Uploaded image for project: 'Insights Experiences'
  1. Insights Experiences
  2. HMS-3759

Test an invalid conversion script signature handling

      Goal: 

      The goal is to test the scenario where the rhc-worker-script receives the conversion script yaml file with an invalid signature. Part of that goal is to know how does the Insights UI handle the error message reported back by rhc-worker-script. It currently sends a plain-text error string with no JSON formatting. The expectation is that the Task job result UI will show the message in the Message column. If not, we'll either need to update rhc-worker-script to send the error message wrapped in JSON or discuss with the Task team how to display the unwrapped message in the UI.

      The invalid signature can occur when an attacker performs an man-in-the-middle attack and replaces the original conversion script with a malicous script. Without having access to the signing key though the script will have an invalid signature.

      Acceptance Criteria:

      • We test the corner case that mocks the script yaml delivered to the rhc-worker-script for execution. The mocked yaml has an invalid signature.
        • The test can be one-time manual or automated.
      • The result of the test is that we know how Tasks respond to the error message returned by the rhc-worker-script when it detects an invalid script signature.

              rh-ee-ssantama Sergio Santamaria Riocerezo
              mbocek@redhat.com Michal Bocek
              Andrea Waltlova, Rodolfo Olivieri
              Sergio Santamaria Riocerezo Sergio Santamaria Riocerezo
              None
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: