docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

"make lint" wasn't actually linting every file in the repo. golint ./... 

ignores buildtags, for instance, and somehow didn't pick up some code in
the signer.

This calls golint on every go file in the repo and also fixes some linting
issues, which involves renaming two yubikey functions to avoid stuttering.

Signed-off-by: Ying Li <ying.li@docker.com>
This commit is contained in:
Ying Li 2016-04-12 16:03:56 -07:00
parent d01d666771
commit cf4e726514
10 changed files with 121 additions and 102 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -98,7 +98,7 @@ fmt:
lint: lint:
@echo "+ $@" @echo "+ $@"
@test -z "$$(golint -tags "${NOTARY_BUILDTAGS}" ./... | grep -v .pb. | grep -v vendor/ | tee /dev/stderr)" @test -z "$(shell find . -type f -name "*.go" -not -path "./vendor/*" -not -name "*.pb.*" -exec golint {} \; | tee /dev/stderr)"
# Requires that the following: # Requires that the following:
# go get -u github.com/client9/misspell/cmd/misspell # go get -u github.com/client9/misspell/cmd/misspell

4
client/client_pkcs11_test.go
View File

@ -7,10 +7,10 @@ import "github.com/docker/notary/trustmanager/yubikey"
// clear out all keys // clear out all keys
func init() { func init() {
yubikey.SetYubikeyKeyMode(0) yubikey.SetYubikeyKeyMode(0)
if !yubikey.YubikeyAccessible() { if !yubikey.IsAccessible() {
return return
} }
store, err := yubikey.NewYubiKeyStore(nil, nil) store, err := yubikey.NewYubiStore(nil, nil)
if err == nil { if err == nil {
for k := range store.ListKeys() { for k := range store.ListKeys() {
store.RemoveKey(k) store.RemoveKey(k)

2
client/repo_pkcs11.go
View File

@ -24,7 +24,7 @@ func NewNotaryRepository(baseDir, gun, baseURL string, rt http.RoundTripper,
} }
keyStores := []trustmanager.KeyStore{fileKeyStore} keyStores := []trustmanager.KeyStore{fileKeyStore}
yubiKeyStore, _ := yubikey.NewYubiKeyStore(fileKeyStore, retriever) yubiKeyStore, _ := yubikey.NewYubiStore(fileKeyStore, retriever)
if yubiKeyStore != nil { if yubiKeyStore != nil {
keyStores = []trustmanager.KeyStore{yubiKeyStore, fileKeyStore} keyStores = []trustmanager.KeyStore{yubiKeyStore, fileKeyStore}
} }

10
cmd/notary/integration_pkcs11_test.go
View File

@ -26,7 +26,7 @@ func init() {
} }
// best effort at removing keys here, so nil is fine // best effort at removing keys here, so nil is fine
s, err := yubikey.NewYubiKeyStore(nil, _retriever) s, err := yubikey.NewYubiStore(nil, _retriever)
if err != nil { if err != nil {
for k := range s.ListKeys() { for k := range s.ListKeys() {
s.RemoveKey(k) s.RemoveKey(k)
@ -41,12 +41,12 @@ func init() {
} }
} }
var rootOnHardware = yubikey.YubikeyAccessible var rootOnHardware = yubikey.IsAccessible
// Per-test set up deletes all keys on the yubikey // Per-test set up deletes all keys on the yubikey
func setUp(t *testing.T) { func setUp(t *testing.T) {
//we're just removing keys here, so nil is fine //we're just removing keys here, so nil is fine
s, err := yubikey.NewYubiKeyStore(nil, _retriever) s, err := yubikey.NewYubiStore(nil, _retriever)
require.NoError(t, err) require.NoError(t, err)
for k := range s.ListKeys() { for k := range s.ListKeys() {
err := s.RemoveKey(k) err := s.RemoveKey(k)
@ -59,9 +59,9 @@ func setUp(t *testing.T) {
// on disk // on disk
func verifyRootKeyOnHardware(t *testing.T, rootKeyID string) { func verifyRootKeyOnHardware(t *testing.T, rootKeyID string) {
// do not bother verifying if there is no yubikey available // do not bother verifying if there is no yubikey available
if yubikey.YubikeyAccessible() { if yubikey.IsAccessible() {
// //we're just getting keys here, so nil is fine // //we're just getting keys here, so nil is fine
s, err := yubikey.NewYubiKeyStore(nil, _retriever) s, err := yubikey.NewYubiStore(nil, _retriever)
require.NoError(t, err) require.NoError(t, err)
privKey, role, err := s.GetKey(rootKeyID) privKey, role, err := s.GetKey(rootKeyID)
require.NoError(t, err) require.NoError(t, err)

