tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_sign_verify.js (23225B)


      1 /* Any copyright is dedicated to the Public Domain.
      2   http://creativecommons.org/publicdomain/zero/1.0/ */
      3 
      4 function run_test() {
      5  /**
      6   * Signs a MAR file.
      7   *
      8   * @param inMAR The MAR file that should be signed
      9   * @param outMAR The MAR file to create
     10   */
     11  function signMAR(inMAR, outMAR, certs, wantSuccess, useShortHandCmdLine) {
     12    // Get a process to the signmar binary from the dist/bin directory.
     13    let process = Cc["@mozilla.org/process/util;1"].createInstance(
     14      Ci.nsIProcess
     15    );
     16    let signmarBin = do_get_file("signmar" + BIN_SUFFIX);
     17 
     18    // Make sure the signmar binary exists and is an executable.
     19    Assert.ok(signmarBin.exists());
     20    Assert.ok(signmarBin.isExecutable());
     21 
     22    // Setup the command line arguments to sign the MAR.
     23    let NSSConfigDir = do_get_file("data");
     24    let args = ["-d", NSSConfigDir.path];
     25    if (certs.length == 1 && useShortHandCmdLine) {
     26      args.push("-n", certs[0]);
     27    } else {
     28      for (let i = 0; i < certs.length; i++) {
     29        args.push("-n" + i, certs[i]);
     30      }
     31    }
     32    args.push("-s", inMAR.path, outMAR.path);
     33 
     34    let exitValue;
     35    process.init(signmarBin);
     36    try {
     37      process.run(true, args, args.length);
     38      exitValue = process.exitValue;
     39    } catch (e) {
     40      // On Windows negative return value throws an exception
     41      exitValue = -1;
     42    }
     43 
     44    // Verify signmar returned 0 for success.
     45    if (wantSuccess) {
     46      Assert.equal(exitValue, 0);
     47    } else {
     48      Assert.notEqual(exitValue, 0);
     49    }
     50  }
     51 
     52  /**
     53   * Extract a MAR signature.
     54   *
     55   * @param inMAR        The MAR file who's signature should be extracted
     56   * @param sigIndex     The index of the signature to extract
     57   * @param extractedSig The file where the extracted signature will be stored
     58   * @param wantSuccess  True if a successful signmar return code is desired
     59   */
     60  function extractMARSignature(inMAR, sigIndex, extractedSig, wantSuccess) {
     61    // Get a process to the signmar binary from the dist/bin directory.
     62    let process = Cc["@mozilla.org/process/util;1"].createInstance(
     63      Ci.nsIProcess
     64    );
     65    let signmarBin = do_get_file("signmar" + BIN_SUFFIX);
     66 
     67    // Make sure the signmar binary exists and is an executable.
     68    Assert.ok(signmarBin.exists());
     69    Assert.ok(signmarBin.isExecutable());
     70 
     71    // Setup the command line arguments to extract the signature in the MAR.
     72    let args = ["-n" + sigIndex, "-X", inMAR.path, extractedSig.path];
     73 
     74    let exitValue;
     75    process.init(signmarBin);
     76    try {
     77      process.run(true, args, args.length);
     78      exitValue = process.exitValue;
     79    } catch (e) {
     80      // On Windows negative return value throws an exception
     81      exitValue = -1;
     82    }
     83 
     84    // Verify signmar returned 0 for success.
     85    if (wantSuccess) {
     86      Assert.equal(exitValue, 0);
     87    } else {
     88      Assert.notEqual(exitValue, 0);
     89    }
     90  }
     91 
     92  /**
     93   * Import a MAR signature.
     94   *
     95   * @param inMAR        The MAR file who's signature should be imported to
     96   * @param sigIndex     The index of the signature to import to
     97   * @param sigFile      The file where the base64 signature exists
     98   * @param outMAR       The same as inMAR but with the specified signature
     99   *                     swapped at the specified index.
