# pylint: disable=cyclic-import  # Intentional for test imports
import codecs
import copy
import hashlib
import os
import unittest
from typing import List, cast

from keylime import json
from keylime.agentstates import AgentAttestState
from keylime.ima import file_signatures, ima
from keylime.ima.types import RuntimePolicyType

# BEGIN TEST DATA

RUNTIME_POLICY_TEST: RuntimePolicyType = {
    "meta": {
        "version": 1,
    },
    "digests": {
        "boot_aggregate": ["e4cb9f5709c88376b5fc3743cd88e76b9aae8f3d992d845678de5215edb31216"],
        "/lib/modules/5.4.48-openpower1/kernel/drivers/usb/common/usb-common.ko": [
            "f1125b940480d20ad841d26d5ea253edc0704b5ec1548c891edf212cb1a9365e"
        ],
        "/lib/modules/5.4.48-openpower1/kernel/drivers/gpu/drm/drm_panel_orientation_quirks.ko": [
            "cd026b58efdf66658685430ff526490d54a430a3f0066a35ac26a8acab66c55d"
        ],
        "/usr/bin/dd": ["d33d5d13792292e202dbf69a6f1b07bc8a02f01424db8489ba7bb7d43c0290ef"],
        "/usr/bin/zmore": ["b8ae0b8dd04a5935cd8165aa2260cd11b658bd71629bdb52256a675a1f73907b"],
        "/usr/bin/zless": ["233ad3a8e77c63a7d9a56063ec2cad1eafa58850"],
    },
    "excludes": [],
    "keyrings": {
        ".ima": ["a7d52aaa18c23d2d9bb2abb4308c0eeee67387a42259f4a6b1a42257065f3d5a"],
    },
    "ima": {"ignored_keyrings": [], "log_hash_alg": "sha1", "dm_policy": None},
    "ima-buf": {},
    "verification-keys": "",
}

# Allowlist with different hashes
RUNTIME_POLICY_WRONG: RuntimePolicyType = {
    "meta": {
        "version": 1,
    },
    "digests": {
        "/usr/bin/dd": ["bad05d13792292e202dbf69a6f1b07bc8a02f01424db8489ba7bb7d43c0290ef"],
        "/usr/bin/zmore": ["bad00b8dd04a5935cd8165aa2260cd11b658bd71629bdb52256a675a1f73907b"],
    },
    "excludes": [],
    "keyrings": {},
    "ima": {"ignored_keyrings": [], "log_hash_alg": "sha1", "dm_policy": None},
    "ima-buf": {},
    "verification-keys": "",
}

EXCLUDES = [
    "boot_aggregate",
    "/lib/modules/5.4.48-openpower1/kernel/drivers/usb/common/usb-common.ko",
    "/lib/modules/5.4.48-openpower1/kernel/drivers/gpu/drm/drm_panel_orientation_quirks.ko",
    "/usr/bin/dd",
    "/usr/bin/zmore",
    "/usr/bin/zless",
]

RUNTIME_POLICY_WITH_EXCLUDES = copy.deepcopy(RUNTIME_POLICY_TEST)
RUNTIME_POLICY_WITH_EXCLUDES["excludes"] = EXCLUDES

RUNTIME_POLICY_WRONG_WITH_EXCLUDES = copy.deepcopy(RUNTIME_POLICY_WRONG)
RUNTIME_POLICY_WRONG_WITH_EXCLUDES["excludes"] = EXCLUDES

MEASUREMENTS: str = (
    "10 0c8a706a75a5689c1e168f0a573a3cbec33061b5 ima-sig sha256:e4cb9f5709c88376b5fc3743cd88e76b9aae8f3d992d845678de5215edb31216 boot_aggregate \n"
    "10 5426cf3031a43f5bfca183d79950698a95a728f6 ima-sig sha256:f1125b940480d20ad841d26d5ea253edc0704b5ec1548c891edf212cb1a9365e /lib/modules/5.4.48-openpower1/kernel/drivers/usb/common/usb-common.ko \n"
    "10 f8a7b32dba2cb3a5437786d7f9d5caee8db3115b ima-sig sha256:cd026b58efdf66658685430ff526490d54a430a3f0066a35ac26a8acab66c55d /lib/modules/5.4.48-openpower1/kernel/drivers/gpu/drm/drm_panel_orientation_quirks.ko \n"
)