6
cmd/notary/keys.go
View File

@ -571,7 +571,7 @@ func (k *keyCommander) keyPassphraseChange(cmd *cobra.Command, args []string) er
var addingKeyStore trustmanager.KeyStore var addingKeyStore trustmanager.KeyStore
switch foundKeyStore.Name() { switch foundKeyStore.Name() {
case "yubikey": case "yubikey":
addingKeyStore, err = getYubiKeyStore(nil, passChangeRetriever) addingKeyStore, err = getYubiStore(nil, passChangeRetriever)
keyInfo = trustmanager.KeyInfo{Role: data.CanonicalRootRole} keyInfo = trustmanager.KeyInfo{Role: data.CanonicalRootRole}
default: default:
addingKeyStore, err = trustmanager.NewKeyFileStore(config.GetString("trust_dir"), passChangeRetriever) addingKeyStore, err = trustmanager.NewKeyFileStore(config.GetString("trust_dir"), passChangeRetriever)
@ -609,9 +609,9 @@ func (k *keyCommander) getKeyStores(
if withHardware { if withHardware {
var yubiStore trustmanager.KeyStore var yubiStore trustmanager.KeyStore
if hardwareBackup { if hardwareBackup {
yubiStore, err = getYubiKeyStore(fileKeyStore, retriever) yubiStore, err = getYubiStore(fileKeyStore, retriever)
} else { } else {
yubiStore, err = getYubiKeyStore(nil, retriever) yubiStore, err = getYubiStore(nil, retriever)
} }
if err == nil && yubiStore != nil { if err == nil && yubiStore != nil {
// Note that the order is important, since we want to prioritize // Note that the order is important, since we want to prioritize

2
cmd/notary/keys_nonpkcs11.go
View File

@ -9,6 +9,6 @@ import (
"github.com/docker/notary/trustmanager" "github.com/docker/notary/trustmanager"
) )
func getYubiKeyStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) { func getYubiStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
return nil, errors.New("Not built with hardware support") return nil, errors.New("Not built with hardware support")
} }

4
cmd/notary/keys_pkcs11.go
View File

@ -8,6 +8,6 @@ import (
"github.com/docker/notary/trustmanager/yubikey" "github.com/docker/notary/trustmanager/yubikey"
) )
func getYubiKeyStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) { func getYubiStore(fileKeyStore trustmanager.KeyStore, ret passphrase.Retriever) (trustmanager.KeyStore, error) {
return yubikey.NewYubiKeyStore(fileKeyStore, ret) return yubikey.NewYubiStore(fileKeyStore, ret)
} }

20
signer/api/api_test.go
View File

@ -46,8 +46,8 @@ func TestDeleteKeyHandlerReturns404WithNonexistentKey(t *testing.T) {
fakeID := "c62e6d68851cef1f7e55a9d56e3b0c05f3359f16838cad43600f0554e7d3b54d" fakeID := "c62e6d68851cef1f7e55a9d56e3b0c05f3359f16838cad43600f0554e7d3b54d"
keyID := &pb.KeyID{ID: fakeID} keyID := &pb.KeyID{ID: fakeID}
requestJson, _ := json.Marshal(keyID) requestJSON, _ := json.Marshal(keyID)
reader = strings.NewReader(string(requestJson)) reader = strings.NewReader(string(requestJSON))
request, err := http.NewRequest("POST", deleteKeyBaseURL, reader) request, err := http.NewRequest("POST", deleteKeyBaseURL, reader)
require.Nil(t, err) require.Nil(t, err)
@ -66,8 +66,8 @@ func TestDeleteKeyHandler(t *testing.T) {
tufKey, _ := cryptoService.Create("", "", data.ED25519Key) tufKey, _ := cryptoService.Create("", "", data.ED25519Key)
require.NotNil(t, tufKey) require.NotNil(t, tufKey)
requestJson, _ := json.Marshal(&pb.KeyID{ID: tufKey.ID()}) requestJSON, _ := json.Marshal(&pb.KeyID{ID: tufKey.ID()})
reader = strings.NewReader(string(requestJson)) reader = strings.NewReader(string(requestJSON))
request, err := http.NewRequest("POST", deleteKeyBaseURL, reader) request, err := http.NewRequest("POST", deleteKeyBaseURL, reader)
require.Nil(t, err) require.Nil(t, err)
@ -156,9 +156,9 @@ func TestSoftwareSignHandler(t *testing.T) {
require.Nil(t, err) require.Nil(t, err)
sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: tufKey.ID()}, Content: make([]byte, 10)} sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: tufKey.ID()}, Content: make([]byte, 10)}
requestJson, _ := json.Marshal(sigRequest) requestJSON, _ := json.Marshal(sigRequest)
reader = strings.NewReader(string(requestJson)) reader = strings.NewReader(string(requestJSON))
request, err := http.NewRequest("POST", signBaseURL, reader) request, err := http.NewRequest("POST", signBaseURL, reader)
@ -184,8 +184,8 @@ func TestSoftwareSignWithInvalidRequestHandler(t *testing.T) {
cryptoService := cryptoservice.NewCryptoService(keyStore) cryptoService := cryptoservice.NewCryptoService(keyStore)
setup(signer.CryptoServiceIndex{data.ED25519Key: cryptoService, data.RSAKey: cryptoService, data.ECDSAKey: cryptoService}) setup(signer.CryptoServiceIndex{data.ED25519Key: cryptoService, data.RSAKey: cryptoService, data.ECDSAKey: cryptoService})
requestJson := "{\"blob\":\"7d16f1d0b95310a7bc557747fc4f20fcd41c1c5095ae42f189df0717e7d7f4a0a2b55debce630f43c4ac099769c612965e3fda3cd4c0078ee6a460f14fa19307\"}" requestJSON := "{\"blob\":\"7d16f1d0b95310a7bc557747fc4f20fcd41c1c5095ae42f189df0717e7d7f4a0a2b55debce630f43c4ac099769c612965e3fda3cd4c0078ee6a460f14fa19307\"}"
reader = strings.NewReader(requestJson) reader = strings.NewReader(requestJSON)
request, err := http.NewRequest("POST", signBaseURL, reader) request, err := http.NewRequest("POST", signBaseURL, reader)
@ -213,9 +213,9 @@ func TestSignHandlerReturns404WithNonexistentKey(t *testing.T) {
cryptoService.Create("", "", data.ED25519Key) cryptoService.Create("", "", data.ED25519Key)
sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: fakeID}, Content: make([]byte, 10)} sigRequest := &pb.SignatureRequest{KeyID: &pb.KeyID{ID: fakeID}, Content: make([]byte, 10)}
requestJson, _ := json.Marshal(sigRequest) requestJSON, _ := json.Marshal(sigRequest)
reader = strings.NewReader(string(requestJson)) reader = strings.NewReader(string(requestJSON))
request, err := http.NewRequest("POST", signBaseURL, reader) request, err := http.NewRequest("POST", signBaseURL, reader)
require.Nil(t, err) require.Nil(t, err)