    100   * @param wantSuccess  True if a successful signmar return code is desired
    101   */
    102  function importMARSignature(inMAR, sigIndex, sigFile, outMAR, wantSuccess) {
    103    // Get a process to the signmar binary from the dist/bin directory.
    104    let process = Cc["@mozilla.org/process/util;1"].createInstance(
    105      Ci.nsIProcess
    106    );
    107    let signmarBin = do_get_file("signmar" + BIN_SUFFIX);
    108 
    109    // Make sure the signmar binary exists and is an executable.
    110    Assert.ok(signmarBin.exists());
    111    Assert.ok(signmarBin.isExecutable());
    112 
    113    // Setup the command line arguments to import the signature in the MAR.
    114    let args = ["-n" + sigIndex, "-I", inMAR.path, sigFile.path, outMAR.path];
    115 
    116    let exitValue;
    117    process.init(signmarBin);
    118    try {
    119      process.run(true, args, args.length);
    120      exitValue = process.exitValue;
    121    } catch (e) {
    122      // On Windows negative return value throws an exception
    123      exitValue = -1;
    124    }
    125 
    126    // Verify signmar returned 0 for success.
    127    if (wantSuccess) {
    128      Assert.equal(exitValue, 0);
    129    } else {
    130      Assert.notEqual(exitValue, 0);
    131    }
    132  }
    133 
    134  /**
    135   * Verifies a MAR file.
    136   *
    137   * @param signedMAR Verifies a MAR file
    138   */
    139  function verifyMAR(signedMAR, wantSuccess, certs, useShortHandCmdLine) {
    140    // Get a process to the signmar binary from the dist/bin directory.
    141    let process = Cc["@mozilla.org/process/util;1"].createInstance(
    142      Ci.nsIProcess
    143    );
    144    let signmarBin = do_get_file("signmar" + BIN_SUFFIX);
    145 
    146    // Make sure the signmar binary exists and is an executable.
    147    Assert.ok(signmarBin.exists());
    148    Assert.ok(signmarBin.isExecutable());
    149 
    150    // Will reference the arguments to use for verification in signmar
    151    let args = [];
    152 
    153    // Setup the command line arguments to create the MAR.
    154    // Windows & Mac vs. Linux/... have different command line for verification
    155    // since on Windows we verify with CryptoAPI, on Mac with Security
    156    // Transforms or CDSA/CSSM and on all other platforms we verify with NSS. So
    157    // on Windows and Mac we use an exported DER file and on other platforms we
    158    // use the NSS config db.
    159    if (mozinfo.os == "win" || mozinfo.os == "mac") {
    160      if (certs.length == 1 && useShortHandCmdLine) {
    161        args.push("-D", "data/" + certs[0] + ".der");
    162      } else {
    163        for (let i = 0; i < certs.length; i++) {
    164          args.push("-D" + i, "data/" + certs[i] + ".der");
    165        }
    166      }
    167    } else {
    168      let NSSConfigDir = do_get_file("data");
    169      args = ["-d", NSSConfigDir.path];
    170      if (certs.length == 1 && useShortHandCmdLine) {
    171        args.push("-n", certs[0]);
    172      } else {
    173        for (let i = 0; i < certs.length; i++) {
    174          args.push("-n" + i, certs[i]);
    175        }
    176      }
    177    }
    178    args.push("-v", signedMAR.path);
    179 
    180    let exitValue;
    181    process.init(signmarBin);
    182    try {
    183      // We put this in a try block because nsIProcess doesn't like -1 returns
    184      process.run(true, args, args.length);
    185      exitValue = process.exitValue;
    186    } catch (e) {
    187      // On Windows negative return value throws an exception
    188      exitValue = -1;
    189    }
    190 
    191    // Verify signmar returned 0 for success.
    192    if (wantSuccess) {
    193      Assert.equal(exitValue, 0);
    194    } else {
    195      Assert.notEqual(exitValue, 0);
    196    }
    197  }
    198 
    199  /**
    200   * Strips a MAR signature.
