Test expired metadata

3 files changed, 20 insertions, 8 deletions

diff --git a/mullvad-update/src/format/deserializer.rs b/mullvad-update/src/format/deserializer.rs
index 2601491117..2647bbe212 100644
--- a/mullvad-update/src/format/deserializer.rs
+++ b/mullvad-update/src/format/deserializer.rs
@@ -94,6 +94,8 @@ pub(super) fn deserialize_and_verify(
 
 #[cfg(test)]
 mod test {
+    use std::str::FromStr;
+
     use super::*;
 
     /// Test that a valid signed version response is successfully deserialized and verified
@@ -112,5 +114,14 @@ mod test {
             chrono::DateTime::UNIX_EPOCH,
         )
         .expect("expected valid signed version metadata");
+
+        // Reject expired data
+        SignedResponse::deserialize_and_verify_at_time(
+            VerifyingKey(verifying_key),
+            include_bytes!("../../test-version-response.json"),
+            // In the year 3000
+            chrono::DateTime::from_str("3000-01-01T00:00:00Z").unwrap(),
+        )
+        .expect_err("expected expired version metadata");
     }
 }
diff --git a/mullvad-update/src/format/key.rs b/mullvad-update/src/format/key.rs
index 3fe308f903..b0eed5b4cb 100644
--- a/mullvad-update/src/format/key.rs
+++ b/mullvad-update/src/format/key.rs
@@ -102,6 +102,7 @@ impl Serialize for VerifyingKey {
 }
 
 /// ed25519 signature
+#[derive(Debug)]
 pub struct Signature(pub ed25519_dalek::Signature);
 
 impl<'de> Deserialize<'de> for Signature {
diff --git a/mullvad-update/src/format/mod.rs b/mullvad-update/src/format/mod.rs
index 494bd4ec74..d1957f42ca 100644
--- a/mullvad-update/src/format/mod.rs
+++ b/mullvad-update/src/format/mod.rs
@@ -21,7 +21,7 @@ pub mod serializer;
 /// JSON response including signature and signed content
 /// This type does not implement [serde::Deserialize] to prevent accidental deserialization without
 /// signature verification.
-#[derive(Serialize)]
+#[derive(Debug, Serialize)]
 pub struct SignedResponse {
     /// Signature of the canonicalized JSON of `signed`
     pub signature: ResponseSignature,
@@ -40,7 +40,7 @@ struct PartialSignedResponse {
 }
 
 /// Signed JSON response, not including the signature
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct Response {
     /// When the signature expires
@@ -51,7 +51,7 @@ pub struct Response {
     pub beta: Option<VersionResponse>,
 }
 
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct VersionResponse {
     /// The current version in this channel
     pub current: SpecificVersionResponse,
@@ -59,7 +59,7 @@ pub struct VersionResponse {
     pub next: Option<NextSpecificVersionResponse>,
 }
 
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct NextSpecificVersionResponse {
     /// The percentage of users that should receive the new version.
     pub rollout: f32,
@@ -67,7 +67,7 @@ pub struct NextSpecificVersionResponse {
     pub version: SpecificVersionResponse,
 }
 
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct SpecificVersionResponse {
     /// Mullvad app version
     pub version: mullvad_version::Version,
@@ -78,7 +78,7 @@ pub struct SpecificVersionResponse {
 }
 
 /// Version details for supported architectures
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct SpecificVersionArchitectureResponses {
     /// Details for x86 installer
     pub x86: Option<SpecificVersionArchitectureResponse>,
@@ -86,7 +86,7 @@ pub struct SpecificVersionArchitectureResponses {
     pub arm64: Option<SpecificVersionArchitectureResponse>,
 }
 
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct SpecificVersionArchitectureResponse {
     /// Mirrors that host the artifact
     pub urls: Vec<String>,
@@ -97,7 +97,7 @@ pub struct SpecificVersionArchitectureResponse {
 }
 
 /// JSON response signature
-#[derive(Deserialize, Serialize)]
+#[derive(Debug, Deserialize, Serialize)]
 pub struct ResponseSignature {
     pub keyid: key::VerifyingKey,
     pub sig: key::Signature,