85
trustmanager/yubikey/yubikeystore.go
View File

@ -25,14 +25,22 @@ import (
) )
const ( const (
USER_PIN = "123456" // UserPin is the user pin of a yubikey (in PIV parlance, is the PIN)
SO_USER_PIN = "010203040506070801020304050607080102030405060708" UserPin = "123456"
numSlots = 4 // number of slots in the yubikey // SOUserPin is the "Security Officer" user pin - this is the PIV management
// (MGM) key, which is different than the admin pin of the Yubikey PGP interface
// (which in PIV parlance is the PUK, and defaults to 12345678)
SOUserPin = "010203040506070801020304050607080102030405060708"
numSlots = 4 // number of slots in the yubikey
KeymodeNone = 0 // KeymodeNone means that no touch or PIN is required to sign with the yubikey
KeymodeTouch = 1 // touch enabled KeymodeNone = 0
KeymodePinOnce = 2 // require pin entry once // KeymodeTouch means that only touch is required to sign with the yubikey
KeymodePinAlways = 4 // require pin entry all the time KeymodeTouch = 1
// KeymodePinOnce means that the pin entry is required once the first time to sign with the yubikey
KeymodePinOnce = 2
// KeymodePinAlways means that pin entry is required every time to sign with the yubikey
KeymodePinAlways = 4
// the key size, when importing a key into yubikey, MUST be 32 bytes // the key size, when importing a key into yubikey, MUST be 32 bytes
ecdsaPrivateKeySize = 32 ecdsaPrivateKeySize = 32
@ -95,6 +103,8 @@ func init() {
} }
} }
// ErrBackupFailed is returned when a YubiStore fails to back up a key that
// is added
type ErrBackupFailed struct { type ErrBackupFailed struct {
err string err string
} }
@ -127,10 +137,13 @@ type YubiPrivateKey struct {
libLoader pkcs11LibLoader libLoader pkcs11LibLoader
} }
type YubikeySigner struct { // YubiKeySigner wraps a YubiPrivateKey and implements the crypto.Signer interface
type yubikeySigner struct {
YubiPrivateKey YubiPrivateKey
} }
// NewYubiPrivateKey returns a YubiPrivateKey, which implements the data.PrivateKey
// interface except that the private material is inacessible
func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey, func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey,
passRetriever passphrase.Retriever) *YubiPrivateKey { passRetriever passphrase.Retriever) *YubiPrivateKey {
@ -142,7 +155,8 @@ func NewYubiPrivateKey(slot []byte, pubKey data.ECDSAPublicKey,
} }
} }
func (ys *YubikeySigner) Public() crypto.PublicKey { // Public is a required method of the crypto.Signer interface
func (ys *yubikeySigner) Public() crypto.PublicKey {
publicKey, err := x509.ParsePKIXPublicKey(ys.YubiPrivateKey.Public()) publicKey, err := x509.ParsePKIXPublicKey(ys.YubiPrivateKey.Public())
if err != nil { if err != nil {
return nil return nil
@ -158,7 +172,7 @@ func (y *YubiPrivateKey) setLibLoader(loader pkcs11LibLoader) {
// CryptoSigner returns a crypto.Signer tha wraps the YubiPrivateKey. Needed for // CryptoSigner returns a crypto.Signer tha wraps the YubiPrivateKey. Needed for
// Certificate generation only // Certificate generation only
func (y *YubiPrivateKey) CryptoSigner() crypto.Signer { func (y *YubiPrivateKey) CryptoSigner() crypto.Signer {
return &YubikeySigner{YubiPrivateKey: *y} return &yubikeySigner{YubiPrivateKey: *y}
} }
// Private is not implemented in hardware keys // Private is not implemented in hardware keys
@ -168,10 +182,14 @@ func (y *YubiPrivateKey) Private() []byte {
return nil return nil
} }
// SignatureAlgorithm returns which algorithm this key uses to sign - currently
// hardcoded to ECDSA
func (y YubiPrivateKey) SignatureAlgorithm() data.SigAlgorithm { func (y YubiPrivateKey) SignatureAlgorithm() data.SigAlgorithm {
return data.ECDSASignature return data.ECDSASignature
} }
// Sign is a required method of the crypto.Signer interface and the data.PrivateKey
// interface
func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) { func (y *YubiPrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) {
ctx, session, err := SetupHSMEnv(pkcs11Lib, y.libLoader) ctx, session, err := SetupHSMEnv(pkcs11Lib, y.libLoader)
