image: Try ALL enc keys when verifying hash
Before this commit, the image verification procedure would fail early if
decryption failed. The procedure is supposed to try all the keys and
report success if any of them works.
diff --git a/image/verify.go b/image/verify.go
index 49d1a1d..7096621 100644
--- a/image/verify.go
+++ b/image/verify.go
@@ -123,12 +123,12 @@
for i, key := range privEncKeys {
dec, err := Decrypt(*img, key)
if err != nil {
- return -1, err
- }
-
- hashErr = dec.verifyHashDecrypted()
- if hashErr == nil {
- return i, nil
+ hashErr = err
+ } else {
+ hashErr = dec.verifyHashDecrypted()
+ if hashErr == nil {
+ return i, nil
+ }
}
}
