Skip to content

Commit 3ecdad0

Browse files
marcriemermarcriemer
committed
Fixed issued and adds tests
1 parent a437a1a commit 3ecdad0

File tree

13 files changed

+650
-194
lines changed

13 files changed

+650
-194
lines changed

‎manifest.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -383,8 +383,10 @@
383383
"Decrypt",
384384
"Encrypt",
385385
"GenerateDataKey",
386+
"GetPublicKey",
386387
"ListAliases",
387-
"Sign"
388+
"Sign",
389+
"Verify"
388390
]
389391
},
390392
"Lambda": {

‎src/Service/Kms/src/Exception/KMSInvalidSignatureException.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?php
2+
3+
namespace AsyncAws\Kms\Exception;
4+
5+
use AsyncAws\Core\Exception\Http\ClientException;
6+
7+
/**
8+
* The request was rejected because the signature verification failed. Signature verification fails when it cannot
9+
* confirm that signature was produced by signing the specified message with the specified KMS key and signing
10+
* algorithm.
11+
*/
12+
final class KMSInvalidSignatureException extends ClientException
13+
{
14+
}

‎src/Service/Kms/src/Input/GetPublicKeyRequest.php‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,11 @@
66
use AsyncAws\Core\Input;
77
use AsyncAws\Core\Request;
88
use AsyncAws\Core\Stream\StreamFactory;
9-
use function sprintf;
109

1110
final class GetPublicKeyRequest extends Input
1211
{
1312
/**
14-
* Identifies an asymmetric KMS key. KMS uses the private key in the asymmetric KMS key to sign the message. The
15-
* `KeyUsage` type of the KMS key must be `SIGN_VERIFY`. To find the `KeyUsage` of a KMS key, use the DescribeKey
16-
* operation.
13+
* Identifies the asymmetric KMS key that includes the public key.
1714
*
1815
* To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with
1916
* `"alias/"`. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.
@@ -28,6 +25,8 @@ final class GetPublicKeyRequest extends Input
2825
* To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey. To get the alias name and alias ARN, use
2926
* ListAliases.
3027
*
28+
* @required
29+
*
3130
* @var string|null
3231
*/
3332
private $keyId;
@@ -50,6 +49,7 @@ final class GetPublicKeyRequest extends Input
5049
* @param array{
5150
* KeyId?: string,
5251
* GrantTokens?: null|string[],
52+
* '@region'?: string|null,
5353
* } $input
5454
*/
5555
public function __construct(array $input = [])
@@ -62,7 +62,8 @@ public function __construct(array $input = [])
6262
/**
6363
* @param array{
6464
* KeyId?: string,
65-
* GrantTokens?: null|string[]
65+
* GrantTokens?: null|string[],
66+
* '@region'?: string|null,
6667
* }|GetPublicKeyRequest $input
6768
*/
6869
public static function create($input): self
@@ -130,10 +131,7 @@ private function requestBody(): array
130131
{
131132
$payload = [];
132133
if (null === $v = $this->keyId) {
133-
throw new InvalidArgument(sprintf(
134-
'Missing parameter "KeyId" for "%s". The value cannot be null.',
135-
self::class
136-
));
134+
throw new InvalidArgument(\sprintf('Missing parameter "KeyId" for "%s". The value cannot be null.', __CLASS__));
137135
}
138136
$payload['KeyId'] = $v;
139137
if (null !== $v = $this->grantTokens) {
@@ -144,6 +142,7 @@ private function requestBody(): array
144142
$payload['GrantTokens'][$index] = $listValue;
145143
}
146144
}
145+
147146
return $payload;
148147
}
149148
}

‎src/Service/Kms/src/Input/VerifyRequest.php‎

Lines changed: 65 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,12 @@
88
use AsyncAws\Core\Stream\StreamFactory;
99
use AsyncAws\Kms\Enum\MessageType;
1010
use AsyncAws\Kms\Enum\SigningAlgorithmSpec;
11-
use function sprintf;
1211

1312
final class VerifyRequest extends Input
1413
{
1514
/**
16-
* Identifies an asymmetric KMS key. KMS uses the private key in the asymmetric KMS key to sign the message. The
17-
* `KeyUsage` type of the KMS key must be `SIGN_VERIFY`. To find the `KeyUsage` of a KMS key, use the DescribeKey
18-
* operation.
15+
* Identifies the asymmetric KMS key that will be used to verify the signature. This must be the same KMS key that was
16+
* used to generate the signature. If you specify a different KMS key, the signature verification fails.
1917
*
2018
* To specify a KMS key, use its key ID, key ARN, alias name, or alias ARN. When using an alias name, prefix it with
2119
* `"alias/"`. To specify a KMS key in a different Amazon Web Services account, you must use the key ARN or alias ARN.
@@ -30,16 +28,20 @@ final class VerifyRequest extends Input
3028
* To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey. To get the alias name and alias ARN, use
3129
* ListAliases.
3230
*
31+
* @required
32+
*
3333
* @var string|null
3434
*/
3535
private $keyId;
3636

