[Collections] Add skip signature check option to 'add' (#3291)

yim-lee · web-flow · commit 5d0e1912ac6a · 2021-02-18T12:36:36.000-08:00
Motivation:
On non-Apple platforms since there are no trusted root certificates by default, signature checks will most certainly fail. To help people get started more quickly, and to offer people a way to opt-out, we will add a `--skip-signature-check` flag to the `add` collection command. User's selection is persisted to collection sources config such that `refresh` would honor it as well.

Modifications:
- Add `skipSignatureCheck` to `CollectionSource`
- Add `--skip-signature-check` to CLI
- Add `isVerified` to `Collection.SignatureData`. It is `false` when `skipSignatureCheck == true`.
- Update logic in `JSONPackageCollectionProvider` to honor `skipSignatureCheck`
- Update CLI to handle `cannotVerifySignature` error
diff --git a/Sources/Commands/SwiftPackageCollectionsTool.swift b/Sources/Commands/SwiftPackageCollectionsTool.swift
@@ -20,8 +20,10 @@ private enum CollectionsError: Swift.Error {
     case invalidArgument(String)
     case invalidVersionString(String)
     case unsigned
+    case cannotVerifySignature
 }
 
+// FIXME: add links to docs in error messages
 extension CollectionsError: CustomStringConvertible {
     var description: String {
         switch self {
@@ -31,6 +33,8 @@ extension CollectionsError: CustomStringConvertible {
             return "Invalid version string '\(versionString)'"
         case .unsigned:
             return "The collection is not signed. If you would still like to add it please rerun 'add' with '--trust-unsigned'."
+        case .cannotVerifySignature:
+            return "The collection's signature cannot be verified due to missing configuration. Please refer to documentations on how to set up trusted root certificates or rerun 'add' with '--skip-signature-check."
         }
     }
 }
@@ -106,12 +110,15 @@ public struct SwiftPackageCollectionsTool: ParsableCommand {
         @Flag(name: .long, help: "Trust the collection even if it is unsigned")
         var trustUnsigned: Bool = false
 
+        @Flag(name: .long, help: "Skip signature check if the collection is signed")
+        var skipSignatureCheck: Bool = false
+
         mutating func run() throws {
             guard let collectionUrl = URL(string: collectionUrl) else {
                 throw CollectionsError.invalidArgument("collectionUrl")
             }
 
-            let source = PackageCollectionsModel.CollectionSource(type: .json, url: collectionUrl)
+            let source = PackageCollectionsModel.CollectionSource(type: .json, url: collectionUrl, skipSignatureCheck: self.skipSignatureCheck)
             let collection: PackageCollectionsModel.Collection = try with { collections in
                 do {
                     let userTrusted = self.trustUnsigned
@@ -125,6 +132,8 @@ public struct SwiftPackageCollectionsTool: ParsableCommand {
                     }
                 } catch PackageCollectionError.trustConfirmationRequired, PackageCollectionError.untrusted {
                     throw CollectionsError.unsigned
+                } catch PackageCollectionError.cannotVerifySignature {
+                    throw CollectionsError.cannotVerifySignature
                 }
             }
 
diff --git a/Sources/PackageCollections/API.swift b/Sources/PackageCollections/API.swift
@@ -174,4 +174,8 @@ public enum PackageCollectionError: Equatable, Error {
 
     /// Package collection is not signed and user explicitly marks it untrusted
     case untrusted
+
+    /// There are no trusted root certificates. Signature check cannot be done in this case since it involves validating
+    /// the certificate chain that is used for signing and one requirement is that the root certificate must be trusted.
+    case cannotVerifySignature
 }
diff --git a/Sources/PackageCollections/Model/Collection.swift b/Sources/PackageCollections/Model/Collection.swift
@@ -100,13 +100,17 @@ extension PackageCollectionsModel {
         /// Indicates if the source is explicitly trusted or untrusted by the user
         public var isTrusted: Bool?
 
+        /// Indicates if the source can skip signature validation
+        public var skipSignatureCheck: Bool
+
         /// The source's absolute file system path, if its URL is of 'file' scheme.
         let absolutePath: AbsolutePath?
 
