WO2022222437A1

WO2022222437A1 - Script verification method, script signing method, and computing device

Info

Publication number: WO2022222437A1
Application number: PCT/CN2021/129672
Authority: WO
Inventors: 张亚; 邵应坚
Original assignee: 统信软件技术有限公司
Priority date: 2021-04-23
Filing date: 2021-11-10
Publication date: 2022-10-27
Also published as: CN112860240B; CN112860240A

Abstract

A script verification method, a script signing method, and a computing device, executed in an operating system. The script verification method comprises the steps of: executing a script file (S310); determining whether the script file is a script file to be verified (S320); if yes, obtaining a script file path on the basis of the script file, and writing the script file path into a character device file (S330); reading the character device file to obtain the script file to be verified on the basis of the script file path in the character device file (S340); and performing signature verification on the script file to be verified, and if the verification succeeds, continuing to execute the script file (S350). The script verification method can fully ensure the security during script running.

Description

Script verification method, script signature method and computing device

technical field

The present invention relates to the technical field of script signature, in particular to a script verification method, a script signature method and a computing device.

Background technique

The script is easy to develop, does not need to be compiled, can be run directly, and is widely used in the Linux operating system. Commonly used scripts in Linux operating systems include shell, python, perl, lua, rubby, etc. As a plain text executable program, the script currently only checks the execution user, executable permission and root account when executing the script, which lacks an effective security mechanism. Moreover, it is difficult for users to determine the publisher of the script and whether the script has been tampered with. Pass. For system environments with high security requirements such as banks and enterprises, it is very important to ensure the security and credibility of scripts when running scripts.

There are two methods for signing scripts in the prior art. One is that after the developer signs the script, the signature information is additionally stored in the signed file, such as the Powershell script digital signature scheme. After the script is signed based on this signature method, when the user runs the signed script, Powershell extracts and checks the signature information in the script to confirm whether the publisher's certificate is trusted. Trust the publisher's script to respond with processing. This signature method is only applicable to PowerShell scripts under Windows systems, and cannot be adapted to many scripting languages under Linux systems, so Linux systems cannot use this signature method.

There is also a signature method. After the developer signs the script, the signature information is additionally saved as a separate signature file, and then the signature file and the script are released. This independent signature file is easily lost during the transfer process. Moreover, the user needs to manually verify the signature before running the signed script. Even if the signature is not verified or the verification fails, the script can be executed, and the security of the script running cannot be guaranteed.

Therefore, a script signature method and a script verification method are required to solve the problems existing in the above technical solutions.

SUMMARY OF THE INVENTION

To this end, the present invention provides a script verification method and a script signature method to try to solve or at least alleviate the above problems.

According to one aspect of the present invention, a script verification method is provided, which is executed in an operating system and includes the steps of: executing a script file; judging whether the script file is a script file to be verified; if it is a script file to be verified, obtaining based on the script file script file path, and write the script file path into the character device file; read the character device file to obtain the script file to be verified based on the script file path in the character device file; and perform signature verification on the script file to be verified, if the verification is successful, Then continue to execute the script file.

Optionally, in the script verification method according to the present invention, the step of judging whether the script file is the script file to be verified includes: acquiring the script interpreter parameters in the script file, and determining whether the script interpreter parameter specifies whether the script interpreter is a predetermined script interpreter. ; If it is a predetermined script interpreter, determine that the script file is the script file to be verified.

Optionally, in the script verification method according to the present invention, it also includes the steps of: if the script interpreter parameter is not obtained, then obtain the script file parameter, and judge whether the file specified by the script file parameter is an elf file or a java file; if not elf file or java file, it is determined that the script file is the script file to be verified.

Optionally, the script verification method according to the present invention further includes the step of: if the signature verification fails, terminating the execution of the script file, and generating a signature verification failure message to display on the interface.

Optionally, in the script verification method according to the present invention, after the signature verification is performed on the script file to be verified, the method further includes the step of: writing the verification result into the character device file.

Optionally, in the script verification method according to the present invention, performing signature verification on the script file includes: calling the script verification method to perform signature verification on the script file.

Optionally, in the script verification method according to the present invention, the step of performing signature verification on the script file includes: acquiring annotation information from the end of the script file, and acquiring signature data based on the annotation information; acquiring script content in the script file; The digest algorithm calculates the first digest of the script content; decrypts the signature data based on the signature certificate to generate the second digest; compares whether the first digest and the second digest are the same, if they are the same, the verification is successful.

