Merge branch 'main' into namespace-kas-grants

.github/workflows/nightly-build.yaml

@@ -23,7 +23,7 @@ jobs:
           create_credentials_file: false
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20
+        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf

.release-please-manifest.json

@@ -2,7 +2,7 @@
   "lib/fixtures": "0.2.7",
   "lib/ocrypto": "0.1.5",
   "lib/flattening": "0.1.1",
-  "protocol/go": "0.2.14",
+  "protocol/go": "0.2.15",
   "sdk": "0.3.12",
   "service": "0.4.23"
 }

lib/flattening/flatten.go

@@ -63,7 +63,7 @@ func flattenInterface(i interface{}) ([]Item, error) {
 	case bool, int, string, float64, float32:
 		o = append(o, Item{Key: "", Value: child})
 	default:
-		return nil, errors.New("unrecognozed item in json")
+		return nil, errors.New("unrecognized item in json")
 	}
 	return o, nil
 }

lib/flattening/flatten_test.go

@@ -308,3 +308,43 @@ func TestListNoIndexValueExtraction(t *testing.T) {
 	assert.NotNil(t, actualOutput)
 	assert.ElementsMatch(t, expectedOutput, actualOutput)
 }
+
+func TestFlattenInterfaceNoPanic(t *testing.T) {
+	testCases := []struct {
+		name  string
+		value interface{}
+	}{
+		{
+			name:  "nil",
+			value: nil,
+		},
+		{
+			name:  "intPtr",
+			value: new(int),
+		},
+		{
+			name:  "channel",
+			value: make(chan int),
+		},
+		{
+			name:  "func",
+			value: func() {},
+		},
+		{
+			name:  "interfaceValue",
+			value: interface{}(123),
+		},
+		{
+			name:  "interfaceEmptyValue",
+			value: interface{}(nil),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			require.NotPanics(t, func() {
+				_, _ = flattenInterface(tc.value)
+			})
+		})
+	}
+}

lib/ocrypto/fuzz_test.go

@@ -0,0 +1,56 @@
+package ocrypto
+
+import (
+	"crypto/elliptic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func makeCompressedZeroSeed(l int) []byte {
+	seed := make([]byte, l)
+	seed[0] = 3
+	return seed
+}
+
+func makeCompressedRandomSeed(f *testing.F, mode ECCMode) []byte {
+	curve, err := GetECCurveFromECCMode(mode)
+	require.NoError(f, err)
+	keyPair, err := NewECKeyPair(mode)
+	require.NoError(f, err)
+	pubKey := keyPair.PrivateKey.PublicKey
+
+	return elliptic.MarshalCompressed(curve, pubKey.X, pubKey.Y)
+}
+
+func FuzzUncompressECPubKey(f *testing.F) {
+	// real random key examples
+	f.Add(makeCompressedRandomSeed(f, ECCModeSecp256r1))
+	f.Add(makeCompressedRandomSeed(f, ECCModeSecp384r1))
+	f.Add(makeCompressedRandomSeed(f, ECCModeSecp521r1))
+	// zero examples
+	f.Add(makeCompressedZeroSeed(curveByteLength(elliptic.P224())))
+	f.Add(makeCompressedZeroSeed(curveByteLength(elliptic.P256())))
+	f.Add(makeCompressedZeroSeed(curveByteLength(elliptic.P384())))
+	f.Add(makeCompressedZeroSeed(curveByteLength(elliptic.P521())))
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		curve := elliptic.P256()
+		switch len(data) { // check if other curves are a better fit
+		case curveByteLength(elliptic.P224()):
+			curve = elliptic.P224()
+		case curveByteLength(elliptic.P384()):
+			curve = elliptic.P384()
+		case curveByteLength(elliptic.P521()):
+			curve = elliptic.P521()
+		}
+
+		require.NotPanics(t, func() {
+			_, _ = UncompressECPubKey(curve, data)
+		})
+	})
+}
+
+func curveByteLength(curve elliptic.Curve) int {
+	return 1 + (curve.Params().BitSize+7)/8
+}