first build

tests/test_profile.py

@@ -0,0 +1,55 @@
+import plistlib
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.serialization import pkcs7
+from tests.helpers import issue_test_ca
+
+from cert_portal.enrollment import export_pkcs12
+from cert_portal.profile import (
+    PKCS12_PAYLOAD_TYPE,
+    build_unsigned_mobileconfig,
+    load_signing_identity,
+    sign_mobileconfig,
+)
+
+
+def test_unsigned_profile_embeds_pkcs12_and_password():
+    key, cert = issue_test_ca()
+    p12, password = export_pkcs12(key=key, certificate=cert, friendly_name="[email protected]")
+    unsigned = build_unsigned_mobileconfig(
+        identity_p12=p12,
+        identity_password=password,
+        display_name="User Certificate",
+        organization="Example",
+        identifier_prefix="com.example.cert-portal",
+        username="[email protected]",
+    )
+    profile = plistlib.loads(unsigned)
+    payloads = profile["PayloadContent"]
+    types = [p["PayloadType"] for p in payloads]
+    assert PKCS12_PAYLOAD_TYPE in types
+    assert "com.apple.security.scep" not in types
+    identity = next(p for p in payloads if p["PayloadType"] == PKCS12_PAYLOAD_TYPE)
+    assert identity["Password"] == password
+    assert identity["PayloadContent"] == p12
+
+
+def test_signed_profile_is_cms_and_contains_plist(signing_p12):
+    key, cert = issue_test_ca()
+    p12, password = export_pkcs12(key=key, certificate=cert)
+    unsigned = build_unsigned_mobileconfig(
+        identity_p12=p12,
+        identity_password=password,
+        display_name="User Certificate",
+        organization="Example",
+        identifier_prefix="com.example.cert-portal",
+        username="[email protected]",
+    )
+    identity = load_signing_identity(signing_p12, "signer-secret")
+    signed = sign_mobileconfig(unsigned, identity)
+    assert signed != unsigned
+    assert signed[:1] == b"\x30"  # DER SEQUENCE
+    assert b"com.apple.security.pkcs12" in signed
+    certs = pkcs7.load_der_pkcs7_certificates(signed)
+    fps = {c.fingerprint(hashes.SHA256()) for c in certs}
+    assert identity.certificate.fingerprint(hashes.SHA256()) in fps