Skip to content

Commit 901728d

Browse files
dido18lucarin91
dido18
and
lucarin91
authoredMar 27, 2025··
fix: allow to specify custom signatureKey in the config.ini (#1024)
* make the signaturePubKey overwritable * Add debug logging for signature key parsing and handle newline escape sequences * Add MustParseRsaPublicKey function for parsing PEM formatted public keys * Remove debug print statement for signature key and fix comment typo in key parsing logic * Add error logging for command verification and update comment for public key usage * refactor(main.go) remove unnecessary print statement in parseIni function * refactor(utilities): improve formatting in ParseRsaPublicKey function * style(tools): align field declarations for improved readability --------- Co-authored-by: Luca Rinaldi <[email protected]>
·
1.7.1-rc11.7.0-rc6
1 parent 5063c6c commit 901728d

File tree

10 files changed

+172
-123
lines changed

10 files changed

+172
-123
lines changed
 

‎conn.go

+81-77
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package main
1919

2020
import (
2121
"bytes"
22+
"crypto/rsa"
2223
"encoding/json"
2324
"errors"
2425
"fmt"
@@ -79,111 +80,114 @@ type Upload struct {
7980

8081
var uploadStatusStr = "ProgrammerStatus"
8182

82-
func uploadHandler(c *gin.Context) {
83-
data := new(Upload)
84-
if err := c.BindJSON(data); err != nil {
85-
c.String(http.StatusBadRequest, fmt.Sprintf("err with the payload. %v", err.Error()))
86-
return
87-
}
88-
89-
log.Printf("%+v %+v %+v %+v %+v %+v", data.Port, data.Board, data.Rewrite, data.Commandline, data.Extra, data.Filename)
90-
91-
if data.Port == "" {
92-
c.String(http.StatusBadRequest, "port is required")
93-
return
94-
}
95-
96-
if data.Board == "" {
97-
c.String(http.StatusBadRequest, "board is required")
98-
log.Error("board is required")
99-
return
100-
}
101-
102-
if !data.Extra.Network {
103-
if data.Signature == "" {
104-
c.String(http.StatusBadRequest, "signature is required")
83+
func uploadHandler(pubKey *rsa.PublicKey) func(*gin.Context) {
84+
return func(c *gin.Context) {
85+
data := new(Upload)
86+
if err := c.BindJSON(data); err != nil {
87+
c.String(http.StatusBadRequest, fmt.Sprintf("err with the payload. %v", err.Error()))
10588
return
10689
}
10790

108-
if data.Commandline == "" {
109-
c.String(http.StatusBadRequest, "commandline is required for local board")
91+
log.Printf("%+v %+v %+v %+v %+v %+v", data.Port, data.Board, data.Rewrite, data.Commandline, data.Extra, data.Filename)
92+
93+
if data.Port == "" {
94+
c.String(http.StatusBadRequest, "port is required")
11095
return
11196
}
11297

113-
err := utilities.VerifyInput(data.Commandline, data.Signature)
114-
115-
if err != nil {
116-
c.String(http.StatusBadRequest, "signature is invalid")
98+
if data.Board == "" {
99+
c.String(http.StatusBadRequest, "board is required")
100+
log.Error("board is required")
117101
return
118102
}
119-
}
120103

121-
buffer := bytes.NewBuffer(data.Hex)
104+
if !data.Extra.Network {
105+
if data.Signature == "" {
106+
c.String(http.StatusBadRequest, "signature is required")
107+
return
108+
}
122109

123-
filePath, err := utilities.SaveFileonTempDir(data.Filename, buffer)
124-
if err != nil {
125-
c.String(http.StatusBadRequest, err.Error())
126-
return
127-
}
110+
if data.Commandline == "" {
111+
c.String(http.StatusBadRequest, "commandline is required for local board")
112+
return
113+
}
128114

129-
tmpdir, err := os.MkdirTemp("", "extrafiles")
130-
if err != nil {
131-
c.String(http.StatusBadRequest, err.Error())
132-
return
133-
}
115+
err := utilities.VerifyInput(data.Commandline, data.Signature, pubKey)
134116

