Merge lp:~canonical-platform-qa/snappy-ecosystem-tests/assertions-signing-mechanism into lp:snappy-ecosystem-tests

[Heber Parrucci]

Adding a generic mechanism to sign assertions

The objective of this change is to provide a mechanism for generating and signing user's assertions. That will be useful, for example for sharing snaps to other users.

The change also contains a test for sharing a snap that is currently skipped because the assertion type: 'snap-developer' is not released yet. So if you run the test you will get:
RuntimeError: Unable to sign assertion: spawn /tmp/tmp.86c1gleSxW/sign_assertion.sh
error: invalid assertion type: snap-developer

Important note: To allow supporting multiple users, a change was made in get_remote_credentials method. It will required you to change your local config file, It should look like this:

[store_user_0]
user_email=
user_password=

[store_user_1]
user_email=
user_password=

[user]
snapd_hostname_remote=
snapd_username_remote=
snapd_port_remote=
snapcraft_hostname_remote=
snapcraft_username_remote=
snapcraft_port_remote=

See README file for more details.

@run_tests: snappy_ecosystem_tests/tests/test_snapd.py

[platform-qa-bot (platform-qa-bot)]

FAILED: Continuous integration, rev:55
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/349/
Executed test runs:
    None: https://platform-qa-jenkins.ubuntu.com/job/generic-update-mp/2338/console

Click here to trigger a rebuild:
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/349/rebuild

review: Needs Fixing (continuous-integration)

[platform-qa-bot (platform-qa-bot)]

PASSED: Continuous integration, rev:55
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/350/
Executed test runs:
    SUCCESS: https://platform-qa-jenkins.ubuntu.com/job/run_snappy_ecosystem_tests/182
    None: https://platform-qa-jenkins.ubuntu.com/job/generic-update-mp/2339/console

Click here to trigger a rebuild:
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/350/rebuild

review: Approve (continuous-integration)

[lp:~canonical-platform-qa/snappy-ecosystem-tests/assertions-signing-mechanism]

56. By Heber Parrucci on 2017-04-13

merge from trunk

[platform-qa-bot (platform-qa-bot)]

PASSED: Continuous integration, rev:56
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/355/
Executed test runs:
    UNSTABLE: https://platform-qa-jenkins.ubuntu.com/job/run_snappy_ecosystem_tests/187
    None: https://platform-qa-jenkins.ubuntu.com/job/generic-update-mp/2347/console

Click here to trigger a rebuild:
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/355/rebuild

review: Approve (continuous-integration)

[platform-qa-bot (platform-qa-bot)]

FAILED: Continuous integration, rev:56
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/355/
Executed test runs:
    UNSTABLE: https://platform-qa-jenkins.ubuntu.com/job/run_snappy_ecosystem_tests/187
    SUCCESS: https://platform-qa-jenkins.ubuntu.com/job/generic-update-mp/2347
    None: https://platform-qa-jenkins.ubuntu.com/job/generic-update-mp/2348/console

Click here to trigger a rebuild:
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/355/rebuild

review: Needs Fixing (continuous-integration)

[platform-qa-bot (platform-qa-bot)]

PASSED: Continuous integration, rev:56
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/356/
Executed test runs:
    SUCCESS: https://platform-qa-jenkins.ubuntu.com/job/run_snappy_ecosystem_tests/188
    None: https://platform-qa-jenkins.ubuntu.com/job/generic-update-mp/2349/console

Click here to trigger a rebuild:
https://platform-qa-jenkins.ubuntu.com/job/snappy-ecosystem-tests-ci/356/rebuild

review: Approve (continuous-integration)

=== modified file 'README.rst'
--- README.rst	2017-03-27 13:16:17 +0000
+++ README.rst	2017-04-13 13:43:35 +0000
@@ -66,9 +66,20 @@
 XDG_USER_CONFIG_HOME=^DIR_PATH^
 
 The config file should look like:
+
+[store_user_0]
+user_email=^USER_0_NAME^
+user_password=^USER_0_PASSWORD^
+
+[store_user_1]
+user_email=^USER_1_NAME^
+user_password=^USER_1_PASSWORD^
+
+[store_user_n]
+user_email=^USER_n_NAME^
+user_password=^USER_n_PASSWORD^
+
 [user]
-user_email=^USER_NAME^
-user_password=^USER_PASSWORD^
 snapd_hostname_remote=^SNAPD_SSH_HOSTNAME^
 snapd_username_remote=^SNAPD_SSH_USERNAME^
 snapd_port_remote=^SNAPD_SSH_PORT^

