Skip to content

Commit 483675a

Browse files
author
Frederik Rothenberger
committed
Merge branch 'frederik/test-verify-canister-sig' into 'master'
feat(sm-tests): add canister signature verification to test binary Canister signature verification is made significantly easier for downstream projects if offered by the test binary. See merge request dfinity-lab/public/ic!12589
2 parents 69a0ca9 + e79d76f commit 483675a

File tree

9 files changed

+81
-33
lines changed

9 files changed

+81
-33
lines changed

‎Cargo.Bazel.StaticOpenSSL.json.lock

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"checksum": "87a5af9327ba381852c335988c62c22781e11ca3f694a38d9056d943286614e3",
2+
"checksum": "f563bcea718f20e1716e04d38f5d24942a2d1f2eb1622e26755e18311177f5cb",
33
"crates": {
44
"abnf 0.12.0": {
55
"name": "abnf",
@@ -13016,7 +13016,7 @@
1301613016
"target": "ic_stable_structures"
1301713017
},
1301813018
{
13019-
"id": "ic-test-state-machine-client 2.1.0",
13019+
"id": "ic-test-state-machine-client 2.2.0",
1302013020
"target": "ic_test_state_machine_client"
1302113021
},
1302213022
{
@@ -20576,13 +20576,13 @@
2057620576
},
2057720577
"license": "Apache-2.0"
2057820578
},
20579-
"ic-test-state-machine-client 2.1.0": {
20579+
"ic-test-state-machine-client 2.2.0": {
2058020580
"name": "ic-test-state-machine-client",
20581-
"version": "2.1.0",
20581+
"version": "2.2.0",
2058220582
"repository": {
2058320583
"Http": {
20584-
"url": "https://crates.io/api/v1/crates/ic-test-state-machine-client/2.1.0/download",
20585-
"sha256": "be83b09145df43603a6255b2dee2b08055ed37642fe1ee26d2036f2ada81730b"
20584+
"url": "https://crates.io/api/v1/crates/ic-test-state-machine-client/2.2.0/download",
20585+
"sha256": "c942bd6ed0f179338f0fbe51999de9ba6f4d339e896a28f3f69bd4ccfe23b142"
2058620586
}
2058720587
},
2058820588
"targets": [
@@ -20630,7 +20630,7 @@
2063020630
"selects": {}
2063120631
},
2063220632
"edition": "2021",
20633-
"version": "2.1.0"
20633+
"version": "2.2.0"
2063420634
},
2063520635
"license": "Apache-2.0"
2063620636
},
@@ -50151,8 +50151,8 @@
5015150151
},
5015250152
{
5015350153
"Binary": {
50154-
"crate_name": "sleep",
50155-
"crate_root": "src/bin/sleep.rs",
50154+
"crate_name": "exit",
50155+
"crate_root": "src/bin/exit.rs",
5015650156
"srcs": {
5015750157
"include": [
5015850158
"**/*.rs"
@@ -50163,8 +50163,8 @@
5016350163
},
5016450164
{
5016550165
"Binary": {
50166-
"crate_name": "reader",
50167-
"crate_root": "src/bin/reader.rs",
50166+
"crate_name": "sleep",
50167+
"crate_root": "src/bin/sleep.rs",
5016850168
"srcs": {
5016950169
"include": [
5017050170
"**/*.rs"
@@ -50175,8 +50175,8 @@
5017550175
},
5017650176
{
5017750177
"Binary": {
50178-
"crate_name": "exit",
50179-
"crate_root": "src/bin/exit.rs",
50178+
"crate_name": "reader",
50179+
"crate_root": "src/bin/reader.rs",
5018050180
"srcs": {
5018150181
"include": [
5018250182
"**/*.rs"

‎Cargo.Bazel.StaticOpenSSL.toml.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3947,9 +3947,9 @@ checksum = "0c0c68bf2fb590e3c3b4e0719383fb2cdceb308cd62df9fef571323b418f7e1c"
39473947

39483948
[[package]]
39493949
name = "ic-test-state-machine-client"
3950-
version = "2.1.0"
3950+
version = "2.2.0"
39513951
source = "registry+https://github.com/rust-lang/crates.io-index"
3952-
checksum = "be83b09145df43603a6255b2dee2b08055ed37642fe1ee26d2036f2ada81730b"
3952+
checksum = "c942bd6ed0f179338f0fbe51999de9ba6f4d339e896a28f3f69bd4ccfe23b142"
39533953
dependencies = [
39543954
"candid 0.8.4",
39553955
"ciborium",

