| """Verify the signed publication record. Requires OpenSSH ssh-keygen.""" | |
| from pathlib import Path | |
| import subprocess,json,argparse,hashlib | |
| root=Path(__file__).resolve().parent;p=argparse.ArgumentParser();p.add_argument('--evidence-dir',type=Path);args=p.parse_args();payload=(root/'PUBLICATION_RECORD.json').read_bytes();record=json.loads(payload) | |
| verified=subprocess.run(['ssh-keygen','-Y','verify','-f',str(root/'PUBLICATION_ALLOWED_SIGNERS'),'-I','pixedar@gmail.com','-n','file','-s',str(root/'PUBLICATION_RECORD.json.sig')],input=payload,capture_output=True) | |
| if verified.returncode:raise SystemExit('Signature verification failed. Compare the signer with the public account key list and the version tag.') | |
| print('Publication signature valid under the included key. Public account key list: '+record['signature']['public_key_association']);print('Pinned scientific source: '+record['source_commit']);print('Pinned evidence data: '+record['evidence_data_commit']) | |
| if args.evidence_dir: | |
| for item in record['archives']: | |
| path=args.evidence_dir/item['path'];digest=hashlib.sha256(path.read_bytes()).hexdigest() | |
| if digest!=item['sha256']:raise SystemExit('Archive checksum mismatch: '+item['path']) | |
| print('Both local numerical archives match the signed record.') | |
| else:print('Archive bytes were not checked; use --evidence-dir after downloading the pinned files.') | |