Source

`tests/purrc/ed25519_sys_test.cpp`

2// Original work; see ACKNOWLEDGMENTS.md for the open-source ideas we build upon.

3// System-level (whole-program) test for the `ed25519` stdlib module, written as a

4// worked EXAMPLE of the signature workflow that backs cheatah's binary-integrity

5// feature: a publisher signs a payload with a secret key, anyone holding only the

6// PUBLIC key can verify it, and ANY tampering — to the payload, the signature, or the

7// key — is rejected. This is the same Ed25519 the runtime uses to refuse a tampered

8// `.so` (see integrity_e2e_test.cpp).

9//

10// Coverage — every function in stdlib/ed25519/ed25519.hpp:

11// generate, public_key, sign, verify.

12//

13// Deterministic: signing is deterministic (RFC 8032), and the generate() result is

14// only exercised by property (a fresh key round-trips), so stdout is fixed.

15#include "e2e_harness.hpp"

17TEST(StdlibE2E, Ed25519) {

18 e2e::expect_e2e("ed25519_sys", R"PURR(import io

19import ed25519

21# A publisher's keypair. In real use the secret stays offline (purrc --keygen); only

22# the public key is shipped to verifiers. Here we use a fixed RFC 8032 seed so the

23# signature is reproducible.

24let secret = "c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7"

25let pub = ed25519.public_key(secret)

26io.print("public:", pub)

28# Sign a payload (think: the bytes of a compiled module).

29let payload = "the trusted payload"

30let sig = ed25519.sign(secret, payload)

32# A verifier with ONLY the public key accepts the genuine payload+signature.

33io.print("genuine accepted:", ed25519.verify(pub, payload, sig))

35# An attacker who injects different bytes but keeps the old signature is rejected:

36# the signature no longer matches the payload.

37io.print("tampered payload rejected:", ed25519.verify(pub, "the INJECTED payload", sig) == false)

39# Tampering with the signature itself is rejected.

40let forged = "00" + sig[2:]

41io.print("forged signature rejected:", ed25519.verify(pub, payload, forged) == false)

43# A signature from a DIFFERENT key does not verify under this public key — a verifier

44# only trusts payloads signed by the key it pins.

45let other_secret = ed25519.generate()

46let other_sig = ed25519.sign(other_secret, payload)

47io.print("untrusted signer rejected:", ed25519.verify(pub, payload, other_sig) == false)

49# A freshly generated key still produces a working, verifiable signature.

50let fresh = ed25519.generate()

51let fresh_pub = ed25519.public_key(fresh)

52io.print("fresh keypair verifies:", ed25519.verify(fresh_pub, payload, ed25519.sign(fresh, payload)))

53)PURR",

54 "public: fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025\n"

55 "genuine accepted: True\n"

56 "tampered payload rejected: True\n"

57 "forged signature rejected: True\n"

58 "untrusted signer rejected: True\n"

59 "fresh keypair verifies: True\n");

60}