135-
for _, extraFile := range data.ExtraFiles {
136-
path, err := utilities.SafeJoin(tmpdir, extraFile.Filename)
137-
if err != nil {
138-
c.String(http.StatusBadRequest, err.Error())
139-
return
117+
if err != nil {
118+
log.WithField("err", err).Error("Error verifying the command")
119+
c.String(http.StatusBadRequest, "signature is invalid")
120+
return
121+
}
140122
}
141-
log.Printf("Saving %s on %s", extraFile.Filename, path)
142123

143-
err = os.MkdirAll(filepath.Dir(path), 0744)
144-
if err != nil {
145-
c.String(http.StatusBadRequest, err.Error())
146-
return
147-
}
124+
buffer := bytes.NewBuffer(data.Hex)
148125

149-
err = os.WriteFile(path, extraFile.Hex, 0644)
126+
filePath, err := utilities.SaveFileonTempDir(data.Filename, buffer)
150127
if err != nil {
151128
c.String(http.StatusBadRequest, err.Error())
152129
return
153130
}
154-
}
155131

156-
if data.Rewrite != "" {
157-
data.Board = data.Rewrite
158-
}
159-
160-
go func() {
161-
// Resolve commandline
162-
commandline, err := upload.PartiallyResolve(data.Board, filePath, tmpdir, data.Commandline, data.Extra, Tools)
132+
tmpdir, err := os.MkdirTemp("", "extrafiles")
163133
if err != nil {
164-
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
134+
c.String(http.StatusBadRequest, err.Error())
165135
return
166136
}
167137

168-
l := PLogger{Verbose: true}
169-
170-
// Upload
171-
if data.Extra.Network {
172-
err = errors.New("network upload is not supported anymore, pease use OTA instead")
173-
} else {
174-
send(map[string]string{uploadStatusStr: "Starting", "Cmd": "Serial"})
175-
err = upload.Serial(data.Port, commandline, data.Extra, l)
138+
for _, extraFile := range data.ExtraFiles {
139+
path, err := utilities.SafeJoin(tmpdir, extraFile.Filename)
140+
if err != nil {
141+
c.String(http.StatusBadRequest, err.Error())
142+
return
143+
}
144+
log.Printf("Saving %s on %s", extraFile.Filename, path)
145+
146+
err = os.MkdirAll(filepath.Dir(path), 0744)
147+
if err != nil {
148+
c.String(http.StatusBadRequest, err.Error())
149+
return
150+
}
151+
152+
err = os.WriteFile(path, extraFile.Hex, 0644)
153+
if err != nil {
154+
c.String(http.StatusBadRequest, err.Error())
155+
return
156+
}
176157
}
177158

178-
// Handle result
179-
if err != nil {
180-
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
181-
return
159+
if data.Rewrite != "" {
160+
data.Board = data.Rewrite
182161
}
183-
send(map[string]string{uploadStatusStr: "Done", "Flash": "Ok"})
184-
}()
185162

186-
c.String(http.StatusAccepted, "")
163+
go func() {
164+
// Resolve commandline
165+
commandline, err := upload.PartiallyResolve(data.Board, filePath, tmpdir, data.Commandline, data.Extra, Tools)
166+
if err != nil {
167+
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
168+
return
169+
}
170+
171+
l := PLogger{Verbose: true}
172+
173+
// Upload
174+
if data.Extra.Network {
175+
err = errors.New("network upload is not supported anymore, pease use OTA instead")
176+
} else {
177+
send(map[string]string{uploadStatusStr: "Starting", "Cmd": "Serial"})
178+
err = upload.Serial(data.Port, commandline, data.Extra, l)
179+
}
180+
181+
// Handle result
182+
if err != nil {
183+
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
184+
return
185+
}
186+
send(map[string]string{uploadStatusStr: "Done", "Flash": "Ok"})
187+
}()
188+
189+
c.String(http.StatusAccepted, "")
190+
}
187191
}
188192