-        public init(type: CollectionSourceType, url: URL, isTrusted: Bool? = nil) {
+        public init(type: CollectionSourceType, url: URL, isTrusted: Bool? = nil, skipSignatureCheck: Bool = false) {
             self.type = type
             self.url = url
             self.isTrusted = isTrusted
+            self.skipSignatureCheck = skipSignatureCheck
 
             if url.scheme?.lowercased() == "file", let absolutePath = try? AbsolutePath(validating: url.path) {
                 self.absolutePath = absolutePath
@@ -192,8 +196,12 @@ extension PackageCollectionsModel {
         /// Details about the certificate used to generate the signature
         public let certificate: Certificate
 
-        public init(certificate: Certificate) {
+        /// Indicates if the signature has been validated. This is set to false if signature check didn't take place.
+        public let isVerified: Bool
+
+        public init(certificate: Certificate, isVerified: Bool) {
             self.certificate = certificate
+            self.isVerified = isVerified
         }
 
         public struct Certificate: Equatable, Codable {
diff --git a/Sources/PackageCollections/PackageCollections.swift b/Sources/PackageCollections/PackageCollections.swift
@@ -140,8 +140,9 @@ public struct PackageCollections: PackageCollectionsProtocol {
                 self.refreshCollectionFromSource(source: source, trustConfirmationProvider: trustConfirmationProvider) { collectionResult in
                     switch collectionResult {
                     case .failure(let error):
-                        // Don't delete the source if we are either pending user confirmation or have recorded user's preference
-                        if let error = error as? PackageCollectionError, error == .trustConfirmationRequired || error == .untrusted {
+                        // Don't delete the source if we are either pending user confirmation or have recorded user's preference.
+                        // It is also possible that we can't verify signature (yet) due to config issue, which user can fix and we retry later.
+                        if let error = error as? PackageCollectionError, error == .trustConfirmationRequired || error == .untrusted || error == .cannotVerifySignature {
                             return callback(.failure(error))
                         }
                         // Otherwise remove source since it fails to be fetched
diff --git a/Sources/PackageCollections/Providers/JSONPackageCollectionProvider.swift b/Sources/PackageCollections/Providers/JSONPackageCollectionProvider.swift
@@ -10,6 +10,7 @@
 
 import Basics
 import Dispatch
+import struct Foundation.Data
 import struct Foundation.Date
 import class Foundation.JSONDecoder
 import struct Foundation.URL
@@ -49,14 +50,9 @@ struct JSONPackageCollectionProvider: PackageCollectionProvider {
         if let absolutePath = source.absolutePath {
             do {
                 let fileContents = try localFileSystem.readFileContents(absolutePath)
-                let collection: JSONModel.Collection = try fileContents.withData { data in
-                    do {
-                        return try self.decoder.decode(JSONModel.Collection.self, from: data)
-                    } catch {
-                        throw Errors.invalidJSON(error)
-                    }
+                return fileContents.withData { data in
+                    self.decodeAndRunSignatureCheck(source: source, data: data, callback: callback)
                 }
-                return callback(self.makeCollection(from: collection, source: source, signature: nil))
             } catch {
                 return callback(.failure(error))
             }
@@ -97,33 +93,43 @@ struct JSONPackageCollectionProvider: PackageCollectionProvider {
                             return callback(.failure(Errors.invalidResponse("Body is empty")))
                         }
 
-                        do {
-                            // parse json and construct result
-                            do {
-                                // This fails if "signature" is missing
-                                let signature = try JSONModel.SignedCollection.signature(from: body, using: self.decoder)
-                                // TODO: Check collection's signature
-                                // If signature is
-                                //      a. valid: process the collection; set isSigned=true
-                                //      b. invalid: includes expired cert, untrusted cert, signature-payload mismatch => return error
-                                let collection = try JSONModel.SignedCollection.collection(from: body, using: self.decoder)
-                                callback(self.makeCollection(from: collection, source: source, signature: Model.SignatureData(from: signature)))
-                            } catch {
-                                // Collection is not signed
-                                guard let collection = try response.decodeBody(JSONModel.Collection.self, using: self.decoder) else {
-                                    return callback(.failure(Errors.invalidResponse("Invalid body")))
-                                }
-                                callback(self.makeCollection(from: collection, source: source, signature: nil))
-                            }
-                        } catch {
-                            callback(.failure(Errors.invalidJSON(error)))
-                        }
+                        self.decodeAndRunSignatureCheck(source: source, data: body, callback: callback)
                     }
                 }
             }
         }
     }
 
