Administration/pmbootstrap-meow
2
0
Fork 0
forked from Mirror/pmbootstrap
Code Pull requests Activity Actions

pmb.chroot.apk_static: use sha256 sig for verification (MR 2417)

Browse source 
Fixes #2456
Depends on https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/72741
This commit is contained in:
Clayton Craft 2024-09-29 10:26:12 -07:00 • committed by Oliver Smith
parent 4998e27cc7
commit 7a299b3fc4
No known key found for this signature in database
GPG key ID: 5AE7F5513E0885CB
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
pmb/chroot/apk_static.py
View file

@ -28,7 +28,7 @@ def read_signature_info(tar):
:returns: (sigfilename, sigkey_path) :returns: (sigfilename, sigkey_path)
""" """
# Get signature filename and key # Get signature filename and key
prefix = "sbin/apk.static.SIGN.RSA." prefix = "sbin/apk.static.SIGN.RSA.sha256."
sigfilename = None sigfilename = None
for filename in tar.getnames(): for filename in tar.getnames():
if filename.startswith(prefix): if filename.startswith(prefix):
@ -88,7 +88,7 @@ def verify_signature(files, sigkey_path):
[ [
"openssl", "openssl",
"dgst", "dgst",
"-sha1", "-sha256",
"-verify", "-verify",
sigkey_path, sigkey_path,
"-signature", "-signature",