Optionally, in the script verification method according to the present invention, the step of decrypting the signature data based on the signature certificate includes: converting the signature data into signature information of a predetermined structure; verifying the signature certificate in order to verify the script The identity of the issuer of the file; the signature information is decrypted based on the signature certificate, and a second digest is generated.

According to an aspect of the present invention, a script signature method is provided, executed in a computing device, comprising the steps of: acquiring script content in a script file; calculating a digest of the script content based on a digest algorithm; performing signature, generating signature information, and converting the signature information into signature data; and adding the signature data to the end of the script file based on an annotation method to serve as the annotation information of the script file.

According to one aspect of the present invention, there is provided a computing device comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the The program instructions include instructions for performing the method as described above.

According to an aspect of the present invention, there is provided a readable storage medium storing program instructions, which when read and executed by a computing device, cause the computing device to perform the method as described above.

According to the technical solution of the present invention, a script signature method and a script verification method are provided. Based on the script signature method, developers can sign script files in multiple languages under the Linux system, and add the signature data to the script in the form of comments. At the end of the file, the signature data is stored in the signed script file as comment information, and it is not easy to lose. In addition, when executing the script file, the computing device determines whether the script needs to be verified by executing the script verification method, and verifies the signature data in the signed script file that needs to be verified, and can continue to run the script only after the verification is passed. In this way, the security of the script runtime can be fully guaranteed.

Description of drawings

To achieve the above and related objects, certain illustrative aspects are described herein in conjunction with the following description and drawings, which are indicative of the various ways in which the principles disclosed herein may be practiced, and all aspects and their equivalents are intended to be within the scope of the claimed subject matter. The above and other objects, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout this disclosure, the same reference numbers generally refer to the same parts or elements.

FIG. 1 shows a schematic diagram of a computing device 100 according to an embodiment of the present invention;

FIG. 2 shows a flowchart of a script signature method 200 according to an embodiment of the present invention;

FIG. 3 shows a flowchart of a script verification method 300 according to an embodiment of the present invention; and

FIG. 4 shows a sequence diagram of a script verification method 300 according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be more thoroughly understood, and will fully convey the scope of the present disclosure to those skilled in the art.

The script signature method 200 and the script verification method 300 in the present invention are suitable for execution in a computing device. The computing device performs developer signature on the script file by executing the script signing method 200, and adds the signature data to the script file in the form of comments. When executing the script file, the computing device verifies the signature data in the script file by executing the script verification method 300 .

FIG. 1 shows a schematic diagram of a computing device 100 according to one embodiment of the present invention.

As shown in FIG. 1 , in a basic configuration 102 , computing device 100 typically includes system memory 106 and one or more processors 104 . The memory bus 108 may be used for communication between the processor 104 and the system memory 106 .

Depending on the desired configuration, the processor 104 may be any type of process including, but not limited to, a microprocessor (UP), a microcontroller (UC), a digital information processor (DSP), or any combination thereof. Processor 104 may include one or more levels of cache, such as L1 cache 110 and L2 cache 112 , processor core 114 , and registers 116 . Exemplary processor cores 114 may include arithmetic logic units (ALUs), floating point units (FPUs), digital signal processing cores (DSP cores), or any combination thereof. The exemplary memory controller 118 may be used with the processor 104 , or in some implementations, the memory controller 118 may be an internal part of the processor 104 .

Depending on the desired configuration, system memory 106 may be any type of memory including, but not limited to, volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. System memory 106 may include operating system 120 , one or more applications 122 , and program data 124 . In some embodiments, applications 122 may be arranged to execute instructions using program data 124 by one or more processors 104 on an operating system.

Computing device 100 also includes storage device 132 including removable storage 136 and non-removable storage 138 .

Computing device 100 may also include a storage interface bus 134 . Storage interface bus 134 enables communication from storage devices 132 (eg, removable storage 136 and non-removable storage 138 ) to base configuration 102 via bus/interface controller 130 . Operating system 120, applications 122, and at least a portion of data 124 may be stored on removable storage 136 and/or non-removable storage 138, and via the storage interface bus when computing device 100 is powered on or applications 122 are to be executed 134 is loaded into system memory 106 and executed by one or more processors 104 .

