diff options
| author | Mathew Inwood <mathewi@google.com> | 2018-12-14 13:53:52 +0000 |
|---|---|---|
| committer | Mathew Inwood <mathewi@google.com> | 2019-01-15 11:54:18 +0000 |
| commit | 45942518a5f7a94ae90c9e0204dc3cdc891fc7d7 (patch) | |
| tree | f1fd0d98fea36fd905f0a9e2d9055cd2e222db60 /tools/signedconfig | |
| parent | 38421787e12081e0d3a4871f4c5012ab4bdad4d8 (diff) | |
Add prod key for serverless config.
Integrate this into SignatureVerifier too.
Bug: 110509075
Test: atest CtsSignedConfigHostTestCases
Test: atest SignedConfigTest
Change-Id: I816598c3332f9577c802109053d0d0b9b1f2a699
Diffstat (limited to 'tools/signedconfig')
| -rw-r--r-- | tools/signedconfig/prod_public.pem | 5 | ||||
| -rwxr-xr-x | tools/signedconfig/verify_b64.sh | 28 |
2 files changed, 32 insertions, 1 deletions
diff --git a/tools/signedconfig/prod_public.pem b/tools/signedconfig/prod_public.pem new file mode 100644 index 000000000000..8c10215eb083 --- /dev/null +++ b/tools/signedconfig/prod_public.pem @@ -0,0 +1,5 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+lky6wKyGL6lE1VrD0YTMHwb0Xwc ++tzC8MvnrzVxodvTpVY/jV7V+Zktcx+pry43XPABFRXtbhTo+qykhyBA1g== +-----END PUBLIC KEY----- + diff --git a/tools/signedconfig/verify_b64.sh b/tools/signedconfig/verify_b64.sh index 8e1f58ce7b45..a4ac6a816d14 100755 --- a/tools/signedconfig/verify_b64.sh +++ b/tools/signedconfig/verify_b64.sh @@ -7,4 +7,30 @@ # The arg values can be taken from the debug log for SignedConfigService when verbose logging is # enabled. -openssl dgst -sha256 -verify $(dirname $0)/debug_public.pem -signature <(echo $2 | base64 -d) <(echo $1 | base64 -d) +function verify() { + D=${1} + S=${2} + K=${3} + echo Trying ${K} + openssl dgst -sha256 -verify $(dirname $0)/${K} -signature <(echo ${S} | base64 -d) <(echo ${D} | base64 -d) +} + + +PROD_KEY_NAME=prod_public.pem +DEBUG_KEY_NAME=debug_public.pem +SIGNATURE="$2" +DATA="$1" + +echo DATA: ${DATA} +echo SIGNATURE: ${SIGNATURE} + +if verify "${DATA}" "${SIGNATURE}" "${PROD_KEY_NAME}"; then + echo Verified with ${PROD_KEY_NAME} + exit 0 +fi + +if verify "${DATA}" "${SIGNATURE}" "${DEBUG_KEY_NAME}"; then + echo Verified with ${DEBUG_KEY_NAME} + exit 0 +fi +exit 1 |