VC-59682: Align the go directive with the vendored Go 1.27.1 toolchain #841
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,10 @@ | ||
| package client | ||
|
|
||
| import ( | ||
| "crypto" | ||
| "crypto/ecdsa" | ||
| "crypto/elliptic" | ||
| "crypto/mldsa" | ||
| "crypto/rand" | ||
| "crypto/x509" | ||
| "crypto/x509/pkix" | ||
|
|
@@ -1477,6 +1479,16 @@ func TestIsExcludableSecret(t *testing.T) { | |
| secret: newTLSSecret("tls-secret-without-client", sampleCertificateChain(t, x509.ExtKeyUsageServerAuth)), | ||
| exclude: true, | ||
| }, | ||
| { | ||
| name: "TLS secret with ML-DSA client cert in tls.crt", | ||
|
Contributor
There was a problem hiding this comment. These two cases do not pin what the helper comment says they pin.
So take the scenario from your own description: someone adds The
Member
Author
There was a problem hiding this comment. Agreed, and fixed in 5453b8e. The helper now parses the leaf and asserts on it. One correction to the suggested check: require.Equal(t, x509.MLDSA, leaf.PublicKeyAlgorithm)
require.Equal(t, x509.MLDSA65, leaf.SignatureAlgorithm)and Checked the assertion is live rather than vacuous: swapping the expectation to [Generated with claude code]
Contributor
There was a problem hiding this comment. Confirmed against the 1.27.1 stdlib: Mutation-checked all three assertions and each fails as it should, including |
||
| secret: newTLSSecret("tls-secret-with-mldsa-client", sampleMLDSACertificateChain(t, x509.ExtKeyUsageClientAuth)), | ||
| exclude: false, | ||
| }, | ||
| { | ||
| name: "TLS secret with ML-DSA non-client cert in tls.crt", | ||
| secret: newTLSSecret("tls-secret-without-mldsa-client", sampleMLDSACertificateChain(t, x509.ExtKeyUsageServerAuth)), | ||
| exclude: true, | ||
| }, | ||
| { | ||
| name: "Non-unstructured", | ||
| secret: &corev1.Pod{ | ||
|
|
@@ -1577,15 +1589,15 @@ func newOpaqueSecret(name string) *unstructured.Unstructured { | |
| } | ||
| } | ||
|
|
||
| // certificateChain returns a PEM encoded sample certificate chain for testing | ||
| // purposes. The leaf certificate is signed by a self-signed CA certificate, | ||
| // both keyed by newKey. The returned string is base64 encoded to match how TLS | ||
| // certificates are typically provided in Kubernetes secrets. The parsed leaf is | ||
| // returned so that callers can assert they got the algorithm they asked for. | ||
| func certificateChain(t testing.TB, newKey func() (crypto.Signer, error), usages ...x509.ExtKeyUsage) (string, *x509.Certificate) { | ||
| t.Helper() | ||
|
|
||
| caPrivKey, err := newKey() | ||
| require.NoError(t, err) | ||
|
|
||
| caTemplate := x509.Certificate{ | ||
|
|
@@ -1602,15 +1614,15 @@ func sampleCertificateChain(t testing.TB, usages ...x509.ExtKeyUsage) string { | |
| IsCA: true, | ||
| } | ||
|
|
||
| caCertDER, err := x509.CreateCertificate(rand.Reader, &caTemplate, &caTemplate, caPrivKey.Public(), caPrivKey) | ||
| require.NoError(t, err) | ||
|
|
||
| caCertPEM := pem.EncodeToMemory(&pem.Block{ | ||
| Type: "CERTIFICATE", | ||
| Bytes: caCertDER, | ||
| }) | ||
|
|
||
| clientPrivKey, err := newKey() | ||
| require.NoError(t, err) | ||
| clientTemplate := x509.Certificate{ | ||
| SerialNumber: big.NewInt(2), | ||
|
|
@@ -1624,13 +1636,43 @@ func sampleCertificateChain(t testing.TB, usages ...x509.ExtKeyUsage) string { | |
| ExtKeyUsage: usages, | ||
| } | ||
|
|
||
| clientCertDER, err := x509.CreateCertificate(rand.Reader, &clientTemplate, &caTemplate, clientPrivKey.Public(), caPrivKey) | ||
| require.NoError(t, err) | ||
|
|
||
| clientCertPEM := pem.EncodeToMemory(&pem.Block{ | ||
| Type: "CERTIFICATE", | ||
| Bytes: clientCertDER, | ||
| }) | ||
|
|
||
| leaf, err := x509.ParseCertificate(clientCertDER) | ||
| require.NoError(t, err) | ||
|
|
||
| return base64.StdEncoding.EncodeToString(append(clientCertPEM, caCertPEM...)), leaf | ||
| } | ||
|
|
||
| // sampleCertificateChain is certificateChain with P-256 keys, for speed. | ||
| func sampleCertificateChain(t testing.TB, usages ...x509.ExtKeyUsage) string { | ||
| t.Helper() | ||
|
|
||
| chain, leaf := certificateChain(t, func() (crypto.Signer, error) { | ||
| return ecdsa.GenerateKey(elliptic.P256(), rand.Reader) | ||
| }, usages...) | ||
| require.Equal(t, x509.ECDSA, leaf.PublicKeyAlgorithm) | ||
|
|
||
| return chain | ||
| } | ||
|
|
||
| // sampleMLDSACertificateChain is certificateChain with ML-DSA-65 keys. The | ||
| // crypto/mldsa import holds the Go 1.27 floor: this package will not build on | ||
| // an older toolchain. | ||
| func sampleMLDSACertificateChain(t testing.TB, usages ...x509.ExtKeyUsage) string { | ||
| t.Helper() | ||
|
|
||
| chain, leaf := certificateChain(t, func() (crypto.Signer, error) { | ||
| return mldsa.GenerateKey(mldsa.MLDSA65()) | ||
| }, usages...) | ||
| require.Equal(t, x509.MLDSA, leaf.PublicKeyAlgorithm) | ||
| require.Equal(t, x509.MLDSA65, leaf.SignatureAlgorithm) | ||
|
|
||
| return chain | ||
| } | ||
Uh oh!
There was an error while loading. Please reload this page.