{"action":"created","comment":{"url":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments/184975608","pull_request_review_id":116227590,"id":184975608,"diff_hunk":"@@ -0,0 +1,212 @@\n+package cose\n+\n+import (\n+\t\"crypto\"\n+\t\"crypto/dsa\"\n+\t\"crypto/ecdsa\"\n+\t\"crypto/elliptic\"\n+\t\"errors\"\n+\t\"fmt\"\n+\t\"github.com/stretchr/testify/assert\"\n+\t\"math/rand\"\n+\t\"testing\"\n+)\n+\n+func TestSignErrors(t *testing.T) {\n+\tassert := assert.New(t)\n+\n+\trandReader := rand.New(rand.NewSource(int64(0)))\n+\n+\tmsg := NewSignMessage([]byte(\"payload to sign\"))\n+\n+\tecdsaPrivateKey := ecdsa.PrivateKey{\n+\t\tPublicKey: ecdsa.PublicKey{\n+\t\t\tCurve: elliptic.P256(),\n+\t\t\tX:     FromBase64Int(\"usWxHK2PmfnHKwXPS54m0kTcGJ90UiglWiGahtagnv8\"),\n+\t\t\tY:     FromBase64Int(\"IBOL-C3BttVivg-lSreASjpkttcsz-1rb7btKLv8EX4\"),\n+\t\t},\n+\t\tD: FromBase64Int(\"V8kgd2ZBRuh2dgyVINBUqpPDr7BOMGcF22CQMIUHtNM\"),\n+\t}\n+\n+\tdsaPrivateKey := dsa.PrivateKey{\n+\t\tPublicKey: dsa.PublicKey{\n+\t\t\tParameters: dsa.Parameters{\n+\t\t\t\tP: FromBase64Int(\"A9B5B793FB4785793D246BAE77E8FF63CA52F442DA763C440259919FE1BC1D6065A9350637A04F75A2F039401D49F08E066C4D275A5A65DA5684BC563C14289D7AB8A67163BFBF79D85972619AD2CFF55AB0EE77A9002B0EF96293BDD0F42685EBB2C66C327079F6C98000FBCB79AACDE1BC6F9D5C7B1A97E3D9D54ED7951FEF\"),\n+\t\t\t\tQ: FromBase64Int(\"E1D3391245933D68A0714ED34BBCB7A1F422B9C1\"),\n+\t\t\t\tG: FromBase64Int(\"634364FC25248933D01D1993ECABD0657CC0CB2CEED7ED2E3E8AECDFCDC4A25C3B15E9E3B163ACA2984B5539181F3EFF1A5E8903D71D5B95DA4F27202B77D2C44B430BB53741A8D59A8F86887525C9F2A6A5980A195EAA7F2FF910064301DEF89D3AA213E1FAC7768D89365318E370AF54A112EFBA9246D9158386BA1B4EEFDA\"),\n+\t\t\t},\n+\t\t\tY: FromBase64Int(\"32969E5780CFE1C849A1C276D7AEB4F38A23B591739AA2FE197349AEEBD31366AEE5EB7E6C6DDB7C57D02432B30DB5AA66D9884299FAA72568944E4EEDC92EA3FBC6F39F53412FBCC563208F7C15B737AC8910DBC2D9C9B8C001E72FDC40EB694AB1F06A5A2DBD18D9E36C66F31F566742F11EC0A52E9F7B89355C02FB5D32D2\"),\n+\t\t},\n+\t\tX: FromBase64Int(\"5078D4D29795CBE76D3AACFE48C9AF0BCDBEE91A\"),\n+\t}\n+\n+\tsigner, err := NewSigner(&ecdsaPrivateKey)\n+\tassert.Nil(err, fmt.Sprintf(\"Error creating signer %s\", err))\n+\n+\topts := SignOpts{\n+\t\tHashFunc: crypto.SHA256,\n+\t\tGetSigner: func(index int, signature Signature) (Signer, error) {\n+\t\t\treturn *signer, ErrNoSignerFound\n+\t\t},\n+\t}\n+\n+\tsig := NewSignature()\n+\tsig.Headers.Protected[algTag] = -41 // RSAES-OAEP w/ SHA-256 from [RFC8230]","path":"vendor/go.mozilla.org/cose/sign_verify_test.go","position":54,"original_position":54,"commit_id":"4f55e230bf15d90fc3a78bff5a9d20eeac0d8ed0","original_commit_id":"4f55e230bf15d90fc3a78bff5a9d20eeac0d8ed0","user":{"login":"franziskuskiefer","id":890105,"avatar_url":"https://avatars0.githubusercontent.com/u/890105?v=4","gravatar_id":"","url":"https://api.github.com/users/franziskuskiefer","html_url":"https://github.com/franziskuskiefer","followers_url":"https://api.github.com/users/franziskuskiefer/followers","following_url":"https://api.github.com/users/franziskuskiefer/following{/other_user}","gists_url":"https://api.github.com/users/franziskuskiefer/gists{/gist_id}","starred_url":"https://api.github.com/users/franziskuskiefer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/franziskuskiefer/subscriptions","organizations_url":"https://api.github.com/users/franziskuskiefer/orgs","repos_url":"https://api.github.com/users/franziskuskiefer/repos","events_url":"https://api.github.com/users/franziskuskiefer/events{/privacy}","received_events_url":"https://api.github.com/users/franziskuskiefer/received_events","type":"User","site_admin":false},"body":"Maybe I'm missing something but I don't see tests with intermediate certs in the protected body header. Note that the Firefox code expects there always to be a (potentially empty) list of intermediate certs.","created_at":"2018-04-30T12:42:23Z","updated_at":"2018-04-30T12:44:05Z","html_url":"https://github.com/mozilla-services/autograph/pull/76#discussion_r184975608","pull_request_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments/184975608"},"html":{"href":"https://github.com/mozilla-services/autograph/pull/76#discussion_r184975608"},"pull_request":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76"}}},"pull_request":{"url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76","id":180476652,"html_url":"https://github.com/mozilla-services/autograph/pull/76","diff_url":"https://github.com/mozilla-services/autograph/pull/76.diff","patch_url":"https://github.com/mozilla-services/autograph/pull/76.patch","issue_url":"https://api.github.com/repos/mozilla-services/autograph/issues/76","number":76,"state":"open","locked":false,"title":"XPI cose signing","user":{"login":"g-k","id":226605,"avatar_url":"https://avatars1.githubusercontent.com/u/226605?v=4","gravatar_id":"","url":"https://api.github.com/users/g-k","html_url":"https://github.com/g-k","followers_url":"https://api.github.com/users/g-k/followers","following_url":"https://api.github.com/users/g-k/following{/other_user}","gists_url":"https://api.github.com/users/g-k/gists{/gist_id}","starred_url":"https://api.github.com/users/g-k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/g-k/subscriptions","organizations_url":"https://api.github.com/users/g-k/orgs","repos_url":"https://api.github.com/users/g-k/repos","events_url":"https://api.github.com/users/g-k/events{/privacy}","received_events_url":"https://api.github.com/users/g-k/received_events","type":"User","site_admin":false},"body":"WIP branch to add COSE signatures to addons\r\n\r\n~~Assume one signer per addon (i.e. we don't need multiple signatures on the COSE message)?