owen
981587e83d
urapt is a self-hostable APT repository server with a companion CLI for pushing and managing Debian .deb packages. Server (urapt-server): - REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO) - .deb files stored content-addressed on disk, reference-counted for dedup - Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto) - APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand from the DB, cached in memory, signed with the server key - Full APT model: repositories -> distributions -> components -> architectures - Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads - First registrant becomes admin; repo-scoped permissions (read/write/read-write/admin) plus owner and server-admin roles - Multipart package push with control-field extraction, list/show/delete, pool serving, blob ref-count cleanup - Audit log CLI (urapt): - register/login/logout/whoami, token management - repo/distro/component/arch CRUD, member management - push/pull/ls/show/rm for packages - apt-config helper that emits apt setup commands (key, sources.list, auth.conf for private repos) Packaging & docs: - Dockerfile (multi-stage distroless), docker-compose.yml, sample config - README quick start, architecture overview, config reference, security notes - PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE - GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64) - Makefile release target producing static binaries + tarballs + checksums Tests cover the data-access layer, auth/permission checks, APT index generation, .deb parsing, GPG signing, the REST API, and the typed API client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing a real package.
69 lines
1.6 KiB
Go
69 lines
1.6 KiB
Go
package gpg
|
|
|
|
import (
|
|
"bytes"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestGenerateAndSign(t *testing.T) {
|
|
k, err := GenerateKey("urapt-server <test.example.com>", 2048)
|
|
if err != nil {
|
|
t.Fatalf("GenerateKey: %v", err)
|
|
}
|
|
if k.Fingerprint == "" {
|
|
t.Fatal("empty fingerprint")
|
|
}
|
|
|
|
pub, err := k.ArmoredPublic()
|
|
if err != nil {
|
|
t.Fatalf("ArmoredPublic: %v", err)
|
|
}
|
|
if !bytes.Contains([]byte(pub), []byte("BEGIN PGP PUBLIC KEY BLOCK")) {
|
|
t.Fatal("bad armored public")
|
|
}
|
|
priv, err := k.ArmoredPrivate()
|
|
if err != nil {
|
|
t.Fatalf("ArmoredPrivate: %v", err)
|
|
}
|
|
if !bytes.Contains([]byte(priv), []byte("BEGIN PGP PRIVATE KEY BLOCK")) {
|
|
t.Fatal("bad armored private")
|
|
}
|
|
|
|
data := []byte("Origin: urapt\nSuite: stable\n\nContents here.\n")
|
|
|
|
clear, err := k.ClearSign(data)
|
|
if err != nil {
|
|
t.Fatalf("ClearSign: %v", err)
|
|
}
|
|
if !bytes.Contains(clear, []byte("BEGIN PGP SIGNED MESSAGE")) {
|
|
t.Fatal("bad clearsign output")
|
|
}
|
|
pt, err := VerifyClearSign(pub, clear)
|
|
if err != nil {
|
|
t.Fatalf("VerifyClearSign: %v", err)
|
|
}
|
|
if strings.ReplaceAll(string(pt), "\r\n", "\n") != string(data) {
|
|
t.Fatalf("plaintext mismatch: got %q want %q", pt, data)
|
|
}
|
|
|
|
det, err := k.DetachedSign(data)
|
|
if err != nil {
|
|
t.Fatalf("DetachedSign: %v", err)
|
|
}
|
|
if !bytes.Contains(det, []byte("BEGIN PGP SIGNATURE")) {
|
|
t.Fatal("bad detached output")
|
|
}
|
|
if err := VerifyDetached(pub, data, det); err != nil {
|
|
t.Fatalf("VerifyDetached: %v", err)
|
|
}
|
|
|
|
k2, err := ParseArmoredPrivate(priv)
|
|
if err != nil {
|
|
t.Fatalf("ParseArmoredPrivate: %v", err)
|
|
}
|
|
if k2.Fingerprint != k.Fingerprint {
|
|
t.Fatalf("fingerprint mismatch after round-trip: %s != %s", k2.Fingerprint, k.Fingerprint)
|
|
}
|
|
}
|