From 978b2bae352c78f720f49ce1a40b441af3661457 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miloslav=20Trma=C4=8D?= <mitr@redhat.com>
Date: Wed, 26 Jul 2017 21:22:50 +0200
Subject: [PATCH] Support v3 signature packets in mechanism_openpgp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

They are handled similarly to the more common V4 signature packets,
except that MessageDetails.SignatureV3 is set instead of
MessageDetails.Signature, and they don’t support expiration.

Bulk of the commit is adding tests which use V3 signature packets.

I have regenerated unknown-key.signature because it was generated using
a temporary key created just for that purpose, and the test is simpler
when fixtures for both packet variants to use the same key.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
---
 signature/fixtures/corrupt.signature-v3      | Bin 0 -> 405 bytes
 signature/fixtures/invalid-blob.signature-v3 | Bin 0 -> 194 bytes
 signature/fixtures/unknown-key.signature     | Bin 558 -> 560 bytes
 signature/fixtures/unknown-key.signature-v3  | Bin 0 -> 549 bytes
 signature/mechanism_openpgp.go               |  14 +-
 signature/mechanism_test.go                  | 158 +++++++++++--------
 6 files changed, 104 insertions(+), 68 deletions(-)
 create mode 100644 signature/fixtures/corrupt.signature-v3
 create mode 100644 signature/fixtures/invalid-blob.signature-v3
 create mode 100644 signature/fixtures/unknown-key.signature-v3

diff --git a/signature/fixtures/corrupt.signature-v3 b/signature/fixtures/corrupt.signature-v3
new file mode 100644
index 0000000000000000000000000000000000000000..51f986b961d281015b00d039d9c55add09eab3c5
GIT binary patch
literal 405
zcmV;G0c!rE0h_?f%)rEWyXccd_m-R!jHeF-Br!x*elV|AN-oMQ$xKenQL?I5%1lYk
zE6FUW1hG@{le1Hcbc<5cQj1dal2eteluA;IOEUA)^>Y*RGSh%;rCJ@O%-qEER3!B<
zIo*`ZbdVA&rQ(c4BU3XgBZH(gBg51b6I1gfV@m@IBg^EJq}0@83v)};MDwK7L_;$p
zGfPXuw3I|M1LIVK6a&K~lT`CGGXoPN^Hft)kYy#61t51MmgMJVCMzW8=anR8=A{-X
z6lbRAC6<&HrGgaY7nEe?=RrJ_T$Bn_T!hf01T-Ww7wE9W+yW&lLlaXABV$W*L*v@o
zPKK$>tl%(#hZ2+5Z|2|Z0%7OQd`Xzt^P*f-`|U}_Ej6F}PB?~4o#^X#Zpn{@R;w0-
zJg$)|e|Wlk#_ow%8n!8^743<z{Jh^`&Ew^ozHSLkC#N;fsb0sV$&lOS(^Y2?mD6rM
zyWHv5&gc1ca!Z$c?6cn>Z2fAvt>!_^>0eV6elfC^*)N}{x#O*G>a}^R^q2q&%+$(d

literal 0
HcmV?d00001

diff --git a/signature/fixtures/invalid-blob.signature-v3 b/signature/fixtures/invalid-blob.signature-v3
new file mode 100644
index 0000000000000000000000000000000000000000..246bdd9a8e5b709077752dd595698da8d9fe1e0a
GIT binary patch
literal 194
zcmV;z06qVs0h_?f%)rEWyXccd_m-R!jHktu7$PgaCxm2V7ApWzUVe#!SFpbyS0}?%
zW>&BiTrJa<IV=p*1uBy?C(ga}r0Q7k4*lI*{`T(P{&vM<zIKC^wthy2SCntgN$HN{
zd8y0gs(rCmyyerGDVs%tSNcD?v}NUtBDVz>ex5LW_0#qJoBj@)J!evW74!v!&-`x9
wDS2MeWz&>T$EQy}&^hrIbIi|*u4Tbbw*_#9eExA~-Rj7ikU7f^2wa;10F(@6@Bjb+