~~\r\n\r\nedit: @jvehent I'm thinking we change the signer config as follows:\r\n\r\n* add a `cose_signers` key \r\n* its value is an array with required keys algorithm, certificate, and privatekey with values:\r\n  * algorithm: from the \"Name\" column of https://www.iana.org/assignments/cose/cose.xhtml#header-algorithm-parameters Might need quotes.\r\n  * certificate and privatekey: same PEM blocks as top level signer values\r\n\r\nFor example:\r\n\r\n```yaml\r\nsigners:\r\n- id: extensions-pkcs7-ecdsa\r\n   type: xpi\r\n   certificate: |\r\n        -----BEGIN CERTIFICATE-----\r\n        ... \r\n   privatekey: | \r\n        -----BEGIN EC PARAMETERS----- \r\n        ...\r\n- id: extensions-signer-pkcs7-and-cose\r\n   type: xpi\r\n   certificate: |  # an optional PKCS7 signer\r\n        -----BEGIN CERTIFICATE----- # probably the same as the first cose\r\n        ... \r\n   privatekey: | \r\n        -----BEGIN EC PARAMETERS----- \r\n        ...\r\n   cose_signers: # enables cose signing when present and makes PKCS7 signing optional\r\n     - algorithm: ES256\r\n       certificate: |\r\n        -----BEGIN CERTIFICATE-----\r\n        ... \r\n       privatekey: |\r\n       -----BEGIN EC PARAMETERS----- \r\n       ...\r\n     - algorithm: PS256\r\n       certificate: |\r\n        -----BEGIN CERTIFICATE-----\r\n        ... \r\n       privatekey: |\r\n       -----BEGIN PRIVATE KEY-----\r\n       ...\r\n```\r\n \r\nThis lets us:\r\n\r\n* use multiple or different intermediates for COSE signing\r\n* enable and disable PKCS7 signing with COSE signing using a different intermediate if necessary \r\n* keep existing PKCS7 signers by having a client's authorizations default to the non-COSE signer but allowing clients to select a COSE signer with an explicit signer keyid","created_at":"2018-04-10T02:51:43Z","updated_at":"2018-04-30T12:44:05Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9c7c660469e718c57d42a889452c1038b90efd7b","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/commits","review_comments_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/comments","review_comment_url":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mozilla-services/autograph/issues/76/comments","statuses_url":"https://api.github.com/repos/mozilla-services/autograph/statuses/4f55e230bf15d90fc3a78bff5a9d20eeac0d8ed0","head":{"label":"mozilla-services:xpi-cose-signing","ref":"xpi-cose-signing","sha":"4f55e230bf15d90fc3a78bff5a9d20eeac0d8ed0","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":49082801,"name":"autograph","full_name":"mozilla-services/autograph","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/autograph","description":"Digital signature micro-services","fork":false,"url":"https://api.github.com/repos/mozilla-services/autograph","forks_url":"https://api.github.com/repos/mozilla-services/autograph/forks","keys_url":"https://api.github.com/repos/mozilla-services/autograph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/autograph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/autograph/teams","hooks_url":"https://api.github.com/repos/mozilla-services/autograph/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/autograph/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/autograph/events","assignees_url":"https://api.github.com/repos/mozilla-services/autograph/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/autograph/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/autograph/tags","blobs_url":"https://api.github.com/repos/mozilla-services/autograph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/autograph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/autograph/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/autograph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/autograph/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/autograph/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/autograph/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/autograph/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/autograph/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/autograph/subscription","commits_url":"https://api.github.com/repos/mozilla-services/autograph/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/autograph/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/autograph/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/autograph/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/autograph/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/autograph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/autograph/merges","archive_url":"https://api.github.com/repos/mozilla-services/autograph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/autograph/downloads","issues_url":"https://api.github.com/repos/mozilla-services/autograph/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/autograph/