Mirror/robosats
1
0
Fork 0
mirror of https://github.com/RoboSats/robosats.git synced 2024-12-14 11:26:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix verify_signed_message (#1371)

Browse Source 
verify_signed_message was not checking for the validity of the
signature. The documentation of python-gnupg is not clear about this, it
says that the fiels are set just if the signature is valid.
In this case tests/robots/1/signed_message was signed with the correct
key but with the wrong digest-algo (SHA256 instead of SHA512) as
expressed on the signature.
Running gpg --verify tests/robots/1/signed_message returned:
gpg: WARNING: signature digest conflict in message
gpg: Can't check signature: General error
and a non zero error code, but verify_signed_message was not catching
this because verified.fingerprint was set even though verified.valid was
False.

Co-authored-by: jerryfletcher21 <jerryfletcher@cock.email>
This commit is contained in:
Reckless_Satoshi 2024-07-07 11:04:14 +00:00 committed by koalasat
parent e853605256
commit 9e442c386a
No known key found for this signature in database
GPG Key ID: 2F7F61C6146AB157
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/utils.py
View File

@ -447,7 +447,7 @@ def verify_signed_message(pub_key, signed_message):
# verify the signed message
verified = gpg.verify(signed_message)
if verified.fingerprint == import_result.fingerprints[0]:
if verified.valid and verified.fingerprint == import_result.fingerprints[0]:
header = "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n"
footer = "-----BEGIN PGP SIGNATURE-----"
cleartext_message = signed_message.split(header)[1].split(footer)[0].strip()

8
tests/robots/1/signed_message
View File

@ -4,8 +4,8 @@ Hash: SHA512
bcrt1qrrvml8tr4lkwlqpg9g394tye6s5950qf9tj9e9
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZVUUTQAKCRAuNFtLSY2X
JA4zAP9PW71ZvQglGnexa9LYryVbnI0w3WnWXYaOmowy/aMM5wD/a2xZNk95DiDq
s8PnKT41yS+QIBrn7+iZ2DqlCjKdNgc=
=NOcM
iHUEARYKAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZnxJEwAKCRAuNFtLSY2X
JEEvAQCh/RPf17JvbodoTbmnyrxWFAeydn3aNefnCVtPrL81XQD/YPMEfIM4f2Tf
3uPqTn0vtXUKtsYtZvxRi8STL7nXKws=
=Nlv0
-----END PGP SIGNATURE-----