我正在尝试按照Node.js 中的描述实现 Safari 推送通知，以便在 Google Cloud Function 中运行。
我正在尝试使用forge创建分离的 PKCS#7 签名，但我的"Signature verification of push package failed"日志记录端点上总是出现错误。我尝试signature以 DER 和 PEM 格式对它们进行编码，但均未成功。基于 Apple 的 PHP 示例，他们想要 DER。我也尝试过使用该safari push notifications 软件包但没有成功。
这是代码：
import * as functions from "firebase-functions";
import * as admin from "firebase-admin";
import fs from "fs";
import path from "path";
import express from "express";
import crypto from "crypto";
import forge from "node-forge";
import archiver from "archiver";
const app = express();
const iconFiles = [
"icon_16x16.png",
"icon_16x16@2x.png",
"icon_32x32.png",
"icon_32x32@2x.png",
"icon_128x128.png",
"icon_128x128@2x.png",
];
const websiteJson = {
websiteName: "...",
websitePushID: "web.<...>",
allowedDomains: ["..."],
urlFormatString: "...",
authenticationToken: "...",
webServiceURL: "...",
};
const p12Asn1 = forge.asn1.fromDer(fs.readFileSync("./certs/apple_push.p12", 'binary'));
const p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, functions.config().safari.keypassword);
const certBags = p12.getBags({bagType: forge.pki.oids.certBag});
const certBag = certBags[forge.pki.oids.certBag];
const cert = certBag[0].cert;
const keyBags = p12.getBags({bagType: forge.pki.oids.pkcs8ShroudedKeyBag});
const keyBag = keyBags[forge.pki.oids.pkcs8ShroudedKeyBag];
const key = keyBag[0].key;
const intermediate = forge.pki.certificateFromPem(fs.readFileSync("./certs/intermediate.pem", "utf8"));
app.post("/:version/pushPackages/:websitePushId", async (req, res) => {
if (!cert) {
console.log("cert is null");
res.sendStatus(500);
return;
}
if (!key) {
console.log("key is null");
res.sendStatus(500);
return;
}
const iconSourceDir = "...";
res.attachment("pushpackage.zip");
const archive = archiver("zip");
archive.on("error", function (err) {
res.status(500).send({ error: err.message });
return;
});
archive.on("warning", function (err) {
if (err.code === "ENOENT") {
console.log(`Archive warning ${err}`);
} else {
throw err;
}
});
archive.on("end", function () {
console.log("Archive wrote %d bytes", archive.pointer());
});
archive.pipe(res);
archive.directory(iconSourceDir, "icon.iconset");
const manifest: {
[key: string]: { hashType: string; hashValue: string };
} = {};
const readPromises: Promise<void>[] = [];
iconFiles.forEach((i) =>
readPromises.push(
new Promise((resolve, reject) => {
const hash = crypto.createHash("sha512");
const readStream = fs.createReadStream(
path.join(iconSourceDir, i),
{ encoding: "utf8" }
);
readStream.on("data", (chunk) => {
hash.update(chunk);
});
readStream.on("end", () => {
const digest = hash.digest("hex");
manifest[`icon.iconset/${i}`] = {
hashType: "sha512",
hashValue: `${digest}`,
};
resolve();
});
readStream.on("error", (err) => {
console.log(`Error on readStream for ${i}; ${err}`);
reject();
});
})
)
);
try {
await Promise.all(readPromises);
} catch (error) {
console.log(`Error writing files; ${error}`);
res.sendStatus(500);
return;
}
const webJSON = {
...websiteJson,
...{ authenticationToken: "..." },
};
const webHash = crypto.createHash("sha512");
const webJSONString = JSON.stringify(webJSON);
webHash.update(webJSONString);
manifest["website.json"] = {
hashType: "sha512",
hashValue: `${webHash.digest("hex")}`,
};
const manifestJSONString = JSON.stringify(manifest);
archive.append(webJSONString, { name: "website.json" });
archive.append(manifestJSONString, { name: "manifest.json" });
const p7 = forge.pkcs7.createSignedData();
p7.content = forge.util.createBuffer(manifestJSONString, "utf8");
p7.addCertificate(cert);
p7.addCertificate(intermediate);
p7.addSigner({
// @ts-ignore
key,
certificate: cert,
digestAlgorithm: forge.pki.oids.sha256,
authenticatedAttributes: [{
type: forge.pki.oids.contentType,
value: forge.pki.oids.data
}, {
type: forge.pki.oids.messageDigest
}, {
type: forge.pki.oids.signingTime,
value: new Date().toString()
}]
});
p7.sign({ detached: true });
const pem = forge.pkcs7.messageToPem(p7);
archive.append(Buffer.from(pem, 'binary'), { name: "signature" });
// Have also tried this:
// archive.append(forge.asn1.toDer(p7.toAsn1()).getBytes(), { name: "signature" });
try {
await archive.finalize();
} catch (error) {
console.log(`Error on archive.finalize(); ${error}`);
res.sendStatus(500);
return;
}
});
当我下载并解压缩我的包时，我运行以下命令：
openssl smime -verify -in signature -content manifest.json -inform der -noverify
它返回：Verification successful
关于我哪里出错的任何建议？