diff --git a/dev-tools/cmd/buildpgp/build_pgp.go b/dev-tools/cmd/buildpgp/build_pgp.go index 8559ea04c32..659fc1acbd1 100644 --- a/dev-tools/cmd/buildpgp/build_pgp.go +++ b/dev-tools/cmd/buildpgp/build_pgp.go @@ -49,9 +49,9 @@ func init() { pgpBytes = packer.MustUnpack("{{ .Pack }}")["GPG-KEY-elasticsearch"] } -// PGP return pgpbytes and a flag describing whether or not no pgp is valid. -func PGP() (bool, []byte) { - return allowEmptyPgp == "true", pgpBytes +// PGP return pgpbytes. +func PGP() []byte { + return pgpBytes } `)) diff --git a/docs/pgp-sign-verify-artifact.md b/docs/pgp-sign-verify-artifact.md new file mode 100644 index 00000000000..9f8f1295a89 --- /dev/null +++ b/docs/pgp-sign-verify-artifact.md @@ -0,0 +1,176 @@ +# Signing Elastic Agent artifacts + +This doc covers generating a key, exporting the public key, signing a file and verifying it using GPG as well as pure Go. + +Full GPG docs: https://www.gnupg.org/documentation/manuals/gnupg/OpenPGP-Key-Management.html + + +## Go + +```go +package main + +import ( + "bytes" + "fmt" + "os" + "path/filepath" + + "golang.org/x/crypto/openpgp" + "golang.org/x/crypto/openpgp/armor" +) + +func main() { + dir, err := os.MkdirTemp(os.TempDir(), "pgp-") + NoError(err, "could not create directory to save the files to") + + key := filepath.Join(dir, "key") + keyPub := filepath.Join(dir, "key.pub") + asc := filepath.Join(dir, "plaindata.asc") + + fmt.Printf("Writing files to %q\n", dir) + + data := []byte("some data") + plaindata := filepath.Join(dir, "plaindata") + err = os.WriteFile(plaindata, data, 0o600) + NoError(err, "could not write plain data file") + + fmt.Printf("wrote %q\n", plaindata) + + // Create files + fKeyPub, err := os.OpenFile( + keyPub, + os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600) + NoError(err, "could not create %q file", keyPub) + defer func() { + if err := fKeyPub.Close(); err != nil { + fmt.Printf("failed closing %q\n", fKeyPub.Name()) + } + fmt.Printf("wrote %q\n", fKeyPub.Name()) + }() + + fKey, err := os.OpenFile( + key, + os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600) + NoError(err, "could not create %q file", key) + defer func() { + if err := fKey.Close(); err != nil { + fmt.Printf("failed closing %q\n", fKey.Name()) + } + fmt.Printf("wrote %q\n", fKey.Name()) + }() + + fasc, err := os.OpenFile( + asc, + os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0600) + NoError(err, "could not create %q file", asc) + defer func() { + if err := fasc.Close(); err != nil { + fmt.Printf("failed closing %q\n", fasc.Name()) + } + fmt.Printf("wrote %q\n", fasc.Name()) + }() + + // Generate PGP key + entity, err := openpgp.NewEntity("someKeyName", "", "", nil) + + // Create an ASCII armored encoder to serialize the private key + wPubKey, err := armor.Encode(fKeyPub, openpgp.PublicKeyType, nil) + NoError(err, "could not create PGP ASCII Armor encoder for public key") + defer func() { + err := wPubKey.Close() + if err != nil { + fmt.Println("failed closing private key writer") + } + }() + + // Writes the public key to the io.Writer passed to armor.Encode. + // Use entity.SerializePrivate if you need the private key. + err = entity.Serialize(wPubKey) + NoError(err, "could not serialize the public key") + + // Create an ASCII armored encoder to serialize the private key + wPrivKey, err := armor.Encode(fKey, openpgp.PrivateKeyType, nil) + NoError(err, "could not create PGP ASCII Armor encoder for private key") + defer func() { + err := wPrivKey.Close() + if err != nil { + fmt.Println("failed closing private key writer") + } + }() + + // Writes the private key to the io.Writer passed to armor.Encode. + // Use entity.SerializePrivate if you need the private key. + err = entity.SerializePrivate(wPrivKey, nil) + NoError(err, "could not serialize the private key") + + // Sign data and write the detached signature to fasc + err = openpgp.ArmoredDetachSign(fasc, entity, bytes.NewReader(data), nil) + NoError(err, "failed signing date") +} + +func NoError(err error, msg string, args ...any) { + if err != nil { + panic(fmt.Sprintf(msg+": %v", append(args, err))) + } +} +``` + +## GPG +### Generate a key + +```shell +gpg --no-default-keyring --keyring ./some-file-to-be-the-key-ring --quick-generate-key atest rsa2048 default none +``` +Where: + - `--no-default-keyring`: do not use your keyring + - `--keyring ./some-file-to-be-the-key-ring`: keyring to use, as the file do not exist, it'll create it + - `--quick-generate-key`: quick generate the key + - `atest`: user-id, a.k.a the key identifier + - `rsa2048`: algorithm to use + - `default`: "usage" for the key. Just use default + - `none`: key expiration + + +### Export the public key +```shell +gpg --no-default-keyring --keyring ./some-file-to-be-the-key-ring --armor --output public-key.pgp --export atest +``` +Where: +- `--no-default-keyring`: do not use your keyring + - `--keyring ./some-file-to-be-the-key-ring`: the keyring to use, created in the previous step + - `--armor`: create ASCII armoured output. Otherwise, it's a binary format + - `--output public-key.pgp`: the output file + - `--export`: export the public key + - `atest`: the key identifier + +### Sing the file +```shell +gpg --no-default-keyring --keyring ./some-file-to-be-the-key-ring -a -o elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc --detach-sign elastic-agent-8.0.0-darwin-x86_64.tar.gz +``` + +Where: + - `-a -o`: --armored, --output + - `elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc`: the output file + - `--detach-sign`: generate a separated file for signature + - `elastic-agent-8.0.0-darwin-x86_64.tar.gz`: the file to sign + + + +### Verify the file + +#### Import the public key +```shell +gpg --no-default-keyring --keyring ./new-keyring --import public-key.pgp +``` +Where: + - `--import`: import a key + - `public-key.pgp`: the key to import + +#### Verify the signature using the imported key +```shell +gpg --no-default-keyring --keyring ./new-keyring --verify elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc +``` +Where: + - `--verify`: verify a signature + - `elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc`: the detached signature file. It'll assume the file to be verified is `elastic-agent-8.0.0-darwin-x86_64.tar.gz` diff --git a/internal/pkg/agent/application/coordinator/coordinator.go b/internal/pkg/agent/application/coordinator/coordinator.go index e6a2dbc182f..a17d3bf6199 100644 --- a/internal/pkg/agent/application/coordinator/coordinator.go +++ b/internal/pkg/agent/application/coordinator/coordinator.go @@ -108,7 +108,7 @@ type RuntimeManager interface { // it performs diagnostics for all current units. PerformDiagnostics(context.Context, ...runtime.ComponentUnitDiagnosticRequest) []runtime.ComponentUnitDiagnostic - //PerformComponentDiagnostics executes the diagnostic action for the provided components. If no components are provided, + // PerformComponentDiagnostics executes the diagnostic action for the provided components. If no components are provided, // then it performs the diagnostics for all current units. PerformComponentDiagnostics(ctx context.Context, additionalMetrics []cproto.AdditionalDiagnosticRequest, req ...component.Component) ([]runtime.ComponentDiagnostic, error) } @@ -415,7 +415,7 @@ func (c *Coordinator) ReExec(callback reexec.ShutdownCallbackFn, argOverrides .. // Upgrade runs the upgrade process. // Called from external goroutines. func (c *Coordinator) Upgrade(ctx context.Context, version string, sourceURI string, action *fleetapi.ActionUpgrade, skipVerifyOverride bool, skipDefaultPgp bool, pgpBytes ...string) error { - // early check outside of upgrader before overridding the state + // early check outside of upgrader before overriding the state if !c.upgradeMgr.Upgradeable() { return ErrNotUpgradable } diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/downloader.go b/internal/pkg/agent/application/upgrade/artifact/download/fs/downloader.go index 42cc058c16b..6de72f0143e 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/fs/downloader.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/fs/downloader.go @@ -52,32 +52,34 @@ func (e *Downloader) Download(ctx context.Context, a artifact.Artifact, version }() // download from source to dest - path, err := e.download(e.config.OS(), a, version) + path, err := e.download(e.config.OS(), a, version, "") downloadedFiles = append(downloadedFiles, path) if err != nil { return "", err } - hashPath, err := e.downloadHash(e.config.OS(), a, version) + hashPath, err := e.download(e.config.OS(), a, version, ".sha512") downloadedFiles = append(downloadedFiles, hashPath) return path, err } -func (e *Downloader) download(operatingSystem string, a artifact.Artifact, version string) (string, error) { - filename, err := artifact.GetArtifactName(a, version, operatingSystem, e.config.Arch()) - if err != nil { - return "", errors.New(err, "generating package name failed") - } - - fullPath, err := artifact.GetArtifactPath(a, version, operatingSystem, e.config.Arch(), e.config.TargetDirectory) +// DownloadAsc downloads the package .asc file from configured source. +// It returns absolute path to the downloaded file and a no-nil error if any occurs. +func (e *Downloader) DownloadAsc(_ context.Context, a artifact.Artifact, version string) (string, error) { + path, err := e.download(e.config.OS(), a, version, ".asc") if err != nil { - return "", errors.New(err, "generating package path failed") + os.Remove(path) + return "", err } - return e.downloadFile(filename, fullPath) + return path, nil } -func (e *Downloader) downloadHash(operatingSystem string, a artifact.Artifact, version string) (string, error) { +func (e *Downloader) download( + operatingSystem string, + a artifact.Artifact, + version, + extension string) (string, error) { filename, err := artifact.GetArtifactName(a, version, operatingSystem, e.config.Arch()) if err != nil { return "", errors.New(err, "generating package name failed") @@ -88,8 +90,10 @@ func (e *Downloader) downloadHash(operatingSystem string, a artifact.Artifact, v return "", errors.New(err, "generating package path failed") } - filename = filename + ".sha512" - fullPath = fullPath + ".sha512" + if extension != "" { + filename += extension + fullPath += extension + } return e.downloadFile(filename, fullPath) } diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/beat-8.0.0-darwin-x86_64.tar.gz b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz similarity index 100% rename from internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/beat-8.0.0-darwin-x86_64.tar.gz rename to internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc new file mode 100644 index 00000000000..dc0dc3745c9 --- /dev/null +++ b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz.asc @@ -0,0 +1,14 @@ +-----BEGIN PGP SIGNATURE----- + +iQGzBAABCgAdFiEE81a455Doc5DWexOcF4e6ez4rqzAFAmUn7TsACgkQF4e6ez4r +qzDcIgwArpuXDex9aisWFWkXjCfjhJdrTTXr3wv8W68NeFsAaazLlvsWPxdol1db +FeKFL+P/P/PhlTvdkZw9xMyXoVRWQXJ2p2jVjV0Wq2SCtbbjdrGjQ4OrchgE9FW7 +onWxqV8RjzPyaMwpDWWtHKgxhQeLP5yXhWm6RXHvBLZ5mqbTCuIq2Q4sijEd6IFD +9JoAA276tqyKGOsPZ1QzaPUFF69B9QLcWasEuNFf5ytMVFfTcMl6/HYDPO7ErhJx +E1hnKGIc5rrMghL0LzaVLGYZUtnQwru02ZA0omXzEv1uYgqmZl75g9qHk2Cu2V5W +0qbg9OtUKOkJ1sODvsVv8O40rVazdZTgL2ifNLi2wFwR3syMdHCih2aKMcPDPzt3 +Q4q0zvsxuR9PGsv5+8zze74iC3oZSvF8h36XGjJuyjEFORUpcWNGDmhsC6l7ql5W +rEbIPZ19j3r1M4yHG/ptBmrwRnQz9RKFnwTO9ME/5eBVumPLUD5kAcYXjvAFYQI5 +qEc7okL5 +=+nvi +-----END PGP SIGNATURE----- diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/beat-8.0.0-darwin-x86_64.tar.gz.sha512 b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz.sha512 similarity index 74% rename from internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/beat-8.0.0-darwin-x86_64.tar.gz.sha512 rename to internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz.sha512 index 5d0fc9e405d..599ae848893 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/beat-8.0.0-darwin-x86_64.tar.gz.sha512 +++ b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/elastic-agent-8.0.0-darwin-x86_64.tar.gz.sha512 @@ -1 +1 @@ -9af9aa016f3349aa248034629e4336ca2f4d31317bfb8c9a23a9d924c18969cf43ad93727e784da010a272690b2b5ce4c4ded3a5d2039e4408e93e1e18d113db beat-8.0.0-darwin-x86_64.tar.gz +9af9aa016f3349aa248034629e4336ca2f4d31317bfb8c9a23a9d924c18969cf43ad93727e784da010a272690b2b5ce4c4ded3a5d2039e4408e93e1e18d113db elastic-agent-8.0.0-darwin-x86_64.tar.gz diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/public-key.pgp b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/public-key.pgp new file mode 100644 index 00000000000..7d452cb033c --- /dev/null +++ b/internal/pkg/agent/application/upgrade/artifact/download/fs/testdata/drop/public-key.pgp @@ -0,0 +1,40 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGNBGUn7JEBDADH0iBdohpZIQY7QyBz9Hl68b7fq0zoFcB4HTDDMQD1ouDQfPwg +Frpr/ViNNHsye1QfrUWXN8FQfKztqHtUHeM8ggdSvhYYGaDtVSuVakoNNz3Z3+kD +YhwH0byZrE2MiCKExtgQYWBIDd1TeCMSOgYcQPAXPqQBwX0G1xRAY3s+eazCjaSU +aNJtlNuAx36jEBa+X73sTh+Y/OtCSN9s75SVYu5xJ+kXkpcHNvsMJmDCZ0zsKrxT +TMvXSU9qcczj8+wAee/1E77eR01ttrf67IjVReuVZ0OhxucVxJHOp7x9jfeGsjjn +6uhFT0KV+VOaaRlI9wZ4AOMmAX5nroNYP/GC+SKiOvKV79+r3jyxbChqd5nWdSBN +mO9okB72nUpGmL1NosW926MMTauR9/nP1uWB66d/pHYRop7sAbAZ7u8COoRS1wd+ +V6dtb3QUwR9LsfKd1xQfrTFVKZ4i703MN1qkq/6TqLhpwlt0+K4WN7LtkkeFivyx +N0RLiVDzZP289ssAEQEAAbQFYXRlc3SJAc4EEwEKADgWIQTzVrjnkOhzkNZ7E5wX +h7p7PiurMAUCZSfskQIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAXh7p7 +PiurMFkbDAC0QLqwq4dZGjOqcNjj02DOM1eQcC8XUSy0w8X6gX/69wFHGM34zl4+ +IO7H6ujvkBxMHmeEU3nNsLH+WsN6Hc8JBRQZSqjySgL2am+K6XYMcP7h7VGnFR0r +5IKbGn9zCR7xkVrkvW0T48U0fJ00X3v+GWcxcBQIu58sMmKrmzliPCDhmQ94yum8 +n8Yc1tB3DazAQEDGxtfP8/yc93sWKZ4qKPBMZUsjSSzC8a7zei/J9vJccRy/JJEl +/mNIQx7FxObrCSSa3wXc4AEbWdq4HNZkahLvnOs4EhNR9ihWg7TtMVyBesV/rdgj +5cgHU3erir1nSOHmrHqLydeWH4vHW4R6BYuJd6NXhsISMHO8Oerlceqmt7aex3wJ +09ULyareJ3QMc+HWcjxxYbSLU6j5ZgCqcPz17V88W7SkXnzbPaoVAxMCf+M3a0Ib +r+Yw6CrvWRj2+bmW8Ars6fND90nX4ZS82VnMc27kFqNYdkAE9kdlZ+L8OU70nWmT +Clh2FhjhHKe5AY0EZSfskQEMANT+4NWxDtyExZEIvwUdegcetF3hbdHlXMmMnuPU +vJwPhXhXJtzyX5VKRp3WCUO2TOGMKaHaNPi4XCS4QMzBEEft8C7X896QPGqanGdV +oZ9Oc/mXNZfuOk62hP6Ifn38VIyxAcpQ11ypKJ5wFSwSvkPIdaXm1125oGIFQg+W +51GSNz8PBuP5GavLs3L1Wp2VupJ9pOrolxGRP+t41u6rNewaktSO6eLY0o0j/FMY +Anujnj68sS92e7TnQcaAEUsplYLrZlZI1Ly0W2QakvOUIkDq5DSsNYKypTM1rZ7s +VYENPjHdhATsHoW1LxirBKHuoi8aANSjsofdggnxtu+sp8mk/+oZpyR78yA/+hIA +/t/wEVgVXETTB0Y8o6n8+/U/uBHEjYGa8JJEcMbNJesQAusBXYt90N8URKHRWEcR +L9IH3V4rmssDqgE7voHYvNKFru/socsI3WPmDnPKFWGRd7rqzlkBoqbrPiD/tRIC +cwDqz5hm3vKqOkHqvsGqzNVp4wARAQABiQG2BBgBCgAgFiEE81a455Doc5DWexOc +F4e6ez4rqzAFAmUn7JECGwwACgkQF4e6ez4rqzA23gv/UZTQw13urB8Hf6s5FJyz +z5dCWT1RMW1ig7MuCe/MzRCk29zDc16y5fOo0aLzYMWsQXBrBTAXj6hx2/MYHXg0 +mUXzxrnUqM5H/b1hbx52NdwD1eR1prQIX39ifPzw+FTirD98qx04479En/561PQW +lbWXtm1/JoaSpGIYP2gWNgb3HfHShEGPxFH39vxmP6XVz99BL+3zaHehcCUP8fbC +Kabo/qbtNC/nZEBUVVMxEj2O9eEq9otk8K8fBzoCOQ4K0Idn+BnQ0O67x4jemunD +JX6BGBo0WYxJNarK2sJw5+CVRK472va8U6Y+6yGyv5qu68eOZZXvkrCbDpysSIf7 +YjwhmaZuerd4oBvRKJHbbHoqgde8sviSjm6cdU+ZSHILvwEaBLwW3pTgBJAupQcV +4Ws7fo7/6R2YWws8c4sseGqLC+XxCXk+SvrvyA02ZBY+0L6IFD6Cb8BT0uMMrLIP +YcZ1xK3gfrp4PCg2OFj46WER5ufHP1r0zvufY7chA9tP +=Jwiw +-----END PGP PUBLIC KEY BLOCK----- diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier.go b/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier.go index 263f6ea8bf5..d8a4812e4cb 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier.go @@ -6,7 +6,6 @@ package fs import ( "fmt" - "io/ioutil" "net/http" "os" "path/filepath" @@ -26,11 +25,10 @@ const ( // The signature is validated against Elastic's public GPG key that is // embedded into Elastic Agent. type Verifier struct { - config *artifact.Config - client http.Client - pgpBytes []byte - allowEmptyPgp bool - log *logger.Logger + config *artifact.Config + client http.Client + defaultKey []byte + log *logger.Logger } func (v *Verifier) Name() string { @@ -39,9 +37,9 @@ func (v *Verifier) Name() string { // NewVerifier creates a verifier checking downloaded package on preconfigured // location against a key stored on elastic.co website. -func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Verifier, error) { - if len(pgp) == 0 && !allowEmptyPgp { - return nil, errors.New("expecting PGP but retrieved none", errors.TypeSecurity) +func NewVerifier(log *logger.Logger, config *artifact.Config, pgp []byte) (*Verifier, error) { + if len(pgp) == 0 { + return nil, errors.New("expecting PGP key but received none", errors.TypeSecurity) } client, err := config.HTTPTransportSettings.Client( @@ -55,11 +53,10 @@ func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool } v := &Verifier{ - config: config, - client: *client, - allowEmptyPgp: allowEmptyPgp, - pgpBytes: pgp, - log: log, + config: config, + client: *client, + defaultKey: pgp, + log: log, } return v, nil @@ -70,24 +67,22 @@ func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool func (v *Verifier) Verify(a artifact.Artifact, version string, skipDefaultPgp bool, pgpBytes ...string) error { filename, err := artifact.GetArtifactName(a, version, v.config.OS(), v.config.Arch()) if err != nil { - return errors.New(err, "retrieving package name") + return fmt.Errorf("could not get artifact name: %w", err) } - fullPath := filepath.Join(v.config.TargetDirectory, filename) + artifactPath := filepath.Join(v.config.TargetDirectory, filename) - if err = download.VerifySHA512Hash(fullPath); err != nil { - var checksumMismatchErr *download.ChecksumMismatchError - if errors.As(err, &checksumMismatchErr) { - os.Remove(fullPath) - os.Remove(fullPath + ".sha512") - } - return err + if err = download.VerifySHA512HashWithCleanup(v.log, artifactPath); err != nil { + return fmt.Errorf("failed to verify SHA512 hash: %w", err) } - if err = v.verifyAsc(fullPath, skipDefaultPgp, pgpBytes...); err != nil { + if err = v.verifyAsc(artifactPath, skipDefaultPgp, pgpBytes...); err != nil { var invalidSignatureErr *download.InvalidSignatureError if errors.As(err, &invalidSignatureErr) { - os.Remove(fullPath + ".asc") + if err := os.Remove(artifactPath + ".asc"); err != nil { + v.log.Warnf("failed clean up after signature verification: failed to remove %q: %v", + artifactPath+".asc", err) + } } return err } @@ -113,44 +108,20 @@ func (v *Verifier) Reload(c *artifact.Config) error { return nil } -func (v *Verifier) verifyAsc(fullPath string, skipDefaultPgp bool, pgpSources ...string) error { +func (v *Verifier) verifyAsc(fullPath string, skipDefaultKey bool, pgpSources ...string) error { var pgpBytes [][]byte - if len(v.pgpBytes) > 0 && !skipDefaultPgp { - v.log.Infof("Default PGP being appended") - pgpBytes = append(pgpBytes, v.pgpBytes) - } - - for _, check := range pgpSources { - if len(check) == 0 { - continue - } - raw, err := download.PgpBytesFromSource(v.log, check, &v.client) - if err != nil { - return err - } - - if len(raw) == 0 { - continue - } - - pgpBytes = append(pgpBytes, raw) - } - - if len(pgpBytes) == 0 { - // no pgp available skip verification process - v.log.Infof("No checks defined") - return nil + pgpBytes, err := download.FetchPGPKeys( + v.log, v.client, v.defaultKey, skipDefaultKey, pgpSources) + if err != nil { + return fmt.Errorf("could not fetch pgp keys: %w", err) } - v.log.Infof("Using %d PGP keys", len(pgpBytes)) ascBytes, err := v.getPublicAsc(fullPath) - if err != nil && v.allowEmptyPgp { - // asc not available but we allow empty for dev use-case - return nil - } else if err != nil { - return err + if err != nil { + return fmt.Errorf("could not get .asc file: %w", err) } +<<<<<<< HEAD for i, check := range pgpBytes { err = download.VerifyGPGSignature(fullPath, ascBytes, check) if err == nil { @@ -165,11 +136,14 @@ func (v *Verifier) verifyAsc(fullPath string, skipDefaultPgp bool, pgpSources .. // return last error return err +======= + return download.VerifyPGPSignatureWithKeys(v.log, fullPath, ascBytes, pgpBytes) +>>>>>>> e43be2aca6 (Remove PGP signature verification skip for DEV builds (#3590)) } func (v *Verifier) getPublicAsc(fullPath string) ([]byte, error) { fullPath = fmt.Sprintf("%s%s", fullPath, ascSuffix) - b, err := ioutil.ReadFile(fullPath) + b, err := os.ReadFile(fullPath) if err != nil { return nil, errors.New(err, fmt.Sprintf("fetching asc file from '%s'", fullPath), errors.TypeFilesystem, errors.M(errors.MetaKeyPath, fullPath)) } diff --git a/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier_test.go b/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier_test.go index 5012e8244dd..4bd605142f3 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier_test.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/fs/verifier_test.go @@ -5,10 +5,10 @@ package fs import ( + "bytes" "context" "crypto/sha512" "fmt" - "io/ioutil" "os" "path/filepath" "testing" @@ -18,11 +18,11 @@ import ( "github.com/stretchr/testify/require" "github.com/elastic/elastic-agent-libs/transport/httpcommon" - "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact" "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact/download" "github.com/elastic/elastic-agent/internal/pkg/release" "github.com/elastic/elastic-agent/pkg/core/logger" + "github.com/elastic/elastic-agent/testing/pgptest" ) const ( @@ -30,21 +30,30 @@ const ( ) var ( - beatSpec = artifact.Artifact{Name: "Filebeat", Cmd: "filebeat", Artifact: "beat/filebeat"} + beatSpec = artifact.Artifact{ + Name: "Elastic Agent", + Cmd: "elastic-agent", + Artifact: "beat/elastic-agent"} ) func TestFetchVerify(t *testing.T) { + // See docs/pgp-sign-verify-artifact.md for how to generate a key, export + // the public key, sign a file and verify it. + log, _ := logger.New("", false) timeout := 15 * time.Second dropPath := filepath.Join("testdata", "drop") installPath := filepath.Join("testdata", "install") targetPath := filepath.Join("testdata", "download") ctx := context.Background() - s := artifact.Artifact{Name: "Beat", Cmd: "beat", Artifact: "beats/filebeat"} + a := artifact.Artifact{ + Name: "elastic-agent", Cmd: "elastic-agent", Artifact: "beats/elastic-agent"} version := "8.0.0" - targetFilePath := filepath.Join(targetPath, "beat-8.0.0-darwin-x86_64.tar.gz") - hashTargetFilePath := filepath.Join(targetPath, "beat-8.0.0-darwin-x86_64.tar.gz.sha512") + filename := "elastic-agent-8.0.0-darwin-x86_64.tar.gz" + targetFilePath := filepath.Join(targetPath, filename) + hashTargetFilePath := filepath.Join(targetPath, filename+".sha512") + ascTargetFilePath := filepath.Join(targetPath, filename+".asc") // cleanup defer os.RemoveAll(targetPath) @@ -60,48 +69,52 @@ func TestFetchVerify(t *testing.T) { }, } - err := prepareFetchVerifyTests(dropPath, targetPath, targetFilePath, hashTargetFilePath) - assert.NoError(t, err) + err := prepareFetchVerifyTests(dropPath, targetPath, filename, targetFilePath, hashTargetFilePath) + require.NoError(t, err) - downloader := NewDownloader(config) - verifier, err := NewVerifier(log, config, true, nil) - assert.NoError(t, err) + pgp, err := os.ReadFile(filepath.Join(dropPath, "public-key.pgp")) + require.NoError(t, err, "could not read public PGP key") + verifier, err := NewVerifier(log, config, pgp) + require.NoError(t, err, "could not create the verifier") // first download verify should fail: // download skipped, as invalid package is prepared upfront // verify fails and cleans download - err = verifier.Verify(s, version, false) + err = verifier.Verify(a, version, false) var checksumErr *download.ChecksumMismatchError - assert.ErrorAs(t, err, &checksumErr) + require.ErrorAs(t, err, &checksumErr) _, err = os.Stat(targetFilePath) - assert.True(t, os.IsNotExist(err)) + require.True(t, os.IsNotExist(err)) _, err = os.Stat(hashTargetFilePath) - assert.True(t, os.IsNotExist(err)) + require.True(t, os.IsNotExist(err)) // second one should pass // download not skipped: package missing // verify passes because hash is not correct - _, err = downloader.Download(ctx, s, version) - assert.NoError(t, err) + _, err = NewDownloader(config).Download(ctx, a, version) + require.NoError(t, err) + asc, err := os.ReadFile(filepath.Join(dropPath, filename+".asc")) + require.NoErrorf(t, err, "could not open .asc for copy") + err = os.WriteFile(ascTargetFilePath, asc, 0o600) + require.NoErrorf(t, err, "could not save .asc (%q) to target path (%q)", + filepath.Join(dropPath, filename+".asc"), ascTargetFilePath) // file downloaded ok _, err = os.Stat(targetFilePath) - assert.NoError(t, err) - + require.NoError(t, err) _, err = os.Stat(hashTargetFilePath) - assert.NoError(t, err) + require.NoError(t, err) + _, err = os.Stat(ascTargetFilePath) + require.NoError(t, err) - err = verifier.Verify(s, version, false) - assert.NoError(t, err) - - // Enable GPG signature validation. - verifier.allowEmptyPgp = false + err = verifier.Verify(a, version, false) + require.NoError(t, err) // Bad GPG public key. { - verifier.pgpBytes = []byte("garbage") + verifier.defaultKey = []byte("garbage") // Don't delete anything. assertFileExists(t, targetFilePath) @@ -109,11 +122,11 @@ func TestFetchVerify(t *testing.T) { } // Setup proper GPG public key. - _, verifier.pgpBytes = release.PGP() + verifier.defaultKey = release.PGP() // Missing .asc file. { - err = verifier.Verify(s, version, false) + err = verifier.Verify(a, version, false) require.Error(t, err) // Don't delete these files when GPG validation failure. @@ -123,10 +136,10 @@ func TestFetchVerify(t *testing.T) { // Invalid signature. { - err = ioutil.WriteFile(targetFilePath+".asc", []byte("bad sig"), 0o600) + err = os.WriteFile(targetFilePath+".asc", []byte("bad sig"), 0o600) require.NoError(t, err) - err = verifier.Verify(s, version, false) + err = verifier.Verify(a, version, false) var invalidSigErr *download.InvalidSignatureError assert.ErrorAs(t, err, &invalidSigErr) @@ -139,9 +152,14 @@ func TestFetchVerify(t *testing.T) { } } -func prepareFetchVerifyTests(dropPath, targetDir, targetFilePath, hashTargetFilePath string) error { - sourceFilePath := filepath.Join(dropPath, "beat-8.0.0-darwin-x86_64.tar.gz") - hashSourceFilePath := filepath.Join(dropPath, "beat-8.0.0-darwin-x86_64.tar.gz.sha512") +func prepareFetchVerifyTests( + dropPath, + targetDir, + filename, + targetFilePath, + hashTargetFilePath string) error { + sourceFilePath := filepath.Join(dropPath, filename) + hashSourceFilePath := filepath.Join(dropPath, filename+".sha512") // clean targets os.Remove(targetFilePath) @@ -163,13 +181,13 @@ func prepareFetchVerifyTests(dropPath, targetDir, targetFilePath, hashTargetFile } defer targretFile.Close() - hashContent, err := ioutil.ReadFile(hashSourceFilePath) + hashContent, err := os.ReadFile(hashSourceFilePath) if err != nil { return err } corruptedHash := append([]byte{1, 2, 3, 4, 5, 6}, hashContent[6:]...) - return