From: Hans-Christoph Steiner <hans@eds.org>
Date: Sat, 30 Aug 2014 04:45:12 +0000 (-0400)
Subject: move apk signature verification into getsig() function
X-Git-Tag: 0.3.0~30
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=commitdiff_plain;h=d74235564f964a2d9c472116e0acc79f09e33ecd;p=fdroidserver.git

move apk signature verification into getsig() function

This makes the python replacement behave like an all-in-one replacement
for getsig.java.

fixes #5 https://gitlab.com/fdroid/fdroidserver/issues/5
---

diff --git a/fdroidserver/update.py b/fdroidserver/update.py
index c618fc78..225f594d 100644
--- a/fdroidserver/update.py
+++ b/fdroidserver/update.py
@@ -342,6 +342,13 @@ def getsig(apkpath):
 
     cert = None
 
+    # verify the jar signature is correct
+    args = ['jarsigner', '-verify', apkpath]
+    p = FDroidPopen(args)
+    if p.returncode != 0:
+        logging.critical(apkpath + " has a bad signature!")
+        return None
+
     with zipfile.ZipFile(apkpath, 'r') as apk:
 
         certs = [n for n in apk.namelist() if cert_path_regex.match(n)]
@@ -516,16 +523,6 @@ def scan_apks(apps, apkcache, repodir, knownapks):
                     sha.update(t)
                 thisinfo['sha256'] = sha.hexdigest()
 
-            # verify the jar signature is correct
-            args = ['jarsigner', '-verify']
-            if options.verbose:
-                args += ['-verbose', '-certs']
-            args += apkfile
-            p = FDroidPopen(args)
-            if p.returncode != 0:
-                logging.critical(apkfile + " has a bad signature!")
-                sys.exit(1)
-
             # Get the signature (or md5 of, to be precise)...
             thisinfo['sig'] = getsig(os.path.join(os.getcwd(), apkfile))
             if not thisinfo['sig']: