almet/dangerzone
1
0
Fork 0
mirror of https://github.com/freedomofpress/dangerzone.git synced 2025-04-29 10:12:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

FIXUP: Add a comment to update the DEFAULT_LOG_INDEX with releases

Browse source
This commit is contained in:
Alexis Métaireau 2025-02-26 17:08:25 +01:00
parent 86f46482e5
commit bb8ea6c0db
No known key found for this signature in database
GPG key ID: C65C7A89A8FFC56E
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
dangerzone/updater/signatures.py
View file

@ -26,6 +26,10 @@ def appdata_dir() -> Path:
return Path(platformdirs.user_data_dir("dangerzone"))
# RELEASE: Bump this value to the log index of the latest signature
# to ensures the software can't upgrade to container images that predates it.
DEFAULT_LOG_INDEX = 0
# XXX Store this somewhere else.
DEFAULT_PUBKEY_LOCATION = get_resource_path("freedomofpress-dangerzone-pub.key")
SIGNATURES_PATH = appdata_dir() / "signatures"
@ -156,17 +160,14 @@ def verify_signatures(
raise errors.SignatureVerificationError("No signatures found")
for signature in signatures:
if not verify_signature(signature, image_digest, pubkey):
msg = f"Unable to verify signature for {image_digest} with pubkey {pubkey}"
raise errors.SignatureVerificationError(msg)
verify_signature(signature, image_digest, pubkey)
return True
def get_last_log_index() -> int:
SIGNATURES_PATH.mkdir(parents=True, exist_ok=True)
if not LAST_LOG_INDEX.exists():
return 0
return DEFAULT_LOG_INDEX
with open(LAST_LOG_INDEX) as f:
return int(f.read())