ioutil.WriteFile(hashTargetFilePath, corruptedHash, 0666) + return os.WriteFile(hashTargetFilePath, corruptedHash, 0666) } func TestVerify(t *testing.T) { @@ -185,8 +203,7 @@ func TestVerify(t *testing.T) { for _, tc := range tt { t.Run(tc.Name, func(t *testing.T) { log, obs := logger.NewTesting("TestVerify") - targetDir, err := ioutil.TempDir(os.TempDir(), "") - require.NoError(t, err) + targetDir := t.TempDir() timeout := 30 * time.Second @@ -200,23 +217,18 @@ func TestVerify(t *testing.T) { }, } - err = prepareTestCase(beatSpec, version, config) - require.NoError(t, err) + pgpKey := prepareTestCase(t, beatSpec, version, config) testClient := NewDownloader(config) - artifact, err := testClient.Download(context.Background(), beatSpec, version) - require.NoError(t, err) + artifactPath, err := testClient.Download(context.Background(), beatSpec, version) + require.NoError(t, err, "fs.Downloader could not download artifacts") + _, err = testClient.DownloadAsc(context.Background(), beatSpec, version) + require.NoError(t, err, "fs.Downloader could not download artifacts .asc file") - t.Cleanup(func() { - os.Remove(artifact) - os.Remove(artifact + ".sha512") - os.RemoveAll(config.DropPath) - }) - - _, err = os.Stat(artifact) + _, err = os.Stat(artifactPath) require.NoError(t, err) - testVerifier, err := NewVerifier(log, config, true, nil) + testVerifier, err := NewVerifier(log, config, pgpKey) require.NoError(t, err) err = testVerifier.Verify(beatSpec, version, false, tc.RemotePGPUris...) @@ -229,25 +241,40 @@ func TestVerify(t *testing.T) { } } -func prepareTestCase(a artifact.Artifact, version string, cfg *artifact.Config) error { +// prepareTestCase creates an artifact file, defined by 'a' and 'version', +// its corresponding checksum (.sha512) and signature (.asc) files. +// It creates the necessary key to sing the artifact and returns the public key +// to verify the signature. +func prepareTestCase( + t *testing.T, + a artifact.Artifact, + version string, + cfg *artifact.Config) []byte { + filename, err := artifact.GetArtifactName(a, version, cfg.OperatingSystem, cfg.Architecture) - if err != nil { - return err - } + require.NoErrorf(t, err, "could not get artifact name") - if err := os.MkdirAll(cfg.DropPath, 0777); err != nil { - return err - } + err = os.MkdirAll(cfg.DropPath, 0777) + require.NoErrorf(t, err, "failed creating directory %q", cfg.DropPath) + + filePath := filepath.Join(cfg.DropPath, filename) + filePathSHA := filePath + ".sha512" + filePathASC := filePath + ".asc" content := []byte("sample content") + err = os.WriteFile(filePath, content, 0644) + require.NoErrorf(t, err, "could not write %q file", filePath) + hash := sha512.Sum512(content) hashContent := fmt.Sprintf("%x %s", hash, filename) + err = os.WriteFile(filePathSHA, []byte(hashContent), 0644) + require.NoErrorf(t, err, "could not write %q file", filePathSHA) - if err := ioutil.WriteFile(filepath.Join(cfg.DropPath, filename), content, 0644); err != nil { - return err - } + pub, sig := pgptest.Sing(t, bytes.NewReader(content)) + err = os.WriteFile(filePathASC, sig, 0644) + require.NoErrorf(t, err, "could not write %q file", filePathASC) - return ioutil.WriteFile(filepath.Join(cfg.DropPath, filename+".sha512"), []byte(hashContent), 0644) + return pub } func assertFileExists(t testing.TB, path string) { diff --git a/internal/pkg/agent/application/upgrade/artifact/download/http/common_test.go b/internal/pkg/agent/application/upgrade/artifact/download/http/common_test.go new file mode 100644 index 00000000000..cfc899420c2 --- /dev/null +++ b/internal/pkg/agent/application/upgrade/artifact/download/http/common_test.go @@ -0,0 +1,121 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package http + +import ( + "bytes" + "context" + "crypto/sha512" + "fmt" + "net" + "net/http" + "net/http/httptest" + "path/filepath" + "strings" + "testing" + + "github.com/stretchr/testify/assert" + + "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact" + "github.com/elastic/elastic-agent/testing/pgptest" +) + +const ( + version = "7.5.1" + sourcePattern = "/downloads/beats/filebeat/" + source = "http://artifacts.elastic.co/downloads/" +) + +var ( + beatSpec = artifact.Artifact{ + Name: "filebeat", + Cmd: "filebeat", + Artifact: "beats/filebeat", + } +) + +type testCase struct { + system string + arch string +} + +func getTestCases() []testCase { + // always test random package to save time + return []testCase{ + {"linux", "32"}, + {"linux", "64"}, + {"linux", "arm64"}, + {"darwin", "32"}, + {"darwin", "64"}, + {"windows", "32"}, + {"windows", "64"}, + } +} + +func getElasticCoServer(t *testing.T) (*httptest.Server, []byte) { + correctValues := map[string]struct{}{ + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "i386.deb"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "amd64.deb"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "i686.rpm"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "x86_64.rpm"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-x86.tar.gz"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-arm64.tar.gz"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-x86_64.tar.gz"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "windows-x86.zip"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "windows-x86_64.zip"): {}, + fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "darwin-x86_64.tar.gz"): {}, + } + var resp []byte + content := []byte("anything will do") + hash := sha512.Sum512(content) + pub, sig := pgptest.Sing(t, bytes.NewReader(content)) + + handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + packageName := r.URL.Path[len(sourcePattern):] + + ext := filepath.Ext(packageName) + if ext == ".gz" { + ext = ".tar.gz" + } + packageName = strings.TrimSuffix(packageName, ext) + + switch ext { + case ".sha512": + resp = []byte(fmt.Sprintf("%x %s", hash, packageName)) + case ".asc": + resp = sig + case ".tar.gz", ".zip", ".deb", ".rpm": + packageName += ext + resp = content + default: + w.WriteHeader(http.StatusNotFound) + t.Errorf("mock elastic.co server: unknown file extension: %q", ext) + return + } + + if _, ok := correctValues[packageName]; !ok { + t.Errorf("mock elastic.co server: invalid package name: %q", packageName) + w.WriteHeader(http.StatusInternalServerError) + _, _ = w.Write([]byte{}) + return + } + + _, err := w.Write(resp) + assert.NoErrorf(t, err, "mock elastic.co server: failes writing response") + }) + + return httptest.NewServer(handler), pub +} + +func getElasticCoClient(server *httptest.Server) http.Client { + return http.Client{ + Transport: &http.Transport{ + DialContext: func(_ context.Context, network, s string) (net.Conn, error) { + _ = s + return net.Dial(network, server.Listener.Addr().String()) + }, + }, + } +} diff --git a/internal/pkg/agent/application/upgrade/artifact/download/http/downloader.go b/internal/pkg/agent/application/upgrade/artifact/download/http/downloader.go index 17945ddccb9..b03fd1b3d70 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/http/downloader.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/http/downloader.go @@ -21,7 +21,6 @@ import ( "github.com/elastic/elastic-agent-libs/atomic" "github.com/elastic/elastic-agent-libs/transport/httpcommon" - "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact" "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact/download" "github.com/elastic/elastic-agent/internal/pkg/agent/errors" diff --git a/internal/pkg/agent/application/upgrade/artifact/download/http/downloader_test.go b/internal/pkg/agent/application/upgrade/artifact/download/http/downloader_test.go index 4d6087f479b..0774c928b6f 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/http/downloader_test.