almet/dangerzone
1
0
Fork 0
mirror of https://github.com/freedomofpress/dangerzone.git synced 2025-04-29 02:12:36 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

FIXUP: throw rather than bools

Browse source
This commit is contained in:
Alexis Métaireau 2025-02-26 16:54:53 +01:00
parent 9b64d393a5
commit 86f46482e5
No known key found for this signature in database
GPG key ID: C65C7A89A8FFC56E
1 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
dangerzone/updater/signatures.py
View file

@ -61,9 +61,14 @@ def signature_to_bundle(sig: Dict) -> Dict:
}
def verify_signature(signature: dict, image_digest: str, pubkey: str | Path) -> bool:
"""Verify a signature against a given public key"""
# XXX - Also verfy the identity/docker-reference field against the expected value
def verify_signature(signature: dict, image_digest: str, pubkey: str | Path) -> None:
"""
Verifies that:
- the signature has been signed by the given public key
- the signature matches the given image digest
"""
# XXX - Also verify the identity/docker-reference field against the expected value
# e.g. ghcr.io/freedomofpress/dangerzone/dangerzone
cosign.ensure_installed()
@ -79,7 +84,8 @@ def verify_signature(signature: dict, image_digest: str, pubkey: str | Path) ->
)
if payload_digest != f"sha256:{image_digest}":
raise errors.SignatureMismatch(
f"The signature does not match the image digest ({payload_digest}, {image_digest})"
"The given signature does not match the expected image digest "
f"({payload_digest}, {image_digest})"
)
with (
@ -106,14 +112,10 @@ def verify_signature(signature: dict, image_digest: str, pubkey: str | Path) ->
]
log.debug(" ".join(cmd))
result = subprocess.run(cmd, capture_output=True)
if result.returncode != 0:
# XXX Raise instead?
if result.returncode != 0 or result.stderr != b"Verified OK\n":
log.debug("Failed to verify signature", result.stderr)
raise errors.SignatureVerificationError("Failed to verify signature")
if result.stderr == b"Verified OK\n":
log.debug("Signature verified")
return True
return False
log.debug("Signature verified")
class Signature: