File wrapping framework.

fetcher.py

@@ -1,9 +1,9 @@
 #!/usr/bin/python3
-# coding=utf8
 
 import argparse
 import json
 import hashlib
+from OpenSSL import crypto
 import socket
 import struct
 import urllib.request
@@ -15,6 +15,11 @@ parser.add_argument(
     dest='base_url',
     action='store',
     required=True)
+parser.add_argument(
+    '--ca-cert',
+    dest='ca_cert',
+    action='store',
+    required=True)
 parser.add_argument(
     '--image-type',
     dest='image_type',
@@ -27,13 +32,24 @@ class Fetcher(object):
 
   _MAX_BP = 10000
 
-  def __init__(self, base_url, image_type):
+  def __init__(self, base_url, image_type, ca_cert):
     self._base_url = base_url
     self._image_type = image_type
+    with open(ca_cert, 'r') as fh:
+      self._ca_cert = crypto.load_certificate(crypto.FILETYPE_PEM, fh.read())
+
+  def _Unwrap(self, wrapped):
+    cert = crypto.load_certificate(crypto.FILETYPE_PEM, wrapped['cert'])
+    crypto.verify(
+        cert,
+        wrapped['sig'].encode('ascii'),
+        wrapped['inner'].encode('ascii'),
+        'sha256')
 
   def _GetManifest(self):
     url = '%s/%s.manifest.json' % (self._base_url, self._image_type)
-    return json.loads(urllib.request.urlopen(url).read().decode('utf8'))
+    resp = urllib.request.urlopen(url).read().decode('utf8')
+    return self._Unwrap(json.loads(resp))
 
   def _ChooseImage(self, manifest):
     hostname = socket.gethostname()
@@ -47,9 +63,9 @@ class Fetcher(object):
 
   def Fetch(self):
     manifest = self._GetManifest()
-    image = self._ChooseImage(manifest)
-    print(image)
+    #image = self._ChooseImage(manifest)
+    #print(image)
 
 
-fetcher = Fetcher(FLAGS.base_url, FLAGS.image_type)
+fetcher = Fetcher(FLAGS.base_url, FLAGS.image_type, FLAGS.ca_cert)
 fetcher.Fetch()