Tests are functional

Author: scheibling

.gitignore

@@ -145,4 +145,5 @@ report.html
 test_certificate
 testing.py
 .idea
-core
+core
+tests/TestSignatures

src/sshkey_tools/signatures.py

@@ -36,7 +36,7 @@ class SignatureFieldset(Fieldset):
     sig_version: _FIELD.SignatureVersionField = _FIELD.SignatureVersionField.factory
     public_key: _FIELD.PublicKeyField = _FIELD.PublicKeyField.factory
 
-    namespace: _FIELD.SignatureNamespaceField = _FIELD.StringField.factory  
+    namespace: _FIELD.SignatureNamespaceField = _FIELD.SignatureNamespaceField.factory
     reserved: _FIELD.ReservedField = _FIELD.ReservedField.factory
     hash_algorithm: _FIELD.SignatureHashAlgorithmField = _FIELD.SignatureHashAlgorithmField.factory
     signature: _FIELD.SignatureField = _FIELD.SignatureField.factory
@@ -75,6 +75,57 @@ def bytes_out(self):
             bytes(self.signature)
         )
 
+    @classmethod
+    def decode(cls, data: bytes):
+        """
+        Decode a SignatureFieldset from SSHSIG binary format.
+        Overrides Fieldset.decode to handle the public key field
+        which is encoded as a length-prefixed SSH wire-format key.
+        """
+        cl_instance = cls()
+
+        decoded, data = cl_instance.magic_preamble.from_decode(data)
+        cl_instance.magic_preamble = decoded
+
+        decoded, data = cl_instance.sig_version.from_decode(data)
+        cl_instance.sig_version = decoded
+
+        # public_key is stored as string(ssh-wire-key) in SSHSIG format
+        pubkey_bytes, data = _FIELD.BytestringField.decode(data)
+        key_type, key_data = _FIELD.StringField.decode(pubkey_bytes)
+
+        sshsig_key_map = {
+            "ssh-rsa": "RsaPubkeyField",
+            "ecdsa-sha2-nistp256": "EcdsaPubkeyField",
+            "ecdsa-sha2-nistp384": "EcdsaPubkeyField",
+            "ecdsa-sha2-nistp521": "EcdsaPubkeyField",
+            "ssh-ed25519": "Ed25519PubkeyField",
+        }
+
+        field_cls_name = sshsig_key_map.get(key_type)
+        if field_cls_name is None:
+            raise _EX.InvalidDataException(
+                f"Unknown public key type in signature: {key_type}"
+            )
+
+        field_cls = getattr(_FIELD, field_cls_name)
+        key_value, _ = field_cls.decode(key_data)
+        cl_instance.public_key = field_cls(value=key_value)
+
+        decoded, data = cl_instance.namespace.from_decode(data)
+        cl_instance.namespace = decoded
+
+        decoded, data = cl_instance.reserved.from_decode(data)
+        cl_instance.reserved = decoded
+
+        decoded, data = cl_instance.hash_algorithm.from_decode(data)
+        cl_instance.hash_algorithm = decoded
+
+        decoded, data = cl_instance.signature.from_decode(data)
+        cl_instance.signature = decoded
+
+        return cl_instance, data
+
 class SSHSignature:
     """
     General class for SSH Signatures, used for loading and parsing.
@@ -189,9 +240,8 @@ def get_signable_file(self, path: str) -> bytes:
     def __str__(self) -> str:
         table = PrettyTable(["Field", "Value"])
 
-        for item in (self.header, self.fields, self.footer):
-            for row in item.__table__():
-                table.add_row(row)
+        for row in self.fields.__table__():
+            table.add_row(row)
 
         return str(table)
 
