fix verify_signed_message (#1371)

verify_signed_message was not checking for the validity of the signature. The documentation of python-gnupg is not clear about this, it says that the fiels are set just if the signature is valid. In this case tests/robots/1/signed_message was signed with the correct key but with the wrong digest-algo (SHA256 instead of SHA512) as expressed on the signature. Running gpg --verify tests/robots/1/signed_message returned: gpg: WARNING: signature digest conflict in message gpg: Can't check signature: General error and a non zero error code, but verify_signed_message was not catching this because verified.fingerprint was set even though verified.valid was False. Co-authored-by: jerryfletcher21 <[email protected]>
RoboSats · Oct 19, 2024 · 20b3c98 · 20b3c98
1 parent 3e9a8dc
commit 20b3c98
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/api/utils.py b/api/utils.py
@@ -447,7 +447,7 @@ def verify_signed_message(pub_key, signed_message):
     # verify the signed message
     verified = gpg.verify(signed_message)
 
-    if verified.fingerprint == import_result.fingerprints[0]:
+    if verified.valid and verified.fingerprint == import_result.fingerprints[0]:
         header = "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n"
         footer = "-----BEGIN PGP SIGNATURE-----"
         cleartext_message = signed_message.split(header)[1].split(footer)[0].strip()

diff --git a/tests/robots/1/signed_message b/tests/robots/1/signed_message
@@ -4,8 +4,8 @@ Hash: SHA512
 bcrt1qrrvml8tr4lkwlqpg9g394tye6s5950qf9tj9e9
 -----BEGIN PGP SIGNATURE-----
 
-iHUEARYIAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZVUUTQAKCRAuNFtLSY2X
-JA4zAP9PW71ZvQglGnexa9LYryVbnI0w3WnWXYaOmowy/aMM5wD/a2xZNk95DiDq
-s8PnKT41yS+QIBrn7+iZ2DqlCjKdNgc=
-=NOcM
+iHUEARYKAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZnxJEwAKCRAuNFtLSY2X
+JEEvAQCh/RPf17JvbodoTbmnyrxWFAeydn3aNefnCVtPrL81XQD/YPMEfIM4f2Tf
+3uPqTn0vtXUKtsYtZvxRi8STL7nXKws=
+=Nlv0
 -----END PGP SIGNATURE-----