. "$BST_LIB" # BST-TIMEOUT: 1800 # ONE python3 start for the probe, plus TWO bare imports, # # plus SEVEN program starts for the pyrsa-* alternatives. # # # # Ten interpreter starts, not three: every pyrsa-* tool is # # itself a python3 process that imports rsa before optparse # # prints its usage, so `--help' costs a full start each. # # That is what makes this suite's budget larger than the # # neighbouring python3 suites' 1200s -- the probe half is # # the same shape as theirs, and the CLI half is the extra. # # # # A suite-timeout red is a batch-wide cost, so if the # # starts prove slower than that on target the RIGHT fix is # # this number, not fewer cases. # # # # NOT MEASURED ON TARGET YET: this port's first on-target # # run is the batch verify, and the measured elapsed # # replaces this note in the test plan rather than in this # # comment, which would cost an image build to keep the # # shipped suite byte-identical. # # python3-rsa 4.9 (meta-openembedded meta-python/recipes-devtools/python, # python3-rsa_4.9.bb, `inherit pypi python_poetry_core update-alternatives', # PyPI sdist) on the wasm32-hwjs glibc image. # # ============================================================================ # WHAT THE PACKAGE IS, AND THEREFORE WHAT HAS TO BE TESTED. # ============================================================================ # # `rsa' is a PURE-PYTHON RSA implementation: PKCS#1 v1.5 signing and # verification, PKCS#1 v1.5 encryption and decryption, and key serialisation in # PEM and DER. There is no socket, no device, no terminal and no C -- the whole # of it is integer arithmetic over Python's `int', which CPython implements in # software on every architecture. # # So what is at risk on this arm is NOT the cryptography. It is the three things # around it: that the package imported at all, that its one third-party runtime # dependency `pyasn1' resolved, and that 1024-bit integer arithmetic gives the # same answers here as it does anywhere else. The suite is shaped to say which # of those failed when one does. # # ============================================================================ # THE KEY IS COMMITTED, NOT GENERATED. THIS IS THE WHOLE DESIGN. # ============================================================================ # # `rsa.newkeys()' searches for primes with a random number generator. On this # image that would cost unbounded wall time and depend on whatever entropy the # guest is offered -- and, worse, it would make every value below unassertable, # because a fresh key gives fresh signatures and there would be nothing to # compare against. # # The probe therefore carries a 1024-bit key pair generated ONCE, off target, # with this exact release, as a PEM literal. Every signature vector below was # computed from it. A red here is a statement about this arm and not about the # run, and the suite is bounded at ten interpreter starts. # # ============================================================================ # WHY THE SIGNATURE VECTORS ARE ASSERTABLE AND THE CIPHERTEXTS ARE NOT. # ============================================================================ # # PKCS#1 v1.5 SIGNING IS DETERMINISTIC. The padding is `00 01 FF..FF 00' # followed by the DigestInfo -- no random material anywhere -- so the same key # over the same payload gives the same 128 bytes on every run and every # platform. That is what lets `sig-*' below be stored literals, and # `sig-deterministic' asserts the property itself so the premise is measured # rather than assumed. # # PKCS#1 v1.5 ENCRYPTION IS NOT. It pads with random non-zero bytes, so the # ciphertext differs on every call. Encryption is therefore asserted by ROUND # TRIP (`dec-roundtrip') and by INEQUALITY (`enc-differs') and never by a stored # vector. Getting that distinction backwards is the obvious way to write a suite # that fails forever on a correct port, which is why `enc-differs' states it out # loud. # # ============================================================================ # WHAT WOULD ACTUALLY BREAK ON THIS ARM, AND THE CASES THAT WOULD CATCH IT. # ============================================================================ # # SHA-3 IS AN IMPORT-TIME HARD DEPENDENCY. rsa/pkcs1.py names # `hashlib.sha3_256', `sha3_384' and `sha3_512' at module # level under a bare `if sys.version_info >= (3, 6)' -- no # try/except. A python3 built without the SHA-3 backend does # not lose three hash methods here, it fails `import rsa' # outright. `hash-methods' pins all nine names and the three # `sig-sha3*' cases exercise them, so the import-time risk is # visible as its own red rather than as a bare ImportError. # # pyasn1 IS THE ONE THIRD-PARTY RUNTIME DEPENDENCY, and it is what parses and # writes the DER key structures. It is declared in the # recipe's RDEPENDS and is already on this image under # BRINTOS-1750. `pyasn1-importable' asserts it directly, and # the four `*-der-*' cases are the dependency actually being # used -- an undeclared-but-imported dependency is the defect # this neighbourhood produces most often. # # BIGNUM ARITHMETIC IS THE THING A FRESH ARM CAN GET WRONG. `pq-is-n' and # `de-congruent' are two identities over the committed key -- # p*q == n, and d*e == 1 mod (p-1)(q-1) -- computed on target # from 512-bit factors. They cost nothing and they fail loudly # if this arm's long-integer path is broken, which every # signature case below would otherwise report as a mysterious # byte mismatch. # # A VERIFY THAT ALWAYS SAYS YES IS THE FAILURE A ROUND TRIP CANNOT SEE. # A port that mis-padded or truncated would still verify a # signature it produced itself. So five cases corrupt on # purpose: one bit in the payload, one bit at each END of the # signature (the two ends are checked by different code paths), # an empty signature and a short one. All five must raise # VerificationError. # # THE PKCS#1 v1.5 SIZE LIMIT IS keylen - 11. For this 1024-bit key that is # 117 bytes. `enc-max-*' takes exactly 117 and `enc-over-max' # takes 118 and must raise OverflowError, so the boundary is # pinned exactly rather than by asserting that "something # large" fails. # # ============================================================================ # THE PACKAGE SHIPS PROGRAMS, WHICH MOST OF THIS NEIGHBOURHOOD DOES NOT. # ============================================================================ # # Six `pyrsa-*' console scripts go through `update-alternatives' with priority # 30. That is the one part of this port that is packaging rather than Python, # and it is asserted as packaging: each alternative link exists at the path the # recipe promises, resolves, is executable, and exits 0 on `--help'. `--help' # and nothing further -- keygen would search for