# 1st signature: RSA
# 2nd signature: EC
SIGNATURES: str = (
    "10 1e70a3e1af66f42826ad63b761b4cb9c4df195e1 ima-sig sha256:d33d5d13792292e202dbf69a6f1b07bc8a02f01424db8489ba7bb7d43c0290ef /usr/bin/dd 030204f3452d2301009dd340c852f37e35748363586939d4199b6684be27e7c1236ca1528f708372ed9cd52a0d991f66448790f5616ed5bd7f9bbd22193b1e3e54f6bf29a1497945a34d1b418b24f4cbeaef897bf3cebca27065ebb8761b46bc2662fe76f141245b9186a5ac8493c7f4976cf0d6dfc085c3e503e3f771bc3ccb121230db76fd8aba4f45f060ad64ab3afd99b4e52824b9eba12e93e46f9dcb2fa01d9cef89f298a0da02a82a4fb56924afd3e3c277a1302d99f770d488449df2d43eb5b174a0a528827e6877b965c2f0b7c89cf1aa26a7417a892df4c2294e2872d62748b72ea04ecb0689b5d792e615a9bf9d56f6e0f298560bf9441df0a22729c5f23389f028c25f\n"
    "10 5d4d5141ccd5066d50dc3f21d79ba02fedc24256 ima-sig sha256:b8ae0b8dd04a5935cd8165aa2260cd11b658bd71629bdb52256a675a1f73907b /usr/bin/zmore 030204531f402500483046022100fe24678d21083ead47660e1a2d553a592d777c478d1b0466de6ed484b54956b3022100cad3adb37f277bbb03544d6107751b4cd4f2289d8353fa36257400a99334d5c3\n"
)

COMBINED: str = MEASUREMENTS + SIGNATURES

# Malformatted signature with bad size indicator
BAD_SIGNATURES: str = "10 5d4d5141ccd5066d50dc3f21d79ba02fedc24256 ima-sig sha256:b8ae0b8dd04a5935cd8165aa2260cd11b658bd71629bdb52256a675a1f73907b /usr/bin/zmore 030204531f402548003046022100fe24678d21083ead47660e1a2d553a592d777c478d1b0466de6ed484b54956b3022100cad3adb37f277bbb03544d6107751b4cd4f2289d8353fa36257400a99334d5c3\n"

KEYRINGS: str = "10 978351440c6c8a17568f0c366b9ede28efd14f8c ima-buf sha256:a7d52aaa18c23d2d9bb2abb4308c0eeee67387a42259f4a6b1a42257065f3d5a .ima 308201d130820178a003020102020101300906072a8648ce3d0401301b3119301706035504030c1054657374696e672d45434453412d4341301e170d3231303631313133353831365a170d3232303631313133353831365a3021311f301d06035504030c1665636473612d63612d7369676e65642d65632d6b65793059301306072a8648ce3d020106082a8648ce3d030107034200044ce55be36765b59de2767f6d6721be8bea8e3db4ccc25ab76c30f5d1c11752ae1699cc39d31b378f69fecbe65ce1eb09e075f840fe4c052bafb9039742b76202a381a73081a430090603551d1304023000301d0603551d0e04160414b6fb3c083d19695be441c5f59afb95742cb6058c30560603551d23044f304d80140a51da379e45bd7ac623c3f765b53e1e2dde5195a11fa41d301b3119301706035504030c1054657374696e672d45434453412d434182142bb351b0d645e4d8594316ac3c96fc6d9c83791530130603551d25040c300a06082b06010505070302300b0603551d0f040403020780300906072a8648ce3d04010348003045022033d47b623c9feefab7d6e68b001ac6463433f99b61ce7b951a32da065a5d17af022100f3d73e38070053aec63a941ed36ae0dcfa25ed9cd538c459732a7e782132a4ca"

