeySpecException.class, () -> Keys.parseEd25519(Base64.decode(base64Key)));
66+
}
67+
68+
@Test
69+
void parseEcdsa() throws InvalidKeySpecException {
12070
var base64Key =
12171
"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEVqBnvab9XEVlTLW4iGKBIdrL6Sxf0x5vclZyXtR6hl79/o+RSgyr1ZQKLLCUC20imDWUgFMmfLu4UUiKNcI2uQ==";
122-
Assertions.assertNotNull(Keys.parsePkixPublicKey(Base64.decode(base64Key), "EC"));
72+
Assertions.assertNotNull(Keys.parseEcdsa(Base64.decode(base64Key)));
12373
}
12474

12575
@Test
126-
void parsePublicKey_failOnBadPEM() throws Exception {
127-
byte[] byteArray = "-----BEGIN A-----\nBBBBB-----END A".getBytes(StandardCharsets.UTF_8);
128-
Assertions.assertThrows(IOException.class, () -> Keys.parsePublicKey(byteArray));
76+
void parseEcdsa_bad() {
77+
var base64Key =
78+
"MFkwEwYHKoZIzj0CAQYIKoZJzj0DAQcDQgAEVqBnvab9XEVlTLW4iGKBIdrL6Sxf0x5vclZyXtR6hl79/o+RSgyr1ZQKLLCUC20imDWUgFMmfLu4UUiKNcI2uQ==";
79+
Assertions.assertThrows(
80+
InvalidKeySpecException.class, () -> Keys.parseEcdsa(Base64.decode(base64Key)));
12981
}
13082
}

‎sigstore-java/src/test/java/dev/sigstore/encryption/certificates/transparency/CTVerifierTest.java

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,12 @@
2020
import com.google.common.io.Resources;
2121
import dev.sigstore.encryption.Keys;
2222
import dev.sigstore.encryption.certificates.Certificates;
23+
import java.nio.charset.StandardCharsets;
2324
import java.security.PublicKey;
2425
import java.security.cert.X509Certificate;
2526
import java.util.Arrays;
2627
import java.util.List;
28+
import org.bouncycastle.util.encoders.Base64;
2729
import org.junit.jupiter.api.Assertions;
2830
import org.junit.jupiter.api.BeforeEach;
2931
import org.junit.jupiter.api.Test;
@@ -55,11 +57,16 @@ public void setUp() throws Exception {
5557
Resources.getResource(
5658
"dev/sigstore/samples/certificatetransparency/cert-ct-embedded.pem")));
5759

58-
PublicKey key =
59-
Keys.parsePublicKey(
60-
Resources.toByteArray(
60+
// a little hacky pem parser, but lightweight
61+
String keyData =
62+
Resources.toString(
6163
Resources.getResource(
62-
"dev/sigstore/samples/certificatetransparency/ct-server-key-public.pem")));
64+
"dev/sigstore/samples/certificatetransparency/ct-server-key-public.pem"),
65+
StandardCharsets.UTF_8)
66+
.replace("-----BEGIN PUBLIC KEY-----", "")
67+
.replace("-----END PUBLIC KEY-----", "")
68+
.replaceAll("\\s", "");
69+
PublicKey key = Keys.parseEcdsa(Base64.decode(keyData));
6370

6471
final CTLogInfo log = new CTLogInfo(key, "Test Log", "foo");
6572
CTLogStore store =

0 commit comments

Comments
 (0)