189193
// PLogger sends the info from the upload to the websocket

‎globals/globals.go

+10-3
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,15 @@
1515

1616
package globals
1717

18-
// DefaultIndexURL is the default index url
1918
var (
20-
// SignatureKey is the public key used to verify commands and url sent by the builder
21-
SignatureKey = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF\nIE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1\nZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1\npFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z\nCeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn\n2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9\ntwIDAQAB\n-----END PUBLIC KEY-----"
19+
// ArduinoSignaturePubKey is the public key used to verify commands and url sent by the builder
20+
ArduinoSignaturePubKey = `-----BEGIN PUBLIC KEY-----
21+
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF
22+
IE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1
23+
ZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1
24+
pFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z
25+
CeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn
26+
2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9
27+
twIDAQAB
28+
-----END PUBLIC KEY-----`
2229
)

‎main.go

+12-4
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ var (
8181
logDump = iniConf.String("log", "off", "off = (default)")
8282
origins = iniConf.String("origins", "", "Allowed origin list for CORS")
8383
portsFilterRegexp = iniConf.String("regex", "usb|acm|com", "Regular expression to filter serial port list")
84-
signatureKey = iniConf.String("signatureKey", globals.SignatureKey, "Pem-encoded public key to verify signed commandlines")
84+
signatureKey = iniConf.String("signatureKey", globals.ArduinoSignaturePubKey, "Pem-encoded public key to verify signed commandlines")
8585
updateURL = iniConf.String("updateUrl", "", "")
8686
verbose = iniConf.Bool("v", true, "show debug logging")
8787
crashreport = iniConf.Bool("crashreport", false, "enable crashreport logging")
@@ -278,9 +278,17 @@ func loop() {
278278
}
279279
}
280280

281+
if signatureKey == nil || len(*signatureKey) == 0 {
282+
log.Panicf("signature public key should be set")
283+
}
284+
signaturePubKey, err := utilities.ParseRsaPublicKey([]byte(*signatureKey))
285+
if err != nil {
286+
log.Panicf("cannot parse signature key '%s'. %s", *signatureKey, err)
287+
}
288+
281289
// Instantiate Index and Tools
282290
Index = index.Init(*indexURL, config.GetDataDir())
283-
Tools = tools.New(config.GetDataDir(), Index, logger)
291+
Tools = tools.New(config.GetDataDir(), Index, logger, signaturePubKey)
284292

285293
// see if we are supposed to wait 5 seconds
286294
if *isLaunchSelf {
@@ -454,7 +462,7 @@ func loop() {
454462
r.LoadHTMLFiles("templates/nofirefox.html")
455463

456464
r.GET("/", homeHandler)
457-
r.POST("/upload", uploadHandler)
465+
r.POST("/upload", uploadHandler(signaturePubKey))
458466
r.GET("/socket.io/", socketHandler)
459467
r.POST("/socket.io/", socketHandler)
460468
r.Handle("WS", "/socket.io/", socketHandler)
@@ -464,7 +472,7 @@ func loop() {
464472
r.POST("/update", updateHandler)
465473

466474
// Mount goa handlers
467-
goa := v2.Server(config.GetDataDir().String(), Index)
475+
goa := v2.Server(config.GetDataDir().String(), Index, signaturePubKey)
468476
r.Any("/v2/*path", gin.WrapH(goa))
469477

470478
go func() {

‎main_test.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ import (
3030

3131
"github.com/arduino/arduino-create-agent/config"
3232
"github.com/arduino/arduino-create-agent/gen/tools"
33+
"github.com/arduino/arduino-create-agent/globals"
3334
"github.com/arduino/arduino-create-agent/index"
3435
"github.com/arduino/arduino-create-agent/upload"
36+
"github.com/arduino/arduino-create-agent/utilities"
3537
v2 "github.com/arduino/arduino-create-agent/v2"
3638
"github.com/gin-gonic/gin"
3739
"github.com/stretchr/testify/require"
@@ -54,7 +56,7 @@ func TestValidSignatureKey(t *testing.T) {
5456