RUNTIME_POLICY_WITH_VERIFICATION_KEYS: RuntimePolicyType = {
    "meta": {"version": 1, "generator": 3, "timestamp": "2024-08-28 15:13:11.952478"},
    "release": 0,
    "digests": {"boot_aggregate": ["0000000000000000000000000000000000000000000000000000000000000000"]},
    "excludes": [],
    "keyrings": {},
    "ima": {"ignored_keyrings": [], "log_hash_alg": "sha1", "dm_policy": None},
    "ima-buf": {},
    "verification-keys": '{"pubkeys": ["MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1cD7bW5tX5qIVgWskS5tzY+XpqWzcW6HFq5npj8dHFIWsAJJCUdoSU631hkyY8HP/RfXDPq/J4IeKvx35EVXj49t1Z1FTJBgUlEbkKvqm0rY6jo7PnJ6BsDRrauXtiEXVKNXcWXDk8ES+9v9Cz26BJYAr+5Xgm2aEyAbj8GhicxUZfsjDm8eJ7ZnQKuhF7jejG5dYAYxnBVu99bQJHI5Fsu3dAjGbys9v7ToNbonS+1bJXdHyEE0swhxBOPvvV6vx5CzRNw1Sou3rT19T4j8wpsFOyYXVcbbRVBAmBE2Qy2UHvojFqaJN/A9lztllyER1S5heGG6CxK3GoR6pkOXAQIDAQAB", "MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEnNH3Y/xOTwRRd8D6hpodRLnVx71qDTLvJHouno7nU7JSzcXWN1PxK+HQEh1V7sMdwBER4KFKE635JTv6C+BRBg=="], "keyids": [4081397027, 1394556965]}',
}

IMA_KEYRING_STRING: str = '{"pubkeys": ["MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1cD7bW5tX5qIVgWskS5tzY+XpqWzcW6HFq5npj8dHFIWsAJJCUdoSU631hkyY8HP/RfXDPq/J4IeKvx35EVXj49t1Z1FTJBgUlEbkKvqm0rY6jo7PnJ6BsDRrauXtiEXVKNXcWXDk8ES+9v9Cz26BJYAr+5Xgm2aEyAbj8GhicxUZfsjDm8eJ7ZnQKuhF7jejG5dYAYxnBVu99bQJHI5Fsu3dAjGbys9v7ToNbonS+1bJXdHyEE0swhxBOPvvV6vx5CzRNw1Sou3rT19T4j8wpsFOyYXVcbbRVBAmBE2Qy2UHvojFqaJN/A9lztllyER1S5heGG6CxK3GoR6pkOXAQIDAQAB", "MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEnNH3Y/xOTwRRd8D6hpodRLnVx71qDTLvJHouno7nU7JSzcXWN1PxK+HQEh1V7sMdwBER4KFKE635JTv6C+BRBg=="], "keyids": [4081397027, 1394556965]}'

IMA_BAD_KEYRING_STRING: str = '{"pubkeys": ["MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1cD7bW5tX5qIVgWskS5tzY+XpqWzcW6HFq5npj8dHFIWsAJJCUdoSU631hkyY8HP/RfXDPq/J4IeKvx35EVXj49t1Z1FTJBgUlEbkKvqm0rY6jo7PnJ6BsDRrauXtiEXVKNXcWXDk8ES+9v9Cz26BJYAr+5Xgm2aEyAbj8GhicxUZfsjDm8eJ7ZnQKuhF7jejG5dYAYxnBVu99bQJHI5Fsu3dAjGbys9v7ToNbonS+1bJXdHyEE0swhxBOPvvV6vx5CzRNw1Sou3rT19T4j8wpsFOyYXVcbbRVBAmBE2Qy2UHvojFqaJN/A9lztllyER1S5heGG6CxK3GoR6pkOXAQIDAQAB", "MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEnNH3Y/xOTwRRd8D6hpodRLnVx71qDTLvJHouno7nU7JSzcXWN1PxK+HQEh1V7sMdwBER4KFKE635JTv6C+BRBg=="]}'