=== modified file 'pylint.cfg'
--- pylint.cfg	2017-03-29 17:35:36 +0000
+++ pylint.cfg	2017-04-13 13:43:35 +0000
@@ -206,7 +206,7 @@
 
 # Regular expression which should only match function or class names that do
 # not require a docstring.
-no-docstring-rgx=.*TestCase$|setUp|tearDown
+no-docstring-rgx=.*TestCase$|setUp|tearDown|__getattr__
 
 # Minimum line length for functions/classes that require docstrings, shorter
 # ones are exempt.
@@ -364,7 +364,7 @@
 min-public-methods=1
 
 # Maximum number of public methods for a class (see R0904).
-max-public-methods=20
+max-public-methods=25
 
 # Maximum number of boolean expressions in a if statement
 max-bool-expr=5

=== modified file 'snappy_ecosystem_tests/helpers/snapcraft/client.py'
--- snappy_ecosystem_tests/helpers/snapcraft/client.py	2017-04-04 20:17:51 +0000
+++ snappy_ecosystem_tests/helpers/snapcraft/client.py	2017-04-13 13:43:35 +0000
@@ -27,6 +27,7 @@
 
 from pathlib import PurePath
 
+from snappy_ecosystem_tests.models.key import Key
 from snappy_ecosystem_tests.models.snap import Snap
 from snappy_ecosystem_tests.utils.commands import build_command
 from snappy_ecosystem_tests.utils.filters import filter_list
@@ -53,12 +54,36 @@
 -c 'interact'\
 """
 
+COMMANDS_CREATE_KEY = """\
+/usr/bin/expect \
+-c 'spawn {snapcraft} create-key {name}' \
+-c 'expect Passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'expect Confirm passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'interact'\
+"""
+
+COMMANDS_REGISTER_KEY = """\
+/usr/bin/expect \
+-c 'spawn {snapcraft} register-key {name}' \
+-c 'expect Email:' \
+-c 'send {email}\\r' \
+-c 'expect Password:' \
+-c 'send {password}\\r' \
+-c 'expect Enter passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'interact'\
+"""
+
 COMMAND_LOGOUT = 'logout'
 
 COMMAND_REGISTER = 'register'
 COMMAND_LIST_REGISTERED = 'list-registered'
+COMMAND_LIST_KEYS = 'keys'
 COMMAND_PUSH = 'push'
 COMMAND_RELEASE = 'release'
+
 LOGGER = logging.getLogger(__name__)
 
 HOSTNAME, USERNAME, PORT = get_snapcraft_remote_host_credentials()
@@ -350,6 +375,61 @@
         self.ssh.run_command('touch {}'.format(file_name), cwd=tempdir)
         return os.path.join(tempdir, file_name)
 
+    def create_key(self, name, passphrase='default', register=True,
+                   email=LOGIN_EMAIL, password=LOGIN_PASSWORD):
+        """Create a user key
+
+        :param name: the key name
+        :param passphrase: the key passphrase
+        :param register: whether to register the key in the store
+        :param email: user email
+        :param password: user password
+        """
+        key = self.get_key(name)
+        if key and key.is_registered():
+            LOGGER.info('Key %s exists and is registered', name)
+            return
+        elif not key:
+            LOGGER.info('Key %s does not exist. Creating...', name)
+            self.ssh.run_command(
+                COMMANDS_CREATE_KEY.format(name=name,
+                                           passphrase=passphrase,
+                                           snapcraft=PATH_SNAPCRAFT))
+        if register:
+            self.register_key(name, email, password)
+
+    def register_key(self, name, passphrase='default',
+                     email=LOGIN_EMAIL, password=LOGIN_PASSWORD):
+        """Register a key in the store
+
+        :param name: the key name
+        :param passphrase: the key passphrase
+        :param email: the user email
+        :param password: the user password
+        """
+        LOGGER.info('Registering key %s.', name)
+        return self.ssh.run_command(
+            COMMANDS_REGISTER_KEY.format(email=email,
+                                         password=password,
+                                         name=name,
+                                         passphrase=passphrase,
+                                         snapcraft=PATH_SNAPCRAFT))
+
+    def get_key(self, name):
+        """Get a user key
+
+        :param name: key name
+        :return: The key instance if found, None otherwise
+        """
+        user_keys = self._run_snapcraft_command_ssh(
+            COMMAND_LIST_KEYS).splitlines()
+        for line in user_keys:
+            if name in line:
+                registered = False if 'not registered' in line.lower() else True
+                fingerprint = line.split()[2]
+                return Key(name, fingerprint, registered)
+        return None
+
 