if err != nil { if err != nil {
@ -215,7 +233,7 @@ func addECDSAKey(
) error { ) error {
logrus.Debugf("Attempting to add key to yubikey with ID: %s", privKey.ID()) logrus.Debugf("Attempting to add key to yubikey with ID: %s", privKey.ID())
err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN) err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SOUserPin)
if err != nil { if err != nil {
return err return err
} }
@ -328,7 +346,7 @@ func getECDSAKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byt
// Sign returns a signature for a given signature request // Sign returns a signature for a given signature request
func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, payload []byte) ([]byte, error) { func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, payload []byte) ([]byte, error) {
err := login(ctx, session, passRetriever, pkcs11.CKU_USER, USER_PIN) err := login(ctx, session, passRetriever, pkcs11.CKU_USER, UserPin)
if err != nil { if err != nil {
return nil, fmt.Errorf("error logging in: %v", err) return nil, fmt.Errorf("error logging in: %v", err)
} }
@ -387,7 +405,7 @@ func sign(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, pass
} }
func yubiRemoveKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error { func yubiRemoveKey(ctx IPKCS11Ctx, session pkcs11.SessionHandle, pkcs11KeyID []byte, passRetriever passphrase.Retriever, keyID string) error {
err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SO_USER_PIN) err := login(ctx, session, passRetriever, pkcs11.CKU_SO, SOUserPin)
if err != nil { if err != nil {
return err return err
} }
@ -595,20 +613,20 @@ func getNextEmptySlot(ctx IPKCS11Ctx, session pkcs11.SessionHandle) ([]byte, err
return nil, errors.New("Yubikey has no available slots.") return nil, errors.New("Yubikey has no available slots.")
} }
// YubiKeyStore is a KeyStore for private keys inside a Yubikey // YubiStore is a KeyStore for private keys inside a Yubikey
type YubiKeyStore struct { type YubiStore struct {
passRetriever passphrase.Retriever passRetriever passphrase.Retriever
keys map[string]yubiSlot keys map[string]yubiSlot
backupStore trustmanager.KeyStore backupStore trustmanager.KeyStore
libLoader pkcs11LibLoader libLoader pkcs11LibLoader
} }
// NewYubiKeyStore returns a YubiKeyStore, given a backup key store to write any // NewYubiStore returns a YubiStore, given a backup key store to write any
// generated keys to (usually a KeyFileStore) // generated keys to (usually a KeyFileStore)
func NewYubiKeyStore(backupStore trustmanager.KeyStore, passphraseRetriever passphrase.Retriever) ( func NewYubiStore(backupStore trustmanager.KeyStore, passphraseRetriever passphrase.Retriever) (
*YubiKeyStore, error) { *YubiStore, error) {
s := &YubiKeyStore{ s := &YubiStore{
passRetriever: passphraseRetriever, passRetriever: passphraseRetriever,
keys: make(map[string]yubiSlot), keys: make(map[string]yubiSlot),
backupStore: backupStore, backupStore: backupStore,
@ -620,15 +638,16 @@ func NewYubiKeyStore(backupStore trustmanager.KeyStore, passphraseRetriever pass
// Name returns a user friendly name for the location this store // Name returns a user friendly name for the location this store
// keeps its data // keeps its data
func (s YubiKeyStore) Name() string { func (s YubiStore) Name() string {
return "yubikey" return "yubikey"
} }
func (s *YubiKeyStore) setLibLoader(loader pkcs11LibLoader) { func (s *YubiStore) setLibLoader(loader pkcs11LibLoader) {
s.libLoader = loader s.libLoader = loader
} }
func (s *YubiKeyStore) ListKeys() map[string]trustmanager.KeyInfo { // ListKeys returns a list of keys in the yubikey store
func (s *YubiStore) ListKeys() map[string]trustmanager.KeyInfo {
if len(s.keys) > 0 { if len(s.keys) > 0 {
return buildKeyMap(s.keys) return buildKeyMap(s.keys)
} }
@ -650,7 +669,7 @@ func (s *YubiKeyStore) ListKeys() map[string]trustmanager.KeyInfo {
} }
// AddKey puts a key inside the Yubikey, as well as writing it to the backup store // AddKey puts a key inside the Yubikey, as well as writing it to the backup store
