summaryrefslogtreecommitdiff
path: root/internal/verify/verify.go
diff options
context:
space:
mode:
authorjwijenbergh <jeroenwijenbergh@protonmail.com>2022-08-23 14:08:58 +0200
committerjwijenbergh <jeroenwijenbergh@protonmail.com>2022-08-23 14:08:58 +0200
commit5839eedd22e28a281f3faa90433f0452ca31b385 (patch)
tree71e4ed1fd7a5bcf1da1813891197aeaaed359be2 /internal/verify/verify.go
parentd41af72a9673728cfe9390e31cb4e67da31fc355 (diff)
Formatting: Run golines
Diffstat (limited to 'internal/verify/verify.go')
-rw-r--r--internal/verify/verify.go60
1 files changed, 51 insertions, 9 deletions
diff --git a/internal/verify/verify.go b/internal/verify/verify.go
index e9a9316..50bdd0b 100644
--- a/internal/verify/verify.go
+++ b/internal/verify/verify.go
@@ -18,13 +18,26 @@ import (
// The return value will either be (true, nil) for a valid signature or (false, VerifyError) otherwise.
//
// Verify is a wrapper around verifyWithKeys where allowedPublicKeys is set to the list from https://git.sr.ht/~eduvpn/disco.eduvpn.org#public-keys.
-func Verify(signatureFileContent string, signedJson []byte, expectedFileName string, minSignTime uint64, forcePrehash bool) (bool, error) {
+func Verify(
+ signatureFileContent string,
+ signedJson []byte,
+ expectedFileName string,
+ minSignTime uint64,
+ forcePrehash bool,
+) (bool, error) {
// keys taken from https://git.sr.ht/~eduvpn/disco.eduvpn.org#public-keys
keyStrs := []string{
"RWRtBSX1alxyGX+Xn3LuZnWUT0w//B6EmTJvgaAxBMYzlQeI+jdrO6KF", // fkooman@tuxed.net, kolla@uninett.no
"RWQKqtqvd0R7rUDp0rWzbtYPA3towPWcLDCl7eY9pBMMI/ohCmrS0WiM", // RoSp
}
- valid, err := verifyWithKeys(signatureFileContent, signedJson, expectedFileName, minSignTime, keyStrs, forcePrehash)
+ valid, err := verifyWithKeys(
+ signatureFileContent,
+ signedJson,
+ expectedFileName,
+ minSignTime,
+ keyStrs,
+ forcePrehash,
+ )
if err != nil {
return valid, &types.WrappedErrorMessage{Message: "failed signature verify", Err: err}
}
@@ -41,12 +54,22 @@ func Verify(signatureFileContent string, signedJson []byte, expectedFileName str
//
// The return value will either be (true, nil) on success or (false, detailedVerifyError) on failure.
// Note that every error path is wrapped in a custom type here because minisign does not return custom error types, they use errors.New
-func verifyWithKeys(signatureFileContent string, signedJson []byte, filename string, minSignTime uint64, allowedPublicKeys []string, forcePrehash bool) (bool, error) {
+func verifyWithKeys(
+ signatureFileContent string,
+ signedJson []byte,
+ filename string,
+ minSignTime uint64,
+ allowedPublicKeys []string,
+ forcePrehash bool,
+) (bool, error) {
switch filename {
case "server_list.json", "organization_list.json":
break
default:
- return false, &VerifyUnknownExpectedFilenameError{Filename: filename, Expected: "server_list.json or organization_list.json"}
+ return false, &VerifyUnknownExpectedFilenameError{
+ Filename: filename,
+ Expected: "server_list.json or organization_list.json",
+ }
}
sig, err := minisign.DecodeSignature(signatureFileContent)
@@ -56,7 +79,10 @@ func verifyWithKeys(signatureFileContent string, signedJson []byte, filename str
// Check if signature is prehashed, see https://jedisct1.github.io/minisign/#signature-format
if forcePrehash && sig.SignatureAlgorithm != [2]byte{'E', 'D'} {
- return false, &VerifyInvalidSignatureAlgorithmError{Algorithm: string(sig.SignatureAlgorithm[:]), WantedAlgorithm: "ED (BLAKE2b-prehashed EdDSA)"}
+ return false, &VerifyInvalidSignatureAlgorithmError{
+ Algorithm: string(sig.SignatureAlgorithm[:]),
+ WantedAlgorithm: "ED (BLAKE2b-prehashed EdDSA)",
+ }
}
// Find allowed key used for signature
@@ -80,9 +106,17 @@ func verifyWithKeys(signatureFileContent string, signedJson []byte, filename str
var signTime uint64
var sigFileName string
// sigFileName cannot have spaces
- _, err = fmt.Sscanf(sig.TrustedComment, "trusted comment: timestamp:%d\tfile:%s", &signTime, &sigFileName)
+ _, err = fmt.Sscanf(
+ sig.TrustedComment,
+ "trusted comment: timestamp:%d\tfile:%s",
+ &signTime,
+ &sigFileName,
+ )
if err != nil {
- return false, &VerifyInvalidTrustedCommentError{TrustedComment: sig.TrustedComment, Err: err}
+ return false, &VerifyInvalidTrustedCommentError{
+ TrustedComment: sig.TrustedComment,
+ Err: err,
+ }
}
if sigFileName != filename {
@@ -127,7 +161,11 @@ type VerifyInvalidSignatureAlgorithmError struct {
}
func (e *VerifyInvalidSignatureAlgorithmError) Error() string {
- return fmt.Sprintf("invalid signature algorithm: %s, wanted: %s", e.Algorithm, e.WantedAlgorithm)
+ return fmt.Sprintf(
+ "invalid signature algorithm: %s, wanted: %s",
+ e.Algorithm,
+ e.WantedAlgorithm,
+ )
}
type VerifyCreatePublicKeyError struct {
@@ -174,7 +212,11 @@ type VerifyWrongSigFilenameError struct {
}
func (e *VerifyWrongSigFilenameError) Error() string {
- return fmt.Sprintf("wrong filename: %s, expected filename: %s for signature", e.Filename, e.SigFilename)
+ return fmt.Sprintf(
+ "wrong filename: %s, expected filename: %s for signature",
+ e.Filename,
+ e.SigFilename,
+ )
}
type VerifySigTimeEarlierError struct {