 def build_snapcraft_command(*args, base_command=PATH_SNAPCRAFT):
     """

=== modified file 'snappy_ecosystem_tests/helpers/snapd/snapd.py'
--- snappy_ecosystem_tests/helpers/snapd/snapd.py	2017-03-22 12:29:03 +0000
+++ snappy_ecosystem_tests/helpers/snapd/snapd.py	2017-04-13 13:43:35 +0000
@@ -22,10 +22,13 @@
 
 import json
 import logging
+import os
 from time import sleep
 
 import yaml
 
+from snappy_ecosystem_tests.models.assertion import AssertionFactory
+from snappy_ecosystem_tests.models.key import Key
 from snappy_ecosystem_tests.utils.ssh import SSHManager
 from snappy_ecosystem_tests.utils.user import get_snapd_remote_host_credentials
 
@@ -39,7 +42,9 @@
 COMMAND_LOGOUT = 'logout'
 COMMAND_REFRESH = 'refresh {snap} --channel={channel}'
 COMMAND_REMOVE = 'remove {snap}'
+COMMAND_SIGN = 'sign'
 CHANNEL_STABLE = 'stable'
+COMMAND_LIST_KEYS = 'keys'
 COMMANDS_LOGIN = """\
 sudo /usr/bin/expect \
 -c 'spawn snap login {email}' \
@@ -47,6 +52,33 @@
 -c 'send {password}\\r' \
 -c 'interact'\
 """
+
+COMMANDS_CREATE_KEY = """\
+/usr/bin/expect \
+-c 'spawn {snap} create-key {name}' \
+-c 'expect Passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'expect Confirm passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'interact'\
+"""
+
+COMMANDS_SIGN_KEY = """\
+/usr/bin/expect \
+-c 'spawn {sign_script}' \
+-c 'expect Enter passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'interact'\
+"""
+
+COMMANDS_EXPORT_KEY = """\
+/usr/bin/expect \
+-c 'spawn {export_key_script}' \
+-c 'expect Enter passphrase:' \
+-c 'send {passphrase}\\r' \
+-c 'interact'\
+"""
+
 LOGGER = logging.getLogger(__name__)
 