5557
func TestUploadHandlerAgainstEvilFileNames(t *testing.T) {
5658
r := gin.New()
57-
r.POST("/", uploadHandler)
59+
r.POST("/", uploadHandler(utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey))))
5860
ts := httptest.NewServer(r)
5961

6062
uploadEvilFileName := Upload{
@@ -90,7 +92,7 @@ func TestUploadHandlerAgainstEvilFileNames(t *testing.T) {
9092

9193
func TestUploadHandlerAgainstBase64WithoutPaddingMustFail(t *testing.T) {
9294
r := gin.New()
93-
r.POST("/", uploadHandler)
95+
r.POST("/", uploadHandler(utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey))))
9496
ts := httptest.NewServer(r)
9597
defer ts.Close()
9698

@@ -119,7 +121,7 @@ func TestInstallToolV2(t *testing.T) {
119121
Index := index.Init(indexURL, config.GetDataDir())
120122

121123
r := gin.New()
122-
goa := v2.Server(config.GetDataDir().String(), Index)
124+
goa := v2.Server(config.GetDataDir().String(), Index, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
123125
r.Any("/v2/*path", gin.WrapH(goa))
124126
ts := httptest.NewServer(r)
125127

@@ -213,7 +215,7 @@ func TestInstalledHead(t *testing.T) {
213215
Index := index.Init(indexURL, config.GetDataDir())
214216

215217
r := gin.New()
216-
goa := v2.Server(config.GetDataDir().String(), Index)
218+
goa := v2.Server(config.GetDataDir().String(), Index, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
217219
r.Any("/v2/*path", gin.WrapH(goa))
218220
ts := httptest.NewServer(r)
219221

‎tools/download_test.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ import (
2121
"testing"
2222
"time"
2323

24+
"github.com/arduino/arduino-create-agent/globals"
2425
"github.com/arduino/arduino-create-agent/index"
26+
"github.com/arduino/arduino-create-agent/utilities"
2527
"github.com/arduino/arduino-create-agent/v2/pkgs"
2628
"github.com/arduino/go-paths-helper"
2729
"github.com/stretchr/testify/require"
@@ -128,7 +130,7 @@ func TestDownload(t *testing.T) {
128130
IndexFile: *paths.New("testdata", "test_tool_index.json"),
129131
LastRefresh: time.Now(),
130132
}
131-
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) })
133+
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) }, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
132134

133135
for _, tc := range testCases {
134136
t.Run(tc.name+"-"+tc.version, func(t *testing.T) {
@@ -175,7 +177,7 @@ func TestCorruptedInstalled(t *testing.T) {
175177
defer fileJSON.Close()
176178
_, err = fileJSON.Write([]byte("Hello"))
177179
require.NoError(t, err)
178-
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) })
180+
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) }, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
179181
// Download the tool
180182
err = testTools.Download("arduino-test", "avrdude", "6.3.0-arduino17", "keep")
181183
require.NoError(t, err)

‎tools/tools.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package tools
1717

1818
import (
19+
"crypto/rsa"
1920
"encoding/json"
2021
"path/filepath"
2122
"strings"
@@ -55,14 +56,14 @@ type Tools struct {
5556
// The New functions accept the directory to use to host the tools,
5657
// an index (used to download the tools),
5758
// and a logger to log the operations
58-
func New(directory *paths.Path, index *index.Resource, logger func(msg string)) *Tools {
59+
func New(directory *paths.Path, index *index.Resource, logger func(msg string), signPubKey *rsa.PublicKey) *Tools {
5960
t := &Tools{
6061
directory: directory,
6162
index: index,
6263
logger: logger,
6364
installed: map[string]string{},
6465
mutex: sync.RWMutex{},
65-
tools: pkgs.New(index, directory.String(), "replace"),
66+
tools: pkgs.New(index, directory.String(), "replace", signPubKey),
6667
}
6768
_ = t.readMap()
6869
return t