+    private func decodeAndRunSignatureCheck(source: Model.CollectionSource,
+                                            data: Data,
+                                            callback: @escaping (Result<Model.Collection, Error>) -> Void) {
+        do {
+            // This fails if "signature" is missing
+            let signature = try JSONModel.SignedCollection.signature(from: data, using: self.decoder)
+            if source.skipSignatureCheck {
+                // Don't validate signature but set isVerified=false
+                let collection = try JSONModel.SignedCollection.collection(from: data, using: self.decoder)
+                callback(self.makeCollection(from: collection, source: source, signature: Model.SignatureData(from: signature, isVerified: false)))
+            } else {
+                // TODO: Signature validator should throw "cannot verify" error on non-Apple platforms
+                // if there are no trusted root certs set up, in which case we should throw PackageCollectionError.cannotVerifySignature
+
+                // TODO: Check collection's signature
+                // If signature is
+                //      a. valid: process the collection; set isSigned=true
+                //      b. invalid: includes expired cert, untrusted cert, signature-payload mismatch => return error
+                let collection = try JSONModel.SignedCollection.collection(from: data, using: self.decoder)
+                callback(self.makeCollection(from: collection, source: source, signature: Model.SignatureData(from: signature, isVerified: true)))
+            }
+        } catch {
+            // Collection is not signed
+            guard let collection = try? self.decoder.decode(JSONModel.Collection.self, from: data) else {
+                return callback(.failure(Errors.invalidJSON(error)))
+            }
+            callback(self.makeCollection(from: collection, source: source, signature: nil))
+        }
+    }
+
     private func makeCollection(from collection: JSONModel.Collection, source: Model.CollectionSource, signature: Model.SignatureData?) -> Result<Model.Collection, Error> {
         if let errors = self.validator.validate(collection: collection)?.errors() {
             return .failure(MultipleErrors(errors))
@@ -380,8 +386,9 @@ extension Model.License {
 }
 
 extension Model.SignatureData {
-    fileprivate init(from: JSONModel.Signature) {
+    fileprivate init(from: JSONModel.Signature, isVerified: Bool) {
         self.certificate = .init(from: from.certificate)
+        self.isVerified = isVerified
     }
 }
 
diff --git a/Sources/PackageCollections/Storage/FilePackageCollectionsSourcesStorage.swift b/Sources/PackageCollections/Storage/FilePackageCollectionsSourcesStorage.swift
@@ -187,6 +187,7 @@ private enum StorageModel {
         let type: String
         let value: String
         let isTrusted: Bool?
+        let skipSignatureCheck: Bool?
     }
 
     enum SourceType: String {
@@ -204,7 +205,7 @@ private extension Model.CollectionSource {
 