    201   *
    202   * @param signedMAR The MAR file that should be signed
    203   * @param outMAR The MAR file to write to with signature stripped
    204   */
    205  function stripMARSignature(signedMAR, outMAR, wantSuccess) {
    206    // Get a process to the signmar binary from the dist/bin directory.
    207    let process = Cc["@mozilla.org/process/util;1"].createInstance(
    208      Ci.nsIProcess
    209    );
    210    let signmarBin = do_get_file("signmar" + BIN_SUFFIX);
    211 
    212    // Make sure the signmar binary exists and is an executable.
    213    Assert.ok(signmarBin.exists());
    214    Assert.ok(signmarBin.isExecutable());
    215 
    216    // Setup the command line arguments to create the MAR.
    217    let args = ["-r", signedMAR.path, outMAR.path];
    218 
    219    let exitValue;
    220    process.init(signmarBin);
    221    try {
    222      process.run(true, args, args.length);
    223      exitValue = process.exitValue;
    224    } catch (e) {
    225      // On Windows negative return value throws an exception
    226      exitValue = -1;
    227    }
    228 
    229    // Verify signmar returned 0 for success.
    230    if (wantSuccess) {
    231      Assert.equal(exitValue, 0);
    232    } else {
    233      Assert.notEqual(exitValue, 0);
    234    }
    235  }
    236 
    237  function cleanup() {
    238    let outMAR = tempDir.clone();
    239    outMAR.append("signed_out.mar");
    240    if (outMAR.exists()) {
    241      outMAR.remove(false);
    242    }
    243    outMAR = tempDir.clone();
    244    outMAR.append("multiple_signed_out.mar");
    245    if (outMAR.exists()) {
    246      outMAR.remove(false);
    247    }
    248    outMAR = tempDir.clone();
    249    outMAR.append("out.mar");
    250    if (outMAR.exists()) {
    251      outMAR.remove(false);
    252    }
    253 
    254    let outDir = tempDir.clone();
    255    outDir.append("out");
    256    if (outDir.exists()) {
    257      outDir.remove(true);
    258    }
    259  }
    260 
    261  const wantFailure = false;
    262  const wantSuccess = true;
    263  // Define the unit tests to run.
    264  let tests = {
    265    // Test signing a MAR file with a single signature
    266    test_sign_single: function _test_sign_single() {
    267      let inMAR = do_get_file("data/binary_data.mar");
    268      let outMAR = tempDir.clone();
    269      outMAR.append("signed_out.mar");
    270      if (outMAR.exists()) {
    271        outMAR.remove(false);
    272      }
    273      signMAR(inMAR, outMAR, ["mycert"], wantSuccess, true);
    274      Assert.ok(outMAR.exists());
    275      let outMARData = getBinaryFileData(outMAR);
    276      let refMAR = do_get_file("data/signed_pib.mar");
    277      let refMARData = getBinaryFileData(refMAR);
    278      compareBinaryData(outMARData, refMARData);
    279    },
    280    // Test signing a MAR file with multiple signatures
    281    test_sign_multiple: function _test_sign_multiple() {
    282      let inMAR = do_get_file("data/binary_data.mar");
    283      let outMAR = tempDir.clone();
    284      outMAR.append("multiple_signed_out.mar");
    285      if (outMAR.exists()) {
    286        outMAR.remove(false);
    287      }
    288      Assert.ok(!outMAR.exists());
    289      signMAR(
    290        inMAR,
    291        outMAR,
    292        ["mycert", "mycert2", "mycert3"],
    293        wantSuccess,
    294        true
    295      );
    296      Assert.ok(outMAR.exists());
    297      let outMARData = getBinaryFileData(outMAR);
    298      let refMAR = do_get_file("data/multiple_signed_pib.mar");
    299      let refMARData = getBinaryFileData(refMAR);
    300      compareBinaryData(outMARData, refMARData);
    301    },
    302    // Test verifying a signed MAR file
    303    test_verify_single: function _test_verify_single() {
    304      let signedMAR = do_get_file("data/signed_pib.mar");
    305      verifyMAR(signedMAR, wantSuccess, ["mycert"], true);
    306      verifyMAR(signedMAR, wantSuccess, ["mycert"], false);
    307    },
    308    // Test verifying a signed MAR file with too many certs fails.