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/http/downloader_test.go @@ -25,6 +25,48 @@ import ( "github.com/elastic/elastic-agent-libs/transport/httpcommon" ) +func TestDownload(t *testing.T) { + targetDir, err := ioutil.TempDir(os.TempDir(), "") + if err != nil { + t.Fatal(err) + } + + log, _ := logger.New("", false) + timeout := 30 * time.Second + testCases := getTestCases() + server, _ := getElasticCoServer(t) + elasticClient := getElasticCoClient(server) + + config := &artifact.Config{ + SourceURI: source, + TargetDirectory: targetDir, + HTTPTransportSettings: httpcommon.HTTPTransportSettings{ + Timeout: timeout, + }, + } + + for _, testCase := range testCases { + testName := fmt.Sprintf("%s-binary-%s", testCase.system, testCase.arch) + t.Run(testName, func(t *testing.T) { + config.OperatingSystem = testCase.system + config.Architecture = testCase.arch + + testClient := NewDownloaderWithClient(log, config, elasticClient) + artifactPath, err := testClient.Download(context.Background(), beatSpec, version) + if err != nil { + t.Fatal(err) + } + + _, err = os.Stat(artifactPath) + if err != nil { + t.Fatal(err) + } + + os.Remove(artifactPath) + }) + } +} + func TestDownloadBodyError(t *testing.T) { // This tests the scenario where the download encounters a network error // part way through the download, while copying the response body. diff --git a/internal/pkg/agent/application/upgrade/artifact/download/http/elastic_test.go b/internal/pkg/agent/application/upgrade/artifact/download/http/elastic_test.go deleted file mode 100644 index bd1564cab2b..00000000000 --- a/internal/pkg/agent/application/upgrade/artifact/download/http/elastic_test.go +++ /dev/null @@ -1,211 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package http - -import ( - "context" - "crypto/sha512" - "fmt" - "io/ioutil" - "math/rand" - "net" - "net/http" - "net/http/httptest" - "os" - "strings" - "testing" - "time" - - "github.com/stretchr/testify/require" - - "github.com/elastic/elastic-agent-libs/transport/httpcommon" - - "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact" - "github.com/elastic/elastic-agent/pkg/core/logger" -) - -const ( - version = "7.5.1" - sourcePattern = "/downloads/beats/filebeat/" - source = "http://artifacts.elastic.co/downloads/" -) - -var ( - beatSpec = artifact.Artifact{ - Name: "filebeat", - Cmd: "filebeat", - Artifact: "beats/filebeat", - } -) - -type testCase struct { - system string - arch string -} - -func TestDownload(t *testing.T) { - targetDir, err := ioutil.TempDir(os.TempDir(), "") - if err != nil { - t.Fatal(err) - } - - log, _ := logger.New("", false) - timeout := 30 * time.Second - testCases := getTestCases() - elasticClient := getElasticCoClient() - - config := &artifact.Config{ - SourceURI: source, - TargetDirectory: targetDir, - HTTPTransportSettings: httpcommon.HTTPTransportSettings{ - Timeout: timeout, - }, - } - - for _, testCase := range testCases { - testName := fmt.Sprintf("%s-binary-%s", testCase.system, testCase.arch) - t.Run(testName, func(t *testing.T) { - config.OperatingSystem = testCase.system - config.Architecture = testCase.arch - - testClient := NewDownloaderWithClient(log, config, elasticClient) - artifactPath, err := testClient.Download(context.Background(), beatSpec, version) - if err != nil { - t.Fatal(err) - } - - _, err = os.Stat(artifactPath) - if err != nil { - t.Fatal(err) - } - - os.Remove(artifactPath) - }) - } -} - -func TestVerify(t *testing.T) { - targetDir, err := ioutil.TempDir(os.TempDir(), "") - if err != nil { - t.Fatal(err) - } - - log, _ := logger.New("", false) - timeout := 30 * time.Second - testCases := getRandomTestCases() - elasticClient := getElasticCoClient() - - config := &artifact.Config{ - SourceURI: source, - TargetDirectory: targetDir, - HTTPTransportSettings: httpcommon.HTTPTransportSettings{ - Timeout: timeout, - }, - } - - for _, testCase := range testCases { - testName := fmt.Sprintf("%s-binary-%s", testCase.system, testCase.arch) - t.Run(testName, func(t *testing.T) { - config.OperatingSystem = testCase.system - config.Architecture = testCase.arch - - testClient := NewDownloaderWithClient(log, config, elasticClient) - artifact, err := testClient.Download(context.Background(), beatSpec, version) - if err != nil { - t.Fatal(err) - } - - _, err = os.Stat(artifact) - if err != nil { - t.Fatal(err) - } - - testVerifier, err := NewVerifier(log, config, true, nil) - if err != nil { - t.Fatal(err) - } - - err = testVerifier.Verify(beatSpec, version, false) - require.NoError(t, err) - - os.Remove(artifact) - os.Remove(artifact + ".sha512") - }) - } -} - -func getTestCases() []testCase { - // always test random package to save time - return []testCase{ - {"linux", "32"}, - {"linux", "64"}, - {"linux", "arm64"}, - {"darwin", "32"}, - {"darwin", "64"}, - {"windows", "32"}, - {"windows", "64"}, - } -} - -func getRandomTestCases() []testCase { - tt := getTestCases() - - rand.Seed(time.Now().UnixNano()) - first := rand.Intn(len(tt)) - second := rand.Intn(len(tt)) - - return []testCase{ - tt[first], - tt[second], - } -} - -func getElasticCoClient() http.Client { - correctValues := map[string]struct{}{ - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "i386.deb"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "amd64.deb"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "i686.rpm"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "x86_64.rpm"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-x86.tar.gz"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-arm64.tar.gz"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "linux-x86_64.tar.gz"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "windows-x86.zip"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "windows-x86_64.zip"): {}, - fmt.Sprintf("%s-%s-%s", beatSpec.Cmd, version, "darwin-x86_64.tar.gz"): {}, - } - - handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - packageName := r.URL.Path[len(sourcePattern):] - isShaReq := strings.HasSuffix(packageName, ".sha512") - packageName = strings.TrimSuffix(packageName, ".sha512") - - if _, ok := correctValues[packageName]; !ok { - w.WriteHeader(http.StatusInternalServerError) - } - - content := []byte(packageName) - if isShaReq { - hash := sha512.Sum512(content) - _, err := w.Write([]byte(fmt.Sprintf("%x %s", hash, packageName))) - if err != nil { - panic(err) - } - } else { - _, err := w.Write(content) - if err != nil { - panic(err) - } - } - }) - server := httptest.NewServer(handler) - - return http.Client{ - Transport: &http.Transport{ - DialContext: func(_ context.Context, network, _ string) (net.Conn, error) { - return net.Dial(network, server.Listener.Addr().String()) - }, - }, - } -} diff --git a/internal/pkg/agent/application/upgrade/artifact/download/http/verifier.go b/internal/pkg/agent/application/upgrade/artifact/download/http/verifier.go index 84f3f6045f0..57d6d78eee4 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/http/verifier.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/http/verifier.go @@ -29,11 +29,18 @@ const ( // Verifier verifies a downloaded package by comparing with public ASC // file from elastic.co website. type Verifier struct { +<<<<<<< HEAD config *artifact.Config client http.Client pgpBytes []byte allowEmptyPgp bool log progressLogger +======= + config *artifact.Config + client http.Client + defaultKey []byte + log *logger.Logger +>>>>>>> e43be2aca6 (Remove PGP signature verification skip for DEV builds (#3590)) } func (v *Verifier) Name() string { @@ -42,9 +49,15 @@ func (v *Verifier) Name() string { // NewVerifier create a verifier checking downloaded package on preconfigured // location against a key stored on elastic.co website. +<<<<<<< HEAD func NewVerifier(log progressLogger, config *artifact.Config, allowEmptyPgp bool, pgp []byte) (*Verifier, error) { if len(pgp) == 0 && !allowEmptyPgp { return nil, errors.New("expecting PGP but retrieved none", errors.TypeSecurity) +======= +func NewVerifier(log *logger.Logger, config *artifact.Config, pgp []byte) (*Verifier, error) { + if len(pgp) == 0 { + return nil, errors.New("expecting PGP key received none", errors.TypeSecurity) +>>>>>>> e43be2aca6 (Remove PGP signature verification skip for DEV builds (#3590)) } client, err := config.HTTPTransportSettings.Client( @@ -58,11 +71,10 @@ func NewVerifier(log progressLogger, config *artifact.Config, allowEmptyPgp bool } v := &Verifier{ - config: config, - client: *client, - allowEmptyPgp: allowEmptyPgp, - pgpBytes: pgp, - log: log, + config: config, + client: *client, + defaultKey: pgp, + log: log, } return v, nil @@ -89,24 +101,26 @@ func (v *Verifier) Reload(c *artifact.Config) error { // Verify checks downloaded package on preconfigured // location against a key stored on elastic.co website. func (v *Verifier) Verify(a artifact.Artifact, version string, skipDefaultPgp bool, pgpBytes ...string) error { - fullPath, err := artifact.GetArtifactPath(a, version, v.config.OS(), v.config.Arch(), v.config.TargetDirectory) + artifactPath, err := artifact.GetArtifactPath(a, version, v.config.OS(), v.config.Arch(), v.config.TargetDirectory) if err != nil { return errors.New(err, "retrieving package path") } - if err = download.VerifySHA512Hash(fullPath); err != nil { - var checksumMismatchErr *download.ChecksumMismatchError - if errors.As(err, &checksumMismatchErr) { - os.Remove(fullPath) - os.Remove(fullPath + ".sha512") - } - return err + if err = download.VerifySHA512HashWithCleanup(v.log, artifactPath); err != nil { + return fmt.Errorf("failed to verify SHA512 hash: %w", err) } if err = v.verifyAsc(a, version, skipDefaultPgp, pgpBytes...); err != nil { var invalidSignatureErr *download.InvalidSignatureError if errors.As(err, &invalidSignatureErr) { - os.Remove(fullPath + ".asc") + if err := os.Remove(artifactPath); err != nil { + v.log.Warnf("failed clean up after signature verification: failed to remove %q: %v", + artifactPath, err) + } + if err := os.Remove(artifactPath + ascSuffix); err != nil { + v.log.Warnf("failed clean up after sha512 check: failed to remove %q: %v", + artifactPath+ascSuffix, err) + } } return