SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Improve PGP fingerprint handling

Browse source 
Warn if no fingerprint is specified and give more details, if
fingerprint comparison fails.

Closes #555
This commit is contained in:
koplas 2024-08-08 12:17:58 +02:00
parent 8feddc70e1
commit 9037574d96
No known key found for this signature in database
2 changed files with 13 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
cmd/csaf_checker/processor.go
View file

@ -1449,7 +1449,7 @@ func (p *processor) checkWellknownSecurityDNS(domain string) error {
} }
// checkPGPKeys checks if the OpenPGP keys are available and valid, fetches // checkPGPKeys checks if the OpenPGP keys are available and valid, fetches
// the the remotely keys and compares the fingerprints. // the remotely keys and compares the fingerprints.
// As a result of these a respective error messages are passed to badPGP method // As a result of these a respective error messages are passed to badPGP method
// in case of errors. It returns nil if all checks are passed. // in case of errors. It returns nil if all checks are passed.
func (p *processor) checkPGPKeys(_ string) error { func (p *processor) checkPGPKeys(_ string) error {
@ -1518,8 +1518,13 @@ func (p *processor) checkPGPKeys(_ string) error {
continue continue
} }
if key.Fingerprint == "" {
p.badPGPs.warn("No fingerprint for public OpenPGP key found.")
continue
}
if !strings.EqualFold(ckey.GetFingerprint(), string(key.Fingerprint)) { if !strings.EqualFold(ckey.GetFingerprint(), string(key.Fingerprint)) {
p.badPGPs.error("Fingerprint of public OpenPGP key %s does not match remotely loaded.", u) p.badPGPs.error("Given Fingerprint (%q) of public OpenPGP key %q does not match remotely loaded (%q).", string(key.Fingerprint), u, ckey.GetFingerprint())
continue continue
} }
if p.keys == nil { if p.keys == nil {

7
cmd/csaf_downloader/downloader.go
View file

@ -366,10 +366,15 @@ func (d *downloader) loadOpenPGPKeys(
continue continue
} }
if key.Fingerprint == "" {
slog.Warn("No fingerprint for public OpenPGP key found.")
continue
}
if !strings.EqualFold(ckey.GetFingerprint(), string(key.Fingerprint)) { if !strings.EqualFold(ckey.GetFingerprint(), string(key.Fingerprint)) {
slog.Warn( slog.Warn(
"Fingerprint of public OpenPGP key does not match remotely loaded", "Fingerprint of public OpenPGP key does not match remotely loaded",
"url", u) "url", u, "fingerprint", key.Fingerprint, "remote-fingerprint", ckey.GetFingerprint())
continue continue
} }
if d.keys == nil { if d.keys == nil {