Skip to content

Commit cb54510

Browse files
santiagorodriguez96santiagorodriguez96
authored
Update conformance specs to use FIDO MDS v3 (#407)
* build(conformanceTests): bump `webauthn` version * build(conformanceTests): bump `byebug` * build(conformanceTests): bump `fido_metadata` version * build(conformanceTests): use ruby `3.4.2` for conformance specs * build(conformanceTests): update bundler * build(conformanceTests): add `webrick` We have to add `webrick` too as it was removed from Ruby's standard library in 3.0 (https://bugs.ruby-lang.org/issues/17303). * feature(conformanceTests): use MDS v3 * build(conformanceTests): point `fido_metadata` to its repo's `main` branch * build(conformanceTests): bump `sinatra` from `2.2.4` to `4.1.1` * build(conformanceTests): add `puma` and `rackup` Fixes an error where `sinatra` was not being able to start. ``` Sinatra could not start, the required gems weren't found! Add them to your bundle with: bundle add rackup puma or install them with: gem install rackup puma ```
1 parent c9f656f commit cb54510

6 files changed

Lines changed: 92 additions & 58 deletions

File tree

‎spec/conformance/.ruby-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.7.2
1+
3.4.2

‎spec/conformance/Gemfile‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,15 @@
22

33
source "https://rubygems.org"
44

5-
ruby "~> 2.7.0"
5+
ruby "~> 3.4.2"
66

77
gem "byebug"
8-
gem "fido_metadata", "~> 0.4.0"
8+
gem "fido_metadata", github: 'bdewater/fido_metadata'
9+
gem "puma", "~> 6.6"
910
gem "rack-contrib"
11+
gem "rackup", "~> 2.2"
1012
gem "rubyzip"
11-
gem "sinatra", "~> 2.0"
13+
gem "sinatra", "~> 4.0"
1214
gem "sinatra-contrib"
1315
gem "webauthn", path: File.join("..", "..")
16+
gem "webrick", "~> 1.9"

‎spec/conformance/Gemfile.lock‎

Lines changed: 56 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,97 @@
1+
GIT
2+
remote: https://github.com/bdewater/fido_metadata.git
3+
revision: fcc1fc1a92f9b0eda5900485d773336494b2c1c6
4+
specs:
5+
fido_metadata (0.3.0)
6+
jwt (~> 2.0)
7+
18
PATH
29
remote: ../..
310
specs:
4-
webauthn (2.5.1)
11+
webauthn (3.4.0)
512
android_key_attestation (~> 0.3.0)
6-
awrence (~> 1.1)
713
bindata (~> 2.4)
814
cbor (~> 0.5.9)
915
cose (~> 1.1)
10-
openssl (~> 2.2)
16+
openssl (>= 2.2)
1117
safety_net_attestation (~> 0.4.0)
12-
tpm-key_attestation (~> 0.10.0)
18+
tpm-key_attestation (~> 0.14.0)
1319

1420
GEM
1521
remote: https://rubygems.org/
1622
specs:
1723
android_key_attestation (0.3.0)
18-
awrence (1.2.1)
19-
backports (3.15.0)
20-
bindata (2.4.10)
21-
byebug (11.0.1)
22-
cbor (0.5.9.6)
23-
cose (1.2.0)
24+
base64 (0.2.0)
25+
bindata (2.5.0)
26+
byebug (11.1.3)
27+
cbor (0.5.9.8)
28+
cose (1.3.1)
2429
cbor (~> 0.5.9)
2530
openssl-signature_algorithm (~> 1.0)
26-
fido_metadata (0.4.0)
27-
jwt (~> 2.0)
28-
ipaddr (1.2.4)
2931
jwt (2.2.1)
32+
logger (1.6.6)
3033
multi_json (1.14.1)
31-
mustermann (1.1.0)
34+
mustermann (3.0.3)
3235
ruby2_keywords (~> 0.0.1)
33-
openssl (2.2.1)
34-
ipaddr
35-
openssl-signature_algorithm (1.1.1)
36-
openssl (~> 2.0)
37-
rack (2.2.3)
38-
rack-contrib (2.1.0)
39-
rack (~> 2.0)
40-
rack-protection (2.0.8.1)
41-
rack
36+
nio4r (2.7.4)
37+
openssl (3.3.0)
38+
openssl-signature_algorithm (1.3.0)
39+
openssl (> 2.0)
40+
puma (6.6.0)
41+
nio4r (~> 2.0)
42+
rack (3.1.10)
43+
rack-contrib (2.5.0)
44+
rack (< 4)
45+
rack-protection (4.1.1)
46+
base64 (>= 0.1.0)
47+
logger (>= 1.6.0)
48+
rack (>= 3.0.0, < 4)
49+
rack-session (2.1.0)
50+
base64 (>= 0.1.0)
51+
rack (>= 3.0.0)
52+
rackup (2.2.1)
53+
rack (>= 3)
4254
ruby2_keywords (0.0.1)
4355
rubyzip (2.0.0)
4456
safety_net_attestation (0.4.0)
4557
jwt (~> 2.0)
46-
sinatra (2.0.8.1)
47-
mustermann (~> 1.0)
48-
rack (~> 2.0)
49-
rack-protection (= 2.0.8.1)
58+
sinatra (4.1.1)
59+
logger (>= 1.6.0)
60+
mustermann (~> 3.0)
61+
rack (>= 3.0.0, < 4)
62+
rack-protection (= 4.1.1)
63+
rack-session (>= 2.0.0, < 3)
5064
tilt (~> 2.0)
51-
sinatra-contrib (2.0.8.1)
52-
backports (>= 2.8.2)
53-
multi_json
54-
mustermann (~> 1.0)
55-
rack-protection (= 2.0.8.1)
56-
sinatra (= 2.0.8.1)
65+
sinatra-contrib (4.1.1)
66+
multi_json (>= 0.0.2)
67+
mustermann (~> 3.0)
68+
rack-protection (= 4.1.1)
69+
sinatra (= 4.1.1)
5770
tilt (~> 2.0)
5871
tilt (2.0.10)
59-
tpm-key_attestation (0.10.0)
72+
tpm-key_attestation (0.14.0)
6073
bindata (~> 2.4)
74+
openssl (> 2.0)
6175
openssl-signature_algorithm (~> 1.0)
76+
webrick (1.9.1)
6277

6378
PLATFORMS
6479
ruby
6580

6681
DEPENDENCIES
6782
byebug
68-
fido_metadata (~> 0.4.0)
83+
fido_metadata!
84+
puma (~> 6.6)
6985
rack-contrib
86+
rackup (~> 2.2)
7087
rubyzip
71-
sinatra (~> 2.0)
88+
sinatra (~> 4.0)
7289
sinatra-contrib
7390
webauthn!
91+
webrick (~> 1.9)
7492

