mirror of
https://github.com/Reckless-Satoshi/robosats.git
synced 2024-09-11 11:55:26 +03:00
fix verify_signed_message (#1371)
verify_signed_message was not checking for the validity of the signature. The documentation of python-gnupg is not clear about this, it says that the fiels are set just if the signature is valid. In this case tests/robots/1/signed_message was signed with the correct key but with the wrong digest-algo (SHA256 instead of SHA512) as expressed on the signature. Running gpg --verify tests/robots/1/signed_message returned: gpg: WARNING: signature digest conflict in message gpg: Can't check signature: General error and a non zero error code, but verify_signed_message was not catching this because verified.fingerprint was set even though verified.valid was False. Co-authored-by: jerryfletcher21 <jerryfletcher@cock.email>
This commit is contained in:
parent
eca8391e75
commit
593794f09b
@ -448,7 +448,7 @@ def verify_signed_message(pub_key, signed_message):
|
||||
# verify the signed message
|
||||
verified = gpg.verify(signed_message)
|
||||
|
||||
if verified.fingerprint == import_result.fingerprints[0]:
|
||||
if verified.valid and verified.fingerprint == import_result.fingerprints[0]:
|
||||
header = "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n"
|
||||
footer = "-----BEGIN PGP SIGNATURE-----"
|
||||
cleartext_message = signed_message.split(header)[1].split(footer)[0].strip()
|
||||
|
@ -4,8 +4,8 @@ Hash: SHA512
|
||||
bcrt1qrrvml8tr4lkwlqpg9g394tye6s5950qf9tj9e9
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iHUEARYIAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZVUUTQAKCRAuNFtLSY2X
|
||||
JA4zAP9PW71ZvQglGnexa9LYryVbnI0w3WnWXYaOmowy/aMM5wD/a2xZNk95DiDq
|
||||
s8PnKT41yS+QIBrn7+iZ2DqlCjKdNgc=
|
||||
=NOcM
|
||||
iHUEARYKAB0WIQQyIVYjhac1qLz7sLwuNFtLSY2XJAUCZnxJEwAKCRAuNFtLSY2X
|
||||
JEEvAQCh/RPf17JvbodoTbmnyrxWFAeydn3aNefnCVtPrL81XQD/YPMEfIM4f2Tf
|
||||
3uPqTn0vtXUKtsYtZvxRi8STL7nXKws=
|
||||
=Nlv0
|
||||
-----END PGP SIGNATURE-----
|
||||
|
Loading…
Reference in New Issue
Block a user