literal 0
HcmV?d00001

diff --git a/signature/fixtures/unknown-key.signature b/signature/fixtures/unknown-key.signature
index 2277b130dab415c59a76679a5ad1b1d252e98908..393ace4a92bceb29eae51426a87944894653d2d2 100644
GIT binary patch
literal 560
zcmV-00?+-U0h_?f%)rFByY!{xg!}z<jHeGoB{4)+e%w~Alw6cql9`;CqhwXBl$ny6
zSCUy$31X+@CugS?=@zA?r52^;C8sJ`DV3xamt^Lp>*prsWu^hyO0_ylnYoGSsYvQ!
za=Iy*=^!OmO2rw8My6&~Mg~b~Muw>=CZ^^|#+C*aMwZDbNvWyH7Uq_wiRMYEiH2rI
zW|o$QX(@?j2F9rdDF%i~CaLCWW(Fok=BcKpAj?WB3qbBjEXmK!OjbzF&nrpH%u6j&
zD9%jJODriZN(Cv(FDS{(&x3d<xhNH=xCo)gK+jOm&{#JmwM+?UTxKrNiHW%dN>+v@
zW+rCF#wO+_wY8m$GAs;?Obl$SOrRiQ;Nld31)Snc_WxnCPKMT>t?QU``n3UXYQ*v8
z>(}=^cX=xJVci$&oki~ZxFgQrEN9xZ%;{#|X6flqQg(5QZz*CFzZoDf^<8JJy!YIq
z_LOxOcfa0hu6|#$;d3f`z`D!xY`WT}nl8-X+z>A!b&cWIllZf<PwnQMvt$03w*_*2
zS*Pt!wOsoU7-$yuqwnof4)41f->an_Mzb$<Z{yu??X1><%3qur${rEVcAQ`Nx?5@c
z<`kv3a&ETS&i@~Nl6$^o-=h`A)}MS&X@s6ucCOsbJ6ZnH4UKYRht!XzQ<-i{`(J;|
yxBXAMm$UEAW!oa2Y})>6?v398CSU$<_<3uchPvFZ<CDB}`PFUAtsZe5G6Dd%nk1qC

literal 558
zcmV+}0@3}W0h_?f%)r6;)IC>F;6ep6<LLuYNetmW9nIBB$wiqZnaPPcN><fMnJKAx
zC7C6aAa+WAa&~HwZc%DlYEf!la;lP*Qb}rYNoHQUer{r3W*U&KRI8(unVXoNiliPU
zr<;<Q4pL&JRGg7$WNKz*WRR3*WSE*_VrrgbY-wO&WSN|jl$x4sVQy)fXr7dsXlQ0+
zW@%}dmXc^@V4P}@VqlnLl4_o2W?*7uo@#0evaF=C0OXFulKkAvWQFAXypqJsywoCv
z;>`5C#FEmYRFI<lf|AVqJcx&qi&BA#ix7GY^bGY3jdfE}%ank|W#$5%n3!9jWMyb#
zW@2V+Y+`OwTieMf!@|JG!NA7K1PUSsE=~bhz~yOjFsu?d#M(1oZvI;a?Wfz>(=Id~
zsyD2^7m{SL`O>k)B`-?0L@ZL}y()d};O`xMqGhb%F57k~E|suqk3T$<)gj}0*ap{D
zP2IHKDMlR5Gxub_Kl@<)%f}1!o6<K(=pV_oGJh(5(!qba(y5}r8*|>TNIx?F!IJ5E
z){OaV0yD&Jzxz99M$RSs71wGNzAxRsP|#lH=4m$Oh*Jw+sOCSFsqK$otN&uzd8ao0
zYvO<Nu5A)GYkMMDQ@Y;dZ@Q@AKTrC;*;1F;pZ6uO`5P`hlc4u#<GHtOZ+vgfj=9+P
wt@`4=s#oFLm6^F^Y!5!||80_%{i`8HNuDw5<)0LV+^unwca$~0i}f@F08-i{D*ylh

