From 8d9a45b2f38809fb3acfacf6f83532b7b556e78c Mon Sep 17 00:00:00 2001 From: Guillaume Le Vaillant Date: Tue, 5 Apr 2022 11:50:48 +0200 Subject: [PATCH] narinfo: Check URI when verifying narinfo validity. * guix/narinfo.scm (valid-narinfo?): Check if the 'uri' field is valid. --- guix/narinfo.scm | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/guix/narinfo.scm b/guix/narinfo.scm index 4fc550aa6c..466ce20deb 100644 --- a/guix/narinfo.scm +++ b/guix/narinfo.scm @@ -209,11 +209,13 @@ (define %mandatory-fields (define* (valid-narinfo? narinfo #:optional (acl (current-acl)) #:key verbose?) - "Return #t if NARINFO's signature is not valid." + "Return #t if NARINFO's signature is valid." (let ((hash (narinfo-sha256 narinfo)) (signature (narinfo-signature narinfo)) - (uri (uri->string (first (narinfo-uris narinfo))))) - (and hash signature + (uri (if (null? (narinfo-uris narinfo)) + #f + (uri->string (first (narinfo-uris narinfo)))))) + (and hash signature uri (signature-case (signature hash acl) (valid-signature #t) (invalid-signature -- 2.35.1