# END TEST DATA


class TestIMAVerification(unittest.TestCase):
    """Test the IMA measurement list verification"""

    def test_measurment_verification(self):
        """Test IMA measurement list verification"""
        _measurements = MEASUREMENTS.splitlines()
        measurements = cast(List[str], _measurements)

        _, failure = ima.process_measurement_list(AgentAttestState("1"), measurements)
        self.assertTrue(not failure, "Validation should always work when no allowlist and no keyring is specified")
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, measurements)
        self.assertTrue(not failure, "Validation should always work when no allowlist and no keyring is specified")

        # test with list with JSON
        _, failure = ima.process_measurement_list(AgentAttestState("1"), measurements, RUNTIME_POLICY_TEST)
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, measurements, RUNTIME_POLICY_TEST)
        self.assertTrue(not failure)

        # No files are in the allowlist -> this should fail
        _, failure = ima.process_measurement_list(AgentAttestState("1"), measurements, ima.EMPTY_RUNTIME_POLICY)
        self.assertTrue(failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, measurements, ima.EMPTY_RUNTIME_POLICY)
        self.assertTrue(failure)

    def test_signature_verification(self):
        """Test the signature verification"""
        curdir = os.path.dirname(os.path.abspath(__file__))
        keydir = os.path.join(curdir, "data", "ima_keys")

        _signatures = SIGNATURES.split("\n")
        signatures = cast(List[str], _signatures)

        # empty keyring
        keyrings = file_signatures.ImaKeyrings()
        _, failure = ima.process_measurement_list(AgentAttestState("1"), signatures, ima_keyrings=keyrings)
        self.assertTrue(failure)

        # empty keyring no AgentAttestState
        keyrings = file_signatures.ImaKeyrings()
        _, failure = ima.process_measurement_list(None, signatures, ima_keyrings=keyrings)
        self.assertTrue(failure)

        tenant_keyring = file_signatures.ImaKeyring()
        keyrings.set_tenant_keyring(tenant_keyring)

        # add key for 1st entry; 1st entry must be verifiable
        rsakeyfile = os.path.join(keydir, "rsa2048pub.pem")
        pubkey, keyidv2 = file_signatures.get_pubkey_from_file(rsakeyfile)
        assert pubkey is not None
        tenant_keyring.add_pubkey(pubkey, keyidv2)
        _, failure = ima.process_measurement_list(AgentAttestState("1"), signatures[0:1], ima_keyrings=keyrings)
        self.assertTrue(not failure)
        _, failure = ima.process_measurement_list(AgentAttestState("1"), signatures[1:2], ima_keyrings=keyrings)
        self.assertTrue(failure)
        # now with no AgentAttestState
        _, failure = ima.process_measurement_list(None, signatures[0:1], ima_keyrings=keyrings)
        self.assertTrue(not failure)
        _, failure = ima.process_measurement_list(None, signatures[1:2], ima_keyrings=keyrings)
        self.assertTrue(failure)

