mirror of
https://github.com/rustfs/rustfs.git
synced 2026-09-07 20:46:11 +00:00
Zhengchao An
5dca076efe
* fix(connect): sync protocol fixture consumers * fix(connect): preserve enrollment validation order * fix(connect): satisfy base64 length lint * fix(connect): restore signature validation order * fix(connect): preserve signature precedence across chain parsing * fix(connect): preserve signature error classification * test(ci): provide log path in workflow harness
182 lines
6.6 KiB
JSON
182 lines
6.6 KiB
JSON
{
|
|
"protocolVersion": "v1",
|
|
"fixtureSet": "offline-enrollment",
|
|
"fixture": "boundary-vectors",
|
|
"description": "Frozen challenge boundary and decision vectors for failures that cannot be added as newly signed golden documents because no fixture private key exists. Mutations start from the accepted pinned-root challenge and are applied without re-signing; every targeted rule runs before the signature invalidated by that mutation.",
|
|
"sourceVector": "challenge signed by a chained signing key under the pinned root",
|
|
"preparseMutations": [
|
|
{
|
|
"name": "challenge envelope is not JSON",
|
|
"scope": "serializedEnvelope",
|
|
"value": "{",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge bytes are non-canonical padded base64",
|
|
"scope": "envelopeBytes",
|
|
"value": "QR==",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge bytes decode to a JSON scalar",
|
|
"scope": "envelopeBytes",
|
|
"value": "bnVsbA==",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge is missing trustChain",
|
|
"scope": "challenge",
|
|
"operation": "remove",
|
|
"field": "trustChain",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge trustChain is a JSON object",
|
|
"scope": "challengeChain",
|
|
"operation": "objectWithFirst",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge issuedAt is not a real calendar instant",
|
|
"scope": "challenge",
|
|
"operation": "replace",
|
|
"field": "issuedAt",
|
|
"value": "2026-02-31T00:00:00Z",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
},
|
|
{
|
|
"name": "first trust link issuerKeyId is malformed",
|
|
"scope": "trustLink",
|
|
"index": 0,
|
|
"operation": "replace",
|
|
"field": "issuerKeyId",
|
|
"value": "not-a-key-id",
|
|
"expectedReason": "DOCUMENT_MALFORMED"
|
|
}
|
|
],
|
|
"verificationMutations": [
|
|
{
|
|
"name": "challenge signature algorithm is not ES256",
|
|
"scope": "envelopeSignature",
|
|
"operation": "replace",
|
|
"field": "algorithm",
|
|
"value": "ES384",
|
|
"expectedReason": "SIGNATURE_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge signature keyId is malformed",
|
|
"scope": "envelopeSignature",
|
|
"operation": "replace",
|
|
"field": "keyId",
|
|
"value": "not-a-key-id",
|
|
"expectedReason": "SIGNATURE_MALFORMED"
|
|
},
|
|
{
|
|
"name": "challenge signature keyId names another well-formed key",
|
|
"scope": "envelopeSignature",
|
|
"operation": "replace",
|
|
"field": "keyId",
|
|
"value": "f6fbe050defded18b50477ace38c9515fb61b8157e57b2f0e7e8ca69c862b6ca",
|
|
"expectedReason": "SIGNATURE_INVALID"
|
|
},
|
|
{
|
|
"name": "pinned-root challenge carries only one trust link",
|
|
"scope": "challengeChain",
|
|
"operation": "keepFirst",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
},
|
|
{
|
|
"name": "intermediate link formatVersion is unsupported",
|
|
"scope": "trustLink",
|
|
"index": 0,
|
|
"operation": "replace",
|
|
"field": "formatVersion",
|
|
"value": "rustfs.connect.offline.trustLink/2",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
},
|
|
{
|
|
"name": "intermediate link protocolVersion is unsupported",
|
|
"scope": "trustLink",
|
|
"index": 0,
|
|
"operation": "replace",
|
|
"field": "protocolVersion",
|
|
"value": "v2",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
},
|
|
{
|
|
"name": "intermediate link signature algorithm is not ES256",
|
|
"scope": "trustLinkSignature",
|
|
"index": 0,
|
|
"operation": "replace",
|
|
"field": "algorithm",
|
|
"value": "ES384",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
},
|
|
{
|
|
"name": "intermediate link omits serial",
|
|
"scope": "trustLink",
|
|
"index": 0,
|
|
"operation": "remove",
|
|
"field": "serial",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
},
|
|
{
|
|
"name": "first trust link carries signing role",
|
|
"scope": "trustLink",
|
|
"index": 0,
|
|
"operation": "replace",
|
|
"field": "role",
|
|
"value": "signing",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
}
|
|
],
|
|
"linkValidityPolicyVectors": [
|
|
{
|
|
"name": "intermediate link at its maximum validity",
|
|
"role": "intermediate",
|
|
"notBefore": "2026-01-01T00:00:00Z",
|
|
"notAfter": "2027-01-01T00:00:00Z",
|
|
"expectedReason": null
|
|
},
|
|
{
|
|
"name": "intermediate link one second beyond its maximum validity",
|
|
"role": "intermediate",
|
|
"notBefore": "2026-01-01T00:00:00Z",
|
|
"notAfter": "2027-01-01T00:00:01Z",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
},
|
|
{
|
|
"name": "signing link at its maximum validity",
|
|
"role": "signing",
|
|
"notBefore": "2026-08-01T00:00:00Z",
|
|
"notAfter": "2026-09-01T00:00:00Z",
|
|
"expectedReason": null
|
|
},
|
|
{
|
|
"name": "signing link one second beyond its maximum validity",
|
|
"role": "signing",
|
|
"notBefore": "2026-08-01T00:00:00Z",
|
|
"notAfter": "2026-09-01T00:00:01Z",
|
|
"expectedReason": "TRUST_CHAIN_INVALID"
|
|
}
|
|
],
|
|
"postSignaturePolicyVectors": [
|
|
{
|
|
"name": "overlong challenge expires at the frozen seven-day boundary",
|
|
"issuedAt": "2026-08-01T00:00:00Z",
|
|
"declaredExpiresAt": "2026-08-09T00:00:00Z",
|
|
"evaluationTime": "2026-08-08T00:05:01Z",
|
|
"expectedEffectiveExpiresAt": "2026-08-08T00:00:00Z",
|
|
"expectedReason": "CHALLENGE_EXPIRED"
|
|
},
|
|
{
|
|
"name": "overlong challenge remains valid at the frozen boundary plus tolerance",
|
|
"issuedAt": "2026-08-01T00:00:00Z",
|
|
"declaredExpiresAt": "2026-08-09T00:00:00Z",
|
|
"evaluationTime": "2026-08-08T00:05:00Z",
|
|
"expectedEffectiveExpiresAt": "2026-08-08T00:00:00Z",
|
|
"expectedReason": null
|
|
}
|
|
]
|
|
}
|