7593
RUBY VERSION
76-
ruby 2.7.0p-1
94+
ruby 3.4.2p28
7795

7896
BUNDLED WITH
79-
2.2.14
97+
2.6.5

‎spec/conformance/MDSROOT.crt‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,29 @@
1+
!!!!!DO NOT DYNAMICALLY FETCH THIS CERTIFICATE!!!!!
2+
!!!!!ADD THIS CERTIFICATE DIRECTLY TO YOUR CERTIFICATE STORAGE OR SOURCE CODE!!!!!
3+
4+
FIDO Alliance Certification TEST Metadata Service Root Certificate
5+
Expected page status: Valid
6+
CN=FAKE Root FAKE
7+
OU=FAKE Metadata 3 BLOB Signing FAKE
8+
O=FIDO Alliance
9+
C=US
10+
Serial number=04 5A 1C 22 66 A1 4F 3F 1F 4D 29 55 12 23 15
11+
Valid from=01 February 2017
12+
Valid to=31 January 2045
13+
14+
Base64
115
-----BEGIN CERTIFICATE-----
2-
MIICZzCCAe6gAwIBAgIPBF0rd3WL/GExWV/szYNVMAoGCCqGSM49BAMDMGcxCzAJ
16+
MIICaDCCAe6gAwIBAgIPBCqih0DiJLW7+UHXx/o1MAoGCCqGSM49BAMDMGcxCzAJ
317
BgNVBAYTAlVTMRYwFAYDVQQKDA1GSURPIEFsbGlhbmNlMScwJQYDVQQLDB5GQUtF
4-
IE1ldGFkYXRhIFRPQyBTaWduaW5nIEZBS0UxFzAVBgNVBAMMDkZBS0UgUm9vdCBG
18+
IE1ldGFkYXRhIDMgQkxPQiBST09UIEZBS0UxFzAVBgNVBAMMDkZBS0UgUm9vdCBG
519
QUtFMB4XDTE3MDIwMTAwMDAwMFoXDTQ1MDEzMTIzNTk1OVowZzELMAkGA1UEBhMC
620
VVMxFjAUBgNVBAoMDUZJRE8gQWxsaWFuY2UxJzAlBgNVBAsMHkZBS0UgTWV0YWRh
7-
dGEgVE9DIFNpZ25pbmcgRkFLRTEXMBUGA1UEAwwORkFLRSBSb290IEZBS0UwdjAQ
8-
BgcqhkjOPQIBBgUrgQQAIgNiAARcVLd6r4fnNHzs5K2zfbg//4X9/oBqmsdRVtZ9
9-
iXhlgM9vFYaKviYtqmwkq0D3Lihg3qefeZgXXYi4dFgvzU7ZLBapSNM3CT8RDBe/
10-
MBJqsPwaRQbIsGmmItmt/ESNQD6jYDBeMAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8E
11-
BTADAQH/MB0GA1UdDgQWBBTd95rIHO/hX9Oh69szXzD0ahmZWTAfBgNVHSMEGDAW
12-
gBTd95rIHO/hX9Oh69szXzD0ahmZWTAKBggqhkjOPQQDAwNnADBkAjBkP3L99KEX
13-
QzviJVGytDMWBmITMBYv1LgNXXiSilWixTyQqHrYrFpLvNFyPZQvS6sCMFMAOUCw
14-
Ach/515XH0XlDbMgdIe2N4zzdY77TVwiHmsxTFWRT0FtS7fUk85c/LzSPQ==
15-
-----END CERTIFICATE-----
21+
dGEgMyBCTE9CIFJPT1QgRkFLRTEXMBUGA1UEAwwORkFLRSBSb290IEZBS0UwdjAQ
22+
BgcqhkjOPQIBBgUrgQQAIgNiAASKYiz3YltC6+lmxhPKwA1WFZlIqnX8yL5RybSL
23+
TKFAPEQeTD9O6mOz+tg8wcSdnVxHzwnXiQKJwhrav70rKc2ierQi/4QUrdsPes8T
24+
EirZOkCVJurpDFbXZOgs++pa4XmjYDBeMAsGA1UdDwQEAwIBBjAPBgNVHRMBAf8E
25+
BTADAQH/MB0GA1UdDgQWBBQGcfeCs0Y8D+lh6U5B2xSrR74eHTAfBgNVHSMEGDAW
26+
gBQGcfeCs0Y8D+lh6U5B2xSrR74eHTAKBggqhkjOPQQDAwNoADBlAjEA/xFsgri0
27+
xubSa3y3v5ormpPqCwfqn9s0MLBAtzCIgxQ/zkzPKctkiwoPtDzI51KnAjAmeMyg
28+
X2S5Ht8+e+EQnezLJBJXtnkRWY+Zt491wgt/AwSs5PHHMv5QgjELOuMxQBc=
29+
-----END CERTIFICATE-----

‎spec/conformance/conformance_cache_store.rb‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,20 @@ def setup_metadata_store(endpoint)
2222
puts("Setting up metadata store TOC")
2323

2424
response = Net::HTTP.post(
25-
URI("https://mds.certinfra.fidoalliance.org/getEndpoints"),
25+
URI("https://mds3.fido.tools/getEndpoints"),
2626
{ endpoint: endpoint }.to_json,
2727
FidoMetadata::Client::DEFAULT_HEADERS
2828
)
2929

3030
response.value
3131
possible_endpoints = JSON.parse(response.body)["result"]
3232

33-
client = FidoMetadata::Client.new(nil)
33+
client = FidoMetadata::Client.new
3434

3535
json =
3636
possible_endpoints.each_with_index do |uri, index|
3737
puts("Trying endpoint #{index}: #{uri}")
38-
break client.download_toc(URI(uri), trusted_certs: conformance_certificates)
38+
break client.download_toc(URI(uri), algorithms: ["ES256"], trusted_certs: conformance_certificates)
3939
rescue FidoMetadata::Client::DataIntegrityError, JWT::VerificationError, Net::HTTPFatalError
4040
nil
4141
end

‎spec/conformance/server.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ def self.registered_for(username)
4242

4343
mds_finder =
4444
MDSFinder.new.tap do |mds|
45-
mds.token = ""
4645
mds.cache_backend = ConformanceCacheStore.new
4746
mds.cache_backend.setup_authenticators
4847
mds.cache_backend.setup_metadata_store("http://#{host}:#{settings.port}")
@@ -51,7 +50,7 @@ def self.registered_for(username)
5150
relying_party = WebAuthn::RelyingParty.new(
5251
origin: "http://#{host}:#{settings.port}",
5352
name: RP_NAME,
54-
algorithms: %w(ES256 ES384 ES512 PS256 PS384 PS512 RS256 RS384 RS512 RS1),
53+
algorithms: %w(ES256 ES384 ES512 PS256 PS384 PS512 RS256 RS384 RS512 RS1 EdDSA),
5554
silent_authentication: true,
5655
attestation_root_certificates_finders: mds_finder
5756
)

0 commit comments

Comments
 (0)