gopasspw--gopass
wehub-resource-sync
56 行
1.9 KiB
Go
56 行
1.9 KiB
Go
package tests
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestTeamJoinPreservesPublicKeys is a reproducer for GH-2620: after cloning
|
|
// a store (or equivalent join operation), the .public-keys/ directory must
|
|
// retain all recipient keys — not just the cloning member's own key.
|
|
//
|
|
// This test creates a multi-recipient store, simulates a "join" by reading
|
|
// .public-keys/ from the store, and verifies all expected keys are present.
|
|
func TestTeamJoinPreservesPublicKeys(t *testing.T) {
|
|
ts := newTester(t)
|
|
defer ts.teardown()
|
|
|
|
// Create a second GPG key to represent a team member.
|
|
key2 := createGPGKey(t, ts, "Teammate", "teammate@example.com")
|
|
|
|
// Enable exportkeys in the config so .public-keys/ is populated during init.
|
|
cfgPath := ts.gopassConfig()
|
|
cfgData, err := os.ReadFile(cfgPath)
|
|
require.NoError(t, err)
|
|
cfgData = bytes.ReplaceAll(cfgData, []byte("exportkeys = false"), []byte("exportkeys = true"))
|
|
require.NoError(t, os.WriteFile(cfgPath, cfgData, 0o600))
|
|
|
|
// Init the store with both keys as recipients.
|
|
out, err := ts.run("init --crypto=gpgcli --storage=fs " + keyID + " " + key2)
|
|
require.NoError(t, err, "init: %s", out)
|
|
|
|
storePath := ts.storeDir("root")
|
|
|
|
// Verify .gpg-id contains both keys.
|
|
gpgID, err := os.ReadFile(filepath.Join(storePath, ".gpg-id"))
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(gpgID), keyID)
|
|
assert.Contains(t, string(gpgID), key2)
|
|
|
|
// .public-keys/ should contain both keys.
|
|
pubKeysDir := filepath.Join(storePath, ".public-keys")
|
|
files, err := os.ReadDir(pubKeysDir)
|
|
require.NoError(t, err)
|
|
assert.GreaterOrEqual(t, len(files), 2, ".public-keys/ must have entries for both recipients")
|
|
|
|
// Verify the diagnostic tool reports both recipients are healthy.
|
|
out, err = ts.run("doctor --recipients --verbose")
|
|
require.NoError(t, err, "doctor --recipients: %s", out)
|
|
assert.Contains(t, out, "local keyring")
|
|
}
|