 HOSTNAME, USERNAME, PORT = get_snapd_remote_host_credentials()
@@ -203,3 +235,96 @@
         else:
             raise ValueError('Snap not published, waited {} seconds.'.format(
                 retry_attempts * retry_interval))
+
+    def create_key(self, name, passphrase='default'):
+        """Create a key if if it does not exists
+        :param name: the key name
+        :param passphrase: the key passphrase
+        :return: the instance of the key
+        """
+        if not self.get_key(name):
+            self.ssh.run_command(
+                COMMANDS_CREATE_KEY.format(name=name,
+                                           passphrase=passphrase,
+                                           snap=PATH_SNAP))
+        return self.get_key(name)
+
+    def get_key(self, name):
+        """Get a user key
+
+        :param name: key name
+        :return: The key instance if found, None otherwise
+        """
+        user_keys = self.run_snapd_command_ssh(COMMAND_LIST_KEYS).splitlines()
+        for line in user_keys:
+            if name in line:
+                _name, fingerprint = line.split()
+                return Key(_name, fingerprint)
+        return None
+
+    def export_key(self, account_id, name, passphrase='default'):
+        """Export a user's key
+
+        :param account_id: user's account_id
+        :param name: name of the key to be exported
+        :param passphrase: the passphrase to unlock the key
+        :return:
+        """
+        tempdir = self.ssh.run_command('mktemp -d')
+        self.ssh.run_command(
+            'echo "{snap} export-key --account={account} {key} > assertion_key"'
+            '  > export_key.sh'.format(
+                snap=PATH_SNAP,
+                account=account_id,
+                key=name),
+            cwd=tempdir)
+        script_path = os.path.join(tempdir, 'export_key.sh')
+        self.ssh.run_command('chmod +x {}'.format(script_path))
+        self.ssh.run_command(
+            COMMANDS_EXPORT_KEY.format(
+                export_key_script=script_path,
+                passphrase=passphrase), cwd=tempdir)
+        return self.ssh.run_command('cat {}'.format(
+            os.path.join(tempdir, 'assertion_key')))
+
+    def build_assertion(self, _type, **kwargs):
+        """
+        Build a new assertion in the remote machine
+
+        :param _type: the assertion type
+        :param kwargs: the arguments for the given assertion type
+        :return: the remote full path of the assertion
+        """
+        assertion = AssertionFactory.create(_type, **kwargs)
+        tempdir = self.ssh.run_command('mktemp -d')
+        self.ssh.run_command(
+            'echo {} > assertion'.format(str(assertion)), cwd=tempdir)
+        return os.path.join(tempdir, 'assertion')
+
+    def sign_assertion(self, assertion, key='default', passphrase='default'):
+        """Sign an assertion with a developer private key
+
+        :param assertion: the path of the assertion to be signed
+        :param key: the developer's private key.
+        :param passphrase: passphrase to unlock the key
+        """
+        tempdir = self.ssh.run_command('mktemp -d')
+        self.ssh.run_command(
+            'echo "cat {} | {} {} -k {} > assertion_signed"  '
+            '> sign_assertion.sh'.format(
+                assertion,
+                PATH_SNAP,
+                COMMAND_SIGN,
+                key),
+            cwd=tempdir)
+        script_path = os.path.join(tempdir, 'sign_assertion.sh')
+        self.ssh.run_command('chmod +x {}'.format(script_path))
+        output = self.ssh.run_command(
+            COMMANDS_SIGN_KEY.format(
+                sign_script=script_path,
+                passphrase=passphrase), cwd=tempdir)
+        if 'invalid assertion' not in output.lower():
+            return self.ssh.run_command('cat {}'.format(
+                os.path.join(tempdir, 'assertion_signed')))
+        else:
+            raise RuntimeError('Unable to sign assertion: {}'.format(output))

=== modified file 'snappy_ecosystem_tests/helpers/store_apis/rest_apis.py'
--- snappy_ecosystem_tests/helpers/store_apis/rest_apis.py	2017-03-29 17:35:36 +0000
+++ snappy_ecosystem_tests/helpers/store_apis/rest_apis.py	2017-04-13 13:43:35 +0000
@@ -398,6 +398,12 @@
         """Sign developer agreement to be able to do operations in the store"""
         return self.sca.sign_developer_agreement(latest_tos_accepted)
 
+    def share_snap(self, snap_name, assertion, series=None):
+        """Share a snap with the given assertion
+        First refresh macaroon if necessary"""
+        return self._refresh_if_necessary(
+            self.sca.share_snap, snap_name, assertion, series)
+
 
 class SSOClient(Client):
     """The Single Sign On server deals with authentication.
@@ -874,6 +880,34 @@
             raise errors.DeveloperAgreementSignError(response)
         return response.json()
 
+    def share_snap(self, snap_name, assertion, series=None):
+        """
+        Share a snap trough the given signed assertion.
+
+        :param snap_name: name of the snap to be shared.
+        :param assertion: the snap-developer assertion.
+        The assertion’s publisher-id must be the authorized user’s account ID.
+        The assertion’s authority-id must be the same as the publisher-id,
+        i.e. the assertion must be signed by one of the authorized user’s
+         private keys.
+        :param series: the snap series
+        """
+        if series is None:
+            series = constants.DEFAULT_SERIES
+        snap_id = self.filter_snaps(series=series, name=snap_name)[0].get_id()
+        url = 'snaps/' + snap_id + '/developers'
+        auth = _macaroon_auth(self.conf)
+        # TODO: Investigate if it is necessary to push the assertion
+        #  before calling to the API
+        data = {
+            'snap_developer': assertion,
+        }
+        response = self.put(
+            url,
+            headers=dict(**{'Authorization': auth}, **JSON_HEADERS),
+            data=json.dumps(data))
+        return response
+
 
 class StatusTracker:
 

