mirror of
https://github.com/opentofu/opentofu.git
synced 2024-12-30 10:47:14 -06:00
495826444b
When verifying the signature of the SHA256SUMS file, we have been hardcoding HashiCorp's public GPG key and using it as the keyring. Going forward, Terraform will get a list of valid public keys for a provider from the Terraform Registry (registry.terraform.io), and use them as the keyring for the openpgp verification func.
21 lines
464 B
Go
21 lines
464 B
Go
package discovery
|
|
|
|
import (
|
|
"bytes"
|
|
"log"
|
|
"strings"
|
|
|
|
"golang.org/x/crypto/openpgp"
|
|
)
|
|
|
|
// Verify the data using the provided openpgp detached signature and the
|
|
// embedded hashicorp public key.
|
|
func verifySig(data, sig []byte, armor string) (*openpgp.Entity, error) {
|
|
el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(armor))
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
return openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
|
|
}
|