3737
/**
38-
* Specifies the message or message digest to sign. Messages can be 0-4096 bytes. To sign a larger message, provide a
39-
* message digest.
38+
* Specifies the message that was signed. You can submit a raw message of up to 4096 bytes, or a hash digest of the
39+
* message. If you submit a digest, use the `MessageType` parameter with a value of `DIGEST`.
40+
*
41+
* If the message specified here is different from the message that was signed, the signature verification fails. A
42+
* message and its hash digest are considered to be the same message.
4043
*
41-
* If you provide a message digest, use the `DIGEST` value of `MessageType` to prevent the digest from being hashed
42-
* again while signing.
44+
* @required
4345
*
4446
* @var string|null
4547
*/
@@ -53,15 +55,16 @@ final class VerifyRequest extends Input
5355
* When the value is `DIGEST`, KMS skips the hashing step in the signing algorithm.
5456
*
5557
* ! Use the `DIGEST` value only when the value of the `Message` parameter is a message digest. If you use the `DIGEST`
56-
* ! value with an unhashed message, the security of the signing operation can be compromised.
58+
* ! value with an unhashed message, the security of the verification operation can be compromised.
5759
*
5860
* When the value of `MessageType`is `DIGEST`, the length of the `Message` value must match the length of hashed
5961
* messages for the specified signing algorithm.
6062
*
6163
* You can submit a message digest and omit the `MessageType` or specify `RAW` so the digest is hashed again while
62-
* signing. However, this can cause verification failures when verifying with a system that assumes a single hash.
64+
* signing. However, if the signed message is hashed once while signing, but twice while verifying, verification fails,
65+
* even when the message hasn't changed.
6366
*
64-
* The hashing algorithm in that `Sign` uses is based on the `SigningAlgorithm` value.
67+
* The hashing algorithm in that `Verify` uses is based on the `SigningAlgorithm` value.
6568
*
6669
* - Signing algorithms that end in SHA_256 use the SHA_256 hashing algorithm.
6770
* - Signing algorithms that end in SHA_384 use the SHA_384 hashing algorithm.
@@ -74,6 +77,25 @@ final class VerifyRequest extends Input
7477
*/
7578
private $messageType;
7679

80+
/**
81+
* The signature that the `Sign` operation generated.
82+
*
83+
* @required
84+
*
85+
* @var string|null
86+
*/
87+
private $signature;
88+
89+
/**
90+
* The signing algorithm that was used to sign the message. If you submit a different algorithm, the signature
91+
* verification fails.
92+
*
93+
* @required
94+
*
95+
* @var SigningAlgorithmSpec::*|null
96+
*/
97+
private $signingAlgorithm;
98+
7799
/**
78100
* A list of grant tokens.
79101
*
@@ -88,17 +110,6 @@ final class VerifyRequest extends Input
88110
*/
89111
private $grantTokens;
90112

91-
/**
92-
* Specifies the signing algorithm to use when signing the message.
93-
*
94-
* Choose an algorithm that is compatible with the type and size of the specified asymmetric KMS key. When signing with
95-
* RSA key pairs, RSASSA-PSS algorithms are preferred. We include RSASSA-PKCS1-v1_5 algorithms for compatibility with
96-
* existing applications.
97-
*
98-
* @var SigningAlgorithmSpec::*|null
99-
*/
100-
private $signingAlgorithm;
101-
102113
/**
103114
* Checks if your request will succeed. `DryRun` is an optional parameter.
104115
*
@@ -111,16 +122,14 @@ final class VerifyRequest extends Input
111122
*/
112123
private $dryRun;
113124

114-
private $signature;
115-
116125
/**
117126
* @param array{
118127
* KeyId?: string,
119128
* Message?: string,
120-
* Signature?: string,
121129
* MessageType?: null|MessageType::*,
122-
* GrantTokens?: null|string[],
130+
* Signature?: string,
123131
* SigningAlgorithm?: SigningAlgorithmSpec::*,
132+
* GrantTokens?: null|string[],
124133
* DryRun?: null|bool,
125134
* '@region'?: string|null,
126135
* } $input
@@ -130,9 +139,9 @@ public function __construct(array $input = [])
130139
$this->keyId = $input['KeyId'] ?? null;
131140
$this->message = $input['Message'] ?? null;
132141
$this->messageType = $input['MessageType'] ?? null;
133-
$this->grantTokens = $input['GrantTokens'] ?? null;
134142
$this->signature = $input['Signature'] ?? null;
135143
$this->signingAlgorithm = $input['SigningAlgorithm'] ?? null;
144+
$this->grantTokens = $input['GrantTokens'] ?? null;
136145
$this->dryRun = $input['DryRun'] ?? null;
137146
parent::__construct($input);
138147
}
@@ -141,10 +150,10 @@ public function __construct(array $input = [])
141150
* @param array{
142151
* KeyId?: string,
143152
* Message?: string,
144-
* Signature?: string,
145153
* MessageType?: null|MessageType::*,
146-
* GrantTokens?: null|string[],
154+
* Signature?: string,
147155
* SigningAlgorithm?: SigningAlgorithmSpec::*,
156+
* GrantTokens?: null|string[],
148157
* DryRun?: null|bool,
149158
* '@region'?: string|null,
150159
* }|VerifyRequest $input
@@ -177,11 +186,6 @@ public function getMessage(): ?string
177186
return $this->message;
178187
}
179188