    309    // Or if you want to look at it another way, One mycert signature
    310    // is missing.
    311    test_verify_single_too_many_certs:
    312      function _test_verify_single_too_many_certs() {
    313        let signedMAR = do_get_file("data/signed_pib.mar");
    314        verifyMAR(signedMAR, wantFailure, ["mycert", "mycert"], true);
    315        verifyMAR(signedMAR, wantFailure, ["mycert", "mycert"], false);
    316      },
    317    // Test verifying a signed MAR file fails when using a wrong cert
    318    test_verify_single_wrong_cert: function _test_verify_single_wrong_cert() {
    319      let signedMAR = do_get_file("data/signed_pib.mar");
    320      verifyMAR(signedMAR, wantFailure, ["mycert2"], true);
    321      verifyMAR(signedMAR, wantFailure, ["mycert2"], false);
    322    },
    323    // Test verifying a signed MAR file with multiple signatures
    324    test_verify_multiple: function _test_verify_multiple() {
    325      let signedMAR = do_get_file("data/multiple_signed_pib.mar");
    326      verifyMAR(signedMAR, wantSuccess, ["mycert", "mycert2", "mycert3"]);
    327    },
    328    // Test verifying an unsigned MAR file fails
    329    test_verify_unsigned_mar_file_fails:
    330      function _test_verify_unsigned_mar_file_fails() {
    331        let unsignedMAR = do_get_file("data/binary_data.mar");
    332        verifyMAR(unsignedMAR, wantFailure, ["mycert", "mycert2", "mycert3"]);
    333      },
    334    // Test verifying a signed MAR file with the same signature multiple
    335    // times fails.  The input MAR has: mycert, mycert2, mycert3.
    336    // we're checking to make sure the number of verified signatures
    337    // is only 1 and not 3.  Each signature should be verified once.
    338    test_verify_multiple_same_cert: function _test_verify_multiple_same_cert() {
    339      let signedMAR = do_get_file("data/multiple_signed_pib.mar");
    340      verifyMAR(signedMAR, wantFailure, ["mycert", "mycert", "mycert"]);
    341    },
    342    // Test verifying a signed MAR file with the correct signatures but in
    343    // a different order fails
    344    test_verify_multiple_wrong_order:
    345      function _test_verify_multiple_wrong_order() {
    346        let signedMAR = do_get_file("data/multiple_signed_pib.mar");
    347        verifyMAR(signedMAR, wantSuccess, ["mycert", "mycert2", "mycert3"]);
    348        verifyMAR(signedMAR, wantFailure, ["mycert", "mycert3", "mycert2"]);
    349        verifyMAR(signedMAR, wantFailure, ["mycert2", "mycert", "mycert3"]);
    350        verifyMAR(signedMAR, wantFailure, ["mycert2", "mycert3", "mycert"]);
    351        verifyMAR(signedMAR, wantFailure, ["mycert3", "mycert", "mycert2"]);
    352        verifyMAR(signedMAR, wantFailure, ["mycert3", "mycert2", "mycert"]);
    353      },
    354    // Test verifying a signed MAR file without a PIB
    355    test_verify_no_pib: function _test_verify_no_pib() {
    356      let signedMAR = do_get_file("data/signed_no_pib.mar");
    357      verifyMAR(signedMAR, wantSuccess, ["mycert"], true);
    358      verifyMAR(signedMAR, wantSuccess, ["mycert"], false);
    359    },
    360    // Test verifying a signed MAR file with multiple signatures without a PIB
    361    test_verify_no_pib_multiple: function _test_verify_no_pib_multiple() {
    362      let signedMAR = do_get_file("data/multiple_signed_no_pib.mar");
    363      verifyMAR(signedMAR, wantSuccess, ["mycert", "mycert2", "mycert3"]);
    364    },
    365    // Test verifying a crafted MAR file where the attacker tried to adjust
    366    // the version number manually.