@@ -204,7 +254,8 @@ def get(self, field: str):
     def set(self, field: str, data):
         if field in self.fields.getattrs():
             self.fields.set(field, data)
-        
+            return
+
         raise _EX.InvalidCertificateFieldException(f"Unknown field {field}")
 
     def verify(

tests/test_certificates.py

@@ -8,6 +8,7 @@
 import random
 import shutil
 import unittest
+import subprocess
 
 import faker
 
@@ -569,14 +570,21 @@ def assertCertificateCreated(self, sub_type, ca_type):
         )
 
         self.assertTrue(certificate.can_sign())
+        
+        
         certificate.sign()
         certificate.to_file(f"tests/certificates/{sub_type}_{ca_type}-cert.pub")
+        
+        createdCmd = subprocess.run(
+            ["ssh-keygen", "-Lf", f"tests/certificates/{sub_type}_{ca_type}-cert.pub"],
+            capture_output=True,
+            text=True
+        )
 
         self.assertEqual(
             0,
-            os.system(
-                f"ssh-keygen -Lf tests/certificates/{sub_type}_{ca_type}-cert.pub"
-            ),
+            createdCmd.returncode,
+            f"ssh-keygen failed to read the created certificate: {createdCmd.stderr}"
         )
 
         reloaded_cert = _CERT.SSHCertificate.from_file(

tests/test_keypairs.py

@@ -5,6 +5,7 @@
 import os
 import shutil
 import unittest
+import subprocess
 
 from cryptography.hazmat.primitives.asymmetric import ec as _EC
 from cryptography.hazmat.primitives.asymmetric import ed25519 as _ED25519
@@ -38,16 +39,22 @@ def generateFiles(self, folder):
             shutil.rmtree(f"tests/{folder}")
             os.mkdir(f"tests/{folder}")
 
-        os.system(
-            f'ssh-keygen -t rsa -b 2048 -f tests/{folder}/rsa_key_sshkeygen -N "password" > /dev/null 2>&1'
+        subprocess.run(
+            ["ssh-keygen", "-t", "rsa", "-b", "2048", "-f", f"tests/{folder}/rsa_key_sshkeygen", "-N", "password"],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL
         )
-        os.system(
-            f'ssh-keygen -t ecdsa -b 256 -f tests/{folder}/ecdsa_key_sshkeygen -N "" > /dev/null 2>&1'
+        subprocess.run(
+            ["ssh-keygen", "-t", "ecdsa", "-b", "256", "-f", f"tests/{folder}/ecdsa_key_sshkeygen", "-N", ""],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL
         )
-        os.system(
-            f'ssh-keygen -t ed25519 -f tests/{folder}/ed25519_key_sshkeygen -N "" > /dev/null 2>&1'
+        subprocess.run(
+            ["ssh-keygen", "-t", "ed25519", "-f", f"tests/{folder}/ed25519_key_sshkeygen", "-N", ""],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL
         )
-
+        
     def setUp(self):
         self.generateClasses()
         self.generateFiles("KeypairMethods")
@@ -76,16 +83,11 @@ def assertEqualPublicKeys(self, keyclass, a, b):
         self.assertEqual(a.raw_bytes(), b.raw_bytes())
 
     def assertEqualKeyFingerprint(self, file_a, file_b):
+        fp_a = subprocess.run(["ssh-keygen", "-lf", file_a], capture_output=True, text=True)
+        fp_b = subprocess.run(["ssh-keygen", "-lf", file_b], capture_output=True, text=True)
+        
         self.assertEqual(
-            0,
-            os.system(
-                f"""bash -c "
-               diff \
-               <( ssh-keygen -lf {file_a}) \
-               <( ssh-keygen -lf {file_b}) \
-            "
-            """
-            ),
+            fp_a.stdout, fp_b.stdout
         )
 
 

tests/test_signatures.py

@@ -1,10 +1,11 @@
 # Test SSH signatures (SSHSIG format)
 # Tests for signature-specific fields, SSHSignature creation/parsing
 # Tests creating signatures with sshkey-tools and verifying with ssh-keygen, and vice versa
-
+import io
 import os
 import shutil
 import unittest
+import subprocess
 
 import src.sshkey_tools.exceptions as _EX
 import src.sshkey_tools.fields as _FIELD
@@ -183,17 +184,20 @@ def generateFiles(self, folder):
         with open(f"tests/{folder}/testdata.txt", "w") as f:
             f.write("This is test data for SSH signature testing.")
 