diff --git a/signature/fixtures/unknown-key.signature-v3 b/signature/fixtures/unknown-key.signature-v3
new file mode 100644
index 0000000000000000000000000000000000000000..67f429b0d82a763be772a166312866a6e299c17e
GIT binary patch
literal 549
zcmV+=0^0qf0h_?f%)rFByY!{xg!}z<jHeGoB{4)+e$=Q|N-oMQ$xKenQL?I5%1lYk
zE6FUW1hG@{le1Hcbc<5cQj1dal2eteluA;IOEUA)^>Y*RGSh%;rCJ@O%-qEER3!B<
zIo*`ZbdVA&rQ(c4BU3XgBZH(gBg51b6I1gfV@m@IBg^EJq}0@83v)};MDwK7L_;$p
zGfPXuw3I|M1LIVK6a&K~lT`CGGXoPN^Hft)kYy#61t51MmgMJVCMzW8=anR8=A{-X
z6lbRAC6<&HrGgaY7nEe?=RrJ_T$Bn_T!heLpl7IOXsnx(TBZavE;ASC#KhbJB`ZS{
zGZQmoV-s_e+S*P=QD#<f=)l8^X<9M|L!<hVC5!iWpU~5P;iEP4>srBd<2ddm?2Eh`
zt~l!R&tr4>Z?7Y!Fey3VV04wvvVR9Z#Y^T@d~)7&ZT*x9Np@FlyJo)=zWuQNy=$m<
zRrl(m>Ad{BlgsS$g8L85FY8(L==`Vt;P5R*oL!u+w`=S$y>V>SV=1?rMcZSKZqdD}
zExf~C)x~7#hsEdCxHWjG@tw`I<9qk?Y=kX)X4lX1vNfd}iVTiVT=c-1W1{Q9c@J3+
zvlZle$*<gNU|({0|NCW43j8f;ZELR=`AhrMr1ia;aijc45Ay^g$2`rdtwQ^l|Ia-u
n`y|ZYE?wR=E+}h({~r18mnVmPYP|n3{HffMXOV8=6J7%Ve1#nq

literal 0
HcmV?d00001

diff --git a/signature/mechanism_openpgp.go b/signature/mechanism_openpgp.go
index e383bde3e..eccd610c9 100644
--- a/signature/mechanism_openpgp.go
+++ b/signature/mechanism_openpgp.go
@@ -132,11 +132,17 @@ func (m *openpgpSigningMechanism) Verify(unverifiedSignature []byte) (contents [
 	if md.SignedBy == nil {
 		return nil, "", InvalidSignatureError{msg: fmt.Sprintf("Invalid GPG signature: %#v", md.Signature)}
 	}
-	if md.Signature.SigLifetimeSecs != nil {
-		expiry := md.Signature.CreationTime.Add(time.Duration(*md.Signature.SigLifetimeSecs) * time.Second)
-		if time.Now().After(expiry) {
-			return nil, "", InvalidSignatureError{msg: fmt.Sprintf("Signature expired on %s", expiry)}
+	if md.Signature != nil {
+		if md.Signature.SigLifetimeSecs != nil {
+			expiry := md.Signature.CreationTime.Add(time.Duration(*md.Signature.SigLifetimeSecs) * time.Second)
+			if time.Now().After(expiry) {
+				return nil, "", InvalidSignatureError{msg: fmt.Sprintf("Signature expired on %s", expiry)}
+			}
 		}
+	} else if md.SignatureV3 == nil {
+		// Coverage: If md.SignedBy != nil, the final md.UnverifiedBody.Read() either sets one of md.Signature or md.SignatureV3,
+		// or sets md.SignatureError.
+		return nil, "", InvalidSignatureError{msg: "Unexpected openpgp.MessageDetails: neither Signature nor SignatureV3 is set"}
 	}
 
 	// Uppercase the fingerprint to be compatible with gpgme
diff --git a/signature/mechanism_test.go b/signature/mechanism_test.go
index 53f2b3d9f..a6587c61c 100644
--- a/signature/mechanism_test.go
+++ b/signature/mechanism_test.go
@@ -17,6 +17,18 @@ const (
 	testGPGHomeDirectory = "./fixtures"
 )
 
+// Many of the tests use two fixtures: V4 signature packets (*.signature), and V3 signature packets (*.signature-v3)
+
+// fixtureVariants loads V3 and V4 signature fixture variants based on the v4 fixture path, and returns a map which makes it easy to test both.
+func fixtureVariants(t *testing.T, v4Path string) map[string][]byte {
+	v4, err := ioutil.ReadFile(v4Path)
+	require.NoError(t, err)
+	v3Path := v4Path + "-v3"
+	v3, err := ioutil.ReadFile(v3Path)
+	require.NoError(t, err)
+	return map[string][]byte{v4Path: v4, v3Path: v3}
+}
+
 func TestSigningNotSupportedError(t *testing.T) {
 	// A stupid test just to keep code coverage
 	s := "test"
@@ -40,13 +52,14 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
 
