Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Verify default bundles downloaded from mirror.openshift.com #3605

Merged
merged 3 commits into from
May 5, 2023
Merged

Verify default bundles downloaded from mirror.openshift.com #3605

merged 3 commits into from
May 5, 2023

Commits on Apr 27, 2023

  1. Add helper to verify pgp v3 clear signed message 

    it adds GetVerifiedClearsignedMsgV3() which returns clear text  msg
and no error if the signature is valid for the supplied pubkey

this uses the golang.org/x/crypto/openpgp library as the maintained
fork of it that is previously used doesn't support the old v3 signs
the other fork of x/crypto at github.com/keybase/go-crypto has less
active contributions
    @anjannath
    anjannath committed Apr 27, 2023
    Configuration menu
    Copy the full SHA
    68367bd View commit details
    Browse the repository at this point in the history

  2. Add helper to get signature verified hash of the default bundle 

    this adds getVerifiedDefaultBundleHash() which downloads the signed
sha256sum.txt file from mirror.openshift.com and verifies that it's
signed with the redhat release key2, then from the verified  hashes
it returns the hash for the default bundle
    @anjannath
    anjannath committed Apr 27, 2023
    Configuration menu
    Copy the full SHA
    e76849b View commit details
    Browse the repository at this point in the history

  3. Verify default bundles downloaded from mirror.openshift.com 

    this removes the hardcoded hashes for each bundle and instead
directly gets the bundle hash from the sha256sum.txt.sig file
at mirror.openshift.com by using the helper from the previous
commit which returns gpg verified hash for the default bundle
    @anjannath
    anjannath committed Apr 27, 2023
    Configuration menu
    Copy the full SHA
    59f4fb8 View commit details
    Browse the repository at this point in the history