=== added file 'snappy_ecosystem_tests/models/assertion.py'
--- snappy_ecosystem_tests/models/assertion.py	1970-01-01 00:00:00 +0000
+++ snappy_ecosystem_tests/models/assertion.py	2017-04-13 13:43:35 +0000
@@ -0,0 +1,116 @@
+# -*- Mode: Python; coding: utf-8; indent-tabs-mode: nil; tab-width: 4 -*-
+
+#
+# Snappy Ecosystem Tests
+# Copyright (C) 2017 Canonical
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+"""Business model classes for assertions"""
+
+import json
+
+from datetime import datetime
+
+
+class Assertion(dict):
+    """Represents an assertion entity."""
+
+    def __init__(self, _type):
+        super().__init__()
+        self.type = _type
+
+    def __getattr__(self, item):
+        return self.get(item)
+
+    def __setattr__(self, key, value):
+        self[key] = value
+
+    def __str__(self, encoding='utf-8'):
+        return str(json.dumps(self).encode(encoding=encoding)).lstrip('b')
+
+
+class SnapDeveloperAssertion(Assertion):
+    """Represents a snap developer assertion entity."""
+
+    def __init__(self, snap_id, developers,
+                 revision, publisher_id='canonical', authority_id=None):
+        super().__init__('snap-developer')
+        self['publisher-id'] = publisher_id
+        self['authority-id'] = authority_id or publisher_id
+        self['snap-id'] = snap_id
+        self['revision'] = revision
+        self._parse_developers(developers)
+
+    def _parse_developers(self, _developers):
+        """Parse the developers list to a  well-known format for the assertion.
+        Examples ('now' is replaced for the current time):
+
+        - [{'dev_id': ('now',)}] --> [{developer-id: 'dev-id', 'since': 'now'}]
+
+        - [{'dev_id': ('now', 'now')}] --> [{developer-id: 'dev-id',
+        'since': 'now', 'until': 'now'}]
+
+        - [{'dev_id': ('2025-04-04T15:49:27.864208',
+        '2026-04-04T15:49:27.864208')}] -->
+        [{developer-id: 'dev-id', 'since': '2025-04-04T15:49:27.864208',
+         'until': '2026-04-04T15:49:27.864208'}]
+
+        :param _developers: the list of developers to be parsed
+        """
+        self.developers = []
+        for dev in _developers:
+            for dev_id, time in dev.items():
+                _dev = {'developer-id': dev_id}
+                if len(time) == 1:
+                    _dev['since'] = self._parse_time(time[0])
+                elif len(time) == 2:
+                    _dev['since'] = self._parse_time(time[0])
+                    _dev['until'] = self._parse_time(time[1])
+                self.developers.append(_dev)
+
+    @staticmethod
+    def _parse_time(time):
+        """Parse and return UTC time in ISO format
+        :param: the time to be parsed. Examples:
+        - 'now'
+        - 'datetime.datetime(2017, 4, 5, 13, 14, 9, 178673)'
+        - '2017-04-05T13:11:57'
+        """
+        if time.lower() == 'now':
+            return datetime.utcnow().isoformat() + 'Z'
+        elif isinstance(time, datetime):
+            return time.isoformat() + 'Z'
+        elif isinstance(time, str):
+            return datetime.strptime(time,
+                                     "%Y-%m-%dT%H:%M:%S").isoformat() + 'Z'
+
+
+class AssertionFactory:
+    """Factory to create assertion objects"""
+
+    mapping = {'snap-developer': SnapDeveloperAssertion}
+
+    @classmethod
+    def create(cls, _type, **kwargs):
+        """Create the assertion object
+        :param _type: assertion type. It must exist in the mapping dict
+        :param kwargs: arguments to initialize the assertion object
+        :raise RuntimeError: when assertion type does not exist in the mapping
+        """
+        try:
+            return cls.mapping[_type](**kwargs)
+        except KeyError:
+            raise RuntimeError('Assertion type {} does not exist'.format(_type))