func (s *YubiKeyStore) AddKey(keyInfo trustmanager.KeyInfo, privKey data.PrivateKey) error { func (s *YubiStore) AddKey(keyInfo trustmanager.KeyInfo, privKey data.PrivateKey) error {
added, err := s.addKey(privKey.ID(), keyInfo.Role, privKey) added, err := s.addKey(privKey.ID(), keyInfo.Role, privKey)
if err != nil { if err != nil {
return err return err
@ -667,7 +686,7 @@ func (s *YubiKeyStore) AddKey(keyInfo trustmanager.KeyInfo, privKey data.Private
// Only add if we haven't seen the key already. Return whether the key was // Only add if we haven't seen the key already. Return whether the key was
// added. // added.
func (s *YubiKeyStore) addKey(keyID, role string, privKey data.PrivateKey) ( func (s *YubiStore) addKey(keyID, role string, privKey data.PrivateKey) (
bool, error) { bool, error) {
// We only allow adding root keys for now // We only allow adding root keys for now
@ -713,7 +732,7 @@ func (s *YubiKeyStore) addKey(keyID, role string, privKey data.PrivateKey) (
// GetKey retrieves a key from the Yubikey only (it does not look inside the // GetKey retrieves a key from the Yubikey only (it does not look inside the
// backup store) // backup store)
func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) { func (s *YubiStore) GetKey(keyID string) (data.PrivateKey, string, error) {
ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader) ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
if err != nil { if err != nil {
logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error()) logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
@ -748,7 +767,7 @@ func (s *YubiKeyStore) GetKey(keyID string) (data.PrivateKey, string, error) {
// RemoveKey deletes a key from the Yubikey only (it does not remove it from the // RemoveKey deletes a key from the Yubikey only (it does not remove it from the
// backup store) // backup store)
func (s *YubiKeyStore) RemoveKey(keyID string) error { func (s *YubiStore) RemoveKey(keyID string) error {
ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader) ctx, session, err := SetupHSMEnv(pkcs11Lib, s.libLoader)
if err != nil { if err != nil {
logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error()) logrus.Debugf("Failed to initialize PKCS11 environment: %s", err.Error())
@ -771,13 +790,13 @@ func (s *YubiKeyStore) RemoveKey(keyID string) error {
} }
// ExportKey doesn't work, because you can't export data from a Yubikey // ExportKey doesn't work, because you can't export data from a Yubikey
func (s *YubiKeyStore) ExportKey(keyID string) ([]byte, error) { func (s *YubiStore) ExportKey(keyID string) ([]byte, error) {
logrus.Debugf("Attempting to export: %s key inside of YubiKeyStore", keyID) logrus.Debugf("Attempting to export: %s key inside of YubiStore", keyID)
return nil, errors.New("Keys cannot be exported from a Yubikey.") return nil, errors.New("Keys cannot be exported from a Yubikey.")
} }
// Not yet implemented // GetKeyInfo is not yet implemented
func (s *YubiKeyStore) GetKeyInfo(keyID string) (trustmanager.KeyInfo, error) { func (s *YubiStore) GetKeyInfo(keyID string) (trustmanager.KeyInfo, error) {
return trustmanager.KeyInfo{}, fmt.Errorf("Not yet implemented") return trustmanager.KeyInfo{}, fmt.Errorf("Not yet implemented")
} }
@ -802,7 +821,7 @@ func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
IPKCS11Ctx, pkcs11.SessionHandle, error) { IPKCS11Ctx, pkcs11.SessionHandle, error) {
if libraryPath == "" { if libraryPath == "" {
return nil, 0, errHSMNotPresent{err: "no library found."} return nil, 0, errHSMNotPresent{err: "no library found"}
} }
p := libLoader(libraryPath) p := libLoader(libraryPath)
@ -842,8 +861,8 @@ func SetupHSMEnv(libraryPath string, libLoader pkcs11LibLoader) (
return p, session, nil return p, session, nil
} }
// YubikeyAccessible returns true if a Yubikey can be accessed // IsAccessible returns true if a Yubikey can be accessed
func YubikeyAccessible() bool { func IsAccessible() bool {
if pkcs11Lib == "" { if pkcs11Lib == "" {
return false return false
} }