 	// Test that using the default directory (presumably in user’s home)
 	// cannot use TestKeyFingerprint.
-	signature, err := ioutil.ReadFile("./fixtures/invalid-blob.signature")
-	require.NoError(t, err)
+	signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
 	mech, err = newGPGSigningMechanismInDirectory("")
 	require.NoError(t, err)
 	defer mech.Close()
-	_, _, err = mech.Verify(signature)
-	assert.Error(t, err)
+	for version, signature := range signatures {
+		_, _, err := mech.Verify(signature)
+		assert.Error(t, err, version)
+	}
 
 	// Similarly, using a newly created empty directory makes TestKeyFingerprint
 	// unavailable
@@ -56,8 +69,10 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
 	mech, err = newGPGSigningMechanismInDirectory(emptyDir)
 	require.NoError(t, err)
 	defer mech.Close()
-	_, _, err = mech.Verify(signature)
-	assert.Error(t, err)
+	for version, signature := range signatures {
+		_, _, err := mech.Verify(signature)
+		assert.Error(t, err, version)
+	}
 
 	// If pubring.gpg is unreadable in the directory, either initializing
 	// the mechanism fails (with openpgp), or it succeeds (sadly, gpgme) and
@@ -71,16 +86,20 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
 	mech, err = newGPGSigningMechanismInDirectory(unreadableDir)
 	if err == nil {
 		defer mech.Close()
-		_, _, err = mech.Verify(signature)
+		for version, signature := range signatures {
+			_, _, err := mech.Verify(signature)
+			assert.Error(t, err, version)
+		}
 	}
-	assert.Error(t, err)
 
 	// Setting the directory parameter to testGPGHomeDirectory makes the key available.
 	mech, err = newGPGSigningMechanismInDirectory(testGPGHomeDirectory)
 	require.NoError(t, err)
 	defer mech.Close()
-	_, _, err = mech.Verify(signature)
-	assert.NoError(t, err)
+	for version, signature := range signatures {
+		_, _, err := mech.Verify(signature)
+		assert.NoError(t, err, version)
+	}
 
 	// If we use the default directory mechanism, GNUPGHOME is respected.
 	origGNUPGHOME := os.Getenv("GNUPGHOME")
@@ -89,8 +108,10 @@ func TestNewGPGSigningMechanismInDirectory(t *testing.T) {
 	mech, err = newGPGSigningMechanismInDirectory("")
 	require.NoError(t, err)
 	defer mech.Close()
-	_, _, err = mech.Verify(signature)
-	assert.NoError(t, err)
+	for version, signature := range signatures {
+		_, _, err := mech.Verify(signature)
+		assert.NoError(t, err, version)
+	}
 }
 
 func TestNewEphemeralGPGSigningMechanism(t *testing.T) {
@@ -100,10 +121,11 @@ func TestNewEphemeralGPGSigningMechanism(t *testing.T) {
 	defer mech.Close()
 	assert.Empty(t, keyIdentities)
 	// Try validating a signature when the key is unknown.
-	signature, err := ioutil.ReadFile("./fixtures/invalid-blob.signature")
-	require.NoError(t, err)
-	content, signingFingerprint, err := mech.Verify(signature)
-	require.Error(t, err)
+	signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
+	for version, signature := range signatures {
+		_, _, err := mech.Verify(signature)
+		require.Error(t, err, version)
+	}
 
 	// Successful import
 	keyBlob, err := ioutil.ReadFile("./fixtures/public-key.gpg")
@@ -113,10 +135,12 @@ func TestNewEphemeralGPGSigningMechanism(t *testing.T) {
 	defer mech.Close()
 	assert.Equal(t, []string{TestKeyFingerprint}, keyIdentities)
 	// After import, the signature should validate.
-	content, signingFingerprint, err = mech.Verify(signature)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("This is not JSON\n"), content)
-	assert.Equal(t, TestKeyFingerprint, signingFingerprint)
+	for version, signature := range signatures {
+		content, signingFingerprint, err := mech.Verify(signature)
+		require.NoError(t, err, version)
+		assert.Equal(t, []byte("This is not JSON\n"), content, version)
+		assert.Equal(t, TestKeyFingerprint, signingFingerprint, version)
+	}
 
 	// Two keys: Read the binary-format pubring.gpg, and concatenate it twice.
 	// (Using two copies of public-key.gpg, in the ASCII-armored format, works with
@@ -176,10 +200,10 @@ func TestGPGSigningMechanismSign(t *testing.T) {
 	// The various GPG/GPGME failures cases are not obviously easy to reach.
 }
 
