test: add test for check_certificate command

Author: notmandatory

Justfile

@@ -18,7 +18,7 @@ build: fmt
     cargo build --all-features --tests
 
 # test the rust-cktap lib with the coinkite cktap card emulator
-test-lib:
+test: fmt
     (test -d emulator_env || python3 -m venv emulator_env) && source emulator_env/bin/activate && pip install -r {{emulator_dir}}/requirements.txt
     source emulator_env/bin/activate && cargo test -p rust-cktap --features emulator
 

README.md

@@ -43,10 +43,8 @@ It is up to the crate user to send and receive the raw cktap APDU messages via N
 
 ### Automated Testing with Emulator
 
-1. Install and start [cktap emulator](https://github.com/coinkite/coinkite-tap-proto/blob/master/emulator/README.md)
-   - TapSigner: `./ecard.py emulate -t --no-init`
-   - SatsCard: `./ecard.py emulate -s`
-2. run tests: `cargo test --features emulator`
+1. Install dependencies for [cktap emulator](https://github.com/coinkite/coinkite-tap-proto/blob/master/emulator/README.md)
+2. run tests with emulator: `just test`
 
 ### Manual Testing with real cards
 

lib/examples/pcsc.rs

@@ -5,9 +5,9 @@ use rust_cktap::commands::{Certificate, Wait};
 use rust_cktap::{pcsc, rand_chaincode, CkTapCard};
 
 use bitcoin::secp256k1::rand;
+use rust_cktap::tap_signer::TapSignerShared;
 use std::io;
 use std::io::Write;
-use rust_cktap::tap_signer::TapSignerShared;
 
 fn get_cvc() -> String {
     print!("Enter cvc: ");

lib/src/apdu.rs

@@ -28,6 +28,8 @@ pub enum Error {
     CkTap(CkTapError),
     #[error("IncorrectSignature: {0}")]
     IncorrectSignature(String),
+    #[error("Root cert is not from Coinkite. Card is counterfeit: {0}")]
+    InvalidRootCert(String),
     #[error("UnknownCardType: {0}")]
     UnknownCardType(String),
 

lib/src/commands.rs

@@ -277,16 +277,10 @@ mod tests {
     async fn test_new_command() {
         let rng = &mut rand::thread_rng();
         let chain_code = rand_chaincode(rng);
-        for card_type in [
-            CardTypeOption::SatsCard,
-            CardTypeOption::TapSigner,
-            CardTypeOption::SatsChip,
-        ] {
+        for card_type in CardTypeOption::values() {
             let pipe_path = format!("/tmp/test-new-command-pipe{card_type}");
             let pipe_path = Path::new(&pipe_path);
-            // Only SatsCard is expected to be initialized
-            let no_init = card_type != CardTypeOption::SatsCard;
-            let python = EcardSubprocess::new(pipe_path, &card_type, no_init).unwrap();
+            let python = EcardSubprocess::new(pipe_path, &card_type).unwrap();
             let emulator = find_emulator(pipe_path).await.unwrap();
             match emulator {
                 CkTapCard::SatsCard(mut sc) => {
@@ -321,6 +315,39 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn test_cert_command() {
+        for card_type in CardTypeOption::values() {
+            let emulator_root_pubkey =
+                "0312d005ca1501b1603c3b00412eefe27c6b20a74c29377263b357b3aff12de6fa".to_string();
+            let pipe_path = format!("/tmp/test-cert-command-pipe{card_type}");
+            let pipe_path = Path::new(&pipe_path);
+            let python = EcardSubprocess::new(pipe_path, &card_type).unwrap();
+            let emulator = find_emulator(pipe_path).await.unwrap();
+            match emulator {
+                CkTapCard::SatsCard(mut sc) => {
+                    assert_eq!(card_type, CardTypeOption::SatsCard);
+                    let response = sc.check_certificate().await;
+                    assert!(response.is_err());
+                    matches!(response, Err(Error::InvalidRootCert(pubkey)) if pubkey == emulator_root_pubkey);
+                }
+                CkTapCard::TapSigner(mut ts) => {
+                    assert_eq!(card_type, CardTypeOption::TapSigner);
+                    let response = ts.check_certificate().await;
+                    assert!(response.is_err());
+                    matches!(response, Err(Error::InvalidRootCert(pubkey)) if pubkey == emulator_root_pubkey);
+                }
+                CkTapCard::SatsChip(mut sc) => {
+                    assert_eq!(card_type, CardTypeOption::SatsChip);
+                    let response = sc.check_certificate().await;
+                    assert!(response.is_err());
+                    matches!(response, Err(Error::InvalidRootCert(pubkey)) if pubkey == emulator_root_pubkey);
+                }
+            };
+            drop(python);
+        }
+    }
+
     // #[test]
     // fn test_tapsigner_signature() {
     //     let card_pubkey = PublicKey::from_slice(

