From d26ca79bcb7a6e2c59f7b6f9292c28b7189d431a Mon Sep 17 00:00:00 2001 From: Steve McIntyre Date: Wed, 6 May 2026 23:58:34 +0100 Subject: Fix up cert filenames and explicitly sort them before use --- 0010-snakeoil.crt | 21 +++++++++++++++++++++ 0020-wrong.crt | 26 ++++++++++++++++++++++++++ 1000-snakeoil.crt | 21 --------------------- 2000-wrong.crt | 26 -------------------------- verify_combine_sigs | 6 +++--- 5 files changed, 50 insertions(+), 50 deletions(-) create mode 100644 0010-snakeoil.crt create mode 100644 0020-wrong.crt delete mode 100644 1000-snakeoil.crt delete mode 100644 2000-wrong.crt diff --git a/0010-snakeoil.crt b/0010-snakeoil.crt new file mode 100644 index 0000000..dd02a82 --- /dev/null +++ b/0010-snakeoil.crt @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDdzCCAl+gAwIBAgIULTs+L+8XzClMGhAvyFIdsp/PYgUwDQYJKoZIhvcNAQEL +BQAwSjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG +b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMCAXDTIwMDkwNzE4NDMyMloY +DzIxMjAwODE0MTg0MzIyWjBKMQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh +ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ +boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1 +wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx ++L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy +I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u +Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB +AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW +gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 +DQEBCwUAA4IBAQBW2ckn0APqBnwSiOXCWkMCnvY7K7UOfxAlotEsMFSrkzdEa4IE +sn0+A3RV/r3HZGqIaE8GMsBqp8UiVIbL5H67dkqvJEke94/7wEUC16JSSOBc0Mac +HeArDWsL/WIbzKiVcRrmgX+XwJFlsUN5UtR/feTHR08yiy5srSCIJEqli/cTrOxS +JAgvWPLxcoFhOKf6Mi+nwWdrQEbpXvvv8Jv/qyyz5e/VmTRY0wIVmUjd+Yseu+5M +3+cpKtlYaawMxVni5RibA0A12fm+i60fGPrkCNhascUrNY+Oppaf/h+QmKOwEM7h +pqKXyGFQyU6dB6cFBQ/uD5IABUYuEOuL7VFY +-----END CERTIFICATE----- diff --git a/0020-wrong.crt b/0020-wrong.crt new file mode 100644 index 0000000..a9039db --- /dev/null +++ b/0020-wrong.crt @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE----- +MIIEUzCCAzugAwIBAgIUa3jcFK7TK14FlPqQlHZGuPANPiMwDQYJKoZIhvcNAQEL +BQAwgYoxCzAJBgNVBAYTAkdCMQ4wDAYDVQQIDAVDYW1iczESMBAGA1UEBwwJQ2Ft +YnJpZGdlMQ8wDQYDVQQKDAZTbGVkZ2UxJTAjBgNVBAMMHFNlY3VyZSBCb290IFNp +Z25pbmcgdGVzdCBrZXkxHzAdBgkqhkiG9w0BCQEWEHN0ZXZlQGVpbnZhbC5jb20w +IBcNMTkwNDI4MjMyNDA1WhgPMjExOTA0MDQyMzI0MDVaMIGKMQswCQYDVQQGEwJH +QjEOMAwGA1UECAwFQ2FtYnMxEjAQBgNVBAcMCUNhbWJyaWRnZTEPMA0GA1UECgwG +U2xlZGdlMSUwIwYDVQQDDBxTZWN1cmUgQm9vdCBTaWduaW5nIHRlc3Qga2V5MR8w +HQYJKoZIhvcNAQkBFhBzdGV2ZUBlaW52YWwuY29tMIIBIjANBgkqhkiG9w0BAQEF +AAOCAQ8AMIIBCgKCAQEArc9AXOIymkUfi3XJD1vZk7LR4cBVdQR71RGQxuM4omg/ +dvu+xaLH+hiwUGQ4/BvOBh95JcKg+ryCRWuILNTbYmxSB6TlJcv/JQgJ7iUmzVcH +NFeEvtfV6Xd5zbh4wqK6ugtiqa7SGEhYKncHcbCL44gZdMKyamEeb5BMaL1VbBSQ +baNeNUiaHeLwREBmNTi+tb0Btq1vTuzNzBN8baGk2RvP91gCUeCN+ILA0DXZ4a43 +flrLt+5d3go76p464htYB+Ab/Z/AFgEBWoKZm6MYZc8igCMdTyLY5Pn4FIX7r23T +5g1u8pCf5MaEO1+ABxnVxim3hbvouABjlNj3BE2HZwIDAQABo4GsMIGpMB0GA1Ud +DgQWBBSND9MzlvKlYN9gpyzKQaKbkq1kjTAfBgNVHSMEGDAWgBSND9MzlvKlYN9g +pyzKQaKbkq1kjTAMBgNVHRMBAf8EAjAAMCsGA1UdJQQkMCIGCCsGAQUFBwMDBgor +BgEEAYI3CgMGBgorBgEEAZIIEAECMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdl +bmVyYXRlZCBDZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQsFAAOCAQEABJDbjwU0Ua+B +xFGfJlYFBlOzGa+Ppj0zQFonSnEA6zXVTOrnZulScKVUzEBaTA64TY6YdGELums+ +vGPiJ5/JWAY6FAiceXAEy+aIUXBHT1NQbis4kGOaYYiFCMkSOA1QH34/3zLVk3y1 +n//BSURlCh4amKoUZO3H1rS8hqQRYP4Hprv7TTJ+qvlKlKiYZcuODFyAusx+No1T +5ht9dGzDtq9CX7Xi4BVHNVddEN1wKC8+9PlGB837DQUqofXGGt7C9fhIa10h/xWL +KC+c5gaqgG8nBr7qVI7xlAqDq9Mr4ZoWwv43HGHno57d95blMj17aGjBRHF/Y2ak +ebBQxN+Z7A== +-----END CERTIFICATE----- diff --git a/1000-snakeoil.crt b/1000-snakeoil.crt deleted file mode 100644 index dd02a82..0000000 --- a/1000-snakeoil.crt +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDdzCCAl+gAwIBAgIULTs+L+8XzClMGhAvyFIdsp/PYgUwDQYJKoZIhvcNAQEL -BQAwSjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCENvbG9yYWRvMRUwEwYDVQQHDAxG -b3J0IENvbGxpbnMxETAPBgNVBAoMCFNuYWtlT2lsMCAXDTIwMDkwNzE4NDMyMloY -DzIxMjAwODE0MTg0MzIyWjBKMQswCQYDVQQGEwJVUzERMA8GA1UECAwIQ29sb3Jh -ZG8xFTATBgNVBAcMDEZvcnQgQ29sbGluczERMA8GA1UECgwIU25ha2VPaWwwggEi -MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi65d6LmojD5S9q8vE/LI2HHQ -boiO5/1KrFVc6kpxD6XdkJwpBoItYIfSls9CPnzvNWOAxR3hIeBd1U/prAPPxvQ1 -wuDLMXfWkcGaYHfPnme/YluAjnpuLH1MQcumgOzj5xYBvZZk+RbytX/phH7FW4Tx -+L1oBYnsfh3BSE/NTtEEHV1nXAXpa/dvyefWMlrlbwjfM5362lZzM6yrJGcOcWEy -I66UYCIVO2Yhe/ZVF5B/tPGtd2oACz11xLeqLPM1WBjlekAG2Zi7UCPIvDCpdn5u -Vna2ZRQmJyDDdh0Ja2VMC19dkMd/5nOAI21O+FvYPOkBWYX8f4DzDyVQlmIFAgMB -AAGjUzBRMB0GA1UdDgQWBBRjuNXuXfh7mi8I3eTboeYGyFTa2zAfBgNVHSMEGDAW -gBRjuNXuXfh7mi8I3eTboeYGyFTa2zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 -DQEBCwUAA4IBAQBW2ckn0APqBnwSiOXCWkMCnvY7K7UOfxAlotEsMFSrkzdEa4IE -sn0+A3RV/r3HZGqIaE8GMsBqp8UiVIbL5H67dkqvJEke94/7wEUC16JSSOBc0Mac -HeArDWsL/WIbzKiVcRrmgX+XwJFlsUN5UtR/feTHR08yiy5srSCIJEqli/cTrOxS -JAgvWPLxcoFhOKf6Mi+nwWdrQEbpXvvv8Jv/qyyz5e/VmTRY0wIVmUjd+Yseu+5M -3+cpKtlYaawMxVni5RibA0A12fm+i60fGPrkCNhascUrNY+Oppaf/h+QmKOwEM7h -pqKXyGFQyU6dB6cFBQ/uD5IABUYuEOuL7VFY ------END CERTIFICATE----- diff --git a/2000-wrong.crt b/2000-wrong.crt deleted file mode 100644 index a9039db..0000000 --- a/2000-wrong.crt +++ /dev/null @@ -1,26 