    367    test_crafted_mar: function _test_crafted_mar() {
    368      let signedBadMAR = do_get_file("data/manipulated_signed.mar");
    369      verifyMAR(signedBadMAR, wantFailure, ["mycert"], true);
    370      verifyMAR(signedBadMAR, wantFailure, ["mycert"], false);
    371    },
    372    // Test verifying a file that doesn't exist fails
    373    test_bad_path_verify_fails: function _test_bad_path_verify_fails() {
    374      let noMAR = do_get_file("data/does_not_exist.mar", true);
    375      Assert.ok(!noMAR.exists());
    376      verifyMAR(noMAR, wantFailure, ["mycert"], true);
    377    },
    378    // Test to make sure a stripped MAR is the same as the original MAR
    379    test_strip_signature: function _test_strip_signature() {
    380      let originalMAR = do_get_file("data/binary_data.mar");
    381      let signedMAR = tempDir.clone();
    382      signedMAR.append("signed_out.mar");
    383      let outMAR = tempDir.clone();
    384      outMAR.append("out.mar", true);
    385      stripMARSignature(signedMAR, outMAR, wantSuccess);
    386 
    387      // Verify that the stripped MAR matches the original data MAR exactly
    388      let outMARData = getBinaryFileData(outMAR);
    389      let originalMARData = getBinaryFileData(originalMAR);
    390      compareBinaryData(outMARData, originalMARData);
    391    },
    392    // Test to make sure a stripped multi-signature-MAR is the same as the original MAR
    393    test_strip_multiple_signatures: function _test_strip_multiple_signatures() {
    394      let originalMAR = do_get_file("data/binary_data.mar");
    395      let signedMAR = tempDir.clone();
    396      signedMAR.append("multiple_signed_out.mar");
    397      let outMAR = tempDir.clone();
    398      outMAR.append("out.mar");
    399      stripMARSignature(signedMAR, outMAR, wantSuccess);
    400 
    401      // Verify that the stripped MAR matches the original data MAR exactly
    402      let outMARData = getBinaryFileData(outMAR);
    403      let originalMARData = getBinaryFileData(originalMAR);
    404      compareBinaryData(outMARData, originalMARData);
    405    },
    406    // Test extracting the first signature in a MAR that has only a single signature
    407    test_extract_sig_single: function _test_extract_sig_single() {
    408      let inMAR = do_get_file("data/signed_pib.mar");
    409      let extractedSig = do_get_file("extracted_signature", true);
    410      if (extractedSig.exists()) {
    411        extractedSig.remove(false);
    412      }
    413      extractMARSignature(inMAR, 0, extractedSig, wantSuccess);
    414      Assert.ok(extractedSig.exists());
    415 
    416      let referenceSig = do_get_file("data/signed_pib_mar.signature.0");
    417      compareBinaryData(extractedSig, referenceSig);
    418    },
    419    // Test extracting the all signatures in a multi signature MAR
    420    // The input MAR has 3 signatures.
