From 60a61051971d7bc9f5d3c8c4672792b373b602d4 Mon Sep 17 00:00:00 2001 From: Prayag Date: Mon, 10 Aug 2026 23:16:32 +0530 Subject: [PATCH] sdk_lib: add GPG signature verification for SDK downloads Signed-off-by: Prayag --- sdk_lib/sdk_util.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sdk_lib/sdk_util.sh b/sdk_lib/sdk_util.sh index b93881b9f83..6c363bb7873 100644 --- a/sdk_lib/sdk_util.sh +++ b/sdk_lib/sdk_util.sh @@ -24,7 +24,7 @@ sdk_download_tarball() { local server url suffix local -a suffixes - suffixes=('' '.DIGESTS') # TODO(marineam): download .asc + suffixes=('' '.DIGESTS' '.DIGESTS.asc') for server in "${FLATCAR_SDK_SERVERS[@]}"; do url="${server}/sdk/${FLATCAR_SDK_ARCH}/${FLATCAR_SDK_VERSION}/${FLATCAR_SDK_TARBALL}" info "URL: ${url}" @@ -72,11 +72,16 @@ _sdk_check_downloads() { sdk_verify_digests() { if [[ ! -f "${FLATCAR_SDK_TARBALL_PATH}" || \ - ! -f "${FLATCAR_SDK_TARBALL_PATH}.DIGESTS" ]]; then + ! -f "${FLATCAR_SDK_TARBALL_PATH}.DIGESTS" || \ + ! -f "${FLATCAR_SDK_TARBALL_PATH}.DIGESTS.asc" ]]; then return 1 fi - # TODO(marineam): Add gpg signature verification too. + info "Verifying GPG signature of the DIGESTS file..." + if ! gpg --verify "${FLATCAR_SDK_TARBALL_PATH}.DIGESTS.asc" "${FLATCAR_SDK_TARBALL_PATH}.DIGESTS"; then + error "GPG signature verification failed! The SDK artifact may be compromised." + return 1 + fi verify_digests "${FLATCAR_SDK_TARBALL_PATH}" || return 1 }