         switch from.type {
         case StorageModel.SourceType.json.rawValue:
-            self.init(type: .json, url: url, isTrusted: from.isTrusted)
+            self.init(type: .json, url: url, isTrusted: from.isTrusted, skipSignatureCheck: from.skipSignatureCheck ?? false)
         default:
             throw SerializationError.unknownType(from.type)
         }
@@ -213,7 +214,8 @@ private extension Model.CollectionSource {
     func source() -> StorageModel.Source {
         switch self.type {
         case .json:
-            return .init(type: StorageModel.SourceType.json.rawValue, value: self.url.absoluteString, isTrusted: self.isTrusted)
+            return .init(type: StorageModel.SourceType.json.rawValue, value: self.url.absoluteString,
+                         isTrusted: self.isTrusted, skipSignatureCheck: self.skipSignatureCheck)
         }
     }
 }
diff --git a/Tests/PackageCollectionsTests/JSONPackageCollectionProviderTests.swift b/Tests/PackageCollectionsTests/JSONPackageCollectionProviderTests.swift
@@ -132,6 +132,69 @@ class JSONPackageCollectionProviderTests: XCTestCase {
             XCTAssertNotNil(version.createdAt)
             XCTAssertTrue(collection.isSigned)
             let signature = collection.signature!
+            XCTAssertTrue(signature.isVerified)
+            XCTAssertEqual("Sample Subject", signature.certificate.subject.commonName)
+            XCTAssertEqual("Sample Issuer", signature.certificate.issuer.commonName)
+        }
+    }
+
+    func testGoodSigned_skipSignatureCheck() throws {
+        fixture(name: "Collections") { directoryPath in
+            let path = directoryPath.appending(components: "JSON", "good_signed.json")
+            let url = URL(string: "https://www.test.com/collection.json")!
+            let data = Data(try localFileSystem.readFileContents(path).contents)
+
+            let handler: HTTPClient.Handler = { request, _, completion in
+                XCTAssertEqual(request.url, url, "url should match")
+                switch request.method {
+                case .head:
+                    completion(.success(.init(statusCode: 200,
+                                              headers: .init([.init(name: "Content-Length", value: "\(data.count)")]))))
+                case .get:
+                    completion(.success(.init(statusCode: 200,
+                                              headers: .init([.init(name: "Content-Length", value: "\(data.count)")]),
+                                              body: data)))
+                default:
+                    XCTFail("method should match")
+                }
+            }
+
+            var httpClient = HTTPClient(handler: handler)
+            httpClient.configuration.circuitBreakerStrategy = .none
+            httpClient.configuration.retryStrategy = .none
+            let provider = JSONPackageCollectionProvider(httpClient: httpClient)
+            // Skip signature check
+            let source = PackageCollectionsModel.CollectionSource(type: .json, url: url, skipSignatureCheck: true)
+            let collection = try tsc_await { callback in provider.get(source, callback: callback) }
+
+            XCTAssertEqual(collection.name, "Sample Package Collection")
+            XCTAssertEqual(collection.overview, "This is a sample package collection listing made-up packages.")
+            XCTAssertEqual(collection.keywords, ["sample package collection"])
+            XCTAssertEqual(collection.createdBy?.name, "Jane Doe")
+            XCTAssertEqual(collection.packages.count, 2)
+            let package = collection.packages.first!
+            XCTAssertEqual(package.repository, .init(url: "https://www.example.com/repos/RepoOne.git"))
+            XCTAssertEqual(package.summary, "Package One")
+            XCTAssertEqual(package.keywords, ["sample package"])
+            XCTAssertEqual(package.readmeURL, URL(string: "https://www.example.com/repos/RepoOne/README")!)
+            XCTAssertEqual(package.license, .init(type: .Apache2_0, url: URL(string: "https://www.example.com/repos/RepoOne/LICENSE")!))
+            XCTAssertEqual(package.versions.count, 1)
+            let version = package.versions.first!
+            XCTAssertEqual(version.summary, "Fixed a few bugs")
+            let manifest = version.manifests.values.first!
+            XCTAssertEqual(manifest.packageName, "PackageOne")
+            XCTAssertEqual(manifest.targets, [.init(name: "Foo", moduleName: "Foo")])
+            XCTAssertEqual(manifest.products, [.init(name: "Foo", type: .library(.automatic), targets: [.init(name: "Foo", moduleName: "Foo")])])
+            XCTAssertEqual(manifest.toolsVersion, ToolsVersion(string: "5.1")!)
+            XCTAssertEqual(manifest.minimumPlatformVersions, [SupportedPlatform(platform: .macOS, version: .init("10.15"))])
+            XCTAssertEqual(version.verifiedCompatibility?.count, 3)
+            XCTAssertEqual(version.verifiedCompatibility!.first!.platform, .macOS)
+            XCTAssertEqual(version.verifiedCompatibility!.first!.swiftVersion, SwiftLanguageVersion(string: "5.1")!)
+            XCTAssertEqual(version.license, .init(type: .Apache2_0, url: URL(string: "https://www.example.com/repos/RepoOne/LICENSE")!))
+            XCTAssertNotNil(version.createdAt)
+            XCTAssertTrue(collection.isSigned)
+            let signature = collection.signature!
+            XCTAssertFalse(signature.isVerified)
             XCTAssertEqual("Sample Subject", signature.certificate.subject.commonName)
             XCTAssertEqual("Sample Issuer", signature.certificate.issuer.commonName)
         }
diff --git a/Tests/PackageCollectionsTests/PackageCollectionsSourcesStorageTest.swift b/Tests/PackageCollectionsTests/PackageCollectionsSourcesStorageTest.swift
@@ -86,7 +86,16 @@ final class PackageCollectionsSourcesStorageTest: XCTestCase {
             source.isTrusted = !(source.isTrusted ?? false)
             _ = try tsc_await { callback in storage.update(source: source, callback: callback) }
             let listAfter = try tsc_await { callback in storage.list(callback: callback) }
-            XCTAssertEqual(source.isTrusted, listAfter.first!.isTrusted, "item should match")
+            XCTAssertEqual(source.isTrusted, listAfter.first!.isTrusted, "isTrusted should match")
+        }
+
+        do {
+            let list = try tsc_await { callback in storage.list(callback: callback) }
+            var source = list.first!
+            source.skipSignatureCheck = !source.skipSignatureCheck
+            _ = try tsc_await { callback in storage.update(source: source, callback: callback) }
+            let listAfter = try tsc_await { callback in storage.list(callback: callback) }
+            XCTAssertEqual(source.skipSignatureCheck, listAfter.first!.skipSignatureCheck, "skipSignatureCheck should match")
         }
     }
 
