SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Use Key ID instead of fingerprint in OpenPGP URL interpolation.

Browse source
This commit is contained in:
Sascha L. Teichmann 2021-12-01 20:51:39 +01:00
parent 9cf4a7cb5c
commit fbe20dbf60
2 changed files with 19 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

32
cmd/csaf_provider/controller.go
View file

@ -112,65 +112,66 @@ func loadCSAF(r *http.Request) (string, []byte, error) {
return cleanFileName(handler.Filename), buf.Bytes(), nil return cleanFileName(handler.Filename), buf.Bytes(), nil
} }
func (c *controller) handleSignature(r *http.Request, data []byte) (string, string, error) { func (c *controller) handleSignature(
r *http.Request,
data []byte,
) (string, *crypto.Key, error) {
// Either way ... we need the key. // Either way ... we need the key.
key, err := c.cfg.loadCryptoKey() key, err := c.cfg.loadCryptoKey()
if err != nil { if err != nil {
return "", "", err return "", nil, err
} }
fingerprint := key.GetFingerprint()
// Was the signature given via request? // Was the signature given via request?
if c.cfg.UploadSignature { if c.cfg.UploadSignature {
sigText := r.FormValue("signature") sigText := r.FormValue("signature")
if sigText == "" { if sigText == "" {
return "", "", errors.New("missing signature in request") return "", nil, errors.New("missing signature in request")
} }
pgpSig, err := crypto.NewPGPSignatureFromArmored(sigText) pgpSig, err := crypto.NewPGPSignatureFromArmored(sigText)
if err != nil { if err != nil {
return "", "", err return "", nil, err
} }
// Use as public key // Use as public key
signRing, err := crypto.NewKeyRing(key) signRing, err := crypto.NewKeyRing(key)
if err != nil { if err != nil {
return "", "", err return "", nil, err
} }
if err := signRing.VerifyDetached( if err := signRing.VerifyDetached(
crypto.NewPlainMessage(data), crypto.NewPlainMessage(data),
pgpSig, crypto.GetUnixTime(), pgpSig, crypto.GetUnixTime(),
); err != nil { ); err != nil {
return "", "", err return "", nil, err
} }
return sigText, fingerprint, nil return sigText, key, nil
} }
// Sign ourself // Sign ourself
if passwd := r.FormValue("passphrase"); !c.cfg.NoPassphrase && passwd != "" { if passwd := r.FormValue("passphrase"); !c.cfg.NoPassphrase && passwd != "" {
if key, err = key.Unlock([]byte(passwd)); err != nil { if key, err = key.Unlock([]byte(passwd)); err != nil {
return "", "", err return "", nil, err
} }
} }
// Use as private key // Use as private key
signRing, err := crypto.NewKeyRing(key) signRing, err := crypto.NewKeyRing(key)
if err != nil { if err != nil {
return "", "", err return "", nil, err
} }
sig, err := signRing.SignDetached(crypto.NewPlainMessage(data)) sig, err := signRing.SignDetached(crypto.NewPlainMessage(data))
if err != nil { if err != nil {
return "", "", err return "", nil, err
} }
armored, err := sig.GetArmored() armored, err := sig.GetArmored()
return armored, fingerprint, err return armored, key, err
} }
func (c *controller) upload(rw http.ResponseWriter, r *http.Request) { func (c *controller) upload(rw http.ResponseWriter, r *http.Request) {
@ -208,7 +209,7 @@ func (c *controller) upload(rw http.ResponseWriter, r *http.Request) {
} }
} }
armored, fingerprint, err := c.handleSignature(r, data) armored, key, err := c.handleSignature(r, data)
if err != nil { if err != nil {
c.failed(rw, "upload.html", err) c.failed(rw, "upload.html", err)
return return
@ -330,7 +331,8 @@ func (c *controller) upload(rw http.ResponseWriter, r *http.Request) {
// TODO: Check for conflicts. // TODO: Check for conflicts.
pmd.Publisher = ex.publisher pmd.Publisher = ex.publisher
pmd.SetPGP(fingerprint, c.cfg.GetOpenPGPURL(fingerprint)) keyID, fingerprint := key.GetHexKeyID(), key.GetFingerprint()
pmd.SetPGP(fingerprint, c.cfg.GetOpenPGPURL(keyID))
return nil return nil
}); err != nil { }); err != nil {

4
cmd/csaf_provider/create.go
View file

@ -101,8 +101,8 @@ func createProviderMetadata(c *config, wellknownCSAF string) error {
if err != nil { if err != nil {
return err return err
} }
fingerprint := key.GetFingerprint() keyID, fingerprint := key.GetHexKeyID(), key.GetFingerprint()
pm.SetPGP(fingerprint, c.GetOpenPGPURL(fingerprint)) pm.SetPGP(fingerprint, c.GetOpenPGPURL(keyID))
return saveToFile(path, pm) return saveToFile(path, pm)
} }