gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-05 19:55:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(connect): restore signature validation order

Browse Source
This commit is contained in:
Zhengchao An
2026-09-05 12:45:19 +08:00
parent 03ef0e8b15
commit 3017f50de6
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/connect/offline/enrollment.rs
+6 -4
View File
@@ -380,6 +380,12 @@ impl OfflineEnrollment {
return Err(EnrollmentError::MalformedDocument);
}
let issued_at = parse_timestamp(&routing.issued_at)?;
// The frozen decision order classifies the top-level signature before
// parsing any trust-link routing fields. Otherwise a malformed first
// link could mask a malformed artifact signature with DOCUMENT_MALFORMED.
let signature = decode_signature(&envelope.signature)?;
let first = routing.trust_chain.first().ok_or(EnrollmentError::MalformedDocument)?;
let first_bytes = decode_document_bytes(&first.bytes)?;
let first_routing: TrustLinkRouting =
@@ -388,10 +394,6 @@ impl OfflineEnrollment {
return Err(EnrollmentError::MalformedDocument);
}
// Only after the document can route verification do we classify the
// top-level signature spelling and algorithm.
let signature = decode_signature(&envelope.signature)?;
// Steps 3 to 5.
let connect_key = verify_trust_chain(
&routing.trust_chain,