ó Õò—Vc@sXddlZddlZddlZddlZddlZddlZdZdZdZdZ dZ dZ dZ d Z d Zd Zd Zd ZdZdZdZdZdZd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Z d„Z!d„Z"d„Z#d „Z$d!„Z%e&d"krTej'e%ƒƒndS(#iÿÿÿÿNtIS_verify_bulkhashsmImage signing application. This will verify the certificate chain and image signature using openssl commands.s1.0sssssssssss2http://www.cisco.com/security/pki/certs/crcam2.cers6http://www.cisco.com/security/pki/certs/innerspace.cert@cd85167b3935e27bcc3b0f5fa24c8457882d0bb994f88269a7f72829d957eae9t@f31e6b39dae6996fdf2045a61be8bd3688a86dfd06c46ce71af4af239f411c56cCsjtjjdƒdkr9|tkr1dGH|GHqf|GHn-|tkrY|d|tGHn ||tGHdS(Ntlinuxiÿÿÿÿs Error Log: s Error log: (tsystplatformtfindtFAILtENDC(tcolortstring((sIS_verify_bulkhash_release.pytLOG2s  cCsjtjjtƒr"tjtƒntjjtƒrDtjtƒntjjdƒrftjdƒndS(Ns ee_pubkey.pem(tostpathtexistst root_certtremovet subca_cert(targs((sIS_verify_bulkhash_release.pytcleanupCs cCs$tj|ƒjdkrtStSdS(Ni(turllibturlopentcodetFalsetTrue(turl((sIS_verify_bulkhash_release.pyt url_existsQscCsntjt|dƒjƒƒjƒ}||kr4tSttd|d|ƒttd|d|ƒtSdS(NtrbsComputed sha256sum of s = sExpected sha256sum of ( thashlibtsha256topentreadt hexdigestRR RR(t cert_nametexpected_sha256t cert_sha256((sIS_verify_bulkhash_release.pytverify_cert_sha256\s $ cCs¢t|dƒ}|jƒ}|jdƒdkr˜dj||ƒ}tj|ƒ\}}|jdƒdkr˜ttd|dƒtt|ƒtSnWdQXt S(Ntrs-----BEGIN CERTIFICATE-----iÿÿÿÿs'openssl x509 -inform der -in {} -out {}terrorsFailed to convert sfrom DER to PEM.( RtreadlineRtformattcommandstgetstatusoutputR RRR(R!tft first_linetcmdtstatustout((sIS_verify_bulkhash_release.pytconvert_cert_to_pemjs   cCsId}t|ƒr8|jdƒd}tj||ƒn ttdƒ|S(NsN/At/iÿÿÿÿsDownload certificate failed.(RtsplitRt urlretrieveR R(tcert_urlR!((sIS_verify_bulkhash_release.pyt download_cert}s   cCsädjttƒ}tj|ƒ\}}|jdƒdksH|dkrfttdƒtt|ƒdSdjtt|ƒ}tj|ƒ\}}|jdƒdks±|dkrÏttdƒtt|ƒdSttdƒ|SdS( Nsopenssl verify -CAfile {} {}R&iÿÿÿÿis2Verification of root and subca certificate failed.s*openssl verify -CAfile {} -untrusted {} {}s>Failed to verify root, subca and end-entity certificate chain.sCSuccessfully verified root, subca and end-entity certificate chain.( R(RRR)R*RR RtOKGREEN(tee_certR-R.R/((sIS_verify_bulkhash_release.pytverify_3tier_cert_chainŠs!  !   cCsfdj|ƒ}tj|ƒ\}}|dkrMttdƒtt|ƒnttd|dƒ|S(Ns2openssl x509 -pubkey -noout -in {} > ee_pubkey.pemis6Failed to fetch a public key from x509 PEM certificates'Successfully fetched a public key from t.