sqv: ensure keys are signing capable before verifying sigs

Closes #164

1 files changed, 12 insertions, 1 deletions

diff --git a/sqv/src/sqv.rs b/sqv/src/sqv.rs
index ca11d035..fc8a98a3 100644
--- a/sqv/src/sqv.rs
+++ b/sqv/src/sqv.rs
@@ -214,8 +214,19 @@ fn real_main() -> Result<(), failure::Error> {
 
         if let Some(ref tpk) = tpko {
             // Find the right key.
-            for (_, _, key) in tpk.keys() {
+            for (maybe_binding, _, key) in tpk.keys() {
+                let binding = match maybe_binding {
+                    Some(b) => b,
+                    None => continue,
+                };
+
                 if issuer == key.keyid() {
+                    if !binding.key_flags().can_sign() {
+                        eprintln!("Cannot check signature, key has no siginig \
+                                   capability");
+                        continue 'sig_loop;
+                    }
+
                     let mut hash = match hashes.get(&sig.hash_algo()) {
                         Some(h) => h.clone(),
                         None => {