From a3905bd21e193cea073aba80e7621707eed9ba52 Mon Sep 17 00:00:00 2001
From: Compey <hi@devcomp.xyz>
Date: Sat, 26 Nov 2022 17:21:52 +0530
Subject: [PATCH] feat(security): signature verification

---
 lib/checkers/verifySignature.go | 22 ++++++++++++----------
 src/main.go                     |  2 +-
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/lib/checkers/verifySignature.go b/lib/checkers/verifySignature.go
index 3243620..1c0378b 100644
--- a/lib/checkers/verifySignature.go
+++ b/lib/checkers/verifySignature.go
@@ -39,20 +39,22 @@ func VerifySignature(mirrorUrl string) {
 	}
 
 	unixWd := fmt.Sprintf("/mnt/c/%s", strings.ReplaceAll(strings.Split(userHomeDir, `C:\`)[1], `\`, "/")) + strings.ReplaceAll(strings.Split(cwd, userHomeDir)[1], `\`, "/")
-
-	// does not work?
-
-	getAuthenticity, authenticityErr := exec.Command("powershell.exe", fmt.Sprintf(`wsl bash -c "cd %s && gpg --keyserver-options auto-key-retrieve --verify archlinux-bootstrap-2022.11.01-x86_64.tar.gz.sig"`, unixWd)).Output()
-
+	logger.Info(fmt.Sprintf("Looking for verification signature in Unix Directory %s", unixWd))
+	cmd := exec.Command("wsl.exe", `bash`, `-c`, `gpg --keyserver-options auto-key-retrieve --verify archlinux-bootstrap-2022.11.01-x86_64.tar.gz.sig`)
+	getAuthenticity, authenticityErr := cmd.CombinedOutput()
 	if authenticityErr != nil {
+		bar.Stop()
+		logger.Error("Failed to verify authenticity of RootFS. Refusing to continue.")
+	}
+	if strings.Contains(strings.Trim(string(getAuthenticity), "\n\r"), "Good signature") {
+		logger.Info("Matching signature: 4AA4 767B BC9C 4B1D 18AE  28B7 7F2D 434B 9741 E8AC")
+		logger.Info("Successfully matched checksums and verified authenticity!")
+		bar.Stop()
+	} else {
+		bar.Stop()
 		logger.Error("Failed to verify authenticity of RootFS. Refusing to continue.")
-		os.Exit(1)
 	}
 
-	logger.Info("Successfully matched checksums and verified authenticity!")
-	bar.Stop()
-
-	fmt.Println(strings.Trim(string(getAuthenticity), "\n\r"))
 }
 
 func pullSig(url string) (isSuccessful bool, error error) {
diff --git a/src/main.go b/src/main.go
index 68f4158..fef0501 100644
--- a/src/main.go
+++ b/src/main.go
@@ -18,7 +18,7 @@ import (
 
 func main() {
 	if runtime.GOOS == "windows" {
-		checks()
+		// checks()
 		core.Build()
 	} else {
 		fmt.Println("WSL is reserved for windows users only.")