From fb1bc06440ab9ef7c94de509880a0503a15577b9 Mon Sep 17 00:00:00 2001 From: olszomal Date: Fri, 30 Oct 2020 15:34:39 +0100 Subject: [PATCH] CAT file tests --- tests/recipes/01_sign_pem | 16 +++++++++++++++ tests/recipes/02_sign_pass | 17 ++++++++++++++++ tests/recipes/03_sign_der | 17 ++++++++++++++++ tests/recipes/04_sign_spc_pvk | 17 ++++++++++++++++ tests/recipes/05_sign_pkcs12 | 17 ++++++++++++++++ tests/recipes/06_test_sha256sum | 15 +++++++++++++- tests/recipes/07_sign_timestamp | 19 ++++++++++++++++++ tests/recipes/08_sign_rfc3161 | 19 ++++++++++++++++++ tests/recipes/09_sign_page_hashes | 3 +++ tests/recipes/10_sign_blob | 24 ++++++++++++++++++++--- tests/recipes/11_sign_nest | 3 +++ tests/recipes/12_sign_readpass_pem | 17 ++++++++++++++++ tests/recipes/13_sign_readpass_pkcs12 | 17 ++++++++++++++++ tests/recipes/14_sign_descryption | 17 ++++++++++++++++ tests/recipes/15_sign_url | 17 ++++++++++++++++ tests/recipes/16_sign_comm | 17 ++++++++++++++++ tests/recipes/17_sign_crosscertfile | 17 ++++++++++++++++ tests/recipes/21_sign_hash_md5 | 2 ++ tests/recipes/22_sign_hash_sha1 | 2 ++ tests/recipes/23_sign_hash_sha2 | 2 ++ tests/recipes/24_sign_hash_sha384 | 2 ++ tests/recipes/25_sign_hash_sha512 | 2 ++ tests/recipes/26_extract_signature_pem | 3 +++ tests/recipes/27_extract_signature_der | 3 +++ tests/recipes/31_attach_signature_der | 3 +++ tests/recipes/32_attach_signature_pem | 3 +++ tests/recipes/33_attach_signed | 3 +++ tests/recipes/34_attach_nest | 3 +++ tests/recipes/35_remove_signature | 3 +++ tests/recipes/37_add_signature_timestamp | 22 +++++++++++++++++++++ tests/recipes/38_add_signature_rfc3161 | 21 ++++++++++++++++++++ tests/recipes/39_add_signature_blob | 20 +++++++++++++++++++ tests/recipes/40_verify_leaf_hash | 15 ++++++++++++++ tests/recipes/41_sign_add_msi_dse | 3 +++ tests/recipes/42_sign_jp_low | 3 +++ tests/recipes/45_verify_fake_pe | 3 +++ tests/recipes/46_verify_timestamp | 3 +++ tests/recipes/47_verify_rfc3161 | 3 +++ tests/recipes/51_verify_time | 17 ++++++++++++++++ tests/recipes/52_verify_timestamp | 20 +++++++++++++++++++ tests/recipes/53_verify_rfc3161 | 20 +++++++++++++++++++ tests/recipes/54_verify_expired | 20 +++++++++++++++++++ tests/recipes/55_verify_revoked | 20 +++++++++++++++++++ tests/recipes/56_verify_multiple | 3 +++ tests/sources/good.cat | Bin 0 -> 394 bytes tests/testall.sh | 5 ++++- 46 files changed, 493 insertions(+), 5 deletions(-) create mode 100755 tests/sources/good.cat diff --git a/tests/recipes/01_sign_pem b/tests/recipes/01_sign_pem index 987e16b..9aaf77e 100644 --- a/tests/recipes/01_sign_pem +++ b/tests/recipes/01_sign_pem @@ -53,4 +53,20 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="014. Sign a CAT file with the certificate and private key files in the PEM format" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_014.cat" + verify_signature "$?" "014" "cat" "success" "@2019-09-01 12:00:00" \ + "sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/02_sign_pass b/tests/recipes/02_sign_pass index 860fed1..a31a38c 100644 --- a/tests/recipes/02_sign_pass +++ b/tests/recipes/02_sign_pass @@ -55,4 +55,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="024. Sign a CAT file with the encrypted private key file in the PEM format" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/keyp.pem" \ + -pass passme \ + -in "good.cat" -out "test_024.cat" + verify_signature "$?" "024" "cat" "success" "@2019-09-01 12:00:00" \ + "sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/03_sign_der b/tests/recipes/03_sign_der index 49b4150..7c38e9d 100644 --- a/tests/recipes/03_sign_der +++ b/tests/recipes/03_sign_der @@ -56,4 +56,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="034. Sign a CAT file with the encrypted private key file in the DER format" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.der" \ + -pass passme \ + -in "good.cat" -out "test_034.cat" + verify_signature "$?" "034" "cat" "success" "@2019-09-01 12:00:00" \ + "sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/04_sign_spc_pvk b/tests/recipes/04_sign_spc_pvk index 09c8599..5d3364c 100644 --- a/tests/recipes/04_sign_spc_pvk +++ b/tests/recipes/04_sign_spc_pvk @@ -56,4 +56,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="044. Sign a CAT file a SPC certificate file and a PVK private key file" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -spc "${script_path}/../certs/cert.spc" -key "${script_path}/../certs/key.pvk" \ + -pass passme \ + -in "good.cat" -out "test_044.cat" + verify_signature "$?" "044" "cat" "success" "@2019-09-01 12:00:00" \ + "sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/05_sign_pkcs12 b/tests/recipes/05_sign_pkcs12 index 381a56f..b57363e 100644 --- a/tests/recipes/05_sign_pkcs12 +++ b/tests/recipes/05_sign_pkcs12 @@ -54,4 +54,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="054. Sign a CAT file with a certificate and key stored in a PKCS#12 container" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -pkcs12 "${script_path}/../certs/cert.p12" \ + -pass passme \ + -in "good.cat" -out "test_054.cat" + verify_signature "$?" "054" "cat" "success" "@2019-09-01 12:00:00" \ + "sha256sum" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/06_test_sha256sum b/tests/recipes/06_test_sha256sum index a06460d..631b381 100644 --- a/tests/recipes/06_test_sha256sum +++ b/tests/recipes/06_test_sha256sum @@ -45,7 +45,20 @@ if test -s "sample.msi" skip=$(($skip+1)) fi -if test $skip -lt 3 +if test -s "good.cat" + then + if test $(cat "sha256sum_cat.log" | cut -d' ' -f1 | uniq | wc -l) -ne 1 + then + res=1 + cat "sha256sum_cat.log" >> "results.log" + printf "Non-unique SHA256 message digests found\n" >> "results.log" + fi + rm -f "sha256sum_cat.log" + else + skip=$(($skip+1)) + fi + +if test $skip -lt 4 then test_result "$res" "$test_name" else diff --git a/tests/recipes/07_sign_timestamp b/tests/recipes/07_sign_timestamp index 22d5dd3..05417a2 100644 --- a/tests/recipes/07_sign_timestamp +++ b/tests/recipes/07_sign_timestamp @@ -61,4 +61,23 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="074. Sign a CAT file with Authenticode timestamping" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -t http://time.certum.pl/ \ + -t http://timestamp.digicert.com/ \ + -verbose \ + -in "good.cat" -out "test_074.cat" + verify_signature "$?" "074" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "Timestamp Server Signature" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/08_sign_rfc3161 b/tests/recipes/08_sign_rfc3161 index 07a24dc..cd71023 100644 --- a/tests/recipes/08_sign_rfc3161 +++ b/tests/recipes/08_sign_rfc3161 @@ -65,4 +65,23 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="084. Sign a CAT file with RFC 3161 timestamping" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -ts http://time.certum.pl/ \ + -ts http://timestamp.digicert.com/ \ + -verbose \ + -in "good.cat" -out "test_084.cat" + verify_signature "$?" "084" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "Timestamp Server Signature" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/09_sign_page_hashes b/tests/recipes/09_sign_page_hashes index f69830c..cb1e3ec 100644 --- a/tests/recipes/09_sign_page_hashes +++ b/tests/recipes/09_sign_page_hashes @@ -26,4 +26,7 @@ if test -s "test.exe" # MSI file # Warning: -ph option is only valid for PE files +# CAT file +# Warning: -ph option is only valid for PE files + exit 0 diff --git a/tests/recipes/10_sign_blob b/tests/recipes/10_sign_blob index 2ab0610..b3fec94 100644 --- a/tests/recipes/10_sign_blob +++ b/tests/recipes/10_sign_blob @@ -15,7 +15,7 @@ if test -s "test.exe" -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ -in "test.exe" -out "test_101.exe" 2>> "results.log" 1>&2 verify_signature "$?" "101" "exe" "success" "@2019-09-01 12:00:00" \ - "UNUSED_PATTERN" "ASCII" "BEGIN_BLOB" "MODIFY" + "UNUSED_PATTERN" "ASCII" "BEGIN_BLOB---" "MODIFY" test_result "$?" "$test_name" else printf "Test skipped\n" @@ -32,7 +32,7 @@ if test -s "test.ex_" -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ -in "test.ex_" -out "test_102.ex_" 2>> "results.log" 1>&2 verify_signature "$?" "102" "ex_" "success" "@2019-09-01 12:00:00" \ - "UNUSED_PATTERN" "ASCII" "BEGIN_BLOB" "MODIFY" + "UNUSED_PATTERN" "ASCII" "BEGIN_BLOB---" "MODIFY" test_result "$?" "$test_name" else printf "Test skipped\n" @@ -49,7 +49,25 @@ if test -s "sample.msi" -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ -in "sample.msi" -out "test_103.msi" 2>> "results.log" 1>&2 verify_signature "$?" "103" "msi" "success" "@2019-09-01 12:00:00" \ - "UNUSED_PATTERN" "ASCII" "BEGIN_BLOB" "MODIFY" + "UNUSED_PATTERN" "ASCII" "BEGIN_BLOB---" "MODIFY" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + +# CAT file +# The message digest is checked by PKCS7_verify() +test_name="104. Sign a CAT file with addUnauthenticatedBlob" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -addUnauthenticatedBlob \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_104.cat" 2>> "results.log" 1>&2 + verify_signature "$?" "104" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "UNUSED_PATTERN" "UNUSED_PATTERN" test_result "$?" "$test_name" else printf "Test skipped\n" diff --git a/tests/recipes/11_sign_nest b/tests/recipes/11_sign_nest index 097f124..8cddaa6 100644 --- a/tests/recipes/11_sign_nest +++ b/tests/recipes/11_sign_nest @@ -68,4 +68,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Warning: CAT files do not support nesting + exit 0 diff --git a/tests/recipes/12_sign_readpass_pem b/tests/recipes/12_sign_readpass_pem index ec20bdd..2363a55 100644 --- a/tests/recipes/12_sign_readpass_pem +++ b/tests/recipes/12_sign_readpass_pem @@ -55,4 +55,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="124. Sign a CAT file with a PEM key file and the file with a password" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -readpass "${script_path}/../certs/password.txt" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/keyp.pem" \ + -in "good.cat" -out "test_124.cat" + verify_signature "$?" "124" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/13_sign_readpass_pkcs12 b/tests/recipes/13_sign_readpass_pkcs12 index cc49608..4b92580 100644 --- a/tests/recipes/13_sign_readpass_pkcs12 +++ b/tests/recipes/13_sign_readpass_pkcs12 @@ -56,4 +56,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="134. Sign a CAT file with a PKCS#12 container and the file with a password" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -readpass "${script_path}/../certs/password.txt" \ + -pkcs12 "${script_path}/../certs/cert.p12" \ + -in "good.cat" -out "test_134.cat" + verify_signature "$?" "134" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "osslsigncode" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/14_sign_descryption b/tests/recipes/14_sign_descryption index b9f4e59..d718ea3 100644 --- a/tests/recipes/14_sign_descryption +++ b/tests/recipes/14_sign_descryption @@ -55,4 +55,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="144. Sign a CAT file with a descryption" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -n "DESCRYPTION_TEXT" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_144.cat" + verify_signature "$?" "144" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "DESCRYPTION_TEXT" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/15_sign_url b/tests/recipes/15_sign_url index d659602..f0181c0 100644 --- a/tests/recipes/15_sign_url +++ b/tests/recipes/15_sign_url @@ -56,4 +56,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="154. Sign a CAT file with specified URL" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -i "https://www.osslsigncode.com/" \ + -in "good.cat" -out "test_154.cat" + verify_signature "$?" "154" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "https://www.osslsigncode.com/" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/16_sign_comm b/tests/recipes/16_sign_comm index 25d74dd..108a560 100644 --- a/tests/recipes/16_sign_comm +++ b/tests/recipes/16_sign_comm @@ -58,4 +58,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="164. Sign a CAT file with the common purpose set" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -comm \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_164.cat" + verify_signature "$?" "164" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "HEX" "300c060a2b060104018237020116" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/17_sign_crosscertfile b/tests/recipes/17_sign_crosscertfile index 638d905..3f3b6d7 100644 --- a/tests/recipes/17_sign_crosscertfile +++ b/tests/recipes/17_sign_crosscertfile @@ -57,4 +57,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="174. Add an additional certificate to the signature block of the CAT file" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -ac "${script_path}/../certs/crosscert.pem" \ + -in "good.cat" -out "test_174.cat" + verify_signature "$?" "174" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "crosscert" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/21_sign_hash_md5 b/tests/recipes/21_sign_hash_md5 index 07b2237..2249940 100644 --- a/tests/recipes/21_sign_hash_md5 +++ b/tests/recipes/21_sign_hash_md5 @@ -24,4 +24,6 @@ if test -s "test.exe" # MSI file +# CAT file + exit 0 diff --git a/tests/recipes/22_sign_hash_sha1 b/tests/recipes/22_sign_hash_sha1 index a241a77..ee6d8b4 100644 --- a/tests/recipes/22_sign_hash_sha1 +++ b/tests/recipes/22_sign_hash_sha1 @@ -24,4 +24,6 @@ if test -s "test.exe" # MSI file +# CAT file + exit 0 diff --git a/tests/recipes/23_sign_hash_sha2 b/tests/recipes/23_sign_hash_sha2 index 6c77dff..cb0cc76 100644 --- a/tests/recipes/23_sign_hash_sha2 +++ b/tests/recipes/23_sign_hash_sha2 @@ -24,4 +24,6 @@ if test -s "test.exe" # MSI file +# CAT file + exit 0 diff --git a/tests/recipes/24_sign_hash_sha384 b/tests/recipes/24_sign_hash_sha384 index fd7f9c1..38193a7 100644 --- a/tests/recipes/24_sign_hash_sha384 +++ b/tests/recipes/24_sign_hash_sha384 @@ -24,4 +24,6 @@ if test -s "test.exe" # MSI file +# CAT file + exit 0 diff --git a/tests/recipes/25_sign_hash_sha512 b/tests/recipes/25_sign_hash_sha512 index 35a1485..12f77c6 100644 --- a/tests/recipes/25_sign_hash_sha512 +++ b/tests/recipes/25_sign_hash_sha512 @@ -24,4 +24,6 @@ if test -s "test.exe" # MSI file +# CAT file + exit 0 diff --git a/tests/recipes/26_extract_signature_pem b/tests/recipes/26_extract_signature_pem index 550f01f..102ccf3 100644 --- a/tests/recipes/26_extract_signature_pem +++ b/tests/recipes/26_extract_signature_pem @@ -58,4 +58,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/27_extract_signature_der b/tests/recipes/27_extract_signature_der index 20c1ae5..bb9e139 100644 --- a/tests/recipes/27_extract_signature_der +++ b/tests/recipes/27_extract_signature_der @@ -58,4 +58,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/31_attach_signature_der b/tests/recipes/31_attach_signature_der index 1743eaa..8e86959 100644 --- a/tests/recipes/31_attach_signature_der +++ b/tests/recipes/31_attach_signature_der @@ -55,4 +55,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/32_attach_signature_pem b/tests/recipes/32_attach_signature_pem index 1903814..0415341 100644 --- a/tests/recipes/32_attach_signature_pem +++ b/tests/recipes/32_attach_signature_pem @@ -55,4 +55,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/33_attach_signed b/tests/recipes/33_attach_signed index 4f62ee2..2f19337 100644 --- a/tests/recipes/33_attach_signed +++ b/tests/recipes/33_attach_signed @@ -66,4 +66,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/34_attach_nest b/tests/recipes/34_attach_nest index 90c7bc7..414b427 100644 --- a/tests/recipes/34_attach_nest +++ b/tests/recipes/34_attach_nest @@ -71,4 +71,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/35_remove_signature b/tests/recipes/35_remove_signature index c31cccc..612c074 100644 --- a/tests/recipes/35_remove_signature +++ b/tests/recipes/35_remove_signature @@ -58,4 +58,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Unsupported command + exit 0 diff --git a/tests/recipes/37_add_signature_timestamp b/tests/recipes/37_add_signature_timestamp index 6ec4162..46f3641 100644 --- a/tests/recipes/37_add_signature_timestamp +++ b/tests/recipes/37_add_signature_timestamp @@ -67,4 +67,26 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="374. Add an authenticode timestamp to the CAT file" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_374_signed.cat" && \ + ../../osslsigncode add \ + -t http://time.certum.pl/ \ + -t http://timestamp.digicert.com/ \ + -verbose \ + -in "test_374_signed.cat" -out "test_374.cat" + verify_signature "$?" "374" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "Timestamp Server Signature" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + + exit 0 diff --git a/tests/recipes/38_add_signature_rfc3161 b/tests/recipes/38_add_signature_rfc3161 index efd81b6..aee5d65 100644 --- a/tests/recipes/38_add_signature_rfc3161 +++ b/tests/recipes/38_add_signature_rfc3161 @@ -67,4 +67,25 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="384. Add RFC 3161 timestamp to signed CAT file" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_384_signed.cat" + ../../osslsigncode add \ + -ts http://time.certum.pl/ \ + -ts http://timestamp.digicert.com/ \ + -verbose \ + -in "test_384_signed.cat" -out "test_384.cat" + verify_signature "$?" "384" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "Timestamp Server Signature" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/39_add_signature_blob b/tests/recipes/39_add_signature_blob index 5e05385..bfaa0ad 100644 --- a/tests/recipes/39_add_signature_blob +++ b/tests/recipes/39_add_signature_blob @@ -61,4 +61,24 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# The message digest is checked by PKCS7_verify() +test_name="394. Add an unauthenticated blob to the CAT file" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_394_signed.cat" + ../../osslsigncode add \ + -addUnauthenticatedBlob \ + -in "test_394_signed.cat" -out "test_394.cat" + verify_signature "$?" "394" "cat" "success" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "ASCII" "UNUSED_PATTERN" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/40_verify_leaf_hash b/tests/recipes/40_verify_leaf_hash index 14af5f6..c7e1b1f 100644 --- a/tests/recipes/40_verify_leaf_hash +++ b/tests/recipes/40_verify_leaf_hash @@ -49,4 +49,19 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="404. Compare the leaf certificate hash against specified SHA256 message digest for the CAT file" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + ../../osslsigncode sign -h sha256 \ + -st "1556668800" \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.der" \ + -in "good.cat" -out "test_404.cat" + verify_leaf_hash "$?" "404" "cat" "@2019-05-01 00:00:00" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/41_sign_add_msi_dse b/tests/recipes/41_sign_add_msi_dse index 0ef3b50..6d18f14 100644 --- a/tests/recipes/41_sign_add_msi_dse +++ b/tests/recipes/41_sign_add_msi_dse @@ -32,4 +32,7 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +# Warning: -add-msi-dse option is only valid for MSI files + exit 0 diff --git a/tests/recipes/42_sign_jp_low b/tests/recipes/42_sign_jp_low index c70f8a3..5fd5064 100644 --- a/tests/recipes/42_sign_jp_low +++ b/tests/recipes/42_sign_jp_low @@ -28,4 +28,7 @@ if test -s "test.ex_" # MSI file # Warning: -jp option is only valid for CAB files +# CAT file +# Warning: -jp option is only valid for CAB files + exit 0 diff --git a/tests/recipes/45_verify_fake_pe b/tests/recipes/45_verify_fake_pe index 6b60c0e..4e1e576 100644 --- a/tests/recipes/45_verify_fake_pe +++ b/tests/recipes/45_verify_fake_pe @@ -27,4 +27,7 @@ if test -s "test.exe" # MSI file # Command is not supported for non-PE files +# CAT file +# Command is not supported for non-PE files + exit 0 diff --git a/tests/recipes/46_verify_timestamp b/tests/recipes/46_verify_timestamp index 83156b2..618377e 100644 --- a/tests/recipes/46_verify_timestamp +++ b/tests/recipes/46_verify_timestamp @@ -30,4 +30,7 @@ if test -s "test.exe" && ! grep -q "no libcurl available" "results.log" # MSI file # Command is not supported for non-PE files +# CAT file +# Command is not supported for non-PE files + exit 0 diff --git a/tests/recipes/47_verify_rfc3161 b/tests/recipes/47_verify_rfc3161 index 670e876..0dc1fc5 100755 --- a/tests/recipes/47_verify_rfc3161 +++ b/tests/recipes/47_verify_rfc3161 @@ -31,4 +31,7 @@ if test -s "test.exe" && ! grep -q "no libcurl available" "results.log" # MSI file # Command is not supported for non-PE files +# CAT file +# Command is not supported for non-PE files + exit 0 diff --git a/tests/recipes/51_verify_time b/tests/recipes/51_verify_time index e4ca4ed..49e15a9 100644 --- a/tests/recipes/51_verify_time +++ b/tests/recipes/51_verify_time @@ -54,4 +54,21 @@ if test -s "sample.msi" printf "Test skipped\n" fi +# CAT file +test_name="514. Verify CAT file signature after the cert has been expired" +printf "\n%s\n" "$test_name" +if test -s "good.cat" + then + TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c ' + script_path=$(pwd) + ../../osslsigncode sign -h sha256 \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -in "good.cat" -out "test_514.cat"' + verify_signature "$?" "514" "cat" "fail" "@2025-01-01 12:00:00" \ + "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/52_verify_timestamp b/tests/recipes/52_verify_timestamp index b3ee1c3..cae51ac 100644 --- a/tests/recipes/52_verify_timestamp +++ b/tests/recipes/52_verify_timestamp @@ -63,4 +63,24 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="524. Verify CAT file signature with timestamping after the cert has been expired" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c ' + script_path=$(pwd) + ../../osslsigncode sign -h sha256 \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -t http://time.certum.pl/ \ + -t http://timestamp.digicert.com/ \ + -verbose \ + -in "good.cat" -out "test_524.cat"' + verify_signature "$?" "524" "cat" "success" "@2025-01-01 12:00:00" \ + "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/53_verify_rfc3161 b/tests/recipes/53_verify_rfc3161 index 310ba0c..e9e37b2 100644 --- a/tests/recipes/53_verify_rfc3161 +++ b/tests/recipes/53_verify_rfc3161 @@ -63,4 +63,24 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="534. Verify CAT file signature with RFC3161 after the cert has been expired" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c ' + script_path=$(pwd) + ../../osslsigncode sign -h sha256 \ + -certs "${script_path}/../certs/cert.pem" -key "${script_path}/../certs/key.pem" \ + -ts http://time.certum.pl/ \ + -ts http://timestamp.digicert.com/ \ + -verbose \ + -in "good.cat" -out "test_534.cat"' + verify_signature "$?" "534" "cat" "success" "@2025-01-01 12:00:00" \ + "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/54_verify_expired b/tests/recipes/54_verify_expired index 620ba34..ea1e1df 100644 --- a/tests/recipes/54_verify_expired +++ b/tests/recipes/54_verify_expired @@ -63,4 +63,24 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="544. Verify CAT file signed with the expired cert" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c ' + script_path=$(pwd) + ../../osslsigncode sign -h sha256 \ + -certs "${script_path}/../certs/expired.pem" -key "${script_path}/../certs/key.pem" \ + -t http://time.certum.pl/ \ + -t http://timestamp.digicert.com/ \ + -verbose \ + -in "good.cat" -out "test_544.cat"' + verify_signature "$?" "544" "cat" "fail" "@2025-01-01 12:00:00" \ + "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/55_verify_revoked b/tests/recipes/55_verify_revoked index 8cc04e5..b063aeb 100644 --- a/tests/recipes/55_verify_revoked +++ b/tests/recipes/55_verify_revoked @@ -63,4 +63,24 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +test_name="554. Verify CAT file signed with the revoked cert" +printf "\n%s\n" "$test_name" +if test -s "good.cat" && ! grep -q "no libcurl available" "results.log" + then + TZ=GMT faketime -f '@2019-05-01 00:00:00' /bin/bash -c ' + script_path=$(pwd) + ../../osslsigncode sign -h sha256 \ + -certs "${script_path}/../certs/revoked.pem" -key "${script_path}/../certs/key.pem" \ + -ts http://time.certum.pl/ \ + -ts http://timestamp.digicert.com/ \ + -verbose \ + -in "good.cat" -out "test_554.cat"' + verify_signature "$?" "554" "cat" "fail" "@2019-09-01 12:00:00" \ + "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" "UNUSED_PATTERN" + test_result "$?" "$test_name" + else + printf "Test skipped\n" + fi + exit 0 diff --git a/tests/recipes/56_verify_multiple b/tests/recipes/56_verify_multiple index 4f5cde2..bea80c4 100644 --- a/tests/recipes/56_verify_multiple +++ b/tests/recipes/56_verify_multiple @@ -96,4 +96,7 @@ if test -s "sample.msi" && ! grep -q "no libcurl available" "results.log" printf "Test skipped\n" fi +# CAT file +# Warning: CAT files do not support nesting + exit 0 diff --git a/tests/sources/good.cat b/tests/sources/good.cat new file mode 100755 index 0000000000000000000000000000000000000000..23cfbee148aa0d3285c45cc5a180c093e567538b GIT binary patch literal 394 zcmYjMJxc>o5S;h&?&QKH29zi%0)ko?Bl`|D2^c>T6BP`Im_kL1V2Cz~Mzj#cT#-gB zY_&No`~zD01GEv+3O4!&?6hAB*RTv3-oXfW6{ zt%NC*a8p6SyLFbzWShZ%(H25QUhjUNK3aphhuiO);i2bjU&tX%PKGLoRV-jg(Fvpc+l;kcT)kYc`^Pskt z$2hA=X2c$1R^;ihbAs;+IG0kwo26-*^8FENj7H-&N;tp?hpa+N6%i0BT4Z{}$&Y