err } @@ -114,36 +128,7 @@ func (v *Verifier) Verify(a artifact.Artifact, version string, skipDefaultPgp bo return nil } -func (v *Verifier) verifyAsc(a artifact.Artifact, version string, skipDefaultPgp bool, pgpSources ...string) error { - var pgpBytes [][]byte - if len(v.pgpBytes) > 0 && !skipDefaultPgp { - v.log.Infof("Default PGP being appended") - pgpBytes = append(pgpBytes, v.pgpBytes) - } - - for _, check := range pgpSources { - if len(check) == 0 { - continue - } - raw, err := download.PgpBytesFromSource(v.log, check, &v.client) - if err != nil { - return err - } - - if len(raw) == 0 { - continue - } - - pgpBytes = append(pgpBytes, raw) - } - - if len(pgpBytes) == 0 { - // no pgp available skip verification process - v.log.Infof("No checks defined") - return nil - } - v.log.Infof("Using %d PGP keys", len(pgpBytes)) - +func (v *Verifier) verifyAsc(a artifact.Artifact, version string, skipDefaultKey bool, pgpSources ...string) error { filename, err := artifact.GetArtifactName(a, version, v.config.OS(), v.config.Arch()) if err != nil { return errors.New(err, "retrieving package name") @@ -160,27 +145,17 @@ func (v *Verifier) verifyAsc(a artifact.Artifact, version string, skipDefaultPgp } ascBytes, err := v.getPublicAsc(ascURI) - if err != nil && v.allowEmptyPgp { - // asc not available but we allow empty for dev use-case - return nil - } else if err != nil { + if err != nil { return errors.New(err, fmt.Sprintf("fetching asc file from %s", ascURI), errors.TypeNetwork, errors.M(errors.MetaKeyURI, ascURI)) } - for i, check := range pgpBytes { - err = download.VerifyGPGSignature(fullPath, ascBytes, check) - if err == nil { - // verify successful - v.log.Infof("Verification with PGP[%d] successful", i) - return nil - } - v.log.Warnf("Verification with PGP[%d] failed: %v", i, err) + pgpBytes, err := download.FetchPGPKeys( + v.log, v.client, v.defaultKey, skipDefaultKey, pgpSources) + if err != nil { + return fmt.Errorf("could not fetch pgp keys: %w", err) } - v.log.Warnf("Verification failed") - - // return last error - return err + return download.VerifyPGPSignatureWithKeys(v.log, fullPath, ascBytes, pgpBytes) } func (v *Verifier) composeURI(filename, artifactName string) (string, error) { @@ -203,11 +178,12 @@ func (v *Verifier) composeURI(filename, artifactName string) (string, error) { func (v *Verifier) getPublicAsc(sourceURI string) ([]byte, error) { ctx, cancelFn := context.WithTimeout(context.Background(), 30*time.Second) defer cancelFn() - // Change NewRequest to NewRequestWithContext and pass context it req, err := http.NewRequestWithContext(ctx, http.MethodGet, sourceURI, nil) if err != nil { return nil, errors.New(err, "failed create request for loading public key", errors.TypeNetwork, errors.M(errors.MetaKeyURI, sourceURI)) } + + // TODO: receive a http.Client resp, err := http.DefaultClient.Do(req) if err != nil { return nil, errors.New(err, "failed loading public key", errors.TypeNetwork, errors.M(errors.MetaKeyURI, sourceURI)) diff --git a/internal/pkg/agent/application/upgrade/artifact/download/http/verifier_test.go b/internal/pkg/agent/application/upgrade/artifact/download/http/verifier_test.go new file mode 100644 index 00000000000..c8f3405f404 --- /dev/null +++ b/internal/pkg/agent/application/upgrade/artifact/download/http/verifier_test.go @@ -0,0 +1,81 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package http + +import ( + "context" + "fmt" + "math/rand" + "net/http" + "os" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/elastic/elastic-agent-libs/transport/httpcommon" + "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact" + "github.com/elastic/elastic-agent/pkg/core/logger" +) + +func TestVerify(t *testing.T) { + targetDir := t.TempDir() + + log, _ := logger.New("", false) + timeout := 30 * time.Second + testCases := getRandomTestCases() + server, pub := getElasticCoServer(t) + elasticClient := getElasticCoClient(server) + // artifact/download/http.Verifier uses http.DefaultClient, thus we need to + // change it. + http.DefaultClient = &elasticClient + + config := &artifact.Config{ + SourceURI: source, + TargetDirectory: targetDir, + HTTPTransportSettings: httpcommon.HTTPTransportSettings{ + Timeout: timeout, + }, + } + + for _, testCase := range testCases { + testName := fmt.Sprintf("%s-binary-%s", testCase.system, testCase.arch) + t.Run(testName, func(t *testing.T) { + config.OperatingSystem = testCase.system + config.Architecture = testCase.arch + + testClient := NewDownloaderWithClient(log, config, elasticClient) + artifact, err := testClient.Download(context.Background(), beatSpec, version) + if err != nil { + t.Fatal(err) + } + + _, err = os.Stat(artifact) + if err != nil { + t.Fatal(err) + } + + testVerifier, err := NewVerifier(log, config, pub) + if err != nil { + t.Fatal(err) + } + + err = testVerifier.Verify(beatSpec, version, false) + require.NoError(t, err) + }) + } +} + +func getRandomTestCases() []testCase { + tt := getTestCases() + + first := rand.Intn(len(tt)) + second := rand.Intn(len(tt)) + + return []testCase{ + tt[first], + tt[second], + } +} diff --git a/internal/pkg/agent/application/upgrade/artifact/download/localremote/verifier.go b/internal/pkg/agent/application/upgrade/artifact/download/localremote/verifier.go index fc2c3a806be..c92b01b207c 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/localremote/verifier.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/localremote/verifier.go @@ -17,10 +17,10 @@ import ( // NewVerifier creates a downloader which first checks local directory // and then fallbacks to remote if configured. -func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool, pgp []byte) (download.Verifier, error) { +func NewVerifier(log *logger.Logger, config *artifact.Config, pgp []byte) (download.Verifier, error) { verifiers := make([]download.Verifier, 0, 3) - fsVer, err := fs.NewVerifier(log, config, allowEmptyPgp, pgp) + fsVer, err := fs.NewVerifier(log, config, pgp) if err != nil { return nil, err } @@ -30,7 +30,7 @@ func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool // useful for testing with a snapshot version of fleet for example // try snapshot repo before official if release.Snapshot() { - snapshotVerifier, err := snapshot.NewVerifier(log, config, allowEmptyPgp, pgp, nil) + snapshotVerifier, err := snapshot.NewVerifier(log, config, pgp, nil) if err != nil { log.Error(err) } else { @@ -38,7 +38,7 @@ func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool } } - remoteVer, err := http.NewVerifier(log, config, allowEmptyPgp, pgp) + remoteVer, err := http.NewVerifier(log, config, pgp) if err != nil { return nil, err } diff --git a/internal/pkg/agent/application/upgrade/artifact/download/snapshot/verifier.go b/internal/pkg/agent/application/upgrade/artifact/download/snapshot/verifier.go index 302aa93e766..060c5e9fa10 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/snapshot/verifier.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/snapshot/verifier.go @@ -24,12 +24,12 @@ func (v *Verifier) Name() string { // NewVerifier creates a downloader which first checks local directory // and then fallbacks to remote if configured. -func NewVerifier(log *logger.Logger, config *artifact.Config, allowEmptyPgp bool, pgp []byte, versionOverride *agtversion.ParsedSemVer) (download.Verifier, error) { +func NewVerifier(log *logger.Logger, config *artifact.Config, pgp []byte, versionOverride *agtversion.ParsedSemVer) (download.Verifier, error) { cfg, err := snapshotConfig(config, versionOverride) if err != nil { return nil, err } - v, err := http.NewVerifier(log, cfg, allowEmptyPgp, pgp) + v, err := http.NewVerifier(log, cfg, pgp) if err != nil { return nil, errors.New(err, "failed to create snapshot verifier") } diff --git a/internal/pkg/agent/application/upgrade/artifact/download/verifier.go b/internal/pkg/agent/application/upgrade/artifact/download/verifier.go index 662367f4909..79fc2348711 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/verifier.