‎utilities/utilities.go

+32-13
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,6 @@ import (
3030
"os/exec"
3131
"path/filepath"
3232
"strings"
33-
34-
"github.com/arduino/arduino-create-agent/globals"
3533
)
3634

3735
// SaveFileonTempDir creates a temp directory and saves the file data as the
@@ -131,23 +129,44 @@ func SafeJoin(parent, subdir string) (string, error) {
131129
return res, nil
132130
}
133131

134-
// VerifyInput will verify an input against a signature
132+
// VerifyInput will verify an input against a signature using the public key.
135133
// A valid signature is indicated by returning a nil error.
136-
func VerifyInput(input string, signature string) error {
134+
func VerifyInput(input string, signature string, pubKey *rsa.PublicKey) error {
137135
sign, _ := hex.DecodeString(signature)
138-
block, _ := pem.Decode([]byte(globals.SignatureKey))
136+
h := sha256.New()
137+
h.Write([]byte(input))
138+
d := h.Sum(nil)
139+
return rsa.VerifyPKCS1v15(pubKey, crypto.SHA256, d, sign)
140+
}
141+
142+
// ParseRsaPublicKey parses a public key in PEM format and returns the rsa.PublicKey object.
143+
// Returns an error if the key is invalid.
144+
func ParseRsaPublicKey(key []byte) (*rsa.PublicKey, error) {
145+
block, _ := pem.Decode(key)
139146
if block == nil {
140-
return errors.New("invalid key")
147+
return nil, errors.New("invalid key")
141148
}
142-
key, err := x509.ParsePKIXPublicKey(block.Bytes)
149+
150+
parsedKey, err := x509.ParsePKIXPublicKey(block.Bytes)
143151
if err != nil {
144-
return err
152+
return nil, err
145153
}
146-
rsaKey := key.(*rsa.PublicKey)
147-
h := sha256.New()
148-
h.Write([]byte(input))
149-
d := h.Sum(nil)
150-
return rsa.VerifyPKCS1v15(rsaKey, crypto.SHA256, d, sign)
154+
155+
publicKey, ok := parsedKey.(*rsa.PublicKey)
156+
if !ok {
157+
return nil, fmt.Errorf("not an rsa key")
158+
}
159+
return publicKey, nil
160+
}
161+
162+
// MustParseRsaPublicKey parses a public key in PEM format and returns the rsa.PublicKey object.
163+
// Panics if the key is invalid.
164+
func MustParseRsaPublicKey(key []byte) *rsa.PublicKey {
165+
parsedKey, err := ParseRsaPublicKey(key)
166+
if err != nil {
167+
panic(err)
168+
}
169+
return parsedKey
151170
}
152171

153172
// UserPrompt executes an osascript and returns the pressed button

‎v2/http.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ package v2
1717

1818
import (
1919
"context"
20+
"crypto/rsa"
2021
"encoding/json"
2122
"net/http"
2223

@@ -31,7 +32,7 @@ import (
3132
)
3233

3334
// Server is the actual server
34-
func Server(directory string, index *index.Resource) http.Handler {
35+
func Server(directory string, index *index.Resource, pubKey *rsa.PublicKey) http.Handler {
3536
mux := goahttp.NewMuxer()
3637

3738
// Instantiate logger
@@ -40,7 +41,7 @@ func Server(directory string, index *index.Resource) http.Handler {
4041
logAdapter := LogAdapter{Logger: logger}
4142

4243
// Mount tools
43-
toolsSvc := pkgs.New(index, directory, "replace")
44+
toolsSvc := pkgs.New(index, directory, "replace", pubKey)
4445
toolsEndpoints := toolssvc.NewEndpoints(toolsSvc)
4546
toolsServer := toolssvr.New(toolsEndpoints, mux, CustomRequestDecoder, goahttp.ResponseEncoder, errorHandler(logger), nil)
4647
toolssvr.Mount(mux, toolsServer)