diff --git a/Tests/PackageCollectionsTests/PackageCollectionsTests.swift b/Tests/PackageCollectionsTests/PackageCollectionsTests.swift
@@ -831,7 +831,8 @@ final class PackageCollectionsTests: XCTestCase {
                         certificate: PackageCollectionsModel.SignatureData.Certificate(
                             subject: .init(userID: nil, commonName: nil, organizationalUnit: nil, organization: nil),
                             issuer: .init(userID: nil, commonName: nil, organizationalUnit: nil, organization: nil)
-                        )
+                        ),
+                        isVerified: true
                     )
                     callback(.success(PackageCollectionsModel.Collection(source: source, name: "", overview: nil, keywords: nil, packages: [], createdAt: Date(), createdBy: nil, signature: signature)))
                 }
diff --git a/Tests/PackageCollectionsTests/Utility.swift b/Tests/PackageCollectionsTests/Utility.swift
@@ -88,7 +88,8 @@ func makeMockCollections(count: Int = Int.random(in: 50 ... 100), maxPackages: I
                 certificate: PackageCollectionsModel.SignatureData.Certificate(
                     subject: .init(userID: nil, commonName: "subject-\(collectionIndex)", organizationalUnit: nil, organization: nil),
                     issuer: .init(userID: nil, commonName: "issuer-\(collectionIndex)", organizationalUnit: nil, organization: nil)
-                )
+                ),
+                isVerified: true
             )
         }
 

