Skip to content

Commit

Permalink
prepare-root: Fold together composefs signature cases
Browse files Browse the repository at this point in the history
Now that we don't support digest-but-not-signature verification
for composefs, the logic here was unnecessarily complicated.
With a prior prep patch that moved the composefs option
initialization up, we can just have everything related to signature
verification in a single conditonal.
  • Loading branch information
cgwalters committed Aug 25, 2023
1 parent 1d316e3 commit e952b1b
Showing 1 changed file with 0 additions and 10 deletions.
10 changes: 0 additions & 10 deletions src/switchroot/ostree-prepare-root.c
Original file line number Diff line number Diff line change
Expand Up @@ -479,21 +479,11 @@ main (int argc, char *argv[])

expected_digest = g_malloc (OSTREE_SHA256_STRING_LEN + 1);
ot_bin2hex (expected_digest, cfs_digest_buf, g_variant_get_size (cfs_digest_v));
}

if (expected_digest != NULL)
{
cfs_options.flags |= LCFS_MOUNT_FLAGS_REQUIRE_VERITY;
g_print ("composefs: Verifying digest: %s\n", expected_digest);
cfs_options.expected_fsverity_digest = expected_digest;
}
else
{
// If we're not verifying a digest, then we *must* also have signatures disabled.
// Or stated in reverse: if signature verification is enabled, then digest verification
// must also be.
g_assert (!composefs_config->is_signed);
}

if (lcfs_mount_image (OSTREE_COMPOSEFS_NAME, TMP_SYSROOT, &cfs_options) == 0)
{
Expand Down

0 comments on commit e952b1b

Please sign in to comment.