Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
If the signature is valid, returns True. If the signature is invalid, raise
an exception explaining why.
"""
# Data must be encoded as bytes
if isinstance(data, str):
data = data.encode()
# Content signature implicitly adds a prefix to signed data
data = b"Content-Signature:\x00" + data
# fastecdsa expects ASCII armored keys, but ours is unarmored. Add the
# armor before passing the key to the library.
EC_PUBLIC_HEADER = "-----BEGIN PUBLIC KEY-----"
EC_PUBLIC_FOOTER = "-----END PUBLIC KEY-----"
verifying_pubkey = PEMEncoder.decode_public_key(
"\n".join([EC_PUBLIC_HEADER, pubkey, EC_PUBLIC_FOOTER])
)
try:
signature = base64.urlsafe_b64decode(signature)
signature = ecdsa.util.sigdecode_string(signature, order=ecdsa.curves.NIST384p.order)
except binascii.Error as e:
if BASE64_WRONG_LENGTH_RE.match(e.args[0]):
raise WrongSignatureSize("Base64 encoded signature was not a multiple of 4")
else:
raise
except AssertionError as e:
# The signature decoder has a clause like
# assert len(signature) == 2*l, (len(signature), 2*l)
# If the AssertionError is consistent with that signature, translate it
# to a nicer error. Otherwise re-raise.