Repository: codenotary/immudb
File: pkg/client/auditor/auditor.go (Go)

Code before:
}

func (a *defaultAuditor) verifyStateSignature(
	serverID string,
	serverState *schema.ImmutableState,
) error {

	if a.serverSigningPubKey != nil && serverState.GetSignature() == nil {
		return fmt.Errorf(
			"a server signing public key has been specified for the auditor, "+
				"but the state %s at TX %d received from server %s @ %s is not signed",
			serverState.GetTxHash(), serverState.GetTxId(), serverID, a.serverAddress)
	}

	if serverState.GetSignature() != nil {
		pk := a.serverSigningPubKey
		if pk == nil {
			a.logger.Warningf(
				"server signature will be verified using untrusted public key (embedded in the server state payload) " +
					"- for better security please configure a public key for the auditor process")
			var err error
			pk, err = signer.UnmarshalKey(serverState.GetSignature().GetPublicKey())
			if err != nil {
				return fmt.Errorf(
					"failed to verify signature for state %s at TX %d received from server %s @ %s: "+
						"error unmarshaling the public key embedded in the server state payload: %v",
					serverState.GetTxHash(), serverState.GetTxId(), serverID, a.serverAddress, err)
			}
		}

		if okSig, err := serverState.CheckSignature(pk); err != nil || !okSig {
			return fmt.Errorf(
				"failed to verify signature for state %s at TX %d received from server %s @ %s: "+
					"verification result: %t, verification error: %v",
				serverState.GetTxHash(), serverState.GetTxId(), serverID, a.serverAddress,
				okSig, err)
		}
	}

	return nil
}

// Signature ...
type Signature struct {
	Signature string `json:"signature"`
	PublicKey string `json:"public_key"`
}

// State ...
type State struct {
	Tx        uint64    `json:"tx" validate:"required"`

Review comment (suggestion):
`Errorf` has a nice [`%w`](https://pkg.go.dev/fmt#Errorf) format specifier that wraps the original error with the new one. That way one can use the [`errors.Is`](https://pkg.go.dev/errors#Is) (or others) to check the original error. Please change to `%w`:

```suggestion
						"error unmarshaling the public key embedded in the server state payload: %w",
```

Code after:
}

func (a *defaultAuditor) verifyStateSignature(
	serverID string,
	serverState *schema.ImmutableState,
) error {

	if a.serverSigningPubKey != nil && serverState.GetSignature() == nil {
		return fmt.Errorf(
			"a server signing public key has been specified for the auditor, "+
				"but the state %s at TX %d received from server %s @ %s is not signed",
			serverState.GetTxHash(), serverState.GetTxId(), serverID, a.serverAddress)
	}

	if serverState.GetSignature() != nil {
		pk := a.serverSigningPubKey
		if pk == nil {
			a.logger.Warningf(
				"server signature will be verified using untrusted public key (embedded in the server state payload) " +
					"- for better security please configure a public key for the auditor process")
			var err error
			pk, err = signer.UnmarshalKey(serverState.GetSignature().GetPublicKey())
			if err != nil {
				return fmt.Errorf(
					"failed to verify signature for state %s at TX %d received from server %s @ %s: "+
						"error unmarshaling the public key embedded in the server state payload: %w",
					serverState.GetTxHash(), serverState.GetTxId(), serverID, a.serverAddress, err)
			}
		}

		if okSig, err := serverState.CheckSignature(pk); err != nil || !okSig {
			return fmt.Errorf(
				"failed to verify signature for state %s at TX %d received from server %s @ %s: "+
					"verification result: %t, verification error: %v",
				serverState.GetTxHash(), serverState.GetTxId(), serverID, a.serverAddress,
				okSig, err)
		}
	}

	return nil
}

// Signature ...
type Signature struct {
	Signature string `json:"signature"`
	PublicKey string `json:"public_key"`
}

// State ...
type State struct {
	Tx        uint64    `json:"tx" validate:"required"`