open-component-model · Skarlso · Dec 6, 2023 · Dec 6, 2023
@@ -0,0 +1,3 @@
+# Release 0.12.1
+
+- fix: public and private key mixed up (#98) 
@@ -71,7 +71,7 @@ func NewClient(client client.Client) *Client {
 // SignDestinationComponent signs the component before transferring it and returns the public key for storing it on the
 // subscription.
 func (c *Client) SignDestinationComponent(_ context.Context, component ocm.ComponentVersionAccess) ([]byte, error) {
-	pub, priv, err := sign.GenerateSigningKeyPEMPair()
+	priv, pub, err := sign.GenerateSigningKeyPEMPair()
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate signing key: %w", err)
 	}
@@ -151,7 +151,25 @@ func (c *Client) GetComponentVersion(
 
 func (c *Client) VerifyComponent(ctx context.Context, obj *v1alpha1.ComponentSubscription, cv ocm.ComponentVersionAccess) (bool, error) {
 	for _, signature := range obj.Spec.Verify {
-		cert, err := c.getPublicKey(ctx, obj.Namespace, signature.PublicKey.SecretRef.Name, signature.Name)
+		var (
+			cert []byte
+			err  error
+		)
+
+		if signature.PublicKey.Value != nil {
+			cert, err = signature.PublicKey.DecodePublicValue()
+		} else {
+			if signature.PublicKey.SecretRef == nil {
+				return false, fmt.Errorf("kubernetes secret reference not provided")
+			}
+
+			cert, err = c.getPublicKey(
+				ctx,
+				obj.Namespace,
+				signature.PublicKey.SecretRef.Name,
+				signature.Name,
+			)
+		}
 		if err != nil {
 			return false, fmt.Errorf("verify error: %w", err)
 		}

@@ -5,7 +5,9 @@
 package ocm
 
 import (
+	"bytes"
 	"context"
+	"encoding/base64"
 	"os"
 	"path/filepath"
 	"testing"
@@ -465,6 +467,54 @@ func TestClient_VerifyComponent(t *testing.T) {
 	assert.True(t, verified, "verified should have been true, but it did not")
 }
 
+func TestClient_SignComponent(t *testing.T) {
+	fakeKubeClient := env.FakeKubeClient()
+	ocmClient := NewClient(fakeKubeClient)
+	component := "github.com/skarlso/ocm-demo-index"
+
+	octx := ocmcontext.NewFakeOCMContext()
+
+	c := &ocmcontext.Component{
+		Name:    component,
+		Version: "v0.0.1",
+	}
+	require.NoError(t, octx.AddComponent(c))
+
+	pub, err := ocmClient.SignDestinationComponent(context.Background(), c)
+	assert.NoError(t, err)
+
+	var buff []byte
+	buffer := bytes.NewBuffer(buff)
+	encoder := base64.NewEncoder(base64.StdEncoding, buffer)
+	_, err = encoder.Write(pub)
+	require.NoError(t, err)
+	require.NoError(t, encoder.Close())
+	cv := &v1alpha1.ComponentSubscription{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-name",
+			Namespace: "default",
+		},
+		Spec: v1alpha1.ComponentSubscriptionSpec{
+			Component: component,
+			Source: v1alpha1.OCMRepository{
+				URL: "localhost",
+			},
+			Verify: []ocmv1alpha1.Signature{
+				{
+					Name: v1alpha1.InternalSignatureName,
+					PublicKey: ocmv1alpha1.PublicKey{
+						Value: buffer.Bytes(),
+					},
+				},
+			},
+		},
+	}
+
+	verified, err := ocmClient.VerifyComponent(context.Background(), cv, c)
+	assert.NoError(t, err)
+	assert.True(t, verified, "verified should have been true, but it did not")
+}
+
 func TestClient_VerifyComponentDifferentPublicKey(t *testing.T) {
 	publicKey2, err := os.ReadFile(filepath.Join("testdata", "public2_key.pem"))
 	require.NoError(t, err)

@@ -5,7 +5,7 @@
 package version
 
 // ReleaseVersion is the version number in semver format "vX.Y.Z", prefixed with "v".
-var ReleaseVersion = "v0.12.0"
+var ReleaseVersion = "v0.12.1"
 
 // ReleaseCandidate is the release candidate ID in format "rc.X", which will be appended to the release version.
 var ReleaseCandidate = "rc.1"
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		# Release 0.12.1

		- fix: public and private key mixed up (#98)