Skip to content

[HotFix] Ensure cryp4gh keys are loaded on startup. #1663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

[HotFix] Ensure cryp4gh keys are loaded on startup. #1663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3eed1fa
[ingest] ensure C4GH keylist is not empty on startup.
jbygdell May 12, 2025
3abd66b
[ingest-test] check for empty C4GH key list
jbygdell May 12, 2025
69f7594
[verify] ensure C4GH keylist is not empty on startup.
jbygdell May 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions sda/cmd/ingest/ingest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"io"
"os"
Expand Down Expand Up @@ -75,10 +76,9 @@ func main() {
panic(err)
}
app.ArchiveKeyList, err = config.GetC4GHprivateKeys()
if err != nil {
log.Error(err)
if err != nil || len(app.ArchiveKeyList) == 0 {
sigc <- syscall.SIGINT
panic(err)
panic(errors.New("no C4GH private keys configured"))
}
app.Archive, err = storage.NewBackend(app.Conf.Archive)
if err != nil {
Expand Down
26 changes: 22 additions & 4 deletions sda/cmd/ingest/ingest_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,13 +169,18 @@ type TestSuite struct {
filePath string
pubKeyList [][32]byte
ingest Ingest
tempDir string
}

func (ts *TestSuite) SetupSuite() {
var err error
viper.Set("log.level", "debug")
tempDir := ts.T().TempDir()
keyFile1 := fmt.Sprintf("%s/c4gh1.key", tempDir)
keyFile2 := fmt.Sprintf("%s/c4gh2.key", tempDir)
ts.tempDir, err = os.MkdirTemp("", "c4gh-keys")
if err != nil {
ts.FailNow("Failed to create temp directory")
}
keyFile1 := fmt.Sprintf("%s/c4gh1.key", ts.tempDir)
keyFile2 := fmt.Sprintf("%s/c4gh2.key", ts.tempDir)

publicKey, err := helper.CreatePrivateKeyFile(keyFile1, "test")
if err != nil {
Expand Down Expand Up @@ -237,6 +242,7 @@ func (ts *TestSuite) SetupSuite() {
func (ts *TestSuite) TearDownSuite() {
_ = os.RemoveAll(ts.ingest.Conf.Archive.Posix.Location)
_ = os.RemoveAll(ts.ingest.Conf.Inbox.Posix.Location)
_ = os.RemoveAll(ts.tempDir)
}

func (ts *TestSuite) SetupTest() {
Expand Down Expand Up @@ -295,6 +301,11 @@ func (ts *TestSuite) SetupTest() {
if err != nil {
ts.FailNow("failed to setup inbox backend")
}

viper.Set("c4gh.privateKeys", []config.C4GHprivateKeyConf{
{FilePath: filepath.Join(ts.tempDir, "c4gh1.key"), Passphrase: "test"},
{FilePath: filepath.Join(ts.tempDir, "c4gh2.key"), Passphrase: "test"},
})
}
func (ts *TestSuite) TestTryDecrypt_wrongFile() {
tempDir := ts.T().TempDir()
Expand Down Expand Up @@ -345,6 +356,7 @@ func (ts *TestSuite) TestTryDecrypt() {

privateKeys, err := config.GetC4GHprivateKeys()
assert.NoError(ts.T(), err)
assert.Equal(ts.T(), 2, len(privateKeys))

for i, key := range privateKeys {
header, err := tryDecrypt(key, buf)
Expand All @@ -353,7 +365,7 @@ func (ts *TestSuite) TestTryDecrypt() {
assert.NoError(ts.T(), err)
assert.NotNil(ts.T(), header)
default:
assert.Contains(ts.T(), err.Error(), "could not find matching public key heade")
assert.Contains(ts.T(), err.Error(), "could not find matching public key header")
assert.Nil(ts.T(), header)
}
}
Expand Down Expand Up @@ -723,3 +735,9 @@ func (ts *TestSuite) TestIngestFile_missingFile() {

assert.Equal(ts.T(), "ack", ts.ingest.ingestFile(corrID, message))
}
func (ts *TestSuite) TestDetectMisingC4GHKeys() {
viper.Set("c4gh.privateKeys", "")
privateKeys, err := config.GetC4GHprivateKeys()
assert.NoError(ts.T(), err)
assert.Equal(ts.T(), 0, len(privateKeys))
}
Comment on lines +738 to +743
Copy link
Contributor

@aaperis aaperis May 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this part check? Does it check that config.GetC4GHprivateKeys translates an empty string to an empty array?
I guess to ensure that the fix won't break the code?

4 changes: 2 additions & 2 deletions sda/cmd/verify/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,8 @@ func main() {
log.Fatal(err)
}
archiveKeyList, err := config.GetC4GHprivateKeys()
if err != nil {
log.Fatal(err)
if err != nil || len(archiveKeyList) == 0 {
log.Fatal("no C4GH private keys configured")
}

defer mq.Channel.Close()
Expand Down
Loading