"""Release identity verification must accept only the explicitly pinned signer."""
import unittest
from verify_apk import verified_signer

SHA = 'd684537f3637fde36c9e7b065b5acd78499c02d345c34bf87857b13ed1d8b87d'


class SignerTests(unittest.TestCase):
    def test_authorized_replacement_key_has_its_actual_subject(self):
        text = f'Signer #1 certificate DN: CN=Reelbox Release, OU=Reelbox\nSigner #1 certificate SHA-256 digest: {SHA}\n'
        self.assertEqual(verified_signer(text, SHA), (SHA, 'CN=Reelbox Release, OU=Reelbox'))

    def test_mismatched_or_debug_signer_is_rejected(self):
        with self.assertRaises(AssertionError):
            verified_signer(f'Signer #1 certificate DN: CN=Reelbox Release\nSigner #1 certificate SHA-256 digest: {SHA}', 'a' * 64)
        with self.assertRaises(AssertionError):
            verified_signer(f'Signer #1 certificate DN: CN=Android Debug\nSigner #1 certificate SHA-256 digest: {SHA}', SHA)


if __name__ == '__main__':
    unittest.main()