be me; in rome

Author: code-asher

src/pgp.test.ts

@@ -29,63 +29,46 @@ describe("pgp", () => {
 	it("cannot read non-existent signature", async () => {
 		const armoredKeys = await fs.readFile(publicKeysPath, "utf8");
 		const publicKeys = await openpgp.readKeys({ armoredKeys });
-		const result = await pgp.verifySignature(
-			publicKeys,
-			cliPath,
-			path.join(__dirname, "does-not-exist"),
-		);
-		expect((result as pgp.VerificationError).code).toBe(
-			pgp.VerificationErrorCode.Read,
-		);
+		await expect(
+			pgp.verifySignature(
+				publicKeys,
+				cliPath,
+				path.join(__dirname, "does-not-exist"),
+			),
+		).rejects.toThrow("Failed to read");
 	});
 
 	it("cannot read invalid signature", async () => {
 		const armoredKeys = await fs.readFile(publicKeysPath, "utf8");
 		const publicKeys = await openpgp.readKeys({ armoredKeys });
-		const result = await pgp.verifySignature(
-			publicKeys,
-			cliPath,
-			invalidSignaturePath,
-		);
-		expect((result as pgp.VerificationError).code).toBe(
-			pgp.VerificationErrorCode.Read,
-		);
+		await expect(
+			pgp.verifySignature(publicKeys, cliPath, invalidSignaturePath),
+		).rejects.toThrow("Failed to read");
 	});
 
 	it("cannot read file", async () => {
 		const armoredKeys = await fs.readFile(publicKeysPath, "utf8");
 		const publicKeys = await openpgp.readKeys({ armoredKeys });
-		const result = await pgp.verifySignature(
-			publicKeys,
-			path.join(__dirname, "does-not-exist"),
-			validSignaturePath,
-		);
-		expect((result as pgp.VerificationError).code).toBe(
-			pgp.VerificationErrorCode.Read,
-		);
+		await expect(
+			pgp.verifySignature(
+				publicKeys,
+				path.join(__dirname, "does-not-exist"),
+				validSignaturePath,
+			),
+		).rejects.toThrow("Failed to read");
 	});
 
 	it("mismatched signature", async () => {
 		const armoredKeys = await fs.readFile(publicKeysPath, "utf8");
 		const publicKeys = await openpgp.readKeys({ armoredKeys });
-		const result = await pgp.verifySignature(
-			publicKeys,
-			__filename,
-			validSignaturePath,
-		);
-		expect((result as pgp.VerificationError).code).toBe(
-			pgp.VerificationErrorCode.Invalid,
-		);
+		await expect(
+			pgp.verifySignature(publicKeys, __filename, validSignaturePath),
+		).rejects.toThrow("Unable to verify");
 	});
 
 	it("verifies signature", async () => {
 		const armoredKeys = await fs.readFile(publicKeysPath, "utf8");
 		const publicKeys = await openpgp.readKeys({ armoredKeys });
-		const result = await pgp.verifySignature(
-			publicKeys,
-			cliPath,
-			validSignaturePath,
-		);
-		expect(result).toBe(true);
+		await pgp.verifySignature(publicKeys, cliPath, validSignaturePath);
 	});
 });

src/pgp.ts

@@ -46,15 +46,15 @@ export async function readPublicKeys(
 
 /**
  * Given public keys, a path to a file to verify, and a path to a detached
- * signature, verify the file's signature.  Return true if valid, otherwise
- * return VerificationError.
+ * signature, verify the file's signature.  Throw VerificationError if invalid
+ * or unable to validate.
  */
 export async function verifySignature(
 	publicKeys: openpgp.Key[],
 	cliPath: string,
 	signaturePath: string,
 	logger?: vscode.LogOutputChannel,
-): Promise<true | VerificationError> {
+): Promise<void> {
 	try {
 		logger?.info("Reading signature", signaturePath);
 		const armoredSignature = await fs.readFile(signaturePath, "utf8");
@@ -81,12 +81,11 @@ export async function verifySignature(
 		} catch (e) {
 			const error = `Unable to verify the authenticity of the binary: ${errToStr(e)}. The binary may have been tampered with.`;
 			logger?.warn(error);
-			return new VerificationError(VerificationErrorCode.Invalid, error);
+			throw new VerificationError(VerificationErrorCode.Invalid, error);
 		}
 	} catch (e) {
 		const error = `Failed to read signature or binary: ${errToStr(e)}.`;
 		logger?.warn(error);
-		return new VerificationError(VerificationErrorCode.Read, error);
+		throw new VerificationError(VerificationErrorCode.Read, error);
 	}
-	return true;
 }

src/storage.ts

@@ -524,19 +524,24 @@ export class Storage {
 		const writeStream = createWriteStream(signaturePath);
 		const status = await this.download(client, source, writeStream);
 		if (status === 200) {
-			const result = await pgp.verifySignature(
-				publicKeys,
-				cliPath,
-				signaturePath,
-				this.output,
-			);
-			if (result !== true) {
+			try {
+				await pgp.verifySignature(
+					publicKeys,
+					cliPath,
+					signaturePath,
+					this.output,
+				);
+			} catch (error) {
 				const action = await this.vscodeProposed.window.showWarningMessage(
-					result.summary(),
+					// VerificationError should be the only thing that throws, but
+					// unfortunately caught errors are always type unknown.
+					error instanceof pgp.VerificationError
+						? error.summary()
+						: "Failed to verify signature",
 					{
 						useCustom: true,
 						modal: true,
-						detail: `${result.message} Would you like to accept this risk and run the binary anyway?`,
+						detail: `${errToStr(error)} Would you like to accept this risk and run the binary anyway?`,
 					},
 					"Run anyway",
 				);