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEUzCCAzugAwIBAgIUa3jcFK7TK14FlPqQlHZGuPANPiMwDQYJKoZIhvcNAQEL -BQAwgYoxCzAJBgNVBAYTAkdCMQ4wDAYDVQQIDAVDYW1iczESMBAGA1UEBwwJQ2Ft -YnJpZGdlMQ8wDQYDVQQKDAZTbGVkZ2UxJTAjBgNVBAMMHFNlY3VyZSBCb290IFNp -Z25pbmcgdGVzdCBrZXkxHzAdBgkqhkiG9w0BCQEWEHN0ZXZlQGVpbnZhbC5jb20w -IBcNMTkwNDI4MjMyNDA1WhgPMjExOTA0MDQyMzI0MDVaMIGKMQswCQYDVQQGEwJH -QjEOMAwGA1UECAwFQ2FtYnMxEjAQBgNVBAcMCUNhbWJyaWRnZTEPMA0GA1UECgwG -U2xlZGdlMSUwIwYDVQQDDBxTZWN1cmUgQm9vdCBTaWduaW5nIHRlc3Qga2V5MR8w -HQYJKoZIhvcNAQkBFhBzdGV2ZUBlaW52YWwuY29tMIIBIjANBgkqhkiG9w0BAQEF -AAOCAQ8AMIIBCgKCAQEArc9AXOIymkUfi3XJD1vZk7LR4cBVdQR71RGQxuM4omg/ -dvu+xaLH+hiwUGQ4/BvOBh95JcKg+ryCRWuILNTbYmxSB6TlJcv/JQgJ7iUmzVcH -NFeEvtfV6Xd5zbh4wqK6ugtiqa7SGEhYKncHcbCL44gZdMKyamEeb5BMaL1VbBSQ -baNeNUiaHeLwREBmNTi+tb0Btq1vTuzNzBN8baGk2RvP91gCUeCN+ILA0DXZ4a43 -flrLt+5d3go76p464htYB+Ab/Z/AFgEBWoKZm6MYZc8igCMdTyLY5Pn4FIX7r23T -5g1u8pCf5MaEO1+ABxnVxim3hbvouABjlNj3BE2HZwIDAQABo4GsMIGpMB0GA1Ud -DgQWBBSND9MzlvKlYN9gpyzKQaKbkq1kjTAfBgNVHSMEGDAWgBSND9MzlvKlYN9g -pyzKQaKbkq1kjTAMBgNVHRMBAf8EAjAAMCsGA1UdJQQkMCIGCCsGAQUFBwMDBgor -BgEEAYI3CgMGBgorBgEEAZIIEAECMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdl -bmVyYXRlZCBDZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQsFAAOCAQEABJDbjwU0Ua+B -xFGfJlYFBlOzGa+Ppj0zQFonSnEA6zXVTOrnZulScKVUzEBaTA64TY6YdGELums+ -vGPiJ5/JWAY6FAiceXAEy+aIUXBHT1NQbis4kGOaYYiFCMkSOA1QH34/3zLVk3y1 -n//BSURlCh4amKoUZO3H1rS8hqQRYP4Hprv7TTJ+qvlKlKiYZcuODFyAusx+No1T -5ht9dGzDtq9CX7Xi4BVHNVddEN1wKC8+9PlGB837DQUqofXGGt7C9fhIa10h/xWL -KC+c5gaqgG8nBr7qVI7xlAqDq9Mr4ZoWwv43HGHno57d95blMj17aGjBRHF/Y2ak -ebBQxN+Z7A== ------END CERTIFICATE----- diff --git a/verify_combine_sigs b/verify_combine_sigs index 438f125..c8dd9ce 100755 --- a/verify_combine_sigs +++ b/verify_combine_sigs @@ -174,7 +174,7 @@ def main(): print("Loading details of all the expected certificates") print("==========") known_certs = {} - for check_cert in glob.glob(SIGN_CERTS): + for check_cert in sorted(glob.glob(SIGN_CERTS)): subject, sha256 = grab_cert_details(check_cert) known_certs[subject] = {"sha256": sha256, "filename": check_cert} print("") @@ -194,7 +194,7 @@ def main(): # Verify that the image is signed and valid print("Looking for any valid checksum and signature") try: - verify_signature(signed, glob.glob(SIGN_CERTS)) + verify_signature(signed, sorted(glob.glob(SIGN_CERTS))) except Exception as exc: print(f"Invalid signature on {signed}: {exc}") sys.exit(1) @@ -281,7 +281,7 @@ def main(): unsigned, ) - for sig in glob.glob(f"{build}/detached-*"): + for sig in sorted(glob.glob(f"{build}/detached-*")): print(f"Adding signature {sig}") attach_sig(sig, unsigned) -- cgit v1.2.3