Well, there's a difference between `res == 0` and `res < 0`, if `< 0` I
think we need to do something else, it doesn't necessarily indicate
signature failure.

What about leaving it as `if res == 0`  and then just doing
`_consuem_errors` no assert?


On Sat, Mar 1, 2014 at 3:12 PM, Alex Stapleton <notifications@github.com>wrote:

> In cryptography/hazmat/backends/openssl/backend.py:
>
> > @@ -783,7 +783,8 @@ def _verify_pkey_ctx(self, rsa_cdata, evp_pkey, evp_md):
> >          # error. This is not a signature failure but we need to fail if it
> >          # occurs.
> >          assert res >= 0
> > -        if res == 0:
> > +        if res != 1:
> > +            assert self._backend._consume_errors()
>
> I could check the lib part probably but there are multiple functions and
> loads of reason codes :-/
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/708/files#r10193108>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084