From d987ac6bf1d78b3a9bbd213e73b871ebc687acb2 Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Mon, 6 Feb 2023 02:49:21 +0100
Subject: Add Chef package registry (#22554)

This PR implements a [Chef registry](https://chef.io/) to manage
cookbooks. This package type was a bit complicated because Chef uses RSA
signed requests as authentication with the registry.


![grafik](https://user-images.githubusercontent.com/1666336/213747995-46819fd8-c3d6-45a2-afd4-a4c3c8505a4a.png)


![grafik](https://user-images.githubusercontent.com/1666336/213748145-d01c9e81-d4dd-41e3-a3cc-8241862c3166.png)

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 modules/util/keypair.go      | 45 ++++++++++++++++++++++++++++++++
 modules/util/keypair_test.go | 61 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 106 insertions(+)
 create mode 100644 modules/util/keypair.go
 create mode 100644 modules/util/keypair_test.go

(limited to 'modules/util')

diff --git a/modules/util/keypair.go b/modules/util/keypair.go
new file mode 100644
index 0000000000..5a3ce715a4
--- /dev/null
+++ b/modules/util/keypair.go
@@ -0,0 +1,45 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+)
+
+// GenerateKeyPair generates a public and private keypair
+func GenerateKeyPair(bits int) (string, string, error) {
+	priv, _ := rsa.GenerateKey(rand.Reader, bits)
+	privPem, err := pemBlockForPriv(priv)
+	if err != nil {
+		return "", "", err
+	}
+	pubPem, err := pemBlockForPub(&priv.PublicKey)
+	if err != nil {
+		return "", "", err
+	}
+	return privPem, pubPem, nil
+}
+
+func pemBlockForPriv(priv *rsa.PrivateKey) (string, error) {
+	privBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(priv),
+	})
+	return string(privBytes), nil
+}
+
+func pemBlockForPub(pub *rsa.PublicKey) (string, error) {
+	pubASN1, err := x509.MarshalPKIXPublicKey(pub)
+	if err != nil {
+		return "", err
+	}
+	pubBytes := pem.EncodeToMemory(&pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: pubASN1,
+	})
+	return string(pubBytes), nil
+}
diff --git a/modules/util/keypair_test.go b/modules/util/keypair_test.go
new file mode 100644
index 0000000000..c6f68c845a
--- /dev/null
+++ b/modules/util/keypair_test.go
@@ -0,0 +1,61 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package util
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/pem"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestKeygen(t *testing.T) {
+	priv, pub, err := GenerateKeyPair(2048)
+	assert.NoError(t, err)
+
+	assert.NotEmpty(t, priv)
+	assert.NotEmpty(t, pub)
+
+	assert.Regexp(t, regexp.MustCompile("^-----BEGIN RSA PRIVATE KEY-----.*"), priv)
+	assert.Regexp(t, regexp.MustCompile("^-----BEGIN PUBLIC KEY-----.*"), pub)
+}
+
+func TestSignUsingKeys(t *testing.T) {
+	priv, pub, err := GenerateKeyPair(2048)
+	assert.NoError(t, err)
+
+	privPem, _ := pem.Decode([]byte(priv))
+	if privPem == nil || privPem.Type != "RSA PRIVATE KEY" {
+		t.Fatal("key is wrong type")
+	}
+
+	privParsed, err := x509.ParsePKCS1PrivateKey(privPem.Bytes)
+	assert.NoError(t, err)
+
+	pubPem, _ := pem.Decode([]byte(pub))
+	if pubPem == nil || pubPem.Type != "PUBLIC KEY" {
+		t.Fatal("key failed to decode")
+	}
+
+	pubParsed, err := x509.ParsePKIXPublicKey(pubPem.Bytes)
+	assert.NoError(t, err)
+
+	// Sign
+	msg := "activity pub is great!"
+	h := sha256.New()
+	h.Write([]byte(msg))
+	d := h.Sum(nil)
+	sig, err := rsa.SignPKCS1v15(rand.Reader, privParsed, crypto.SHA256, d)
+	assert.NoError(t, err)
+
+	// Verify
+	err = rsa.VerifyPKCS1v15(pubParsed.(*rsa.PublicKey), crypto.SHA256, d, sig)
+	assert.NoError(t, err)
+}
-- 
cgit v1.2.3