29 lines
907 B
Go
29 lines
907 B
Go
package bootstrap
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestBootstrapNoticeMatchesTLSCertificateFingerprint(t *testing.T) {
|
|
material, err := NewTemporaryTLSMaterial("203.0.113.20")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var output bytes.Buffer
|
|
writeBootstrapNotice(&output, 8080, "/run/scert/bootstrap-url", material)
|
|
digest := sha256.Sum256(material.Leaf.Raw)
|
|
want := strings.ToUpper(hex.EncodeToString(digest[:]))
|
|
if !strings.Contains(output.String(), "SHA-256 指纹："+want) || !strings.Contains(output.String(), "/run/scert/bootstrap-url") {
|
|
t.Fatal("启动提示缺少实际 TLS 证书的 SHA-256 指纹或受保护地址路径")
|
|
}
|
|
for _, forbidden := range []string{"token=", "PRIVATE KEY", "CERTIFICATE-----"} {
|
|
if strings.Contains(output.String(), forbidden) {
|
|
t.Fatal("启动提示不得泄露令牌、私钥或完整证书材料")
|
|
}
|
|
}
|
|
}
|