        # add key for 2nd entry; 1st & 2nd entries must be verifiable
        eckeyfile = os.path.join(keydir, "secp256k1.pem")
        pubkey, keyidv2 = file_signatures.get_pubkey_from_file(eckeyfile)
        assert pubkey is not None
        tenant_keyring.add_pubkey(pubkey, keyidv2)
        _, failure = ima.process_measurement_list(AgentAttestState("1"), signatures[0:2], ima_keyrings=keyrings)
        self.assertTrue(not failure)
        # now with no AgentAttestState
        _, failure = ima.process_measurement_list(None, signatures[0:2], ima_keyrings=keyrings)
        self.assertTrue(not failure)

    def test_ima_buf_verification(self):
        """The verification of ima-buf entries supporting keys loaded onto keyrings"""
        ima_keyrings = file_signatures.ImaKeyrings()

        self.assertTrue(
            ima.process_measurement_list(
                AgentAttestState("1"), KEYRINGS.splitlines(), RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings
            )
            is not None
        )

    def test_iterative_attestation(self):
        """Test that the resulting pcr value is as expected by subsequently feeding a measurement list.
        The AgentAtestState() will maintain the state of PCR 10.
        """

        pcrval = None
        lines = MEASUREMENTS.splitlines()
        agentAttestState = AgentAttestState("1")
        running_hash = agentAttestState.get_pcr_state(10)
        assert running_hash is not None
        for line in lines:
            parts = line.split(" ")
            template_hash = bytes.fromhex(parts[1])
            running_hash = hashlib.sha1(running_hash + template_hash).digest()
            pcrval = codecs.encode(running_hash, "hex").decode("utf-8")
            ima_hash, _ = ima.process_measurement_list(agentAttestState, [line], pcrval=pcrval)
            self.assertTrue(ima_hash == pcrval)

        # Feed empty iterative measurement list simulating 'no new measurement list entries' on attested system
        ima_hash, _ = ima.process_measurement_list(agentAttestState, [], pcrval=pcrval)
        self.assertTrue(ima_hash == pcrval)

    def test_mixed_verfication(self):
        """Test verification using allowlist and keys"""

        ima_keyrings = file_signatures.ImaKeyrings()
        empty_keyring = file_signatures.ImaKeyring()

        _combined = COMBINED.splitlines()
        combined = cast(List[str], _combined)

        # every entry is covered by the allowlist and there's no keyring -> this should pass
        _, failure = ima.process_measurement_list(AgentAttestState("1"), combined, RUNTIME_POLICY_TEST)
        self.assertTrue(not failure)

        # every entry is covered by the allowlist and there's no keyring with no AgentAttestState -> this should pass
        _, failure = ima.process_measurement_list(None, combined, RUNTIME_POLICY_TEST)
        self.assertTrue(not failure)

        curdir = os.path.dirname(os.path.abspath(__file__))
        keydir = os.path.join(curdir, "data", "ima_keys")
        tenant_keyring = file_signatures.ImaKeyring()

        rsakeyfile = os.path.join(keydir, "rsa2048pub.pem")
        pubkey, keyidv2 = file_signatures.get_pubkey_from_file(rsakeyfile)
        assert pubkey is not None
        tenant_keyring.add_pubkey(pubkey, keyidv2)

        eckeyfile = os.path.join(keydir, "secp256k1.pem")
        pubkey, keyidv2 = file_signatures.get_pubkey_from_file(eckeyfile)
        assert pubkey is not None
        tenant_keyring.add_pubkey(pubkey, keyidv2)

        ima_keyrings.set_tenant_keyring(tenant_keyring)

        # entries are not covered by a exclude list -> this should fail
        _, failure = ima.process_measurement_list(AgentAttestState("1"), combined, ima_keyrings=ima_keyrings)
        self.assertTrue(failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, combined, ima_keyrings=ima_keyrings)
        self.assertTrue(failure)

        # all entries are either covered by allow list or by signature verification -> this should pass
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), combined, RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, combined, RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings)
        self.assertTrue(not failure)

        _signatures = SIGNATURES.splitlines()
        signatures = cast(List[str], _signatures)

        # the signature is valid but the hash in the allowlist is wrong -> this should pass
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), signatures, RUNTIME_POLICY_WRONG, ima_keyrings=ima_keyrings
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, signatures, RUNTIME_POLICY_WRONG, ima_keyrings=ima_keyrings)
        self.assertTrue(not failure)