Original file line number	Diff line number	Diff line change
`@@ -20,8 +20,10 @@ private enum CollectionsError: Swift.Error {`
`20`	`20`	`case invalidArgument(String)`
`21`	`21`	`case invalidVersionString(String)`
`22`	`22`	`case unsigned`
	`23`	`+ case cannotVerifySignature`
`23`	`24`	`}`
`24`	`25`
	`26`	`+// FIXME: add links to docs in error messages`
`25`	`27`	`extension CollectionsError: CustomStringConvertible {`
`26`	`28`	`var description: String {`
`27`	`29`	`switch self {`
`@@ -31,6 +33,8 @@ extension CollectionsError: CustomStringConvertible {`
`31`	`33`	`return "Invalid version string '\(versionString)'"`
`32`	`34`	`case .unsigned:`
`33`	`35`	`return "The collection is not signed. If you would still like to add it please rerun 'add' with '--trust-unsigned'."`
	`36`	`+ case .cannotVerifySignature:`
	`37`	`+ return "The collection's signature cannot be verified due to missing configuration. Please refer to documentations on how to set up trusted root certificates or rerun 'add' with '--skip-signature-check."`
`34`	`38`	`}`
`35`	`39`	`}`
`36`	`40`	`}`
`@@ -106,12 +110,15 @@ public struct SwiftPackageCollectionsTool: ParsableCommand {`
`106`	`110`	`@Flag(name: .long, help: "Trust the collection even if it is unsigned")`
`107`	`111`	`var trustUnsigned: Bool = false`
`108`	`112`
	`113`	`+ @Flag(name: .long, help: "Skip signature check if the collection is signed")`
	`114`	`+ var skipSignatureCheck: Bool = false`
	`115`	`+`
`109`	`116`	`mutating func run() throws {`
`110`	`117`	`guard let collectionUrl = URL(string: collectionUrl) else {`
`111`	`118`	`throw CollectionsError.invalidArgument("collectionUrl")`
`112`	`119`	`}`
`113`	`120`
`114`		`- let source = PackageCollectionsModel.CollectionSource(type: .json, url: collectionUrl)`
	`121`	`+ let source = PackageCollectionsModel.CollectionSource(type: .json, url: collectionUrl, skipSignatureCheck: self.skipSignatureCheck)`
`115`	`122`	`let collection: PackageCollectionsModel.Collection = try with { collections in`
`116`	`123`	`do {`
`117`	`124`	`let userTrusted = self.trustUnsigned`
`@@ -125,6 +132,8 @@ public struct SwiftPackageCollectionsTool: ParsableCommand {`
`125`	`132`	`}`
`126`	`133`	`} catch PackageCollectionError.trustConfirmationRequired, PackageCollectionError.untrusted {`
`127`	`134`	`throw CollectionsError.unsigned`
	`135`	`+ } catch PackageCollectionError.cannotVerifySignature {`
	`136`	`+ throw CollectionsError.cannotVerifySignature`
`128`	`137`	`}`
`129`	`138`	`}`
`130`	`139`
Original file line number	Diff line number	Diff line change
`@@ -174,4 +174,8 @@ public enum PackageCollectionError: Equatable, Error {`
`174`	`174`
`175`	`175`	`/// Package collection is not signed and user explicitly marks it untrusted`
`176`	`176`	`case untrusted`
	`177`	`+`
	`178`	`+ /// There are no trusted root certificates. Signature check cannot be done in this case since it involves validating`
	`179`	`+ /// the certificate chain that is used for signing and one requirement is that the root certificate must be trusted.`
	`180`	`+ case cannotVerifySignature`
`177`	`181`	`}`
Original file line number	Diff line number	Diff line change
`@@ -187,6 +187,7 @@ private enum StorageModel {`
`187`	`187`	`let type: String`
`188`	`188`	`let value: String`
`189`	`189`	`let isTrusted: Bool?`
	`190`	`+ let skipSignatureCheck: Bool?`
`190`	`191`	`}`
`191`	`192`
`192`	`193`	`enum SourceType: String {`
`@@ -204,7 +205,7 @@ private extension Model.CollectionSource {`
`204`	`205`
`205`	`206`	`switch from.type {`
`206`	`207`	`case StorageModel.SourceType.json.rawValue:`
`207`		`- self.init(type: .json, url: url, isTrusted: from.isTrusted)`
	`208`	`+ self.init(type: .json, url: url, isTrusted: from.isTrusted, skipSignatureCheck: from.skipSignatureCheck ?? false)`
`208`	`209`	`default:`
`209`	`210`	`throw SerializationError.unknownType(from.type)`
`210`	`211`	`}`
`@@ -213,7 +214,8 @@ private extension Model.CollectionSource {`
`213`	`214`	`func source() -> StorageModel.Source {`
`214`	`215`	`switch self.type {`
`215`	`216`	`case .json:`
`216`		`- return .init(type: StorageModel.SourceType.json.rawValue, value: self.url.absoluteString, isTrusted: self.isTrusted)`
	`217`	`+ return .init(type: StorageModel.SourceType.json.rawValue, value: self.url.absoluteString,`
	`218`	`+ isTrusted: self.isTrusted, skipSignatureCheck: self.skipSignatureCheck)`
`217`	`219`	`}`
`218`	`220`	`}`
`219`	`221`	`}`
Original file line number	Diff line number	Diff line change
`@@ -831,7 +831,8 @@ final class PackageCollectionsTests: XCTestCase {`
`831`	`831`	`certificate: PackageCollectionsModel.SignatureData.Certificate(`
`832`	`832`	`subject: .init(userID: nil, commonName: nil, organizationalUnit: nil, organization: nil),`
`833`	`833`	`issuer: .init(userID: nil, commonName: nil, organizationalUnit: nil, organization: nil)`
`834`		`- )`
	`834`	`+ ),`
	`835`	`+ isVerified: true`
`835`	`836`	`)`
`836`	`837`	`callback(.success(PackageCollectionsModel.Collection(source: source, name: "", overview: nil, keywords: nil, packages: [], createdAt: Date(), createdBy: nil, signature: signature)))`
`837`	`838`	`}`
Original file line number	Diff line number	Diff line change
`@@ -88,7 +88,8 @@ func makeMockCollections(count: Int = Int.random(in: 50 ... 100), maxPackages: I`
`88`	`88`	`certificate: PackageCollectionsModel.SignatureData.Certificate(`
`89`	`89`	`subject: .init(userID: nil, commonName: "subject-\(collectionIndex)", organizationalUnit: nil, organization: nil),`
`90`	`90`	`issuer: .init(userID: nil, commonName: "issuer-\(collectionIndex)", organizationalUnit: nil, organization: nil)`
`91`		`- )`
	`91`	`+ ),`
	`92`	`+ isVerified: true`
`92`	`93`	`)`
`93`	`94`	`}`
`94`	`95`