180-
public function getSignature(): ?string
181-
{
182-
return $this->signature;
183-
}
184-
185189
/**
186190
* @return MessageType::*|null
187191
*/
@@ -190,6 +194,11 @@ public function getMessageType(): ?string
190194
return $this->messageType;
191195
}
192196

197+
public function getSignature(): ?string
198+
{
199+
return $this->signature;
200+
}
201+
193202
/**
194203
* @return SigningAlgorithmSpec::*|null
195204
*/
@@ -265,6 +274,13 @@ public function setMessageType(?string $value): self
265274
return $this;
266275
}
267276

277+
public function setSignature(?string $value): self
278+
{
279+
$this->signature = $value;
280+
281+
return $this;
282+
}
283+
268284
/**
269285
* @param SigningAlgorithmSpec::*|null $value
270286
*/
@@ -279,36 +295,30 @@ private function requestBody(): array
279295
{
280296
$payload = [];
281297
if (null === $v = $this->keyId) {
282-
throw new InvalidArgument(sprintf(
283-
'Missing parameter "KeyId" for "%s". The value cannot be null.',
284-
self::class
285-
));
298+
throw new InvalidArgument(\sprintf('Missing parameter "KeyId" for "%s". The value cannot be null.', __CLASS__));
286299
}
287300
$payload['KeyId'] = $v;
288301
if (null === $v = $this->message) {
289-
throw new InvalidArgument(sprintf(
290-
'Missing parameter "Message" for "%s". The value cannot be null.',
291-
self::class
292-
));
302+
throw new InvalidArgument(\sprintf('Missing parameter "Message" for "%s". The value cannot be null.', __CLASS__));
293303
}
294304
$payload['Message'] = base64_encode($v);
295-
if (null === $v = $this->signature) {
296-
throw new InvalidArgument(sprintf(
297-
'Missing parameter "Signature" for "%s". The value cannot be null.',
298-
self::class
299-
));
300-
}
301-
$payload['Signature'] = base64_encode($v);
302305
if (null !== $v = $this->messageType) {
303-
if (! MessageType::exists($v)) {
304-
throw new InvalidArgument(sprintf(
305-
'Invalid parameter "MessageType" for "%s". The value "%s" is not a valid "MessageType".',
306-
self::class,
307-
$v
308-
));
306+
if (!MessageType::exists($v)) {
307+
throw new InvalidArgument(\sprintf('Invalid parameter "MessageType" for "%s". The value "%s" is not a valid "MessageType".', __CLASS__, $v));
309308
}
310309
$payload['MessageType'] = $v;
311310
}
311+
if (null === $v = $this->signature) {
312+
throw new InvalidArgument(\sprintf('Missing parameter "Signature" for "%s". The value cannot be null.', __CLASS__));
313+
}
314+
$payload['Signature'] = base64_encode($v);
315+
if (null === $v = $this->signingAlgorithm) {
316+
throw new InvalidArgument(\sprintf('Missing parameter "SigningAlgorithm" for "%s". The value cannot be null.', __CLASS__));
317+
}
318+
if (!SigningAlgorithmSpec::exists($v)) {
319+
throw new InvalidArgument(\sprintf('Invalid parameter "SigningAlgorithm" for "%s". The value "%s" is not a valid "SigningAlgorithmSpec".', __CLASS__, $v));
320+
}
321+
$payload['SigningAlgorithm'] = $v;
312322
if (null !== $v = $this->grantTokens) {
313323
$index = -1;
314324
$payload['GrantTokens'] = [];
@@ -317,20 +327,6 @@ private function requestBody(): array
317327
$payload['GrantTokens'][$index] = $listValue;
318328
}
319329
}
320-
if (null === $v = $this->signingAlgorithm) {
321-
throw new InvalidArgument(sprintf(
322-
'Missing parameter "SigningAlgorithm" for "%s". The value cannot be null.',
323-
self::class
324-
));
325-
}
326-
if (! SigningAlgorithmSpec::exists($v)) {
327-
throw new InvalidArgument(sprintf(
328-
'Invalid parameter "SigningAlgorithm" for "%s". The value "%s" is not a valid "SigningAlgorithmSpec".',
329-
self::class,
330-
$v
331-
));
332-
}
333-
$payload['SigningAlgorithm'] = $v;
334330
if (null !== $v = $this->dryRun) {
335331
$payload['DryRun'] = (bool) $v;
336332
}

0 commit comments

Comments
 (0)