        # the signature is valid and the file is not in the allowlist -> this should pass
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), signatures, ima.EMPTY_RUNTIME_POLICY, ima_keyrings=ima_keyrings
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, signatures, ima.EMPTY_RUNTIME_POLICY, ima_keyrings=ima_keyrings)
        self.assertTrue(not failure)

        # the signature is invalid but the correct hash is in the allowlist -> this should pass
        ima_keyrings.set_tenant_keyring(empty_keyring)
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), signatures, RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        ima_keyrings.set_tenant_keyring(empty_keyring)
        _, failure = ima.process_measurement_list(None, signatures, RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings)
        self.assertTrue(not failure)

        _measurements = MEASUREMENTS.splitlines()
        measurements = cast(List[str], _measurements)

        # the file has no signature but the hash is correct -> this should pass
        _, failure = ima.process_measurement_list(AgentAttestState("1"), measurements, RUNTIME_POLICY_TEST)
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, measurements, RUNTIME_POLICY_TEST)
        self.assertTrue(not failure)

        # All files are in the exclude list but hashes are invalid -> this should pass
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), measurements, RUNTIME_POLICY_WRONG_WITH_EXCLUDES
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(None, measurements, RUNTIME_POLICY_WRONG_WITH_EXCLUDES)
        self.assertTrue(not failure)

        # All files are in the exclude list and their signatures are invalid -> this should pass
        ima_keyrings.set_tenant_keyring(tenant_keyring)
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), signatures, RUNTIME_POLICY_WITH_EXCLUDES, ima_keyrings=ima_keyrings
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        ima_keyrings.set_tenant_keyring(tenant_keyring)
        _, failure = ima.process_measurement_list(
            None, signatures, RUNTIME_POLICY_WITH_EXCLUDES, ima_keyrings=ima_keyrings
        )
        self.assertTrue(not failure)

        # All files are in the exclude list but hashes or signatures are invalid -> this should pass
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"),
            measurements,
            RUNTIME_POLICY_WRONG_WITH_EXCLUDES,
            ima_keyrings=ima_keyrings,
        )
        self.assertTrue(not failure)
        # now without AgentAttestState
        _, failure = ima.process_measurement_list(
            None,
            measurements,
            RUNTIME_POLICY_WRONG_WITH_EXCLUDES,
            ima_keyrings=ima_keyrings,
        )
        self.assertTrue(not failure)

        _bad_signatures = BAD_SIGNATURES.splitlines()
        bad_signatures = cast(List[str], _bad_signatures)

        # The signature is malformatted and the file is in the exclude list -> this must not pass
        ima_keyrings.set_tenant_keyring(empty_keyring)
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), bad_signatures, RUNTIME_POLICY_WITH_EXCLUDES, ima_keyrings=ima_keyrings
        )
        self.assertTrue(failure)
        # now without AgentAttestState
        ima_keyrings.set_tenant_keyring(empty_keyring)
        _, failure = ima.process_measurement_list(
            None, bad_signatures, RUNTIME_POLICY_WITH_EXCLUDES, ima_keyrings=ima_keyrings
        )
        self.assertTrue(failure)

        # The signature is malformatted and the file is in the accept list -> this must not pass
        ima_keyrings.set_tenant_keyring(empty_keyring)
        _, failure = ima.process_measurement_list(
            AgentAttestState("1"), bad_signatures, RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings
        )
        self.assertTrue(failure)
        # now without AgentAttestState
        ima_keyrings.set_tenant_keyring(empty_keyring)
        _, failure = ima.process_measurement_list(None, bad_signatures, RUNTIME_POLICY_TEST, ima_keyrings=ima_keyrings)
        self.assertTrue(failure)

    def test_read_allowlist(self):
        """Test reading and processing of the IMA allow-list"""