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/verifier.go @@ -21,7 +21,6 @@ import ( "time" "github.com/hashicorp/go-multierror" - "golang.org/x/crypto/openpgp" //nolint:staticcheck // crypto/openpgp is only receiving security updates. "github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade/artifact" @@ -39,12 +38,18 @@ var ( ErrUnknownPGPSource = errors.New("unknown pgp source") ) -// warnLogger is a logger that only needs to implement Warnf, as that is the only functions -// that the downloadProgressReporter uses. +// warnLogger is a logger that only needs to implement Warnf. type warnLogger interface { Warnf(format string, args ...interface{}) } +// loggerInfofWarnf is a logger that only needs to implement Infof and Warnf. +type infoWarnLogger interface { + warnLogger + + Infof(format string, args ...interface{}) +} + // ChecksumMismatchError indicates the expected checksum for a file does not // match the computed checksum. type ChecksumMismatchError struct { @@ -70,18 +75,40 @@ func (e *InvalidSignatureError) Error() string { // Unwrap returns the cause. func (e *InvalidSignatureError) Unwrap() error { return e.Err } -// Verifier is an interface verifying the SHA512 checksum and GPG signature and +// Verifier is an interface verifying the SHA512 checksum and PGP signature and // of a downloaded artifact. type Verifier interface { Name() string - // Verify should verify the artifact and return if succeed status (true|false) and an error if any checks fail. - // If the checksum does no match Verify returns a - // *download.ChecksumMismatchError. And if the GPG signature is invalid then - // Verify returns a *download.InvalidSignatureError. Use errors.As() to - // check error types. + // Verify should verify the artifact, returning an error if any checks fail. + // If the checksum does no match Verify returns a *download.ChecksumMismatchError. + // If the PGP signature check fails then Verify returns a + // *download.InvalidSignatureError. Verify(a artifact.Artifact, version string, skipDefaultPgp bool, pgpBytes ...string) error } +// VerifySHA512HashWithCleanup calls VerifySHA512Hash and, in case of a +// *ChecksumMismatchError, performs a cleanup by deleting both the filename and +// filename.sha512 files. If the cleanup fails, it logs a warning. +func VerifySHA512HashWithCleanup(log infoWarnLogger, filename string) error { + if err := VerifySHA512Hash(filename); err != nil { + var checksumMismatchErr *ChecksumMismatchError + if errors.As(err, &checksumMismatchErr) { + if err := os.Remove(filename); err != nil { + log.Warnf("failed clean up after sha512 verification: failed to remove %q: %v", + filename, err) + } + if err := os.Remove(filename + ".sha512"); err != nil { + log.Warnf("failed clean up after sha512 check: failed to remove %q: %v", + filename+".sha512", err) + } + } + + return err + } + + return nil +} + // VerifySHA512Hash checks that a sidecar file containing a sha512 checksum // exists and that the checksum in the sidecar file matches the checksum of // the file. It returns an error if validation fails. @@ -89,7 +116,7 @@ func VerifySHA512Hash(filename string) error { // Read expected checksum. expectedHash, err := readChecksumFile(filename+".sha512", filepath.Base(filename)) if err != nil { - return err + return fmt.Errorf("could not read checksum file: %w", err) } // Compute sha512 checksum. @@ -101,10 +128,10 @@ func VerifySHA512Hash(filename string) error { hash := sha512.New() if _, err := io.Copy(hash, f); err != nil { - return err + return fmt.Errorf("faled to read file to calculate hash") } - computedHash := hex.EncodeToString(hash.Sum(nil)) + computedHash := hex.EncodeToString(hash.Sum(nil)) if computedHash != expectedHash { return &ChecksumMismatchError{ Expected: expectedHash, @@ -157,11 +184,27 @@ func readChecksumFile(checksumFile, filename string) (string, error) { return checksum, nil } -// VerifyGPGSignature verifies the GPG signature of a file. It accepts the path +func VerifyPGPSignatureWithKeys( + log infoWarnLogger, file string, asciiArmorSignature []byte, publicKeys [][]byte) error { + var err error + for i, key := range publicKeys { + err = VerifyPGPSignature(file, asciiArmorSignature, key) + if err == nil { + log.Infof("Verification with PGP[%d] successful", i) + return nil + } + log.Warnf("Verification with PGP[%d] failed: %v", i, err) + } + + log.Warnf("Verification failed: %v", err) + return fmt.Errorf("could not verify PGP signature of %q: %w", file, err) +} + +// VerifyPGPSignature verifies the GPG signature of a file. It accepts the path // to the file to verify, the ASCII armored signature, and the public key to // check against. If there is a problem with the signature then a // *download.InvalidSignatureError is returned. -func VerifyGPGSignature(file string, asciiArmorSignature, publicKey []byte) error { +func VerifyPGPSignature(file string, asciiArmorSignature, publicKey []byte) error { keyring, err := openpgp.ReadArmoredKeyRing(bytes.NewReader(publicKey)) if err != nil { return errors.New(err, "read armored key ring", errors.TypeSecurity) @@ -181,6 +224,39 @@ func VerifyGPGSignature(file string, asciiArmorSignature, publicKey []byte) erro return nil } +func FetchPGPKeys(log infoWarnLogger, client http.Client, defaultPGPKey []byte, skipDefaultPGP bool, pgpSources []string) ([][]byte, error) { + var pgpKeys [][]byte + if len(defaultPGPKey) > 0 && !skipDefaultPGP { + pgpKeys = append(pgpKeys, defaultPGPKey) + log.Infof("Default PGP appended") + } + + for _, check := range pgpSources { + if len(check) == 0 { + continue + } + + raw, err := PgpBytesFromSource(log, check, &client) + if err != nil { + return nil, err + } + + if len(raw) == 0 { + continue + } + + pgpKeys = append(pgpKeys, raw) + } + + if len(pgpKeys) == 0 { + log.Infof("No PGP key available, skipping verification process") + return nil, nil + } + + log.Infof("Using %d PGP keys", len(pgpKeys)) + return pgpKeys, nil +} + func PgpBytesFromSource(log warnLogger, source string, client HTTPClient) ([]byte, error) { if strings.HasPrefix(source, PgpSourceRawPrefix) { return []byte(strings.TrimPrefix(source, PgpSourceRawPrefix)), nil @@ -191,7 +267,8 @@ func PgpBytesFromSource(log warnLogger, source string, client HTTPClient) ([]byt if errors.Is(err, ErrRemotePGPDownloadFailed) || errors.Is(err, ErrInvalidLocation) { log.Warnf("Skipped remote PGP located at %q because it's unavailable: %v", strings.TrimPrefix(source, PgpSourceURIPrefix), err) } else if err != nil { - log.Warnf("Failed to fetch remote PGP") + log.Warnf("Failed to fetch remote PGP key from %q: %v", + strings.TrimPrefix(source, PgpSourceURIPrefix), err) } return pgpBytes, nil diff --git a/internal/pkg/agent/application/upgrade/artifact/download/verifier_test.go b/internal/pkg/agent/application/upgrade/artifact/download/verifier_test.go index 05ad9a96b91..6e12a4b3d98 100644 --- a/internal/pkg/agent/application/upgrade/artifact/download/verifier_test.go +++ b/internal/pkg/agent/application/upgrade/artifact/download/verifier_test.go @@ -6,10 +6,16 @@ package download import ( "bytes" + "crypto/sha512" + "encoding/hex" + "fmt" "io" "net/http" + "os" + "path/filepath" "testing" + "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/elastic/elastic-agent/internal/pkg/agent/errors" @@ -118,6 +124,85 @@ func TestPgpBytesFromSource(t *testing.T) { } } +func TestVerifySHA512HashWithCleanup_success(t *testing.T) { + data := "I’m the Doctor. I’m a Time Lord. I’m from the planet " + + "Gallifrey in the constellation of Kasterborous. I’m 903 years old and " + + "I’m the man who’s going to save your lives and all 6 billion people on " + + "the planet below. You got a problem with that?" + dir := t.TempDir() + filename := "file" + path := filepath.Join(dir, filename) + + f, err := os.Create(path) + require.NoError(t, err, "could not create file") + fsha512, err := os.Create(path + ".sha512") + require.NoError(t, err, "could not create .sha512 file") + + _, err = fmt.Fprint(f, data) + require.NoError(t, err, "could not write to file") + hash := sha512.Sum512([]byte(data)) + _, err = fmt.Fprintf(fsha512, "%s %s", hex.EncodeToString(hash[:]), filename) + require.NoError(t, err, "could not write to file") + + err = f.Close() + require.NoError(t, err, "could not close file") + err = fsha512.Close() + require.NoError(t, err, "could not close .sha512 file") + + err = VerifySHA512HashWithCleanup(testlogger{t: t}, path) + assert.NoErrorf(t, err, "failed verifying sha512") +} + +func TestVerifySHA512HashWithCleanup_failure(t *testing.T) { + data := "I’m the Doctor. I’m a Time Lord. I’m from the planet " + + "Gallifrey in the constellation of Kasterborous. I’m 903 years old and " + + "I’m the man who’s going to save your lives and all 6 billion people on " + + "the planet below. You got a problem with that?" + dir := t.TempDir() + filename := "file" + path := filepath.Join(dir, filename) + + f, err := os.Create(path) + require.NoError(t, err, "could not create file") + fsha512, err := os.Create(path + ".sha512") + require.NoError(t, err, "could not create .sha512 file") + + _, err = fmt.Fprint(f, data) + require.NoError(t, err, "could not write to file") + _, err = fmt.Fprintf(fsha512, "%s %s", "wrong-sha512", filename) + require.NoError(t, err, "could not write to file") + + err = f.Close() + require.NoError(t, err, "could not close file") + err = fsha512.Close() + require.NoError(t, err, "could not close .sha512 file") + + err = VerifySHA512HashWithCleanup(testlogger{t: t}, path) + assert.Errorf(t, err, "checksum verification should have failed") + + dirEntries, err := os.ReadDir(dir) + require.NoError(t, err, "could not read %q to check it's empty", dir) + if len(dirEntries) != 0 { + var files []string + for _, e := range dirEntries { + files = append(files, e.Name()) + } + + t.Errorf("there