From 644193d4e02592965e7359ac2775d08bb84f1a7b Mon Sep 17 00:00:00 2001
From: Jonathan Lebon <jonathan@jlebon.com>
Date: Sep 20 2019 20:07:43 +0000
Subject: Handle new checksum format for CoreOS signing requests


In order to be more self-documenting and forward-compatible, the
checksum field for signing requests is now prefixed by the algorithm
used to derive it. Handle this new format.

See https://github.com/coreos/fedora-coreos-tracker/issues/198#issuecomment-533683246

Signed-off-by: Jonathan Lebon <jonathan@jlebon.com>

---

diff --git a/robosignatory/coreos.py b/robosignatory/coreos.py
index 693361f..72ba206 100644
--- a/robosignatory/coreos.py
+++ b/robosignatory/coreos.py
@@ -97,6 +97,12 @@ class SignerWrapper(object):
         raise NotImplementedError
 
     def sign(self, url, checksum):
+        if ':' not in checksum:
+            raise SigningFailed("Missing algo prefix in {}".format(checksum))
+        algo, checksum = checksum.split(':', 1)
+        if algo != "sha256":
+            # for now, we only handle sha256
+            raise SigningFailed("Unknown checksum algo {}".format(algo))
         tmpdir = tempfile.mkdtemp(prefix="/tmp/robosignatory-")
         try:
             self._sign_object(url, checksum, tmpdir)
diff --git a/tests/test_coreos.py b/tests/test_coreos.py
index c3ae9c3..83a9755 100644
--- a/tests/test_coreos.py
+++ b/tests/test_coreos.py
@@ -35,7 +35,7 @@ ARTIFACTS_MESSAGE = Message(
         "basearch": "basearch",
         "artifacts": [{
             "file": "s3://host/some/path/test1",
-            "checksum": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            "checksum": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         }]
     }
 )
@@ -47,7 +47,7 @@ OSTREE_MESSAGE = Message(
         "stream": "stream",
         "basearch": "basearch",
         "commit_object": "s3://host/some/path/test1",
-        "checksum": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "checksum": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     }
 )
 
@@ -119,7 +119,7 @@ class TestCoreOS(unittest.TestCase):
     @mock.patch('robosignatory.coreos.utils.run_command')
     def test_wrong_checksum(self, run_command):
         new_body = copy.deepcopy(ARTIFACTS_MESSAGE.body)
-        new_body["artifacts"][0]["checksum"] = "wrong-checksum"
+        new_body["artifacts"][0]["checksum"] = "sha256:wrong-checksum"
         msg = Message(topic=ARTIFACTS_MESSAGE.topic, body=new_body)
         self.consumer.bucket.download_file.side_effect = fake_download
         expected_response = self._get_response_message(ARTIFACTS_MESSAGE, failed=True)