search

cvmfs-contrib / python-cvmfsutils

BSD 3-Clause "New" or "Revised" License
0 stars 6 forks source link

Convert from m2crypto to cryptography for el9 support #30

Closed DrDaveD closed 6 months ago

DrDaveD commented 6 months ago

As mentioned in PR #29. Use the RSAPublicKey recover_data_from_signature() function in Certificate verify function.

DrDaveD commented 6 months ago

I tried using recover_data_from_signature(), but it's a no-go. First, it's only available starting in version 3.3, which is too new for EL8. Second, it only works with PKCS1v15 padding and that's apparently not the padding used. The error message when I tried to use it along with a hash of None (which is supposed to work) was confusing though: TypeError: Expected provider of AsymmetricPadding.. I tried first converting the whitelist _signature_verify function to cryptography, and it couldn't translate directly because the public key did not have a decrypt function. So it was there that I tried to use recover_data_from_signature().

Hopefully with more experimentation I'll be able to find a workaround to the EL9 sha1 ban using m2crypto.