        curdir = os.path.dirname(os.path.abspath(__file__))
        allowlist_file = os.path.join(curdir, "data", "runtime-policy-test.json")
        allowlist_file_signed = os.path.join(curdir, "data", "runtime-policy-test-signed.json")
        allowlist_file_signed_bad = os.path.join(curdir, "data", "runtime-policy-test-signed-bad.json")
        allowlist_dsse_key = os.path.join(curdir, "data", "runtime-policy-pubkey.pub")
        allowlist_checksum = "64608ceb82d6d6459e8ac5ffd19865d670d1fe99417e10f20446de5d125bc4ab"
        allowlist_signed_checksum = "ed42c2beda1207061187a5e03b1faaf4cb3e2ff57121cb823ac92b536800e027"
        allowlist_bad_checksum = "4c143670836f96535d9e617359b4d87c59e89e633e2773b4d7feae97f561b3dc"

        # simple read, no fancy verification
        runtime_policy, _ = ima.read_runtime_policy(allowlist_file)
        runtime_policy = json.loads(runtime_policy)
        self.assertIsNotNone(runtime_policy, "Runtime policy data is present")
        self.assertIsNotNone(runtime_policy["meta"], "Runtime policy metadata is present")
        self.assertEqual(runtime_policy["meta"]["version"], 1, "Runtime policy metadata version is correct")
        self.assertEqual(
            runtime_policy["meta"]["generator"],
            ima.RUNTIME_POLICY_GENERATOR.CompatibleAllowList,
            "Runtime policy metadata generator is correct",
        )
        self.assertIsNotNone(runtime_policy["digests"], "Runtime policy digests are present")
        self.assertEqual(len(runtime_policy["digests"]), 21, "Runtime policy hashes are correct length")
        self.assertEqual(
            runtime_policy["digests"]["/boot/grub2/i386-pc/testload.mod"][0],
            "68e1d012e3f193dcde955e6ffbbc80e22b0f8778",
            "Runtime policy sample hash is correct",
        )
        self.assertIsNotNone(runtime_policy["keyrings"], "Runtime policy keyrings are present")
        self.assertEqual(len(runtime_policy["keyrings"]), 1, "Runtime policy keyrings are correct length")
        self.assertEqual(
            runtime_policy["keyrings"][".ima"][0],
            "a7d52aaa18c23d2d9bb2abb4308c0eeee67387a42259f4a6b1a42257065f3d5a",
            "Runtime policy sample keyring is correct",
        )

        # validate checksum
        runtime_policy, _ = ima.read_runtime_policy(allowlist_file, allowlist_checksum)
        runtime_policy = json.loads(runtime_policy)
        self.assertIsNotNone(runtime_policy, "Runtime policy data is present")
        self.assertIsNotNone(runtime_policy["digests"], "Runtime policy hashes are present")
        self.assertEqual(len(runtime_policy["digests"]), 21, "Runtime policy hashes are correct length")
        self.assertEqual(
            runtime_policy["digests"]["/boot/grub2/i386-pc/testload.mod"][0],
            "68e1d012e3f193dcde955e6ffbbc80e22b0f8778",
            "Runtime policy sample hash is correct",
        )

        # test with a bad checksum
        with self.assertRaises(Exception) as bad_checksum_context:
            ima.read_runtime_policy(allowlist_file, allowlist_bad_checksum)
        self.assertIn("Checksum of runtime policy does not match", str(bad_checksum_context.exception))

        # validate DSSE signature (tenant side)
        runtime_policy_envelope_raw, runtime_policy_key = ima.read_runtime_policy(
            allowlist_file_signed, None, allowlist_dsse_key
        )
        runtime_policy_envelope = json.loads(runtime_policy_envelope_raw)
        self.assertIsNotNone(runtime_policy_envelope, "Runtime policy envelope data is present")
        self.assertIsNotNone(runtime_policy_key, "Runtime policy signing key is present")
        self.assertIsNotNone(runtime_policy_envelope["payload"], "DSSE payload is present")
        self.assertIsNotNone(runtime_policy_envelope["payloadType"], "DSSE payload type is present")
        self.assertEqual(
            runtime_policy_envelope["payloadType"],
            "application/vnd.keylime+json",
            "DSSE payload is present",
        )

        # deserialize DSSE payload
        runtime_policy = ima.deserialize_runtime_policy(runtime_policy_envelope_raw.decode())
        self.assertIsNotNone(runtime_policy["digests"], "Runtime policy hashes are present")
        self.assertEqual(len(runtime_policy["digests"]), 21, "Runtime policy hashes are correct length")
        self.assertEqual(
            runtime_policy["digests"]["/boot/grub2/i386-pc/testload.mod"][0],
            "68e1d012e3f193dcde955e6ffbbc80e22b0f8778",
            "Runtime policy sample hash is correct",
        )

        # test with a bad DSSE signature (tenant-side)
        with self.assertRaises(Exception) as bad_sig_context:
            ima.read_runtime_policy(allowlist_file_signed_bad, None, allowlist_dsse_key)
        self.assertIn("Runtime policy failed DSSE signature verification!", str(bad_sig_context.exception))

        # validate DSSE signature (verifier side)
        runtime_policy, runtime_policy_key = ima.read_runtime_policy(allowlist_file_signed, None, allowlist_dsse_key)
        ima.verify_runtime_policy(runtime_policy, runtime_policy_key)

        # test with a bad sig (verifier-side)

        with open(allowlist_file_signed_bad, "rb") as bad_sig_f:
            runtime_policy_bad = bad_sig_f.read()
        with self.assertRaises(ima.ImaValidationError) as bad_sig_context:
            ima.verify_runtime_policy(runtime_policy_bad, runtime_policy_key)
        self.assertIn("Runtime policy failed DSSE signature verification!", bad_sig_context.exception.message)
        self.assertEqual(bad_sig_context.exception.code, 401)

        # validate everything together
        runtime_policy_envelope_raw, runtime_policy_key = ima.read_runtime_policy(
            allowlist_file_signed, allowlist_signed_checksum, allowlist_dsse_key
        )
        runtime_policy_envelope = json.loads(runtime_policy_envelope_raw)
        self.assertIsNotNone(runtime_policy_envelope, "Runtime policy envelope data is present")
        self.assertIsNotNone(runtime_policy_key, "Runtime policy signing key is present")
        self.assertIsNotNone(runtime_policy_envelope["payload"], "DSSE payload is present")
        self.assertIsNotNone(runtime_policy_envelope["payloadType"], "DSSE payload type is present")
        self.assertEqual(
            runtime_policy_envelope["payloadType"],
            "application/vnd.keylime+json",
            "DSSE payload is present",
        )

        # deserialize DSSE payload
        runtime_policy = ima.deserialize_runtime_policy(runtime_policy_envelope_raw.decode())
        self.assertIsNotNone(runtime_policy["digests"], "Runtime policy hashes are present")
        self.assertEqual(len(runtime_policy["digests"]), 21, "Runtime policy hashes are correct length")
        self.assertEqual(
            runtime_policy["digests"]["/boot/grub2/i386-pc/testload.mod"][0],
            "68e1d012e3f193dcde955e6ffbbc80e22b0f8778",
            "Runtime policy sample hash is correct",
        )

    def test_from_string_validates_json_schema(self) -> None:
        """Test if from_string validates JSON schema"""

        keyring = file_signatures.ImaKeyring.from_string(IMA_KEYRING_STRING)
        self.assertIsNotNone(keyring)
        if keyring:
            self.assertEqual(keyring.to_string(), IMA_KEYRING_STRING)

        should_be_none = None
        with self.assertLogs("keylime.file_signatures", level="ERROR") as context:
            should_be_none = file_signatures.ImaKeyring.from_string(IMA_BAD_KEYRING_STRING)

        self.assertTrue("JSON from string is not a valid IMA Keyring" in str(context.output))
        self.assertIsNone(should_be_none)