(R(R)R*R RR6(R!R-R.R/((sIS_verify_bulkhash_release.pytfetch_pubkey_from_cert¥s  cCs€|jrd}nd}dj||j|jƒ}tj|ƒ\}}|dkr|ttd|jdƒtt|ƒn|S(NRtsha512s7openssl dgst -{} -verify ee_pubkey.pem -signature {} {}is#Failed to verify dgst signature of R9(RR(t signaturet image_nameR)R*R R(Rt sha_versionR-R.R/((sIS_verify_bulkhash_release.pytverify_dgst_signatureµs   cCskdj|j|j|jƒ}tj|ƒ\}}|dkrgttd|jdƒtt|ƒn|S(Ns]openssl smime -verify -binary -in {} -inform PEM -content {} -noverify -nointern -certfile {}is$Failed to verify smime signature of R9(R(R<R=R7R)R*R R(RR-R.R/((sIS_verify_bulkhash_release.pytverify_smime_signatureÈs  cCsM|jdkrt|ƒ}n+t|jƒ}|dkr=dSt|ƒ}|S(Ntsmimeii(t verify_typeR@R:R7R?(RR.((sIS_verify_bulkhash_release.pytverify_signature×s  cCskttdtdƒttƒatdkrotttƒr^ttƒttdtdƒq}t|ƒdSnt|ƒdSttdt dƒtt ƒa t dkrìtt t ƒrÛtt ƒttdt dƒqút|ƒdSnt|ƒdSt |j ƒ}|dkr#t|ƒdSt|ƒ}|dkr]ttd|jd |j ƒnt|ƒdS( Ns Downloading CA certificate from s ...sN/As%Successfully downloaded and verified R9s#Downloading SubCA certificate from is'Successfully verified the signature of s using (R R6trel_root_cert_urlR5RR$trel_root_cert_sha256R0Rtrel_subca_cert_urlRtrel_subca_cert_sha256R8R7RCR=(RR.((sIS_verify_bulkhash_release.pytcommand_handlerås:              " cCsÍ|jdkrCtjj|jƒsCttd|jdƒdSn|jdkr†tjj|jƒs†ttd|jdƒdSn|jdkrÉtjj|jƒsÉttd|jdƒdSndS(Nt's' does not existii( R=tNoneR R RR RR<R7(R((sIS_verify_bulkhash_release.pytverify_parser_optionssc CsOtjdtdtƒ}|jddddddtdƒ|jd d d d d ddtddƒ|jddd dd ddtddƒ|jddd dd ddtddƒ|jddddd gd!dgd d"dtdd#ƒ|jdtƒ}|jd$dd%d d&dd'ƒ|jd(dd%d d)dd*ƒ|j d+t ƒ|S(,Ntprogt descriptions-Vs --versiontactiontversions%(prog)s (version t)s-es --ee_certtmetavarstdestR7trequiredthelps2Local path to End-entity certificate in PEM formats-ss --signaturesR<s#Filename containing image signatures-is --image_names R=s Image names-vs --verify_typetchoicestdgstRAtdefaultRBsVerify type: dgst|smimes-sha256t store_trueRs9Using sha256 hashing algorithm (required only for 'dgst')s-sha512R;s9Using sha512 hashing algorithm (required only for 'dgst')tfunc( targparsetArgumentParsert PROG_NAMEtMENU_MAIN_DESCt add_argumenttIS_VERIFY_BULKHASH_VERSIONRRtadd_mutually_exclusive_groupt set_defaultsRH(tpmaint group_input((sIS_verify_bulkhash_release.pyt arg_parser,s$(((7cCs<tƒ}|jƒ}t|ƒdkr+dS|j|ƒdS(Nii(Rdt parse_argsRKRY(RbR((sIS_verify_bulkhash_release.pytmainMs    t__main__((RR RZR)RRR\R]R_RtWARNINGtHEADERR6tOKBLUEtOKCYANtOKWHITERtBOLDt UNDERLINERDRFRERGR RRR$R0R5R8R:R?R@RCRHRKRdRft__name__texit(((sIS_verify_bulkhash_release.pyt sN                3  !