-func assertSigningError(t *testing.T, content []byte, fingerprint string, err error) {
-	assert.Error(t, err)
-	assert.Nil(t, content)
-	assert.Empty(t, fingerprint)
+func assertSigningError(t *testing.T, content []byte, fingerprint string, err error, msgAndArgs ...interface{}) {
+	assert.Error(t, err, msgAndArgs...)
+	assert.Nil(t, content, msgAndArgs...)
+	assert.Empty(t, fingerprint, msgAndArgs...)
 }
 
 func TestGPGSigningMechanismVerify(t *testing.T) {
@@ -188,30 +212,31 @@ func TestGPGSigningMechanismVerify(t *testing.T) {
 	defer mech.Close()
 
 	// Successful verification
-	signature, err := ioutil.ReadFile("./fixtures/invalid-blob.signature")
-	require.NoError(t, err)
-	content, signingFingerprint, err := mech.Verify(signature)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("This is not JSON\n"), content)
-	assert.Equal(t, TestKeyFingerprint, signingFingerprint)
+	signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
+	for variant, signature := range signatures {
+		content, signingFingerprint, err := mech.Verify(signature)
+		require.NoError(t, err, variant)
+		assert.Equal(t, []byte("This is not JSON\n"), content, variant)
+		assert.Equal(t, TestKeyFingerprint, signingFingerprint, variant)
+	}
 
 	// For extra paranoia, test that we return nil data on error.
 
 	// Completely invalid signature.
-	content, signingFingerprint, err = mech.Verify([]byte{})
+	content, signingFingerprint, err := mech.Verify([]byte{})
 	assertSigningError(t, content, signingFingerprint, err)
 
 	content, signingFingerprint, err = mech.Verify([]byte("invalid signature"))
 	assertSigningError(t, content, signingFingerprint, err)
 
 	// Literal packet, not a signature
-	signature, err = ioutil.ReadFile("./fixtures/unsigned-literal.signature")
+	signature, err := ioutil.ReadFile("./fixtures/unsigned-literal.signature") // Not fixtureVariants, the “literal data” packet does not have V3/V4 versions.
 	require.NoError(t, err)
 	content, signingFingerprint, err = mech.Verify(signature)
 	assertSigningError(t, content, signingFingerprint, err)
 
 	// Encrypted data, not a signature.
-	signature, err = ioutil.ReadFile("./fixtures/unsigned-encrypted.signature")
+	signature, err = ioutil.ReadFile("./fixtures/unsigned-encrypted.signature") // Not fixtureVariants, the “public-key encrypted session key” does not have V3/V4 versions.
 	require.NoError(t, err)
 	content, signingFingerprint, err = mech.Verify(signature)
 	assertSigningError(t, content, signingFingerprint, err)
@@ -219,22 +244,24 @@ func TestGPGSigningMechanismVerify(t *testing.T) {
 	// FIXME? Is there a way to create a multi-signature so that gpgme_op_verify returns multiple signatures?
 
 	// Expired signature
-	signature, err = ioutil.ReadFile("./fixtures/expired.signature")
+	signature, err = ioutil.ReadFile("./fixtures/expired.signature") // Not fixtureVariants, V3 signature packets don’t support expiration.
 	require.NoError(t, err)
 	content, signingFingerprint, err = mech.Verify(signature)
 	assertSigningError(t, content, signingFingerprint, err)
 
 	// Corrupt signature
-	signature, err = ioutil.ReadFile("./fixtures/corrupt.signature")
-	require.NoError(t, err)
-	content, signingFingerprint, err = mech.Verify(signature)
-	assertSigningError(t, content, signingFingerprint, err)
+	signatures = fixtureVariants(t, "./fixtures/corrupt.signature")
+	for version, signature := range signatures {
+		content, signingFingerprint, err := mech.Verify(signature)
+		assertSigningError(t, content, signingFingerprint, err, version)
+	}
 
 	// Valid signature with an unknown key
-	signature, err = ioutil.ReadFile("./fixtures/unknown-key.signature")
-	require.NoError(t, err)
-	content, signingFingerprint, err = mech.Verify(signature)
-	assertSigningError(t, content, signingFingerprint, err)
+	signatures = fixtureVariants(t, "./fixtures/unknown-key.signature")
+	for version, signature := range signatures {
+		content, signingFingerprint, err := mech.Verify(signature)
+		assertSigningError(t, content, signingFingerprint, err, version)
+	}
 