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/autograph/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/autograph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/autograph/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/autograph/releases{/id}","deployments_url":"https://api.github.com/repos/mozilla-services/autograph/deployments","created_at":"2016-01-05T17:55:26Z","updated_at":"2018-04-29T14:28:11Z","pushed_at":"2018-04-29T14:28:10Z","git_url":"git://github.com/mozilla-services/autograph.git","ssh_url":"git@github.com:mozilla-services/autograph.git","clone_url":"https://github.com/mozilla-services/autograph.git","svn_url":"https://github.com/mozilla-services/autograph","homepage":"","size":62181,"stargazers_count":51,"watchers_count":51,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":10,"mirror_url":null,"archived":false,"open_issues_count":13,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0"},"forks":10,"open_issues":13,"watchers":51,"default_branch":"master"}},"base":{"label":"mozilla-services:master","ref":"master","sha":"500cfb90f01bb08226eb3c86f267cd88ecbad2ed","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":49082801,"name":"autograph","full_name":"mozilla-services/autograph","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars1.githubusercontent.com/u/1066228?v=4","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/autograph","description":"Digital signature micro-services","fork":false,"url":"https://api.github.com/repos/mozilla-services/autograph","forks_url":"https://api.github.com/repos/mozilla-services/autograph/forks","keys_url":"https://api.github.com/repos/mozilla-services/autograph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/autograph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/autograph/teams","hooks_url":"https://api.github.com/repos/mozilla-services/autograph/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/autograph/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/autograph/events","assignees_url":"https://api.github.com/repos/mozilla-services/autograph/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/autograph/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/autograph/tags","blobs_url":"https://api.github.com/repos/mozilla-services/autograph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/autograph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/autograph/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/autograph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/autograph/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/autograph/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/autograph/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/autograph/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/autograph/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/autograph/subscription","commits_url":"https://api.github.com/repos/mozilla-services/autograph/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/autograph/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/autograph/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/autograph/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/autograph/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/autograph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/autograph/merges","archive_url":"https://api.github.com/repos/mozilla-services/autograph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/autograph/downloads","issues_url":"https://api.github.com/repos/mozilla-services/autograph/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/autograph/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/autograph/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/autograph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/autograph/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/autograph/releases{/id}","deployments_url":"https://api.github.com/repos/mozilla-services/autograph/deployments","created_at":"2016-01-05T17:55:26Z","updated_at":"2018-04-29T14:28:11Z","pushed_at":"2018-04-29T14:28:10Z","git_url":"git://github.com/mozilla-services/autograph.git","ssh_url":"git@github.com:mozilla-services/autograph.git","clone_url":"https://github.com/mozilla-services/autograph.git","svn_url":"https://github.com/mozilla-services/autograph","homepage":"","size":62181,"stargazers_count":51,"watchers_count":51,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":10,"mirror_url":null,"archived":false,"open_issues_count":13,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0"},"forks":10,"open_issues":13,"watchers":51,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76"},"html":{"href":"https://github.com/mozilla-services/autograph/pull/76"},"issue":{"href":"https://api.github.com/repos/mozilla-services/autograph/issues/76"},"comments":{"href":"https://api.github.com/repos/mozilla-services/autograph/issues/76/comments"},"review_comments":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/comments"},"review_comment":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mozilla-services/autograph/pulls/76/commits"},"statuses":{"href":"https://api.github.com/repos/mozilla-services/autograph/statuses/4f55e230bf15d90fc3a78bff5a9d20eeac0d8ed0"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"franziskuskiefer"}}