88
trustmanager/yubikey/yubikeystore_test.go
View File

@ -21,7 +21,7 @@ var ret = passphrase.ConstantRetriever("passphrase")
// create a new store for clearing out keys, because we don't want to pollute // create a new store for clearing out keys, because we don't want to pollute
// any cache // any cache
func clearAllKeys(t *testing.T) { func clearAllKeys(t *testing.T) {
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
for k := range store.ListKeys() { for k := range store.ListKeys() {
@ -78,7 +78,7 @@ func addMaxKeys(t *testing.T, store trustmanager.KeyStore) []string {
// We can add keys enough times to fill up all the slots in the Yubikey. // We can add keys enough times to fill up all the slots in the Yubikey.
// They are backed up, and we can then list them and get the keys. // They are backed up, and we can then list them and get the keys.
func TestYubiAddKeysAndRetrieve(t *testing.T) { func TestYubiAddKeysAndRetrieve(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -90,13 +90,13 @@ func TestYubiAddKeysAndRetrieve(t *testing.T) {
// create 4 keys on the original store // create 4 keys on the original store
backup := trustmanager.NewKeyMemoryStore(ret) backup := trustmanager.NewKeyMemoryStore(ret)
store, err := NewYubiKeyStore(backup, ret) store, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
keys := addMaxKeys(t, store) keys := addMaxKeys(t, store)
// create a new store, since we want to be sure the original store's cache // create a new store, since we want to be sure the original store's cache
// is not masking any issues // is not masking any issues
cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) cleanStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
// All 4 keys should be in the original store, in the clean store (which // All 4 keys should be in the original store, in the clean store (which
@ -118,7 +118,7 @@ func TestYubiAddKeysAndRetrieve(t *testing.T) {
// Test that we can successfully keys enough times to fill up all the slots in the Yubikey, even without a backup store // Test that we can successfully keys enough times to fill up all the slots in the Yubikey, even without a backup store
func TestYubiAddKeysWithoutBackup(t *testing.T) { func TestYubiAddKeysWithoutBackup(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -129,13 +129,13 @@ func TestYubiAddKeysWithoutBackup(t *testing.T) {
}() }()
// create 4 keys on the original store // create 4 keys on the original store
store, err := NewYubiKeyStore(nil, ret) store, err := NewYubiStore(nil, ret)
require.NoError(t, err) require.NoError(t, err)
keys := addMaxKeys(t, store) keys := addMaxKeys(t, store)
// create a new store, since we want to be sure the original store's cache // create a new store, since we want to be sure the original store's cache
// is not masking any issues // is not masking any issues
cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) cleanStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
// All 4 keys should be in the original store, in the clean store (which // All 4 keys should be in the original store, in the clean store (which
@ -157,7 +157,7 @@ func TestYubiAddKeysWithoutBackup(t *testing.T) {
// We can't add a key if there are no more slots // We can't add a key if there are no more slots
func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) { func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -169,7 +169,7 @@ func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
// create 4 keys on the original store // create 4 keys on the original store
backup := trustmanager.NewKeyMemoryStore(ret) backup := trustmanager.NewKeyMemoryStore(ret)
store, err := NewYubiKeyStore(backup, ret) store, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
addMaxKeys(t, store) addMaxKeys(t, store)
@ -179,7 +179,7 @@ func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
// create a new store, since we want to be sure the original store's cache // create a new store, since we want to be sure the original store's cache
// is not masking any issues // is not masking any issues
cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) cleanStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
// The key should not be in the original store, in the new clean store, or // The key should not be in the original store, in the new clean store, or
@ -197,7 +197,7 @@ func TestYubiAddKeyFailureIfNoMoreSlots(t *testing.T) {
// If some random key in the middle was removed, adding a key will work (keys // If some random key in the middle was removed, adding a key will work (keys
// do not have to be deleted/added in order) // do not have to be deleted/added in order)
func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) { func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -209,7 +209,7 @@ func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
// create 4 keys on the original store // create 4 keys on the original store
backup := trustmanager.NewKeyMemoryStore(ret) backup := trustmanager.NewKeyMemoryStore(ret)
store, err := NewYubiKeyStore(backup, ret) store, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
keys := addMaxKeys(t, store) keys := addMaxKeys(t, store)
