From 20d56bdb6f61bf20ad0b528bf8dbfe23879034eb Mon Sep 17 00:00:00 2001 From: jerryfletcher21 Date: Wed, 26 Jun 2024 19:07:14 +0200 Subject: [PATCH] fix verify_signed_message verify_signed_message was not checking for the validity of the signature. The documentation of python-gnupg is not clear about this, it says that the fiels are set just if the signature is valid. In this case tests/robots/1/signed_message was signed with the correct key but with the wrong digest-algo (SHA256 instead of SHA512) as expressed on the signature. Running gpg --verify tests/robots/1/signed_message returned: gpg: WARNING: signature digest conflict in message gpg: Can't check signature: General error and a non zero error code, but verify_signed_message was not catching this because verified.fingerprint was set even though verified.valid was False. --- api/utils.py | 2 +- tests/robots/1/signed_message | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/api/utils.py b/api/utils.py index 13fad5b0..2d797fd7 100644 --- a/api/utils.py +++ b/api/utils.py @@ -448,7 +448,7 @@ def verify_signed_message(pub_key, signed_message): # verify the signed message verified = gpg.verify(signed_message) - if verified.fingerprint == import_result.fingerprints[0]: + if verified.valid and verified.fingerprint == import_result.fingerprints[0]: header = "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n" footer = "-----BEGIN PGP SIGNATURE-----" cleartext_message = signed_message.split(header)[1].split(footer)[0].strip() diff --git a/tests/robots/1/signed_message b/tests/robots/1/signed_message index 6be10ef6..2f88965f 100644 --- a/tests/robots/1/signed_message +++ b/tests/robots/1/signed_message @@ -4,8 +4,8 @@ Hash: SHA512 bcrt1qrrvml8tr4lkwlqpg9g394tye6s5950qf9tj9e9 -----BEGIN PGP SIGNATURE----- -iHUEARYIAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZVUUTQAKCRAuNFtLSY2X -JA4zAP9PW71ZvQglGnexa9LYryVbnI0w3WnWXYaOmowy/aMM5wD/a2xZNk95DiDq -s8PnKT41yS+QIBrn7+iZ2DqlCjKdNgc= -=NOcM +iHUEARYKAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZnxJEwAKCRAuNFtLSY2X +JEEvAQCh/RPf17JvbodoTbmnyrxWFAeydn3aNefnCVtPrL81XQD/YPMEfIM4f2Tf +3uPqTn0vtXUKtsYtZvxRi8STL7nXKws= +=Nlv0 -----END PGP SIGNATURE-----