    421    test_extract_sig_multi: function _test_extract_sig_multi() {
    422      for (let i = 0; i < 3; i++) {
    423        let inMAR = do_get_file("data/multiple_signed_pib.mar");
    424        let extractedSig = do_get_file("extracted_signature", true);
    425        if (extractedSig.exists()) {
    426          extractedSig.remove(false);
    427        }
    428        extractMARSignature(inMAR, i, extractedSig, wantSuccess);
    429        Assert.ok(extractedSig.exists());
    430 
    431        let referenceSig = do_get_file("data/multiple_signed_pib_mar.sig." + i);
    432        compareBinaryData(extractedSig, referenceSig);
    433      }
    434    },
    435    // Test extracting a signature that is out of range fails
    436    test_extract_sig_out_of_range: function _test_extract_sig_out_of_range() {
    437      let inMAR = do_get_file("data/signed_pib.mar");
    438      let extractedSig = do_get_file("extracted_signature", true);
    439      if (extractedSig.exists()) {
    440        extractedSig.remove(false);
    441      }
    442      const outOfBoundsIndex = 5;
    443      extractMARSignature(inMAR, outOfBoundsIndex, extractedSig, wantFailure);
    444      Assert.ok(!extractedSig.exists());
    445    },
    446    // Test signing a file that doesn't exist fails
    447    test_bad_path_sign_fails: function _test_bad_path_sign_fails() {
    448      let inMAR = do_get_file("data/does_not_exist.mar", true);
    449      let outMAR = tempDir.clone();
    450      outMAR.append("signed_out.mar");
    451      Assert.ok(!inMAR.exists());
    452      signMAR(inMAR, outMAR, ["mycert"], wantFailure, true);
    453      Assert.ok(!outMAR.exists());
    454    },
    455    // Test verifying only a subset of the signatures fails.
    456    // The input MAR has: mycert, mycert2, mycert3.
    457    // We're only verifying 2 of the 3 signatures and that should fail.
    458    test_verify_multiple_subset: function _test_verify_multiple_subset() {
    459      let signedMAR = do_get_file("data/multiple_signed_pib.mar");
    460      verifyMAR(signedMAR, wantFailure, ["mycert", "mycert2"]);
    461    },
    462    // Test importing the first signature in a MAR that has only
    463    // a single signature
    464    test_import_sig_single: function _test_import_sig_single() {
    465      // Make sure the input MAR was signed with mycert only
    466      let inMAR = do_get_file("data/signed_pib.mar");
    467      verifyMAR(inMAR, wantSuccess, ["mycert"], false);
    468      verifyMAR(inMAR, wantFailure, ["mycert2"], false);
    469      verifyMAR(inMAR, wantFailure, ["mycert3"], false);
    470 
    471      // Get the signature file for this MAR signed with the key from mycert2
    472      let sigFile = do_get_file("data/signed_pib_mar.signature.mycert2");
    473      Assert.ok(sigFile.exists());
    474      let outMAR = tempDir.clone();
    475      outMAR.append("sigchanged_signed_pib.mar");
    476      if (outMAR.exists()) {
    477        outMAR.remove(false);
    478      }
    479 
    480      // Run the import operation
    481      importMARSignature(inMAR, 0, sigFile, outMAR, wantSuccess);
    482 
    483      // Verify we have a new MAR file, that mycert no longer verifies and that,
    484      // mycert2 does verify
    485      Assert.ok(outMAR.exists());
    486      verifyMAR(outMAR, wantFailure, ["mycert"], false);
    487      verifyMAR(outMAR, wantSuccess, ["mycert2"], false);
    488      verifyMAR(outMAR, wantFailure, ["mycert3"], false);
    489 
    490      // Compare the binary data to something that was signed originally
    491      // with the private key from mycert2
    492      let refMAR = do_get_file("data/signed_pib_with_mycert2.mar");
    493      Assert.ok(refMAR.exists());
    494      let refMARData = getBinaryFileData(refMAR);
    495      let outMARData = getBinaryFileData(outMAR);
    496      compareBinaryData(outMARData, refMARData);
    497    },
    498    // Test importing a signature that doesn't belong to the file
    499    // fails to verify.
    500    test_import_wrong_sig: function _test_import_wrong_sig() {
    501      // Make sure the input MAR was signed with mycert only
    502      let inMAR = do_get_file("data/signed_pib.mar");
    503      verifyMAR(inMAR, wantSuccess, ["mycert"], false);
    504      verifyMAR(inMAR, wantFailure, ["mycert2"], false);
    505      verifyMAR(inMAR, wantFailure, ["mycert3"], false);
    506 
    507      // Get the signature file for multiple_signed_pib.mar signed with the
    508      // key from mycert
    509      let sigFile = do_get_file("data/multiple_signed_pib_mar.sig.0");
    510      Assert.ok(sigFile.exists());
    511      let outMAR = tempDir.clone();
    512      outMAR.append("sigchanged_signed_pib.mar");
    513      if (outMAR.exists()) {
    514        outMAR.remove(false);
    515      }
    516 
    517      // Run the import operation
    518      importMARSignature(inMAR, 0, sigFile, outMAR, wantSuccess);
    519 
    520      // Verify we have a new MAR file and that the mar file fails to verify
    521      // when using a signature for another mar file.
