mirror of
https://github.com/freedomofpress/dangerzone.git
synced 2025-05-19 19:50:33 +02:00
97d7b52093
This allows to be sure that the image name is verified by a known public key, rather than relying on an input by the user, which can lead to issues.
32 lines
818 B
Python
32 lines
818 B
Python
import subprocess
|
|
|
|
from . import errors, log
|
|
|
|
|
|
def ensure_installed() -> None:
|
|
try:
|
|
subprocess.run(["cosign", "version"], capture_output=True, check=True)
|
|
except subprocess.CalledProcessError:
|
|
raise errors.CosignNotInstalledError()
|
|
|
|
|
|
def verify_local_image(oci_image_folder: str, pubkey: str) -> bool:
|
|
"""Verify the given path against the given public key"""
|
|
|
|
ensure_installed()
|
|
cmd = [
|
|
"cosign",
|
|
"verify",
|
|
"--key",
|
|
pubkey,
|
|
"--offline",
|
|
"--local-image",
|
|
oci_image_folder,
|
|
]
|
|
log.debug(" ".join(cmd))
|
|
result = subprocess.run(cmd, capture_output=True)
|
|
if result.returncode == 0:
|
|
log.info("Signature verified")
|
|
return True
|
|
log.info("Failed to verify signature", result.stderr)
|
|
return False
|