@ -223,7 +223,7 @@ func TestYubiAddKeyCanAddToMiddleSlot(t *testing.T) {
// create a new store, since we want to be sure the original store's cache // create a new store, since we want to be sure the original store's cache
// is not masking any issues // is not masking any issues
cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) cleanStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
// The new key should be in the original store, in the new clean store, and // The new key should be in the original store, in the new clean store, and
@ -262,7 +262,7 @@ func (s *nonworkingBackup) AddKey(keyInfo trustmanager.KeyInfo, privKey data.Pri
// be removed from the Yubikey too because otherwise there is no way for // be removed from the Yubikey too because otherwise there is no way for
// the user to later get a backup of the key. // the user to later get a backup of the key.
func TestYubiAddKeyRollsBackIfCannotBackup(t *testing.T) { func TestYubiAddKeyRollsBackIfCannotBackup(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -275,7 +275,7 @@ func TestYubiAddKeyRollsBackIfCannotBackup(t *testing.T) {
backup := &nonworkingBackup{ backup := &nonworkingBackup{
KeyMemoryStore: *trustmanager.NewKeyMemoryStore(ret), KeyMemoryStore: *trustmanager.NewKeyMemoryStore(ret),
} }
store, err := NewYubiKeyStore(backup, ret) store, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
_, err = testAddKey(t, store) _, err = testAddKey(t, store)
@ -289,7 +289,7 @@ func TestYubiAddKeyRollsBackIfCannotBackup(t *testing.T) {
// If, when adding a key to the Yubikey, and it already exists, we succeed // If, when adding a key to the Yubikey, and it already exists, we succeed
// without adding it to the backup store. // without adding it to the backup store.
func TestYubiAddDuplicateKeySucceedsButDoesNotBackup(t *testing.T) { func TestYubiAddDuplicateKeySucceedsButDoesNotBackup(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -299,14 +299,14 @@ func TestYubiAddDuplicateKeySucceedsButDoesNotBackup(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
origStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) origStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, origStore) key, err := testAddKey(t, origStore)
require.NoError(t, err) require.NoError(t, err)
backup := trustmanager.NewKeyMemoryStore(ret) backup := trustmanager.NewKeyMemoryStore(ret)
cleanStore, err := NewYubiKeyStore(backup, ret) cleanStore, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
require.Len(t, cleanStore.ListKeys(), 1) require.Len(t, cleanStore.ListKeys(), 1)
@ -321,7 +321,7 @@ func TestYubiAddDuplicateKeySucceedsButDoesNotBackup(t *testing.T) {
// RemoveKey removes a key from the yubikey, but not from the backup store. // RemoveKey removes a key from the yubikey, but not from the backup store.
func TestYubiRemoveKey(t *testing.T) { func TestYubiRemoveKey(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -332,7 +332,7 @@ func TestYubiRemoveKey(t *testing.T) {
}() }()
backup := trustmanager.NewKeyMemoryStore(ret) backup := trustmanager.NewKeyMemoryStore(ret)
store, err := NewYubiKeyStore(backup, ret) store, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)
@ -348,11 +348,11 @@ func TestYubiRemoveKey(t *testing.T) {
// create a new store, since we want to be sure the original store's cache // create a new store, since we want to be sure the original store's cache
// is not masking any issues // is not masking any issues
cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) cleanStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
// key is not in either the original store or the clean store // key is not in either the original store or the clean store
for _, store := range []*YubiKeyStore{store, cleanStore} { for _, store := range []*YubiStore{store, cleanStore} {
_, _, err := store.GetKey(key.ID()) _, _, err := store.GetKey(key.ID())
require.Error(t, err) require.Error(t, err)
} }
@ -360,7 +360,7 @@ func TestYubiRemoveKey(t *testing.T) {
// One cannot export from hardware - it will not export from the backup // One cannot export from hardware - it will not export from the backup
func TestYubiExportKeyFails(t *testing.T) { func TestYubiExportKeyFails(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -370,7 +370,7 @@ func TestYubiExportKeyFails(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)
@ -384,7 +384,7 @@ func TestYubiExportKeyFails(t *testing.T) {
// If there are keys in the backup store but no keys in the Yubikey, // If there are keys in the backup store but no keys in the Yubikey,
// listing and getting cannot access the keys in the backup store // listing and getting cannot access the keys in the backup store
func TestYubiListAndGetKeysIgnoresBackup(t *testing.T) { func TestYubiListAndGetKeysIgnoresBackup(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -398,7 +398,7 @@ func TestYubiListAndGetKeysIgnoresBackup(t *testing.T) {
key, err := testAddKey(t, backup) key, err := testAddKey(t, backup)
require.NoError(t, err) require.NoError(t, err)
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.Len(t, store.ListKeys(), 0) require.Len(t, store.ListKeys(), 0)
_, _, err = store.GetKey(key.ID()) _, _, err = store.GetKey(key.ID())
