Mirror/robosats
1
0
Fork 0
mirror of https://github.com/RoboSats/robosats.git synced 2024-12-14 03:16:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix verify_signed_message

Browse Source 
verify_signed_message was not checking for the validity of the
signature. The documentation of python-gnupg is not clear about this, it
says that the fiels are set just if the signature is valid.
In this case tests/robots/1/signed_message was signed with the correct
key but with the wrong digest-algo (SHA256 instead of SHA512) as
expressed on the signature.
Running gpg --verify tests/robots/1/signed_message returned:
gpg: WARNING: signature digest conflict in message
gpg: Can't check signature: General error
and a non zero error code, but verify_signed_message was not catching
this because verified.fingerprint was set even though verified.valid was
False.
This commit is contained in:
jerryfletcher21 2024-06-26 19:07:14 +02:00
parent 82b5604ecb
commit 20d56bdb6f
No known key found for this signature in database
GPG Key ID: 6FA7713E574EDEC3
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/utils.py
View File

@ -448,7 +448,7 @@ def verify_signed_message(pub_key, signed_message):
# verify the signed message
verified = gpg.verify(signed_message)
if verified.fingerprint == import_result.fingerprints[0]:
if verified.valid and verified.fingerprint == import_result.fingerprints[0]:
header = "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n"
footer = "-----BEGIN PGP SIGNATURE-----"
cleartext_message = signed_message.split(header)[1].split(footer)[0].strip()

8
tests/robots/1/signed_message
View File

@ -4,8 +4,8 @@ Hash: SHA512
bcrt1qrrvml8tr4lkwlqpg9g394tye6s5950qf9tj9e9
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZVUUTQAKCRAuNFtLSY2X
JA4zAP9PW71ZvQglGnexa9LYryVbnI0w3WnWXYaOmowy/aMM5wD/a2xZNk95DiDq
s8PnKT41yS+QIBrn7+iZ2DqlCjKdNgc=
=NOcM
iHUEARYKAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZnxJEwAKCRAuNFtLSY2X
JEEvAQCh/RPf17JvbodoTbmnyrxWFAeydn3aNefnCVtPrL81XQD/YPMEfIM4f2Tf
3uPqTn0vtXUKtsYtZvxRi8STL7nXKws=
=Nlv0
-----END PGP SIGNATURE-----