test/fixtures/minisign/make-fixtures.sh

1#!/bin/sh

2# Regenerate the minisign interop fixtures with the real minisign tool.

3#

4# guix shell minisign curl -- test/fixtures/minisign/make-fixtures.sh

5#

6# Keys are generated fresh (unencrypted, in a temp dir that is deleted);

7# only public keys, messages and signatures are kept. Re-running changes

8# every key and signature, so commit the whole directory together.

9#

10# Also fetches two signatures made by other people's keys:

11# - production registry.json(.minisig) from pkg.usesigil.org, signed by

12# the Sigil registry ROOT key that sigil-env pins (trust.sgl);

13# - minisign-0.12.tar.gz(.minisig) from minisign's GitHub release,

14# signed by the minisign author's published key (minisign README).

15set -eu

16DIR=$(cd "$(dirname "$0")" && pwd)

17KEYS=$(mktemp -d)

18trap 'rm -rf "$KEYS"' EXIT

19cd "$DIR"

20minisign -v

22minisign -G -W -f -p a.pub -s "$KEYS/a.key" >/dev/null

23minisign -G -W -f -p b.pub -s "$KEYS/b.key" >/dev/null

25printf 'hello, minisign\n' > hello.txt

26: > empty.txt

27# Every byte value, including NUL and CR, four times over.

28LC_ALL=C awk 'BEGIN { for (r = 0; r < 4; r++) for (i = 0; i < 256; i++) printf "%c", i }' > binary.bin

29[ "$(wc -c < binary.bin)" -eq 1024 ] || { echo "REFUSING: binary.bin is not 1024 bytes"; exit 1; }

31sign() { # sign <key> <file> <sigfile> <trusted-comment> [extra flags]

32 key=$1 file=$2 out=$3 tc=$4; shift 4

33 minisign -S -s "$KEYS/$key.key" -m "$file" -x "$out" -t "$tc" "$@" >/dev/null

34}

35sign a hello.txt hello.txt.ED.minisig "sigil-crypto fixture: prehashed"

36sign a hello.txt hello.txt.Ed.minisig "sigil-crypto fixture: legacy" -l

37sign a empty.txt empty.txt.ED.minisig "sigil-crypto fixture: empty file"

38sign a binary.bin binary.bin.ED.minisig "sigil-crypto fixture: binary"

39sign a binary.bin binary.bin.Ed.minisig "sigil-crypto fixture: binary legacy" -l

40sign a hello.txt hello.txt.unicode.minisig "fixture ✓ unicode — trusted"

41sign b hello.txt hello.txt.keyb.minisig "sigil-crypto fixture: key b"

43# Every signature must verify with the tool itself before it is a fixture.

44minisign -V -q -p a.pub -m hello.txt -x hello.txt.ED.minisig

45minisign -V -q -p a.pub -m hello.txt -x hello.txt.Ed.minisig

46minisign -V -q -p a.pub -m empty.txt -x empty.txt.ED.minisig

47minisign -V -q -p a.pub -m binary.bin -x binary.bin.ED.minisig

48minisign -V -q -p a.pub -m binary.bin -x binary.bin.Ed.minisig

49minisign -V -q -p a.pub -m hello.txt -x hello.txt.unicode.minisig

50minisign -V -q -p b.pub -m hello.txt -x hello.txt.keyb.minisig

51# -H refuses the legacy one: the positive control for minisign-verify-prehashed.

52if minisign -V -q -H -p a.pub -m hello.txt -x hello.txt.Ed.minisig 2>/dev/null; then

53 echo "REFUSING: minisign -H accepted a legacy signature"; exit 1

54fi

56curl -fsS -o registry.json https://pkg.usesigil.org/v1/meta/registry.json

57curl -fsS -o registry.json.minisig https://pkg.usesigil.org/v1/meta/registry.json.minisig

58minisign -V -q -P RWRa9dPSUBFexBbLdzZIfuAmuCYL736UeHC7IbdAOIYpgGIyDmWRaQHY \

59 -m registry.json -x registry.json.minisig

61curl -fsSL -o minisign-0.12.tar.gz \

62 https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12.tar.gz

63curl -fsSL -o minisign-0.12.tar.gz.minisig \

64 https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12.tar.gz.minisig

65minisign -V -q -P RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3 \

66 -m minisign-0.12.tar.gz -x minisign-0.12.tar.gz.minisig

68sha256sum *.pub *.txt *.bin *.minisig registry.json minisign-0.12.tar.gz > SHA256SUMS.fixtures

69echo FIXTURES-COMPLETE