primes, and encrypt/sign want # a key on stdin, so a deeper CLI exercise would either hang or need fixtures # the probe already covers in-process. # # ============================================================================ # WHAT THIS SUITE DOES NOT DO. # ============================================================================ # # Nothing here reaches a network, a peer, a device or a terminal, and nothing is # spawned except the ten python3 starts named above. No key is generated. There # is no BRINTOS-780 interactive follow-on: the package has no interactive mode, # and the six programs are exercised as far as they can go without fixtures. P=python3-rsa bst_ok $P/suite-canary require python3 $P/python3-present SITE=/usr/lib/python3.12/site-packages PKGDIR=$SITE/rsa DI=$SITE/rsa-4.9.dist-info PKGLIST=/var/lib/dpkg/info/python3-rsa.list PROBE=$BST_DATA/python3-rsa-probe.py tmp=${TMPDIR:-/tmp} W=$tmp/bst-rsa-suite.$$ mkdir -p "$W" || { bst_notok $P/workdir "cannot create $W"; exit 0; } # --------------------------------------------------------------------------- # The tree: what the .deb actually put on the image. # --------------------------------------------------------------------------- check $P/site-packages-dir test -d "$SITE" check $P/package-dir test -d "$PKGDIR" check $P/not-a-flat-module test ! -e "$SITE/rsa.py" check $P/init-file test -s "$PKGDIR/__init__.py" check $P/key-file test -s "$PKGDIR/key.py" check $P/pkcs1-file test -s "$PKGDIR/pkcs1.py" check $P/pkcs1-v2-file test -s "$PKGDIR/pkcs1_v2.py" check $P/asn1-file test -s "$PKGDIR/asn1.py" check $P/cli-file test -s "$PKGDIR/cli.py" check $P/common-file test -s "$PKGDIR/common.py" check $P/core-file test -s "$PKGDIR/core.py" check $P/pem-file test -s "$PKGDIR/pem.py" check $P/prime-file test -s "$PKGDIR/prime.py" check $P/randnum-file test -s "$PKGDIR/randnum.py" check $P/transform-file test -s "$PKGDIR/transform.py" check $P/util-file test -s "$PKGDIR/util.py" check $P/parallel-file test -s "$PKGDIR/parallel.py" # PEP 561: the package advertises inline type information. It is a shipped file # like any other, and a packaging change that dropped it would be invisible # without a case naming it. check $P/py-typed test -f "$PKGDIR/py.typed" check $P/pycache-init test -s "$PKGDIR/__pycache__/__init__.cpython-312.pyc" cat "$PKGLIST" > "$W/pkgf" 2>/dev/null || : > "$W/pkgf" check $P/pkg-list-present test -s "$W/pkgf" # PURE PYTHON, WHICH IS WHY IT PORTS. This image's python3 is ONE STATIC BINARY # with an empty lib-dynload and no dynamic loader (BRINTOS-1476), so a release # that grew a compiled extension would install into site-packages and die at # `import rsa'. The negative is asserted directly rather than assumed, so a # version bump that grows an extension fails loudly here instead of as an # ImportError three tickets later. check_eq $P/pkg-no-so "" \ "$(grep -E '\.so($|\.)' "$W/pkgf" 2>/dev/null)" # UNLIKE its pure-Python neighbours, this package DOES ship programs -- six of # them, through update-alternatives. So the sibling suites' `pkg-no-bin' case # would be wrong here, and its inverse is asserted instead: the tree carries # only Python, the dist-info, and the six tools. _bad="" while IFS= read -r _f; do [ -f "$_f" ] || continue case "$_f" in *.py|*.pyc) continue ;; */__pycache__/*) continue ;; */*.dist-info/*) continue ;; /usr/bin/pyrsa-*) continue ;; */rsa/py.typed) continue ;; esac _bad="$_bad $_f" done < "$W/pkgf" check_eq $P/pkg-only-python-and-tools "" "$_bad" check $P/dist-info-dir test -d "$DI" check $P/dist-info-metadata test -f "$DI/METADATA" check_out $P/dist-info-name "Name: rsa" cat "$DI/METADATA" check_out $P/dist-info-version "Version: 4.9" cat "$DI/METADATA" check $P/dist-info-record test -s "$DI/RECORD" # poetry-core writes entry_points.txt and NO top_level.txt -- the sibling # setuptools3 ports assert the latter, and asserting it here would fail on a # correct package. entry_points.txt is also the file that ties the six console # scripts to the six update-alternatives entries exercised at the end. check $P/dist-info-entry-points test -s "$DI/entry_points.txt" check $P/dist-info-no-top-level test ! -e "$DI/top_level.txt" check_out $P/entry-point-keygen "pyrsa-keygen=rsa.cli:keygen" cat "$DI/entry_points.txt" check_out $P/entry-point-priv2pub "pyrsa-priv2pub=rsa.util:private_to_public" cat "$DI/entry_points.txt" # poetry-core builds a pure wheel; both facts are the packaging promise this # port depends on, and both are what make the no-.so case above expectable # rather than lucky. check_out $P/dist-info-purelib "Root-Is-Purelib: true" cat "$DI/WHEEL" check_out $P/dist-info-tag-py3 "Tag: py3-none-any" cat "$DI/WHEEL" sed -n '/^Package: python3-rsa$/,/^$/p' /var/lib/dpkg/status > "$W/st" 2>/dev/null check $P/pkg-known test -s "$W/st" check_out $P/pkg-installed "Status: install ok installed" cat "$W/st" check_out $P/pkg-version "Version: 4.9-r0" cat "$W/st" # --------------------------------------------------------------------------- # The import. # --------------------------------------------------------------------------- check $P/import python3 -c 'import rsa' # A library that prints on import corrupts every caller that parses stdout, and # this one has a dependency chain to import through. check_eq $P/import-quiet "" \ "$(python3 -c 'import rsa' 2>&1)" # --------------------------------------------------------------------------- # The probe: ONE python3 start for every measurement below. # --------------------------------------------------------------------------- if [ ! -f "$PROBE" ]; then bst_notok $P/probe-present "$PROBE did not ship" rm -rf "$W" exit 0 fi bst_ok $P/probe-present bst_probe $P/probe-run "$W/probe" 900 python3 "$PROBE" OUT="$W/probe" pv() { grep "^$1=" "$OUT" 2>/dev/null | head -n 1 | cut -d= -f2-; } if [ -s "$OUT" ]; then bst_ok $P/probe-output else bst_notok $P/probe-output "the probe emitted nothing -- python3 did not start, or died before its first line; every CASE below is unscorable" fi check_eq $P/probe-complete "yes" "$(pv probe_done)" check_eq $P/probe-count "64" "$(pv emitted_count)" check_eq $P/module-answered "$PKGDIR/__init__.py" "$(pv module_file)" check_eq $P/is-package "yes" "$(pv is_package)" check_eq $P/version-attr "4.9" "$(pv version_attr)" check_eq $P/api \ "DecryptionError,PrivateKey,PublicKey,VerificationError,compute_hash,decrypt,encrypt,find_signature_hash,newkeys,sign,sign_hash,verify" \ "$(pv api)" # The dependency, and the dependency actually resolving. check_eq $P/pyasn1-importable "yes" "$(pv pyasn1_importable)" check_eq $P/pyasn1-version "0.5.1" "$(pv pyasn1_version)" # All nine, including the three SHA-3 names this release imports unconditionally. check_eq $P/hash-methods \ "MD5,SHA-1,SHA-224,SHA-256,SHA-384,SHA-512,SHA3-256,SHA3-384,SHA3-512" \ "$(pv hash_methods)" # --------------------------------------------------------------------------- # The committed key, loaded both ways. # --------------------------------------------------------------------------- check_eq $P/priv-loaded "yes" "$(pv priv_loaded)" check_eq $P/pub-loaded "yes" "$(pv pub_loaded)" check_eq $P/priv-type "PrivateKey" "$(pv priv_type)" check_eq $P/pub-type "PublicKey" "$(pv pub_type)" check_eq $P/n-hex \ "be9c8868c5a010c57dd11c7e436ba187d244a2bc2b62d39f00cb7a959bfdaf8f9d159b08f8460d176a7223cc413c449be7b816b130dbce8555b546ed3cc14cac3a208de44d49bf80cd14f68ba179f9e71443cde3d813e5072916c1e259cc2c41e06af1ce9c21ff1502c70f6dd09ba7c3243a005e94807153593a52d7a3bc2fed" \ "$(pv n_hex)" check_eq $P/priv-e "65537" "$(pv priv_e)" check_eq $P/pub-e "65537" "$(pv pub_e)" check_eq $P/pub-n-matches "yes" "$(pv pub_n_matches_priv)" check_eq $P/key-size-bits "1024" "$(pv key_size_bits)" check_eq $P/block-size-bytes "128" "$(pv block_size_bytes)" # Two identities over the committed key, computed on target from its 512-bit # factors: the cheapest possible statement that this arm's bignum is sane. check_eq $P/pq-is-n "yes" "$(pv pq_is_n)" check_eq $P/de-congruent "yes" "$(pv de_congruent)" # DER, which is pyasn1 doing the work. # The private key's DER too, not only the public one. `priv-der-n-matches' below # compares only the modulus, so a drift in pyasn1's DER encoding -- a changed # integer padding, a re-ordered field -- would round-trip cleanly and pass it # while the bytes moved. This is the case that would not. check_eq $P/priv-der-hex \ "3082025f02010002818100be9c8868c5a010c57dd11c7e436ba187d244a2bc2b62d39f00cb7a959bfdaf8f9d159b08f8460d176a7223cc413c449be7b816b130dbce8555b546ed3cc14cac3a208de44d49bf80cd14f68ba179f9e71443cde3d813e5072916c1e259cc2c41e06af1ce9c21ff1502c70f6dd09ba7c3243a005e94807153593a52d7a3bc2fed02030100010281804c6933c5cc737e45ad4a46c1d7052e9be40edfadcf36aedeeed2a3319676fc09f64ed2f7a58f6f70139bedfdd3a8f5580a6c21aca6897720bc5b0f337b98c715e431fbde3dd41bd082e1c4f9ab2028217d005f7e56da75205c6e2b6a81c3047cee1eb92b9133096dc2349fcab28c8ec2be19c5d8dffee1fc89c2b3891c71b981024500c6c503e080854513bc55202111d859451ec0d2c59379cbf7d94f91f86511932717067a529f848c943f44ebd545884c14325fdbe487112429a18f94f4609268c434f32563023d00f57e31e1c559398a047f975e41c8cb5de6d3cc67763c9bf02415259e4fe8d1a3a7b67665faa64422df2d20d89068be6718208c974b9b2803100b3e6f024409465421fb9d3c55e969c770039726c334e6266f95ac0f3a67677116381113deb512564ed8a6a4b09e2b271df27aa3a2259f97711864525da6ee3e3310f683f0f3cf8ca5023c1dabc7f9a2b19b0bbc69737118005ddc169708c08480e4d40c7865d8918df1309787ad1dbc42b63f84bbde996e32cab88928fdf51755446bc257a98f02441fe90668549964a5fef95c0f4487bf311d6f1ad0230f7e0281be5fa9b1e6cd9db3e9edd6554ffa1435ac2e20a88339e9a10a74a6d9dbccf06bbd46d5033e45ebf0eefa8f" \ "$(pv priv_der_hex)" check_eq $P/pub-der-hex \ "30818902818100be9c8868c5a010c57dd11c7e436ba187d244a2bc2b62d39f00cb7a959bfdaf8f9d159b08f8460d176a7223cc413c449be7b816b130dbce8555b546ed3cc14cac3a208de44d49bf80cd14f68ba179f9e71443cde3d813e5072916c1e259cc2c41e06af1ce9c21ff1502c70f6dd09ba7c3243a005e94807153593a52d7a3bc2fed0203010001" \ "$(pv pub_der_hex)" check_eq $P/priv-der-n-matches "yes" "$(pv priv_der_n_matches)" check_eq $P/pub-der-n-matches "yes" "$(pv pub_der_n_matches)" check_eq $P/priv-pem-roundtrip "yes" "$(pv priv_pem_roundtrip)" # --------------------------------------------------------------------------- # Signing: nine stored vectors, each 128 bytes, each deterministic. # # `verify-*' asserts the NAME verify() recovered from the DigestInfo rather than # a bare true: that says the padding parsed AND names which algorithm the # signature commits to, which a boolean cannot. # --------------------------------------------------------------------------- check_eq $P/sig-md5 \ "a729742c4e0c6f986b020198da4457723613f4767d814fcec67d7bf9c6824dbac25e214117c252df41430375f95a155cf79f478d9778a31785459b162489e1b8a74438f0212d67caac40d6db3c73a4e517aa4a504afbe4bc932c7a52714bfa6b9dbfb4a0ac96e80806fe47691653b5ff2bb74c1a76e69072fdb787ba5e88e0de" \ "$(pv sig_md5)" check_eq $P/verify-md5 "MD5" "$(pv verify_md5)" check_eq $P/sig-sha1 \ "3d6813fc2d0cd0ca16cfcd87a777f3a70dbd310243eda3dd106ea06ec2210bde811885bd656f2da8f19d6e6a4fe31fbc5d3b8e402d7c53eb128e4c58b755dadabda4f68fb5fe1ff0398a9684df7e28b428e9e4361416d0c9241f391dd56f3fef02466bbf41e0f35fd042eafbd27e1b96190296824dde62cc3c07407ebf55416d" \ "$(pv sig_sha1)" check_eq $P/verify-sha1 "SHA-1" "$(pv verify_sha1)" check_eq $P/sig-sha224 \ "902abd0d8916e6a6f1ccad65bc8dfddc3b68e602d703e37c7031c2e681c776a9ef40a4942c5898a81f3bca895210156516257f260c6b5b43bdb87351feee7303eb2362045c9e1a7924327ecdf75bbd174bb435ca0e5b328e2125a35301b768a1d0b3f653cebb4ddf9360124a86eb88489eb9226da2a0378663efe7ccaba4fc13" \ "$(pv sig_sha224)" check_eq $P/verify-sha224 "SHA-224" "$(pv verify_sha224)" check_eq $P/sig-sha256 \ "4dc3b86f745b743e607c4ea5076aa996b209553b98f7b9aabb46aacf330abd17cc9631087433e838cc710f1a5913f8430e56fb7b9d65923e9191949816219e9368b0ec748f66d45666501952a46e2650ad0d0c0600104b531ba67e61a6adf1ecd188593ea16ece78a9a6fd4fc02d2fffce2e69792c454d854d31c9e34ff57066" \ "$(pv sig_sha256)" check_eq $P/verify-sha256 "SHA-256" "$(pv verify_sha256)" check_eq $P/sig-sha384 \ "92b38a4e5235d2b100d9209fca110ee8cdf56beb8884eb437a38c4978a0855e53af73dfcc21316501c70140f82ee61f7d2d61958ef5a35fa37469404154c998c22ca709515c1faace51531b758e7d569bb8678f3073081c1c942d51563f35cb8c5d8f3d5765b585e2542b38191514849686719cd599c62570a57ce314cc40c67" \ "$(pv sig_sha384)" check_eq $P/verify-sha384 "SHA-384" "$(pv verify_sha384)" check_eq $P/sig-sha512 \ "0c267094e7751ebc8b81b2e4c6c053d875c8f4247c7d4e25f33512b23ac0c23e513173e9fb4017a15b1c9d68c3fa14bdc11a0b4dc5eb3f9071ea5046d9dc1209e3e84050639c1a3775f53f18f850add04299bfd4211a66919a5764bc8a2e00989e75f9d397d009f532253d144253bdb25b63614b484f9f06ed30697f2af926a4" \ "$(pv sig_sha512)" check_eq $P/verify-sha512 "SHA-512" "$(pv verify_sha512)" check_eq $P/sig-sha3256 \ "49a836a898d6bc503308808bafc0b263deaafde5edf43e49657d8928bafbedf2d78e5a91827cd6ed452de1880607e4a069dd6badbe75fadc1a404ff8dc93e065fe9df9a55a28d4e3088623e1cc1058e7afb134eccabb4bd3ac94002755106e37826d86d98f7c1fb0e4d303a99ed1eb4ae9efc67360710751799c122492d8b04e" \ "$(pv sig_sha3256)" check_eq $P/verify-sha3256 "SHA3-256" "$(pv verify_sha3256)" check_eq $P/sig-sha3384 \ "b65b2263e8cd34620758ce936426e6290d43d67bb11a80088749c722a32abc3c161d5aba494cfc260d5983615ef0be37dcc62f5c9c233a47e95a35bfb7abb2ca3af46a61a1272f6f805122e8340ce61c4c2b58165da8d85bda247f516c98be0446b42e3f524d05221abeda994aeec9d76a18b660044ad1a75a4226c48a23a154" \ "$(pv sig_sha3384)" check_eq $P/verify-sha3384 "SHA3-384" "$(pv verify_sha3384)" check_eq $P/sig-sha3512 \ "b602e6d280f0d271f4ccbeed4f310d6637df6c9e9e40feec839bb0962e1c9be09f20fb98e62553828b769dc1e4f0b243a41da993c30f0dbed97f507e87002539adaa232d4b742645f5dc6993c6ed24b4e0d2b59a995b3c986e9ba189ee9e6fcbe05d5315580ce4baac2f8af12f6950d4bc70fa677e0ca1f6ea1925814b751da2" \ "$(pv sig_sha3512)" check_eq $P/verify-sha3512 "SHA3-512" "$(pv verify_sha3512)" check_eq $P/sig-deterministic "yes" "$(pv sig_deterministic)" check_eq $P/find-signature-hash "SHA-256" "$(pv find_signature_hash)" check_eq $P/compute-hash-sha256 \ "96b377178ef229d0ef001b92efa07caec9e1e73feef635d807d44890f5c811f1" \ "$(pv compute_hash_sha256)" check_eq $P/sign-hash-agrees "yes" "$(pv sign_hash_agrees)" # --------------------------------------------------------------------------- # Verification must FAIL where it should. See the header: a round trip alone # cannot tell a working verify from a rubber stamp. # --------------------------------------------------------------------------- check_eq $P/verify-flipped-payload "!VerificationError" "$(pv verify_flipped_payload)" check_eq $P/verify-flipped-sig-first "!VerificationError" "$(pv verify_flipped_sig_first)" check_eq $P/verify-flipped-sig-last "!VerificationError" "$(pv verify_flipped_sig_last)" check_eq $P/verify-empty-sig "!VerificationError" "$(pv verify_empty_sig)" check_eq $P/verify-short-sig "!VerificationError" "$(pv verify_short_sig)" # --------------------------------------------------------------------------- # Encryption: round trip and inequality, never a stored ciphertext. # --------------------------------------------------------------------------- check_eq $P/enc-len "128" "$(pv enc_len)" check_eq $P/enc-differs "yes" "$(pv enc_differs)" check_eq $P/dec-roundtrip \ "$(pv dec_roundtrip_plain_hex)" "$(pv dec_roundtrip)" check_eq $P/dec-second-roundtrip "yes" "$(pv dec_second_roundtrip_agrees)" check_eq $P/enc-max-len "128" "$(pv enc_max_len)" check_eq $P/enc-max-roundtrip "yes" "$(pv enc_max_roundtrip)" check_eq $P/enc-over-max "!OverflowError" "$(pv enc_over_max)" check_eq $P/dec-garbage "!DecryptionError" "$(pv dec_garbage)" check_eq $P/dec-empty "!DecryptionError" "$(pv dec_empty)" check_eq $P/cli-targets "decrypt,encrypt,keygen,sign,verify" "$(pv cli_targets)" check_eq $P/util-private-to-public "yes" "$(pv util_private_to_public)" check_eq $P/stdout-clean "yes" "$(pv stdout_clean)" # --------------------------------------------------------------------------- # The six programs, which is the update-alternatives half of this port. # # `--help' and no further: keygen would search for primes, and encrypt/sign want # a key on stdin. Each tool is a full python3 start that imports rsa before # optparse prints anything, so this loop is six of the suite's ten starts. # --------------------------------------------------------------------------- for _t in pyrsa-decrypt pyrsa-encrypt pyrsa-keygen pyrsa-priv2pub pyrsa-sign pyrsa-verify; do check $P/$_t-link test -e "/usr/bin/$_t" check $P/$_t-executable test -x "/usr/bin/$_t" check_rc $P/$_t-help 0 "/usr/bin/$_t" --help done # The usage line names the tool itself, which is what says the alternative # resolved to the RIGHT program rather than merely to something that exits 0. check_out $P/pyrsa-keygen-usage "pyrsa-keygen" /usr/bin/pyrsa-keygen --help check_out $P/pyrsa-priv2pub-usage "pyrsa-priv2pub" /usr/bin/pyrsa-priv2pub --help rm -rf "$W"