blob: 02abe399e3616968a35c79f0af808befabaf6b3e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
#!/bin/bash
# Tests for rotate command
this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"
setup_key_dir_layout() {
local keys_dir="${TEST_DIR}/keys"
mkdir -p "${keys_dir}" "${SZECRET_STORE}"
rm -f "${SZECRET_STORE}"/*.age
unset SZECRET_PRIVATE_KEY
export SZECRET_PRIVATE_KEY_DIR="${keys_dir}"
local temp_key="${TEST_DIR}/initial-key"
age-keygen -o "${temp_key}" 2>/dev/null
local pub
pub="$(age-keygen -y "${temp_key}")"
echo "${pub}" > "${SZECRET_PUBLIC_KEY}"
mv "${temp_key}" "${keys_dir}/${pub}"
chmod 600 "${keys_dir}/${pub}"
SETUP_PUB="${pub}"
}
test_rotate_reencrypts_secrets() {
setup_key_dir_layout
local old_pub="${SETUP_PUB}"
echo "rotate-me" | szecret put "rotate-test"
echo "other" | szecret put "rotate-other"
szecret rotate --yes
local new_pub
new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
if [[ "${new_pub}" == "${old_pub}" ]]; then
fail "public key should change after rotate"
fi
assert_equals "rotate-me" "$(szecret get "rotate-test")" "rotated secret"
assert_equals "other" "$(szecret get "rotate-other")" "other rotated secret"
assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key file"
pass "rotate re-encrypts secrets and updates keys"
}
test_rotate_empty_store() {
setup_key_dir_layout >/dev/null
szecret rotate --yes
local new_pub
new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key with empty store"
pass "rotate succeeds with empty store"
}
test_rotate_requires_confirmation() {
setup_key_dir_layout >/dev/null
assert_failure szecret rotate
pass "rotate fails without confirmation"
}
run_tests() {
test_rotate_reencrypts_secrets
test_rotate_empty_store
test_rotate_requires_confirmation
}
[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests
|
