goverify does not verify the file content
werwurm opened this issue · 2 comments
Hi,
I noticed that the goverify tool only checks if the file has a signature that verifies against the provided certificate, but it does not compute the digest over the file's content, and therefore, also does not check if the file's content matches the digest in the indirect section of the signature.
This could be considered a vulnerability if anyone relies on goverify to assert the authenticity of an executable. It should be possible to freely modify the sections of the file without tripping up goverify.
This can be fixed fairly easily. But at the very least I would suggest a warning in the docs or even the output of the tool, that it only checks the signature but may not be relied upon for security.
Yo,
Yes, I think I reflected on that while writing it but the current checksum and pecoff API is quite terrible so I never really implemented it properly.
The cmd/ directory should probably be considered examples and not indicative of proper usage, and a comment saying as much should probably be written.