paddle::verify_signature(): Fix signature verification

I think I was doing it in the wrong direction. Previously, I had added
the signature from the POST param to the verifier, and verified against
the serialized params.

Seems like I was instead supposed to add the serialized params to the
verifier, and verify against the input signature.

It works correctly now against a request from Paddle.

1 files changed, 3 insertions, 3 deletions

diff --git a/license-generator/paddle/src/lib.rs b/license-generator/paddle/src/lib.rs
index d725efe..be10a76 100644
--- a/license-generator/paddle/src/lib.rs
+++ b/license-generator/paddle/src/lib.rs
@@ -36,11 +36,11 @@ where
     let rsa = Rsa::public_key_from_pem(pem)?;
     let pkey = PKey::from_rsa(rsa)?;
     let mut verifier = Verifier::new(MessageDigest::sha1(), &pkey)?;
-    verifier.update(signature)?;
 
-    let signature = php_serialize(params);
+    let digest = php_serialize(params);
+    verifier.update(digest.as_bytes())?;
 
-    Ok(verifier.verify(signature.as_ref())?)
+    Ok(verifier.verify(signature)?)
 }
 
 fn php_serialize<'a, S, I>(pairs: I) -> String