Computing device 100 may also include an interface bus 140 that facilitates communication from various interface devices (eg, output device 142 , peripheral interface 144 , and communication device 146 ) to base configuration 102 via bus/interface controller 130 . Example output devices 142 include graphics processing unit 148 and audio processing unit 150 . They may be configured to facilitate communication via one or more A/V ports 152 with various external devices such as displays or speakers. Example peripheral interfaces 144 may include serial interface controller 154 and parallel interface controller 156, which may be configured to facilitate communication via one or more I/O ports 158 and input devices such as keyboard, mouse, pen , voice input devices, touch input devices) or other peripherals (eg printers, scanners, etc.) The example communication device 146 may include a network controller 160 that may be arranged to facilitate communication via one or more communication ports 164 with one or more other computing devices 162 over a network communication link.

A network communication link may be one example of a communication medium. Communication media may typically embody computer readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media. A "modulated data signal" may be a signal in which one or more of its data sets or whose changes may be made in the signal in a manner that encodes information. By way of non-limiting example, communication media may include wired media, such as wired or leased line networks, and various wireless media, such as acoustic, radio frequency (RF), microwave, infrared (IR), or other wireless media. The term computer readable medium as used herein may include both storage media and communication media.

Computing device 100 may be implemented as a personal computer including a desktop computer and a notebook computer configuration. Of course, computing device 100 may also be implemented as part of a small form factor portable (or mobile) electronic device such as a cellular telephone, digital camera, personal digital assistant (PDA), personal media player device, wireless web browsing device , personal headsets, application-specific devices, or hybrid devices that can include any of the above. It can even be implemented as a server, such as a file server, database server, application server, and WEB server. The embodiments of the present invention do not limit this.

In an embodiment according to the present invention, the computing device 100 is configured to perform the script signing method 200 according to the present invention. The application 122 of the computing device 100 includes a plurality of program instructions for executing the script signature method 200 of the present invention, and these program instructions can be read and executed by the computing device 100, so that the computing device 100 can execute the script signature according to the present invention. The method 200 is to developer-sign the script file.

In an embodiment according to the present invention, the computing device 100 is configured to execute the script verification method 300 according to the present invention. Wherein, the operating system 120 of the computing device 100 contains a plurality of program instructions for executing the script verification method 300 of the present invention, and these program instructions can be read and executed by the computing device 100, so that the operating system executes the script verification method according to the present invention The method 300 is to verify the signed script file.

It should be noted that, according to the technical solution of the present invention, when the developer signs the script file, the computing device 100 signs the script file by executing the script signature method 200, and adds the signature data to the end of the script file in the form of comments , so that the signature data is saved in the signed script file as comment information. When the user executes the signed script file, the operating system of the computing device 100 verifies the signature data in the script file by executing the script verification method 300 .

FIG. 2 shows a flowchart of a script signing method 200 according to an embodiment of the present invention. The method 200 is suitable for execution in a computing device, such as the aforementioned computing device 100 .

It should be noted that the script signature method 200 is suitable for developer signatures for script files in multiple languages under the Linux system. Here, the present invention is not limited to a specific script language.

As shown in FIG. 2, the method 200 starts at step S210. In step S210, the script content in the script file is obtained.

In step S220, a digest of the script content is calculated based on a digest algorithm. That is to say, the digest is calculated for the script content based on the digest algorithm, and the digest is also the digest of the script file. Here, the digest algorithm is, for example, a message digest algorithm.

It should be noted that when obtaining the script content in the script file, blank lines and comment lines are ignored. In this way, when calculating the summary of the script file in step S220, the summary is calculated based on the content of the script after removing blank lines and comment lines.

In step S230, signature calculation is performed on the digest based on the private key and the signature algorithm, signature information is generated, and signature data is generated after format conversion of the signature information. Here, the signature information obtained by calculating the signature on the digest is a structure conforming to the pkcs#7 standard, and the signature data in pem format is obtained after format conversion of the signature information conforming to the pkcs#7 standard. It should be noted that the present invention is not limited to the specific format of the signature information.

In step S240, the signature data in pem format is added to the end of the script file based on the annotation method, as the annotation information of the script file. In this way, the signature data generated after signing the content of the script file according to the method 200 of the present invention is stored in the signed script file as comment information, which avoids the problem of easy loss of the scheme of separately saving the signature file.

It should be pointed out that the script signature method 200 and the corresponding script verification method 300 of the present invention are both applicable to script files in multiple languages under the Linux system. Here, the present invention does not specifically limit the script language of the script file. For example, the script file may be implemented as a Shell script, a Python script, a Perl script, a Lua script, a Rubby script, etc., but is not limited thereto. In the embodiment of the present invention, the script signature method 200 and the script verification method 300 of the present invention are described in detail by taking a shell script as an example.