‎v2/pkgs/tools.go

+15-12
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package pkgs
1818
import (
1919
"bytes"
2020
"context"
21+
"crypto/rsa"
2122
"crypto/sha256"
2223
"encoding/hex"
2324
"encoding/json"
@@ -58,23 +59,25 @@ var (
5859
//
5960
// It requires an Index Resource to search for tools
6061
type Tools struct {
61-
index *index.Resource
62-
folder string
63-
behaviour string
64-
installed map[string]string
65-
mutex sync.RWMutex
62+
index *index.Resource
63+
folder string
64+
behaviour string
65+
installed map[string]string
66+
mutex sync.RWMutex
67+
verifySignaturePubKey *rsa.PublicKey // public key used to verify the signature of a command sent to the boards
6668
}
6769

6870
// New will return a Tool object, allowing the caller to execute operations on it.
6971
// The New function will accept an index as parameter (used to download the indexes)
7072
// and a folder used to download the indexes
71-
func New(index *index.Resource, folder, behaviour string) *Tools {
73+
func New(index *index.Resource, folder, behaviour string, verifySignaturePubKey *rsa.PublicKey) *Tools {
7274
t := &Tools{
73-
index: index,
74-
folder: folder,
75-
behaviour: behaviour,
76-
installed: map[string]string{},
77-
mutex: sync.RWMutex{},
75+
index: index,
76+
folder: folder,
77+
behaviour: behaviour,
78+
installed: map[string]string{},
79+
mutex: sync.RWMutex{},
80+
verifySignaturePubKey: verifySignaturePubKey,
7881
}
7982
t.readInstalled()
8083
return t
@@ -166,7 +169,7 @@ func (t *Tools) Install(ctx context.Context, payload *tools.ToolPayload) (*tools
166169

167170
//if URL is defined and is signed we verify the signature and override the name, payload, version parameters
168171
if payload.URL != nil && payload.Signature != nil && payload.Checksum != nil {
169-
err := utilities.VerifyInput(*payload.URL, *payload.Signature)
172+
err := utilities.VerifyInput(*payload.URL, *payload.Signature, t.verifySignaturePubKey)
170173
if err != nil {
171174
return nil, err
172175
}

‎v2/pkgs/tools_test.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@ import (
2525

2626
"github.com/arduino/arduino-create-agent/config"
2727
"github.com/arduino/arduino-create-agent/gen/tools"
28+
"github.com/arduino/arduino-create-agent/globals"
2829
"github.com/arduino/arduino-create-agent/index"
30+
"github.com/arduino/arduino-create-agent/utilities"
2931
"github.com/arduino/arduino-create-agent/v2/pkgs"
3032
"github.com/arduino/go-paths-helper"
3133
"github.com/stretchr/testify/require"
@@ -45,7 +47,7 @@ func TestTools(t *testing.T) {
4547
// Instantiate Index
4648
Index := index.Init(indexURL, config.GetDataDir())
4749

48-
service := pkgs.New(Index, tmp, "replace")
50+
service := pkgs.New(Index, tmp, "replace", utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
4951

5052
ctx := context.Background()
5153

@@ -126,7 +128,7 @@ func TestEvilFilename(t *testing.T) {
126128
// Instantiate Index
127129
Index := index.Init(indexURL, config.GetDataDir())
128130

129-
service := pkgs.New(Index, tmp, "replace")
131+
service := pkgs.New(Index, tmp, "replace", utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
130132

131133
ctx := context.Background()
132134

@@ -195,7 +197,7 @@ func TestInstalledHead(t *testing.T) {
195197
// Instantiate Index
196198
Index := index.Init(indexURL, config.GetDataDir())
197199

198-
service := pkgs.New(Index, tmp, "replace")
200+
service := pkgs.New(Index, tmp, "replace", utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
199201

200202
ctx := context.Background()
201203

@@ -216,7 +218,7 @@ func TestInstall(t *testing.T) {
216218
LastRefresh: time.Now(),
217219
}
218220

219-
tool := pkgs.New(testIndex, tmp, "replace")
221+
tool := pkgs.New(testIndex, tmp, "replace", utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
220222

221223
ctx := context.Background()
222224

0 commit comments

Comments
 (0)
Please sign in to comment.