verify_packages.py

import os, sys

# requires pycryptodome
from Crypto.Signature import pkcs1_15
from Crypto.Hash import SHA1
from Crypto.PublicKey import RSA

# key sent over network at startup
pubkeybin = bytes.fromhex("30819d300d06092a864886f70d010101050003818b00308187028181009525173d72e87cbbcbdc86146587aebaa883ad448a6f814dd259bff97507c5e000cdc41eed27d81f476d56bd6b83a4dc186fa18002ab29717aba2441ef483af3970345618d4060392f63ae15d6838b2931c7951fc7e1a48d261301a88b0260336b8b54ab28554fb91b699cc1299ffe414bc9c1e86240aa9e16cae18b950f900f020111")
pubkey = RSA.import_key(pubkeybin)

count = 0
root = sys.argv[1]
for filename in os.listdir(root):
    if not filename.lower().endswith(".pkg"):
        continue
        
    fullname = os.path.join(root, filename)
    data = open(fullname, "rb").read()
    signame = fullname + "_rsa_signature"
    if os.path.isfile(signame):
        signature = open(signame, "rb").read()
        h = SHA1.new(data)

        try:
            res = pkcs1_15.new(pubkey).verify(h, signature)
            ok = True
        except:
            ok = False
            
        if ok:
            print("Signature verified OK", filename)
            count += 1
        else:
            print("!!!!! SIGNATURE BAD", filename)

    else:
        print("!!!!! file without signature", filename)
        
print("total verified files", count)