FIG. 3 shows a flowchart of a script verification method 300 according to an embodiment of the present invention. The method 300 is suitable for execution in an operating system of a computing device, such as the aforementioned computing device 100 .

As shown in FIG. 3, the method 300 begins at step S310. In step S310, the script file is executed. Here, one or more kinds of script files can be executed in the Linux system, such as executing Shell script, Python script, Perl script, Lua script, Rubby script, and not limited to these script files.

Subsequently, in step S320, it is determined whether the script file is a script file to be verified. That is, when executing the script file, it is determined whether the script file is the script file to be verified.

It should be noted that the script file to be verified here is, for example, a script file that is signed based on the aforementioned script signature method 200. When a user requests to execute the signed script file, the computing device 100 will verify the script file according to the script verification method 300 of the present invention. The signature data of the signed script file is verified. It should be understood that the script file to be verified after being signed based on the script signature method 200 may be one or more of a Shell script, a Python script, a Perl script, a Lua script, and a Rubby script.

According to one embodiment, whether the script file is a script file to be verified can be determined according to the following steps:

Obtain the script interpreter parameters in the script file, and determine whether the script interpreter parameter specifies a predetermined script interpreter. Here, the predetermined script interpreter includes one or more script interpreters suitable for parsing and executing the corresponding script file, such as a shell script interpreter, which matches with one or more script files signed based on the script signature method 200 . bash. It should be noted that the predetermined script interpreter may include one or more types of script interpreters, and the present invention is not limited to the specific kind of the predetermined script interpreter. In one embodiment, the script interpreter parameter is the first parameter that is the first line of the script file.

If it is a predetermined script interpreter, it is determined that the script file is the script file to be verified, that is, the script file signed based on the script signature method 200 . If the specified script interpreter is not the predetermined script interpreter, it is determined that the script file is not the script file to be verified.

In addition, if the script interpreter parameter is not obtained, the script file parameter is further obtained, and it is judged whether the file specified by the script file parameter (the script file itself) is an elf file or a java file. If the file specified by the script file parameter is not an elf file or a java file, it is also determined that the script file is the script file to be verified. On the contrary, if the file specified by the script file parameter is an elf file or a java file, it is determined that the script file is not the script file to be verified, and the script file is no longer verified based on the method 300 .

In one embodiment, before determining whether the script file is the script file to be verified based on the above steps, one or more parameters included in the script file are obtained in advance based on the search_binary_handler function of the kernel module. In this way, from all the obtained parameters, parameters corresponding to the script interpreter, parameters corresponding to the script file itself, parameters corresponding to the script file path, and the like can be obtained.

In the foregoing step S320, if it is determined that the script file is the script file to be verified, step S330 is executed.

In step S330, the current script file to be verified is blocked, and the script file path is obtained based on the script file, for example, the script file path is obtained by obtaining the corresponding parameter (parameter corresponding to the script file path) in the script file, The script file path is then written to the character device file. Here, the character device file is, for example, a dev file.

Subsequently, in step S340, the character device file is read, so as to obtain the script file to be verified based on the script file path in the character device file.

Finally, in step S350, the script verification method is invoked to perform signature verification on the script file to be verified, that is, to verify the signature data of the script file. Here, the script verification method can be implemented as a shell-sign program, for example. If the signature verification of the script file is successful, the execution of the current script file is continued. If the signature verification of the script file fails, the execution of the current script file is terminated, and a message of signature verification failure is generated and displayed on the interface, so as to prompt the user that the current script file cannot be run due to the verification failure.

In this way, the present invention performs signature verification on the script file when executing the script file, and can run the script only after the verification is passed, thereby ensuring the security of running the script file under the Linux system.

According to an embodiment, as shown in FIG. 4 , the script file may be implemented as a shell script, and the foregoing steps S310 to S330 are suitable for being executed by the LSM module of the Linux system kernel. The foregoing steps S340 to S350 are suitable for being executed by the background process deepin-elf-verify.

As shown in Figure 4, the background process deepin-elf-verify cyclically reads the character device file, and calls the shell-sign script verification method to verify the signature of the script file to be verified. Subsequently, the background process deepin-elf-verify obtains the signature verification result returned by the shell-sign method, wherein, when the verification result is determined to be a verification failure, the background process deepin-elf-verify generates a script file signature verification failure message, and sends the message to the Sent to the UI interface for display.

