module

Fluxion::Executor::SignatureVerifier

Verifies a detached OpenPGP signature against an explicitly trusted signer.

A zero exit from gpg is deliberately not sufficient. gpg reports success for a signature made by any key it happens to have, so the machine-readable status output is parsed and every VALIDSIG must name the configured signer.

Constants

ALLOWED_HASH_ALGORITHMS = Set {8, 9, 10}

SHA-256, SHA-384, SHA-512. SHA-1 is deliberately absent.

ALLOWED_PUBLIC_KEY_ALGORITHMS = Set {1, 3, 19, 22, 27, 28}

RSA-encrypt-or-sign, RSA-sign, ECDSA, legacy EdDSA, Ed25519, Ed448.

REJECTED = ["BADSIG", "ERRSIG", "EXPSIG", "EXPKEYSIG", "REVKEYSIG", "KEYEXPIRED", "SIGEXPIRED", "NODATA", "NO_PUBKEY"] of ::String

Statuses that mean the signature is bad, expired, revoked, or unknown.

VERIFY_TIMEOUT = 1.minute

Instance methods

verify(artifact : String, signature : String, signer : Fingerprint, runner : ShellRunner) : Nil
Source