require.Error(t, err) require.Error(t, err)
@ -408,7 +408,7 @@ func TestYubiListAndGetKeysIgnoresBackup(t *testing.T) {
// specifically that you cannot get the private bytes out. Assume we can // specifically that you cannot get the private bytes out. Assume we can
// sign something. // sign something.
func TestYubiKeyAndSign(t *testing.T) { func TestYubiKeyAndSign(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -418,7 +418,7 @@ func TestYubiKeyAndSign(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
ecdsaPrivateKey, err := testAddKey(t, store) ecdsaPrivateKey, err := testAddKey(t, store)
@ -449,7 +449,7 @@ var setupErrors = []string{"Initialize", "GetSlotList", "OpenSession"}
// Create a new store, so that we avoid any cache issues, and list keys // Create a new store, so that we avoid any cache issues, and list keys
func cleanListKeys(t *testing.T) map[string]trustmanager.KeyInfo { func cleanListKeys(t *testing.T) map[string]trustmanager.KeyInfo {
cleanStore, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) cleanStore, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
return cleanStore.ListKeys() return cleanStore.ListKeys()
} }
@ -507,7 +507,7 @@ func testYubiFunctionCleansUpOnSpecifiedErrors(t *testing.T,
} }
func TestYubiAddKeyCleansUpOnError(t *testing.T) { func TestYubiAddKeyCleansUpOnError(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -518,7 +518,7 @@ func TestYubiAddKeyCleansUpOnError(t *testing.T) {
}() }()
backup := trustmanager.NewKeyMemoryStore(ret) backup := trustmanager.NewKeyMemoryStore(ret)
store, err := NewYubiKeyStore(backup, ret) store, err := NewYubiStore(backup, ret)
require.NoError(t, err) require.NoError(t, err)
var _addkey = func() error { var _addkey = func() error {
@ -571,7 +571,7 @@ func TestYubiAddKeyCleansUpOnError(t *testing.T) {
} }
func TestYubiGetKeyCleansUpOnError(t *testing.T) { func TestYubiGetKeyCleansUpOnError(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -581,7 +581,7 @@ func TestYubiGetKeyCleansUpOnError(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)
require.NoError(t, err) require.NoError(t, err)
@ -603,7 +603,7 @@ func TestYubiGetKeyCleansUpOnError(t *testing.T) {
} }
func TestYubiRemoveKeyCleansUpOnError(t *testing.T) { func TestYubiRemoveKeyCleansUpOnError(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -613,7 +613,7 @@ func TestYubiRemoveKeyCleansUpOnError(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)
require.NoError(t, err) require.NoError(t, err)
@ -646,7 +646,7 @@ func TestYubiRemoveKeyCleansUpOnError(t *testing.T) {
} }
func TestYubiListKeyCleansUpOnError(t *testing.T) { func TestYubiListKeyCleansUpOnError(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -656,9 +656,9 @@ func TestYubiListKeyCleansUpOnError(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
// Do not call NewYubiKeyStore, because it list keys immediately to // Do not call NewYubiStore, because it list keys immediately to
// build the cache. // build the cache.
store := &YubiKeyStore{ store := &YubiStore{
passRetriever: ret, passRetriever: ret,
keys: make(map[string]yubiSlot), keys: make(map[string]yubiSlot),
backupStore: trustmanager.NewKeyMemoryStore(ret), backupStore: trustmanager.NewKeyMemoryStore(ret),
@ -685,7 +685,7 @@ func TestYubiListKeyCleansUpOnError(t *testing.T) {
// export key fails anyway, don't bother testing // export key fails anyway, don't bother testing
func TestYubiSignCleansUpOnError(t *testing.T) { func TestYubiSignCleansUpOnError(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -695,7 +695,7 @@ func TestYubiSignCleansUpOnError(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)
@ -732,7 +732,7 @@ func TestYubiSignCleansUpOnError(t *testing.T) {
// If Sign gives us an invalid signature, we retry until successful up to // If Sign gives us an invalid signature, we retry until successful up to
// a maximum of 5 times. // a maximum of 5 times.
func TestYubiRetrySignUntilSuccess(t *testing.T) { func TestYubiRetrySignUntilSuccess(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -742,7 +742,7 @@ func TestYubiRetrySignUntilSuccess(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)
@ -777,7 +777,7 @@ func TestYubiRetrySignUntilSuccess(t *testing.T) {
// If Sign gives us an invalid signature, we retry until up to a maximum of 5 // If Sign gives us an invalid signature, we retry until up to a maximum of 5
// times, and if it's still invalid, fail. // times, and if it's still invalid, fail.
func TestYubiRetrySignUntilFail(t *testing.T) { func TestYubiRetrySignUntilFail(t *testing.T) {
if !YubikeyAccessible() { if !IsAccessible() {
t.Skip("Must have Yubikey access.") t.Skip("Must have Yubikey access.")
} }
clearAllKeys(t) clearAllKeys(t)
@ -787,7 +787,7 @@ func TestYubiRetrySignUntilFail(t *testing.T) {
SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce) SetYubikeyKeyMode(KeymodeTouch | KeymodePinOnce)
}() }()
store, err := NewYubiKeyStore(trustmanager.NewKeyMemoryStore(ret), ret) store, err := NewYubiStore(trustmanager.NewKeyMemoryStore(ret), ret)
require.NoError(t, err) require.NoError(t, err)
key, err := testAddKey(t, store) key, err := testAddKey(t, store)