=== added file 'snappy_ecosystem_tests/models/key.py'
--- snappy_ecosystem_tests/models/key.py	1970-01-01 00:00:00 +0000
+++ snappy_ecosystem_tests/models/key.py	2017-04-13 13:43:35 +0000
@@ -0,0 +1,41 @@
+# -*- Mode: Python; coding: utf-8; indent-tabs-mode: nil; tab-width: 4 -*-
+
+#
+# Snappy Ecosystem Tests
+# Copyright (C) 2017 Canonical
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+"""Business model classes for User's Key"""
+
+from textwrap import dedent
+
+
+class Key:
+    """Represents a key entity."""
+
+    def __init__(self, name, fingerprint, registered=False):
+        self.name = name
+        self.fingerprint = fingerprint
+        self.registered = registered
+
+    def is_registered(self):
+        """Return True if the key is registered, False otherwise"""
+        return self.registered
+
+    def __str__(self):
+        return dedent(
+            '''name: {}\npublic-key-sha3-384: {}'''.format(self.name,
+                                                           self.fingerprint))

=== modified file 'snappy_ecosystem_tests/models/snap.py'
--- snappy_ecosystem_tests/models/snap.py	2017-02-21 19:06:58 +0000
+++ snappy_ecosystem_tests/models/snap.py	2017-04-13 13:43:35 +0000
@@ -37,3 +37,7 @@
     def is_private(self):
         """Return True if the snap is private, False otherwise"""
         return self.private
+
+    def get_id(self):
+        """Return the snap id"""
+        return self._id

=== added file 'snappy_ecosystem_tests/tests/test_share_snap.py'
--- snappy_ecosystem_tests/tests/test_share_snap.py	1970-01-01 00:00:00 +0000
+++ snappy_ecosystem_tests/tests/test_share_snap.py	2017-04-13 13:43:35 +0000
@@ -0,0 +1,143 @@
+# -*- Mode: Python; coding: utf-8; indent-tabs-mode: nil; tab-width: 4 -*-
+
+#
+# Snappy Ecosystem Tests
+# Copyright (C) 2017 Canonical
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+"""Tests for sharing Snaps in the store"""
+
+from testtools import skip
+
+from snappy_ecosystem_tests.helpers.snapcraft.client import Snapcraft
+from snappy_ecosystem_tests.helpers.snapd.snapd import Snapd
+from snappy_ecosystem_tests.helpers.store_apis import errors
+from snappy_ecosystem_tests.helpers.store_apis.rest_apis import Store
+from snappy_ecosystem_tests.helpers.test_base import SnappyEcosystemTestCase
+from snappy_ecosystem_tests.tests.commons import get_random_snap_name
+from snappy_ecosystem_tests.utils.storeconfig import get_store_credentials
+
+
+class ShareSnapTestCase(SnappyEcosystemTestCase):
+
+    def setUp(self):
+        super().setUp()
+        self.acls = ['package_manage', 'package_upload', 'package_access',
+                     'modify_account_key']
+        self.snapcraft = Snapcraft()
+        self.snapd = Snapd()
+        self.store = Store()
+        email, password = get_store_credentials()
+        self.assertTrue(self.snapcraft.login(email, password))
+        self.addCleanup(self.snapcraft.logout)
+        self.store.login(email, password, acls=self.acls)
+        self.addCleanup(self.store.logout)
+        self.assertTrue(self.snapd.login(email, password))
+        self.addCleanup(self.snapd.logout, email)
+
+    @staticmethod
+    def _get_developer_id(index=0):
+        """Return the developer_id (aka account_id)
+        :param index: the index of the user's list that want
+        to be returned from the config stack
+        """
+        store = Store()
+        store.login(*get_store_credentials(index=index))
+        developer_id = store.get_account_information()['account_id']
+        store.logout()
+        return developer_id
+
+    def _ensure_key_registered(self, user_index, name, passphrase='default'):
+        """Ensure the given key exists and is registered in the store
+        :param user_index: the index of the user you want to
+        register the key for
+        :param name: the key name
+        :param passphrase: the key passphrase
+        :return: True if key was registered successfully or if it is already
+         registered in the store, False otherwise
+        """
+        # Create the key if it does not exist
+        self.snapd.create_key(name, passphrase)
+        # export the key
+        key_exported = self.snapd.export_key(self._get_developer_id(user_index),
+                                             name, passphrase)
+        # Register the key in the store
+        try:
+            self.store.register_key(key_exported)
+        except errors.StoreKeyRegistrationError as kre:
+            if 'already the current revision' in str(kre).lower():
+                return True
+            elif 'authorization required' in str(kre).lower():
+                user, email = get_store_credentials(user_index)
+                self.store.logout()
+                self.store.login(user, email, acls=self.acls)
+                self.store.register_key(key_exported)
+                return True
+            else:
+                return False
+
+    @skip('The assertion type "snap-developer" is still in development')
+    def test_push_and_release_a_shared_snap(self):
+        """A user to whom a snap was shared via RESTful API pushes and releases
+        a new revision and it is available on the store
+        """
+        version = '0.1'
+        revision = 1
+        snap_name = get_random_snap_name()
+        user_key = 'default'
+        self.assertTrue(self.store.register(snap_name),
+                        'Unable to register snap')
+        snap_id = self.store.filter_snaps(name=snap_name)[0].get_id()
+
+        # Upload the snap and wait for its processing on server to finish.
+        tracker = self.store.upload(
+            snap_name, self.snapcraft.build_and_pull(snap_name, version))
+        tracker.track()
+
+        # Build the snap-developer assertion
+        developers = [{self._get_developer_id(index=1): ('now',)}]
+        assertion = self.snapd.build_assertion(
+            'snap-developer',
+            publisher_id=self._get_developer_id(),
+            snap_id=snap_id,
+            developers=developers,
+            revision=revision)
+
+        # Ensure Key is registered for current user
+        self.assertTrue(self._ensure_key_registered(0, user_key))
+        # Sign the snap-developer assertion
+        assertion_signed = self.snapd.sign_assertion(assertion,
+                                                     key=user_key)
+        self.store.share_snap(snap_name, assertion_signed)
+
+        # Login with the user to whom the snap was shared
+        # and verify he can push and release a new version of the snap
+        new_version = '0.2'
+        new_revision = 2
+        channels = ['candidate', 'stable']
+        self.store.logout()
+        self.snapcraft.logout()
+        self.store.login(*get_store_credentials(index=1))
+        self.snapcraft.login(*get_store_credentials(index=1))
+
+        # Push and release the snap to multiple channels
+        self.snapcraft.push(self.snapcraft.build(snap_name, new_version),
+                            channels=channels)
+        # Check using REST API if snap was released to all channels
+        self.assertTrue(self.store.is_snap_published(snap_name,
+                                                     new_version,
+                                                     new_revision,
+                                                     channels))