lib/src/emulator.rs

@@ -67,6 +67,16 @@ pub mod test {
         SatsChip,
     }
 
+    impl CardTypeOption {
+        pub fn values() -> [CardTypeOption; 3] {
+            [
+                CardTypeOption::SatsCard,
+                CardTypeOption::TapSigner,
+                CardTypeOption::SatsChip,
+            ]
+        }
+    }
+
     impl Display for CardTypeOption {
         fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
             let str = match self {
@@ -82,8 +92,10 @@ pub mod test {
         pub fn new(
             pipe_path: &Path,
             card_type: &CardTypeOption,
-            no_init: bool,
         ) -> Result<Self, Box<dyn std::error::Error>> {
+            // Only SatsCard is expected to be initialized
+            let no_init = *card_type != CardTypeOption::SatsCard;
+
             // execute ecard.py python script
             let mut command = Command::new("python3");
             command
@@ -100,6 +112,7 @@ pub mod test {
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
             if no_init {
+                // Do not initialize the first slot of card
                 command.arg("--no-init");
             }
             let child = command.spawn()?;
@@ -120,7 +133,7 @@ pub mod test {
     #[tokio::test]
     pub async fn test_transmit() {
         let pipe_path = Path::new("/tmp/test-transmit-pipe");
-        let _python = EcardSubprocess::new(pipe_path, &CardTypeOption::SatsCard, false).unwrap();
+        let _python = EcardSubprocess::new(pipe_path, &CardTypeOption::SatsCard).unwrap();
         let emulator = find_emulator(pipe_path).await.unwrap();
         dbg!(emulator);
     }

lib/src/factory_root_key.rs

@@ -24,8 +24,8 @@ impl TryFrom<PublicKey> for FactoryRootKey {
         match pubkey.serialize().to_lower_hex_string().as_str() {
             PUB_FACTORY_ROOT_KEY => Ok(FactoryRootKey::Pub(pubkey)),
             DEV_FACTORY_ROOT_KEY => Ok(FactoryRootKey::Dev(pubkey)),
-            _ => Err(Error::IncorrectSignature(
-                "Root cert is not from Coinkite. Card is counterfeit.".to_string(),
+            _ => Err(Error::InvalidRootCert(
+                pubkey.serialize().to_lower_hex_string(),
             )),
         }
     }

lib/src/sats_chip.rs

@@ -1,7 +1,4 @@
-use bitcoin::secp256k1::{
-    hashes::{sha256, Hash as _},
-    All, Message, PublicKey, Secp256k1,
-};
+use bitcoin::secp256k1::{All, PublicKey, Secp256k1};
 
 use crate::apdu::{Error, StatusResponse};
 use crate::commands::{Authentication, Certificate, CkTransport, Read, Wait};
@@ -30,6 +27,10 @@ impl<T: CkTransport> Authentication<T> for SatsChip<T> {
         &self.secp
     }
 
+    fn ver(&self) -> &str {
+        &self.ver
+    }
+
     fn pubkey(&self) -> &PublicKey {
         &self.pubkey
     }
@@ -90,14 +91,8 @@ impl<T: CkTransport> Read<T> for SatsChip<T> {
 }
 
 impl<T: CkTransport> Certificate<T> for SatsChip<T> {
-    fn message_digest(&mut self, card_nonce: [u8; 16], app_nonce: [u8; 16]) -> Message {
-        let mut message_bytes: Vec<u8> = Vec::new();
-        message_bytes.extend("OPENDIME".as_bytes());
-        message_bytes.extend(card_nonce);
-        message_bytes.extend(app_nonce);
-
-        let message_bytes_hash = sha256::Hash::hash(message_bytes.as_slice());
-        Message::from_digest(message_bytes_hash.to_byte_array())
+    async fn slot_pubkey(&mut self) -> Result<Option<PublicKey>, Error> {
+        Ok(None)
     }
 }