in mfg/verify.go [200:224]
func VerifySigs(man manifest.MfgManifest, keys []sec.PubSignKey) (int, error) {
sigs, err := man.SecSigs()
if err != nil {
return -1, err
}
hash, err := hex.DecodeString(man.MfgHash)
if err != nil {
return -1, errors.Wrapf(err,
"mfg manifest contains invalid hash: %s", man.MfgHash)
}
for keyIdx, k := range keys {
sigIdx, err := sec.VerifySigs(k, sigs, hash)
if err != nil {
return -1, errors.Wrapf(err, "failed to verify mfgimg signatures")
}
if sigIdx != -1 {
return keyIdx, nil
}
}
return -1, errors.Errorf("mfg signatures do not match provided keys")
}