diff --git a/api/utils.py b/api/utils.py index 10f938c1..83dfb25d 100644 --- a/api/utils.py +++ b/api/utils.py @@ -447,7 +447,7 @@ def verify_signed_message(pub_key, signed_message): # verify the signed message verified = gpg.verify(signed_message) - if verified.fingerprint == import_result.fingerprints[0]: + if verified.valid and verified.fingerprint == import_result.fingerprints[0]: header = "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n" footer = "-----BEGIN PGP SIGNATURE-----" cleartext_message = signed_message.split(header)[1].split(footer)[0].strip() diff --git a/tests/robots/1/signed_message b/tests/robots/1/signed_message index 6be10ef6..2f88965f 100644 --- a/tests/robots/1/signed_message +++ b/tests/robots/1/signed_message @@ -4,8 +4,8 @@ Hash: SHA512 bcrt1qrrvml8tr4lkwlqpg9g394tye6s5950qf9tj9e9 -----BEGIN PGP SIGNATURE----- -iHUEARYIAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZVUUTQAKCRAuNFtLSY2X -JA4zAP9PW71ZvQglGnexa9LYryVbnI0w3WnWXYaOmowy/aMM5wD/a2xZNk95DiDq -s8PnKT41yS+QIBrn7+iZ2DqlCjKdNgc= -=NOcM +iHUEARYKAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZnxJEwAKCRAuNFtLSY2X +JEEvAQCh/RPf17JvbodoTbmnyrxWFAeydn3aNefnCVtPrL81XQD/YPMEfIM4f2Tf +3uPqTn0vtXUKtsYtZvxRi8STL7nXKws= +=Nlv0 -----END PGP SIGNATURE-----