Add (broken) signature verification

1 files changed, 10 insertions, 0 deletions

diff --git a/packages/server/src/metadata/metadataService.ts b/packages/server/src/metadata/metadataService.ts
index 29ff835..92f207e 100644
--- a/packages/server/src/metadata/metadataService.ts
+++ b/packages/server/src/metadata/metadataService.ts
@@ -5,6 +5,7 @@ import { ENV_VARS } from '../helpers/constants';
 import toHash from '../helpers/toHash';
 import validateCertificatePath from '../helpers/validateCertificatePath';
 import convertASN1toPEM from '../helpers/convertASN1toPEM';
+import verifySignature from '../helpers/verifySignature';
 
 import parseJWT from './parseJWT';
 
@@ -127,6 +128,15 @@ class MetadataService {
       return;
     }
 
+    // TODO: Figure out why the signature won't verify here
+    const leafCert = fullCertPath[0];
+    const jwtParts = data.split('.');
+    const signatureBaseBuffer = Buffer.from(`${jwtParts[0]}.${jwtParts[1]}`, 'base64');
+    const signatureBuffer = Buffer.from(jwtParts[2], 'base64');
+
+    const verified = verifySignature(signatureBuffer, signatureBaseBuffer, leafCert);
+    console.log({ verified });
+
     // Convert the nextUpdate property into a Date so we can determine when to redownload
     const [year, month, day] = payload.nextUpdate.split('-');
     this.nextUpdate = new Date(