=== modified file 'snappy_ecosystem_tests/utils/storeconfig.py'
--- snappy_ecosystem_tests/utils/storeconfig.py	2017-02-22 17:41:52 +0000
+++ snappy_ecosystem_tests/utils/storeconfig.py	2017-04-13 13:43:35 +0000
@@ -21,6 +21,7 @@
 """Get all the store related data like credentials, urls"""
 
 import os
+from configparser import NoSectionError
 
 from snappy_ecosystem_tests.commons.config import (
     CONFIG_STACK,
@@ -31,16 +32,21 @@
 URL_WEB_STORE_STAGING = CONFIG_STACK.get('staging_urls', 'web')
 
 
-def get_store_credentials():
+def get_store_credentials(index=0):
     """Get user store credentials.
     It will retrieve the credentials stored in a user config file,
     if the config is not found,
     then it will return the ones provided in environment variables
+
+    :param index: the index of the user that want
+     to be returned from the user config stack
     """
-    return (USER_CONFIG_STACK.get('user', 'user_email',
-                                  default=os.environ.get('user_email')),
-            USER_CONFIG_STACK.get('user', 'user_password',
-                                  default=os.environ.get('user_password')))
+    try:
+        section = USER_CONFIG_STACK.get_section('store_user_{}'.format(index))
+    except (NoSectionError, KeyError):
+        section = USER_CONFIG_STACK.get_section('user')
+    return (section.get('user_email') or os.environ.get('user_email'),
+            section.get('user_password') or os.environ.get('user_password'))
 
 
 def is_staging():