    522      Assert.ok(outMAR.exists());
    523      verifyMAR(outMAR, wantFailure, ["mycert"], false);
    524      verifyMAR(outMAR, wantFailure, ["mycert2"], false);
    525      verifyMAR(outMAR, wantFailure, ["mycert3"], false);
    526    },
    527    // Test importing to the second signature in a MAR that has multiple
    528    // signature
    529    test_import_sig_multiple: function _test_import_sig_multiple() {
    530      // Make sure the input MAR was signed with mycert only
    531      let inMAR = do_get_file("data/multiple_signed_pib.mar");
    532      verifyMAR(inMAR, wantSuccess, ["mycert", "mycert2", "mycert3"], false);
    533      verifyMAR(inMAR, wantFailure, ["mycert", "mycert", "mycert3"], false);
    534 
    535      // Get the signature file for this MAR signed with the key from mycert
    536      let sigFile = do_get_file("data/multiple_signed_pib_mar.sig.0");
    537      Assert.ok(sigFile.exists());
    538      let outMAR = tempDir.clone();
    539      outMAR.append("sigchanged_signed_pib.mar");
    540      if (outMAR.exists()) {
    541        outMAR.remove(false);
    542      }
    543 
    544      // Run the import operation
    545      const secondSigPos = 1;
    546      importMARSignature(inMAR, secondSigPos, sigFile, outMAR, wantSuccess);
    547 
    548      // Verify we have a new MAR file and that mycert no longer verifies
    549      // and that mycert2 does verify
    550      Assert.ok(outMAR.exists());
    551      verifyMAR(outMAR, wantSuccess, ["mycert", "mycert", "mycert3"], false);
    552      verifyMAR(outMAR, wantFailure, ["mycert", "mycert2", "mycert3"], false);
    553 
    554      // Compare the binary data to something that was signed originally
    555      // with the private keys from mycert, mycert, mycert3
    556      let refMAR = do_get_file("data/multiple_signed_pib_2.mar");
    557      Assert.ok(refMAR.exists());
    558      let refMARData = getBinaryFileData(refMAR);
    559      let outMARData = getBinaryFileData(outMAR);
    560      compareBinaryData(outMARData, refMARData);
    561    },
    562    // Test stripping a MAR that doesn't exist fails
    563    test_bad_path_strip_fails: function _test_bad_path_strip_fails() {
    564      let noMAR = do_get_file("data/does_not_exist.mar", true);
    565      Assert.ok(!noMAR.exists());
    566      let outMAR = tempDir.clone();
    567      outMAR.append("out.mar");
    568      stripMARSignature(noMAR, outMAR, wantFailure);
    569    },
    570    // Test extracting from a bad path fails
    571    test_extract_bad_path: function _test_extract_bad_path() {
    572      let noMAR = do_get_file("data/does_not_exist.mar", true);
    573      let extractedSig = do_get_file("extracted_signature", true);
    574      Assert.ok(!noMAR.exists());
    575      if (extractedSig.exists()) {
    576        extractedSig.remove(false);
    577      }
    578      extractMARSignature(noMAR, 0, extractedSig, wantFailure);
    579      Assert.ok(!extractedSig.exists());
    580    },
    581    // Between each test make sure the out MAR does not exist.
    582    cleanup_per_test: function _cleanup_per_test() {},
    583  };
    584 
    585  cleanup();
    586 
    587  // Run all the tests
    588  Assert.equal(run_tests(tests), Object.keys(tests).length - 1);
    589 
    590  registerCleanupFunction(cleanup);
    591 }