should be no files on %q. Found %v", dir, files) + } +} + +type testlogger struct { + t *testing.T +} + +func (l testlogger) Infof(format string, args ...interface{}) { + l.t.Logf("[INFO] "+format, args) +} +func (l testlogger) Warnf(format string, args ...interface{}) { + l.t.Logf("[WARN] "+format, args) +} + type MockClient struct { DoFunc func(req *http.Request) (*http.Response, error) } diff --git a/internal/pkg/agent/application/upgrade/step_download.go b/internal/pkg/agent/application/upgrade/step_download.go index a273460f337..cee0c1d75dc 100644 --- a/internal/pkg/agent/application/upgrade/step_download.go +++ b/internal/pkg/agent/application/upgrade/step_download.go @@ -143,23 +143,23 @@ func newDownloader(version *agtversion.ParsedSemVer, log *logger.Logger, setting } func newVerifier(version *agtversion.ParsedSemVer, log *logger.Logger, settings *artifact.Config) (download.Verifier, error) { - allowEmptyPgp, pgp := release.PGP() + pgp := release.PGP() if !version.IsSnapshot() { - return localremote.NewVerifier(log, settings, allowEmptyPgp, pgp) + return localremote.NewVerifier(log, settings, pgp) } - fsVerifier, err := fs.NewVerifier(log, settings, allowEmptyPgp, pgp) + fsVerifier, err := fs.NewVerifier(log, settings, pgp) if err != nil { return nil, err } - snapshotVerifier, err := snapshot.NewVerifier(log, settings, allowEmptyPgp, pgp, version) + snapshotVerifier, err := snapshot.NewVerifier(log, settings, pgp, version) if err != nil { return nil, err } - remoteVerifier, err := http.NewVerifier(log, settings, allowEmptyPgp, pgp) + remoteVerifier, err := http.NewVerifier(log, settings, pgp) if err != nil { return nil, err } diff --git a/internal/pkg/agent/cmd/run.go b/internal/pkg/agent/cmd/run.go index 91d470ac00b..319c0954b55 100644 --- a/internal/pkg/agent/cmd/run.go +++ b/internal/pkg/agent/cmd/run.go @@ -217,10 +217,6 @@ func run(override cfgOverrider, testingMode bool, fleetInitTimeout time.Duration l.Error(errors.New(err, "failed to invoke rollback watcher")) } - if allowEmptyPgp, _ := release.PGP(); allowEmptyPgp { - l.Info("Elastic Agent has been built with security disabled. Elastic Agent will not verify signatures of upgrade artifact.") - } - execPath, err := reexecPath() if err != nil { return err diff --git a/internal/pkg/release/pgp.go b/internal/pkg/release/pgp.go index 49d4cfc32a9..9644f6778f3 100644 --- a/internal/pkg/release/pgp.go +++ b/internal/pkg/release/pgp.go @@ -19,7 +19,7 @@ func init() { pgpBytes = packer.MustUnpack("eJyMlsuOtLoBhPd5jH9/JBua0U+ksxguhobGjI0v4B1gNDQ2NNPNTNNEeffoRMoqipR1Va1KVfr+8Sv5SP7I4+aPwbaP7do/hvbej7/+/utSge1SwZBynbFrQCh8/+RIhCy20TnekKyCkMV+VL3+8oEttMr2C1475/R2jvW3FkF6TpvXZXr/Lhj5zGNdisovWunBITR5OENKuRdSY44qxT/E4ICiMdZJVlazd2pssJMJOTT2AHHx3iYclLVKZI1bNtmMwfWQdlz6SI9Vst6wwTkxJCfVdqVAfWjX3pqZuE1NDixX2lod6AN9FA6eZY0vRMJkqLagn3BRxRi3sDk6uB59vAYE0kwB/NKOd29l8VOSNRJyX7nkRzHRXRv/KlhG+UIJjtWjSNe6cdT1AouTEPZNwLGuuILVgrA23GMSVZKhq4Yi1Mv600vksFi34Xw7OGh2DoOPHNIQC/Sqku3F+Rj2DmxysJqGKYORfejo80dHKtIGugqiskuzx2DsRyk0z6Et8bKy3MV7lZC8EPZycZDCNbp1YC/b9N2jL/88JOPEoYpasO8lwkwnt13a284P+6V5Rjo4ykKsNZuzEzVeqoF/uwBPUWc39P32ah0YqgkrBfCu+P5WJejWA4T6VAUdGzmZY5czWxcTispUBcSIkHCUFigTYsFKxqdnI3Q52LWmi1XFrJfQbOh/aYJlj27Oti4V7cCzQtrx3sc2HpKtlWidmwmHg0Xpf+dNLlm2aHk+qtkjnbOFDCAqYkQrjjIFRSTkOqnaLpXMAg1tQSBaqhi5FdcJlzoiEP2wOAslx4EGIqoSjchzTXCMAuLoO2fBdyHhlc32g9dZNcxroAB6CCRoIeHSHfi7OlRI4XhtJ9oQvjparDE9gnPF91XU5N6j4HuYehjO3qGmoBTOuPOJehSoR1cHsHHpQhzIabidB2uBmOzcR3YXL/+qoYKVwaWOt6Y98KHSVRGeqRzaRxFjO1x/5xgUL+qKlAD/0cynZ5eKiFnikWXMu/kTdLzw2tCfKmCOgYkvbW+udpCjHQ6Kmtqe9ztGzZ1KP+HO6WA2uHRk5UOCYxGrl5g064QiQ4zDBqI3xd6fDVhvfZpdhmSD0kDCkdr7OGM5WGeKEBisoDT0Cw7U3MbjVylFnMPRhtNosIvdHI7OEJ9fDT8B5Xi8Q9lba557Z2nVR8GtuPoZA/reCztXvPd6qzcO9rJLxxuZMpA7xZMv+EvFGuPwd65E9uBIe12srsLACdfBRtMg02l2FxB/DyabWwc2LMIOO7KmgNrRDmR0trSZt5AiVHHgnTDYAi51gPkquvf1rQGwxpU/6dq2fBrHDuGxAdveInzVs8/6Gl0HM14aKKic4WMwHq6A5oRnCT2Qx5dPr79ublP5s14Qwcbnoc3euKGOsMVP49pJu8VJik+XJhR2TJ/KVGQlE9eytrao/GZg4ruDAerYONFwu/XJ/t0jfudxRqW5QRnfXlX1yAv59NhsT0NEXA2DVCYi6uJ9bxz6XSTIU+Hm5DBz1VT8SCTyflFTA/qXFKtoRQxaq9vW8U89iJ/YHU8YZF/5cy3++iRqthS7+MyNcpQIEsGClh8qp8unR8G6txaHjRkrPm9jVz2AkrAuXFErqGa5jFA7WBDntDe1LRXMQGi2lS6N11r0UkfGK6GRXlY1RBYMtebEHaccqIQJHXRJFg2zuXeM1jTcqBC6VobSInr3ROXXjAX3/ggu2u1zWmvWvnxBU8E7d0w7s4lippSILOAcha1ASJksVCD7a8c5sSj/T+9tijHh6Kcyoqwm23b1qtp5uxTv61QAmBFuUSnHgE/nZ1ejXIB96t2x0GlW9YeCzDS7WLInuT5Ad/0NsUACO/6JMLQKk31gYxPN6K5cnBQsy0NLRz17OeawaLjgXaIXicx9MNSqyR6DoEQmPm1c+hxmPDKr4k4Ko53fO3dsUUQYMulfu9h3hBtgfvVVkdxyvGQbBnbpDawFpw1FgdPBIG0NfBRLvLeC2oGPdyZWNAiRlwhfeged24h+icm6fWQvHS9O5PXwiKuxlluBn6vDmHDLBC/arD+k1kcf4aSbuEfqsdbJWBZwzKXE30wqppMt00IvfNKiWM73hp33AvWOnj0xIA46cHryBOJwxrBfsOKptWIKShn6Fy6FUNzDGmhOzdnhfGQXB33zGaVcCreV6723VnWQljpRjy4dM81sIyVciREVr37nvQjiLtZVF/uLsNSU9SiUGZPWXUPMsgkfAfogN79k2Y98v/2bbS5clDT8Pxjo888/f/3zb/8KAAD///dAGpU=")["GPG-KEY-elasticsearch"] } -// PGP return pgpbytes and a flag describing whether or not no pgp is valid. -func PGP() (bool, []byte) { - return allowEmptyPgp == "true", pgpBytes +// PGP return pgpbytes. +func PGP() []byte { + return pgpBytes } diff --git a/internal/pkg/release/version.go b/internal/pkg/release/version.go index 5ff0be1dc29..93f78e5f4be 100644 --- a/internal/pkg/release/version.go +++ b/internal/pkg/release/version.go @@ -23,10 +23,6 @@ var snapshot = "" // complete is an environment variable marking the image as complete. var complete = "ELASTIC_AGENT_COMPLETE" -// allowEmptyPgp is used as a debug flag and allows working -// without valid pgp -var allowEmptyPgp string - // allowUpgrade is used as a debug flag and allows working // with upgrade without requiring Agent to be installed correctly var allowUpgrade string diff --git a/testing/integration/upgrade_gpg_test.go b/testing/integration/upgrade_gpg_test.go index 56d4378d147..e2001dc1eca 100644 --- a/testing/integration/upgrade_gpg_test.go +++ b/testing/integration/upgrade_gpg_test.go @@ -11,7 +11,6 @@ import ( "strings" "testing" - "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/elastic/elastic-agent/internal/pkg/release" @@ -55,7 +54,7 @@ func TestStandaloneUpgradeWithGPGFallback(t *testing.T) { t.Logf("Testing Elastic Agent upgrade from %s to %s...", define.Version(), upgradeToVersion) - _, defaultPGP := release.PGP() + defaultPGP := release.PGP() firstSeven := string(defaultPGP[:7]) newPgp := strings.Replace( string(defaultPGP), @@ -73,7 +72,7 @@ func TestStandaloneUpgradeWithGPGFallback(t *testing.T) { upgradetest.WithSourceURI(""), upgradetest.WithCustomPGP(customPGP), upgradetest.WithSkipVerify(false)) - assert.NoError(t, err) + require.NoError(t, err, "perform upgrade failed") } func TestStandaloneUpgradeWithGPGFallbackOneRemoteFailing(t *testing.T) { @@ -110,7 +109,7 @@ func TestStandaloneUpgradeWithGPGFallbackOneRemoteFailing(t *testing.T) { t.Logf("Testing Elastic Agent upgrade from %s to %s...", define.Version(), upgradeToVersion) - _, defaultPGP := release.PGP() + defaultPGP := release.PGP() firstSeven := string(defaultPGP[:7]) newPgp := strings.Replace( string(defaultPGP), @@ -129,4 +128,5 @@ func TestStandaloneUpgradeWithGPGFallbackOneRemoteFailing(t *testing.T) { upgradetest.WithSourceURI(""), upgradetest.WithCustomPGP(customPGP), upgradetest.WithSkipVerify(false)) + require.NoError(t, err, "perform upgrade failed") } diff --git a/testing/pgptest/pgp.go b/testing/pgptest/pgp.go new file mode 100644 index 00000000000..c6c441536bf --- /dev/null +++ b/testing/pgptest/pgp.go @@ -0,0 +1,42 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package pgptest + +import ( + "bytes" + "io" + "testing" + + "github.com/stretchr/testify/require" + "golang.org/x/crypto/openpgp" //nolint:staticcheck // It still receives security fixes and it's just test code + "golang.org/x/crypto/openpgp/armor" //nolint:staticcheck // It still receives security fixes and it's just test code +) + +// Sing signs data using RSA. It creates the key, sings data and returns the +// ASCII armored public key and detached signature. +func Sing(t *testing.T, data io.Reader) ([]byte, []byte) { + pub := &bytes.Buffer{} + asc := &bytes.Buffer{} + + // Create a new key. The openpgp.Entity hold the private and public keys. + entity, err := openpgp.NewEntity("somekey", "", "", nil) + require.NoError(t, err, "could not create PGP key") + + // Create an encoder to serialize the public key. + wPubKey, err := armor.Encode(pub, openpgp.PublicKeyType, nil) + require.NoError(t, err, "could not create PGP ASCII Armor encoder") + + // Writes the public key to the io.Writer padded to armor.Encode. + // Use entity.SerializePrivate if you need the private key. + err = entity.Serialize(wPubKey) + require.NoError(t, err, "could not serialize the public key") + // cannot use defer as it needs to be closed before pub.Bytes() is invoked. + wPubKey.Close() + + err = openpgp.ArmoredDetachSign(asc, entity, data, nil) + require.NoError(t, err, "failed signing the data") + + return pub.Bytes(), asc.Bytes() +}