o/devicemgmtstate,o/assertstate: add task to validate request messages

overlord/assertstate/assertstate.go

@@ -1485,3 +1485,33 @@ func ValidatedIntegrityData(st *state.State, snapID string, rev snap.Revision) (
 
 	return integrity.NewIntegrityDataParamsFromRevision(revAssertion)
 }
+
+// AccountKey returns the account-key assertion for the given signing key ID,
+// if it's present in the system assertion database.
+func AccountKey(st *state.State, signKeyID string) (*asserts.AccountKey, error) {
+	db := DB(st)
+	as, err := db.Find(asserts.AccountKeyType, map[string]string{
+		"public-key-sha3-384": signKeyID,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return as.(*asserts.AccountKey), nil
+}
+
+// FetchAccountKey fetches the account-key assertion for the given signing key ID.
+func FetchAccountKey(st *state.State, userID int, signKeyID string) error {
+	deviceCtx, err := snapstate.DevicePastSeeding(st, nil)
+	if err != nil {
+		return err
+	}
+
+	return doFetch(st, userID, deviceCtx, nil, func(f asserts.Fetcher) error {
+		ref := &asserts.Ref{
+			Type:       asserts.AccountKeyType,
+			PrimaryKey: []string{signKeyID},
+		}
+		return f.Fetch(ref)
+	})
+}

overlord/assertstate/assertstate_test.go

@@ -6315,3 +6315,53 @@ func (s *assertMgrSuite) TestValidatedIntegrityDataErrorNoRevisionsFound(c *C) {
 		expErr:         regexp.QuoteMeta("no snap-revision assertion found that matches (snap-id=snap-id-1, snap-revision=10)."),
 	})
 }
+
+func (s *assertMgrSuite) TestFetchAccountKeyOK(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	storeAs := s.setupModelAndStore(c)
+	err := s.storeSigning.Add(storeAs)
+	c.Assert(err, IsNil)
+
+	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
+		Backstore: asserts.NewMemoryBackstore(),
+		Trusted:   s.storeSigning.Trusted,
+	})
+	c.Assert(err, IsNil)
+
+	assertstate.ReplaceDB(s.state, db)
+
+	keyID := s.dev1AcctKey.PublicKeyID()
+
+	// not found locally
+	_, err = assertstate.AccountKey(s.state, keyID)
+	c.Assert(err, testutil.ErrorIs, &asserts.NotFoundError{})
+
+	err = assertstate.FetchAccountKey(s.state, 0, keyID)
+	c.Assert(err, IsNil)
+
+	// found after fetch
+	_, err = assertstate.AccountKey(s.state, keyID)
+	c.Assert(err, IsNil)
+}
+
+func (s *assertMgrSuite) TestFetchAccountKeyError(c *C) {
+	s.state.Lock()
+	defer s.state.Unlock()
+
+	storeAs := s.setupModelAndStore(c)
+	err := s.storeSigning.Add(storeAs)
+	c.Assert(err, IsNil)
+
+	db, err := asserts.OpenDatabase(&asserts.DatabaseConfig{
+		Backstore: asserts.NewMemoryBackstore(),
+		Trusted:   s.storeSigning.Trusted,
+	})
+	c.Assert(err, IsNil)
+
+	assertstate.ReplaceDB(s.state, db)
+
+	err = assertstate.FetchAccountKey(s.state, 0, "no-such-key-id")
+	c.Assert(err, testutil.ErrorIs, &asserts.NotFoundError{})
+}