tree a16d9b5d0d5d9d1a99c7a2f16faf6d749947f0b9
parent fa358253c57503f1b72e6d48f93e74df3e0c076c
author David Zeuthen <zeuthen@chromium.org> 1383249506 -0700
committer chrome-internal-fetch <chrome-internal-fetch@google.com> 1383946941 +0000

Add a way for devserver to transmit public key and signed metadata hash.

The option --public-key which can be used with a public RSA key (in
PEM format) to have it be included as the value (base64 encoded) of
the PublicKeyRsa value in the XML response.

The option --private_key_for_metadata_hash_signature can be used with
a private RSA key to have devserver sign the metadata hash and include
it as the value of the MetadataSignatureRsa in the XML response, just
like the Omaha server.

Combined with CL:175285 for update_engine, this can be used to write
tests to assure that update_engine works correctly, e.g. that it

 - Accepts payloads where both the metadata hash and the payload is
   signed by a trusted key:

   $ ./devserver.py --test_image                                     \
         --private_key unittest_key.pem                              \
         --private_key_for_metadata_hash_signature unittest_key.pem  \
         --public_key unittest_key.pub.pem

 - Rejects payloads where the metadata hash is signed by an untrusted
   key and the payload is signed by a trusted key:

   $ ./devserver.py --test_image                                     \
         --private_key unittest_key.pem                              \
         --private_key_for_metadata_hash_signature unittest_key2.pem \
         --public_key unittest_key.pub.pem

 - Rejects payloads where the metadata hash is signed by a trusted key,
   but the payload is signed by an untrusted key:

   $ ./devserver.py --test_image                                     \
         --private_key unittest_key.pem                              \
         --private_key_for_metadata_hash_signature unittest_key2.pem \
         --public_key unittest_key2.pub.pem

BUG=chromium:264352
TEST=Unit tests pass + manual testing (see above.)

Change-Id: I4a0297549a61a559d074de4f2bf45b3c4012f58d
Reviewed-on: https://chromium-review.googlesource.com/175283
Commit-Queue: David Zeuthen <zeuthen@chromium.org>
Tested-by: David Zeuthen <zeuthen@chromium.org>
Reviewed-by: David Zeuthen <zeuthen@chromium.org>