-        os.system(
-            f'ssh-keygen -t rsa -b 2048 -f tests/{folder}/rsa_key -N "" > /dev/null 2>&1'
+        subprocess.run(
+            ["ssh-keygen", "-t", "rsa", "-b", "2048", "-f", f"tests/{folder}/rsa_key", "-N", '']
         )
-        os.system(
-            f'ssh-keygen -t ecdsa -b 256 -f tests/{folder}/ecdsa_key -N "" > /dev/null 2>&1'
+        
+        subprocess.run(
+            ["ssh-keygen", "-t", "ecdsa", "-b", "256", "-f", f"tests/{folder}/ecdsa_key", "-N", '']
         )
-        os.system(
-            f'ssh-keygen -t ed25519 -f tests/{folder}/ed25519_key -N "" > /dev/null 2>&1'
+        
+        subprocess.run(
+            ["ssh-keygen", "-t", "ed25519", "-f", f"tests/{folder}/ed25519_key", "-N", '']
         )
-
+        
         for key_type in KEY_TYPES:
+            os.chmod(f"tests/{folder}/{key_type}_key", 0o600)
             with open(f"tests/{folder}/{key_type}_key.pub") as f:
                 pubkey = f.read().strip()
             with open(f"tests/{folder}/{key_type}_allowed_signers", "w") as f:
@@ -238,12 +242,23 @@ def assertSignAndVerifyWithSshkeygen(self, key_type, namespace="file", hash_alg=
         data_path = f"tests/{self.folder}/{key_type}_{namespace}_{hash_alg}_data.txt"
         with open(data_path, "wb") as f:
             f.write(data)
-
-        result = os.system(
-            f"ssh-keygen -Y verify -f {allowed_signers_path} -I {PRINCIPAL} "
-            f"-n {namespace} -s {sig_path} < {data_path} > /dev/null 2>&1"
+        
+        
+        p = subprocess.Popen([
+                "ssh-keygen", "-Y", "verify", "-f", allowed_signers_path, "-I", PRINCIPAL,
+                "-n", namespace, "-s", sig_path
+            ],
+            stdout=subprocess.PIPE, 
+            stdin=subprocess.PIPE, 
+            stderr=subprocess.PIPE, 
+            text=True
+        )
+        stdout_data = p.communicate(input=data.decode("utf-8"))
+        
+        self.assertNotStartsWith(
+            stdout_data[0],
+            'Could not verify signature'
         )
-        self.assertEqual(result, 0, f"ssh-keygen failed to verify {key_type} signature")
 
     def test_rsa_sign_sha512(self):
         self.assertSignAndVerifyWithSshkeygen("rsa", "file", "sha512")
@@ -279,11 +294,14 @@ def test_sign_file_method(self):
 
         allowed_signers_path = self.createSshkeyToolsAllowedSigners("ed25519_file_method", pubkey)
 
-        result = os.system(
-            f"ssh-keygen -Y verify -f {allowed_signers_path} -I {PRINCIPAL} "
-            f"-n file -s {sig_path} < tests/{self.folder}/testdata.txt > /dev/null 2>&1"
+        result = subprocess.run(
+            ["bash", "-c", 
+                f"ssh-keygen -Y verify -f {allowed_signers_path} -I {PRINCIPAL} "
+            f"-n file -s {sig_path} < tests/{self.folder}/testdata.txt",
+            ],
+            capture_output=True
         )
-        self.assertEqual(result, 0, "ssh-keygen failed to verify file-signed ed25519 signature")
+        self.assertEqual(result.returncode, 0, "ssh-keygen failed to verify file-signed ed25519 signature")
 
 
 class TestSshkeygenSignaturesParsedBySshkeyTools(SignatureMethods):
@@ -298,11 +316,11 @@ def assertParseSshkeygenSignature(self, key_type):
         with open(data_path, "wb") as f:
             f.write(data)
 
-        ret = os.system(
-            f"ssh-keygen -Y sign -f tests/{self.folder}/{key_type}_key "
-            f"-n file {data_path} > /dev/null 2>&1"
+        ret = subprocess.run(
+            ["ssh-keygen", "-Y", "sign", "-f", f"tests/{self.folder}/{key_type}_key", "-n", "file", data_path],
+            capture_output=True
         )
-        self.assertEqual(ret, 0, f"ssh-keygen failed to sign {data_path}")
+        self.assertEqual(ret.returncode, 0, f"ssh-keygen failed to sign {data_path}")
 
         sig = _SIG.SSHSignature.from_file(sig_path)