 	// The various GPG/GPGME failures cases are not obviously easy to reach.
 }
@@ -245,12 +272,13 @@ func TestGPGSigningMechanismUntrustedSignatureContents(t *testing.T) {
 	defer mech.Close()
 
 	// A valid signature
-	signature, err := ioutil.ReadFile("./fixtures/invalid-blob.signature")
-	require.NoError(t, err)
-	content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
-	require.NoError(t, err)
-	assert.Equal(t, []byte("This is not JSON\n"), content)
-	assert.Equal(t, TestKeyShortID, shortKeyID)
+	signatures := fixtureVariants(t, "./fixtures/invalid-blob.signature")
+	for version, signature := range signatures {
+		content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
+		require.NoError(t, err, version)
+		assert.Equal(t, []byte("This is not JSON\n"), content, version)
+		assert.Equal(t, TestKeyShortID, shortKeyID, version)
+	}
 
 	// Completely invalid signature.
 	_, _, err = mech.UntrustedSignatureContents([]byte{})
@@ -260,19 +288,19 @@ func TestGPGSigningMechanismUntrustedSignatureContents(t *testing.T) {
 	assert.Error(t, err)
 
 	// Literal packet, not a signature
-	signature, err = ioutil.ReadFile("./fixtures/unsigned-literal.signature")
+	signature, err := ioutil.ReadFile("./fixtures/unsigned-literal.signature") // Not fixtureVariants, the “literal data” packet does not have V3/V4 versions.
 	require.NoError(t, err)
-	content, shortKeyID, err = mech.UntrustedSignatureContents(signature)
+	content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
 	assert.Error(t, err)
 
 	// Encrypted data, not a signature.
-	signature, err = ioutil.ReadFile("./fixtures/unsigned-encrypted.signature")
+	signature, err = ioutil.ReadFile("./fixtures/unsigned-encrypted.signature") // Not fixtureVariants, the “public-key encrypted session key” does not have V3/V4 versions.
 	require.NoError(t, err)
 	content, shortKeyID, err = mech.UntrustedSignatureContents(signature)
 	assert.Error(t, err)
 
 	// Expired signature
-	signature, err = ioutil.ReadFile("./fixtures/expired.signature")
+	signature, err = ioutil.ReadFile("./fixtures/expired.signature") // Not fixtureVariants, V3 signature packets don’t support expiration.
 	require.NoError(t, err)
 	content, shortKeyID, err = mech.UntrustedSignatureContents(signature)
 	require.NoError(t, err)
@@ -280,18 +308,20 @@ func TestGPGSigningMechanismUntrustedSignatureContents(t *testing.T) {
 	assert.Equal(t, TestKeyShortID, shortKeyID)
 
 	// Corrupt signature
-	signature, err = ioutil.ReadFile("./fixtures/corrupt.signature")
-	require.NoError(t, err)
-	content, shortKeyID, err = mech.UntrustedSignatureContents(signature)
-	require.NoError(t, err)
-	assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic ","timestamp":1458239713}}`), content)
-	assert.Equal(t, TestKeyShortID, shortKeyID)
+	signatures = fixtureVariants(t, "./fixtures/corrupt.signature")
+	for version, signature := range signatures {
+		content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
+		require.NoError(t, err, version)
+		assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic ","timestamp":1458239713}}`), content, version)
+		assert.Equal(t, TestKeyShortID, shortKeyID, version)
+	}
 
 	// Valid signature with an unknown key
-	signature, err = ioutil.ReadFile("./fixtures/unknown-key.signature")
-	require.NoError(t, err)
-	content, shortKeyID, err = mech.UntrustedSignatureContents(signature)
-	require.NoError(t, err)
-	assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic 0.1.13-dev","timestamp":1464633474}}`), content)
-	assert.Equal(t, "E5476D1110D07803", shortKeyID)
+	signatures = fixtureVariants(t, "./fixtures/unknown-key.signature")
+	for version, signature := range signatures {
+		content, shortKeyID, err := mech.UntrustedSignatureContents(signature)
+		require.NoError(t, err, version)
+		assert.Equal(t, []byte(`{"critical":{"identity":{"docker-reference":"testing/manifest"},"image":{"docker-manifest-digest":"sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55"},"type":"atomic container signature"},"optional":{"creator":"atomic 0.1.13-dev","timestamp":1464633474}}`), content, version)
+		assert.Equal(t, "BB75E91990DF8F7E", shortKeyID, version)
+	}
 }