‎Cargo.Bazel.json.lock

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"checksum": "6ee9224073d1c20dd9523a8a061a5500f3716a0c62b19612a3da665af44d9c13",
2+
"checksum": "f020704ff72e0fb36927054b85f11dcbb1e0f52a8fab33a7b710ecd781ebd7b7",
33
"crates": {
44
"abnf 0.12.0": {
55
"name": "abnf",
@@ -13016,7 +13016,7 @@
1301613016
"target": "ic_stable_structures"
1301713017
},
1301813018
{
13019-
"id": "ic-test-state-machine-client 2.1.0",
13019+
"id": "ic-test-state-machine-client 2.2.0",
1302013020
"target": "ic_test_state_machine_client"
1302113021
},
1302213022
{
@@ -20576,13 +20576,13 @@
2057620576
},
2057720577
"license": "Apache-2.0"
2057820578
},
20579-
"ic-test-state-machine-client 2.1.0": {
20579+
"ic-test-state-machine-client 2.2.0": {
2058020580
"name": "ic-test-state-machine-client",
20581-
"version": "2.1.0",
20581+
"version": "2.2.0",
2058220582
"repository": {
2058320583
"Http": {
20584-
"url": "https://crates.io/api/v1/crates/ic-test-state-machine-client/2.1.0/download",
20585-
"sha256": "be83b09145df43603a6255b2dee2b08055ed37642fe1ee26d2036f2ada81730b"
20584+
"url": "https://crates.io/api/v1/crates/ic-test-state-machine-client/2.2.0/download",
20585+
"sha256": "c942bd6ed0f179338f0fbe51999de9ba6f4d339e896a28f3f69bd4ccfe23b142"
2058620586
}
2058720587
},
2058820588
"targets": [
@@ -20630,7 +20630,7 @@
2063020630
"selects": {}
2063120631
},
2063220632
"edition": "2021",
20633-
"version": "2.1.0"
20633+
"version": "2.2.0"
2063420634
},
2063520635
"license": "Apache-2.0"
2063620636
},
@@ -50127,8 +50127,8 @@
5012750127
},
5012850128
{
5012950129
"Binary": {
50130-
"crate_name": "sleep",
50131-
"crate_root": "src/bin/sleep.rs",
50130+
"crate_name": "exit",
50131+
"crate_root": "src/bin/exit.rs",
5013250132
"srcs": {
5013350133
"include": [
5013450134
"**/*.rs"
@@ -50139,8 +50139,8 @@
5013950139
},
5014050140
{
5014150141
"Binary": {
50142-
"crate_name": "reader",
50143-
"crate_root": "src/bin/reader.rs",
50142+
"crate_name": "sleep",
50143+
"crate_root": "src/bin/sleep.rs",
5014450144
"srcs": {
5014550145
"include": [
5014650146
"**/*.rs"
@@ -50151,8 +50151,8 @@
5015150151
},
5015250152
{
5015350153
"Binary": {
50154-
"crate_name": "exit",
50155-
"crate_root": "src/bin/exit.rs",
50154+
"crate_name": "reader",
50155+
"crate_root": "src/bin/reader.rs",
5015650156
"srcs": {
5015750157
"include": [
5015850158
"**/*.rs"

‎Cargo.Bazel.toml.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3947,9 +3947,9 @@ checksum = "0c0c68bf2fb590e3c3b4e0719383fb2cdceb308cd62df9fef571323b418f7e1c"
39473947

39483948
[[package]]
39493949
name = "ic-test-state-machine-client"
3950-
version = "2.1.0"
3950+
version = "2.2.0"
39513951
source = "registry+https://github.com/rust-lang/crates.io-index"
3952-
checksum = "be83b09145df43603a6255b2dee2b08055ed37642fe1ee26d2036f2ada81730b"
3952+
checksum = "c942bd6ed0f179338f0fbe51999de9ba6f4d339e896a28f3f69bd4ccfe23b142"
39533953
dependencies = [
39543954
"candid 0.8.4",
39553955
"ciborium",

‎Cargo.lock

Lines changed: 4 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bazel/external_crates.bzl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -487,7 +487,7 @@ def external_crates_repository(name, static_openssl, cargo_lockfile, lockfile):
487487
version = "^0.2.1",
488488
),
489489
"ic-test-state-machine-client": crate.spec(
490-
version = "^2.1.0",
490+
version = "^2.2.0",
491491
),
492492
"ic-utils": crate.spec(
493493
version = "^0.23.0",

‎rs/state_machine_tests/BUILD.bazel

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ rust_library(
6464
BIN_DEPENDENCIES = [
6565
"//rs/config",
6666
"//rs/crypto",
67+
"//rs/crypto/iccsa",
68+
"//rs/crypto/utils/threshold_sig_der",
6769
"//rs/registry/subnet_type",
6870
"//rs/types/types",
6971
"//rs/types/ic00_types",

‎rs/state_machine_tests/Cargo.toml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,12 @@ ic-constants = { path = "../constants" }
1515
ic-crypto = { path = "../crypto" }
1616
ic-crypto-ecdsa-secp256k1 = { path = "../crypto/ecdsa_secp256k1" }
1717
ic-crypto-extended-bip32 = { path = "../crypto/extended_bip32" }
18+
ic-crypto-iccsa = { path = "../crypto/iccsa" }
1819
ic-crypto-internal-seed = { path= "../crypto/internal/crypto_lib/seed" }
1920
ic-crypto-internal-threshold-sig-bls12381 = { path= "../crypto/internal/crypto_lib/threshold_sig/bls12_381" }
2021
ic-crypto-internal-types = { path= "../crypto/internal/crypto_lib/types" }
2122
ic-crypto-tree-hash = { path= "../crypto/tree_hash" }
23+
ic-crypto-utils-threshold-sig-der = { path = "../crypto/utils/threshold_sig_der" }
2224
ic-cycles-account-manager = { path = "../cycles_account_manager" }
2325
ic-error-types = { path = "../types/error_types" }
2426
ic-execution-environment = { path = "../execution_environment/" }

‎rs/state_machine_tests/src/main.rs

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ use clap::Parser;
22
use ic_config::execution_environment;
33
use ic_config::subnet_config::SubnetConfig;
44
use ic_crypto::threshold_sig_public_key_to_der;
5+
use ic_crypto_iccsa::types::SignatureBytes;
6+
use ic_crypto_iccsa::{public_key_bytes_from_der, verify};
7+
use ic_crypto_utils_threshold_sig_der::parse_threshold_sig_key_from_der;
58
use ic_registry_subnet_type::SubnetType;
69
use ic_state_machine_tests::{StateMachineBuilder, StateMachineConfig};
710
use ic_test_state_machine_client::{CanisterCall, RawCanisterId, Request, Request::*};
@@ -131,6 +134,45 @@ fn main() {
131134
env.run_until_completion(arg.max_ticks as usize);
132135
send_response((), &opts);
133136
}
137+
VerifyCanisterSig(arg) => {
138+
type VerificationResult = Result<(), String>;
139+
let pubkey = match public_key_bytes_from_der(&arg.pubkey) {
140+
Ok(pubkey) => pubkey,
141+
Err(err) => {
142+
send_response(
143+
VerificationResult::Err(format!(
144+
"failed to parse DER encoded public key: {:?}",
145+
err
146+
)),
147+
&opts,
148+
);
149+
continue;
150+
}
151+
};
152+
let root_pubkey = match parse_threshold_sig_key_from_der(&arg.root_pubkey) {
153+
Ok(root_pubkey) => root_pubkey,
154+
Err(err) => {
155+
send_response(
156+
VerificationResult::Err(format!(
157+
"failed to parse DER encoded root public key: {:?}",
158+
err
159+
)),
160+
&opts,
161+
);
162+
continue;
163+
}
164+
};
165+
match verify(&arg.msg, SignatureBytes(arg.sig), pubkey, &root_pubkey) {
166+
Ok(()) => send_response(VerificationResult::Ok(()), &opts),
167+
Err(err) => send_response(
168+
VerificationResult::Err(format!(
169+
"canister signature verification failed: {:?}",
170+
err
171+
)),
172+
&opts,
173+
),
174+
};
175+
}
134176
}
135177
}
136178
}

0 commit comments

Comments
 (0)