In addition, the background process deepin-elf-verify also writes the verification results to the character device file (dev). The LSM module of the kernel reads the verification result from the character device file, and determines whether to release the script file and continue to execute the script file according to the read verification result. Here, when the verification result read by the LSM module of the kernel is that the verification is successful, the script file is released, so as to continue to execute the script file.

It should be noted that, in the embodiment of the present invention, since the signature data of the script file is stored in the script file as comment information, when performing signature verification on the script file, it is necessary to split the script file in advance and obtain the Signature data and script content in script files.

According to one embodiment, the signature data is obtained based on the annotation information by obtaining the annotation information from the end of the script file. Here, remove the comment character "#" at the beginning of the line of the comment information, start from '-----END PKCS7-----', and stop reading '-----BEGIN PKCS7-----' , and combine all the lines read to obtain signature data (string) in Pem format. Then, get the script content in the script file. It should be noted that blank and comment lines are ignored when fetching script content.

Furthermore, a first digest of the script content is calculated based on a digest algorithm. The digest algorithm is, for example, a message digest algorithm.

And, the signature data obtained from the script file is decrypted based on the signature certificate to generate a second digest. Specifically, format conversion is performed on the signature data first, and the signature data is converted into signature information of a predetermined structure, for example, the predetermined structure is a structure conforming to the pkcs#7 standard, but is not limited thereto. Subsequently, the signing certificate is verified in order to verify the identity of the publisher of the script file. After the identity verification of the publisher based on the signature certificate is passed, the signature information is decrypted based on the public key of the signature certificate (matching the private key in the method 200 ) to generate a second digest.

Finally, it is compared whether the first digest and the second digest are the same, and if they are the same, the signature verification of the script file is successful, so that the script file continues to be executed. If different, signature verification fails and execution of the script file is terminated.

According to the technical solution of the present invention, based on the script signature method 200, script files in multiple languages under the Linux system can be signed, and the signature data is added to the end of the script file in the form of comments, so that the signature data is saved as comment information in the Inside the signed script file, it is not easy to lose. Moreover, when executing the script file, the computing device determines whether the script needs to be verified by executing the script verification method 300, and verifies the signature data in the signed script file that needs to be verified, and can continue to run the script only after the verification is passed. , in this way, the security of various scripts under the Linux system can be fully guaranteed.

The various techniques described herein can be implemented in conjunction with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or certain aspects or portions of the method and apparatus of the present invention, may take the form of an embedded tangible medium, such as a removable hard disk, a USB stick, a floppy disk, a CD-ROM, or any other machine-readable storage medium. in the form of program code (ie, instructions) that, when the program is loaded into a machine, such as a computer, and executed by the machine, the machine becomes an apparatus for practicing the invention.

Where the program code is executed on a programmable computer, the computing device typically includes a processor, a storage medium readable by the processor (including volatile and nonvolatile memory and/or storage elements), at least one input device, and at least one output device. Wherein, the memory is configured to store program codes; the processor is configured to execute the multilingual garbage text identification method of the present invention according to the instructions in the program codes stored in the memory.

By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media store information such as computer readable instructions, data structures, program modules or other data. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Combinations of any of the above are also included within the scope of readable media.

In the specification provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems may also be used with examples of the present invention. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not directed to any particular programming language. It is to be understood that various programming languages may be used to implement the inventions described herein, and that the descriptions of specific languages above are intended to disclose the best mode for carrying out the invention.

In the description provided herein, numerous specific details are set forth. It will be understood, however, that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it is to be understood that in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or its description. This disclosure, however, should not be interpreted as reflecting an intention that the invention as claimed requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will appreciate that the modules or units or components of the apparatus in the examples disclosed herein may be arranged in the apparatus as described in this embodiment, or alternatively may be positioned differently from the apparatus in this example in one or more devices. The modules in the preceding examples may be combined into one module or further divided into sub-modules.

Those skilled in the art will appreciate that the modules in the device in an embodiment can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that although some of the embodiments described herein include certain features, but not others, included in other embodiments, that combinations of features of different embodiments are intended to be within the scope of the invention within and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

Furthermore, some of the described embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other means for performing the described functions. Thus, a processor having the necessary instructions for implementing the method or method element forms means for implementing the method or method element. Furthermore, an element of an apparatus embodiment described herein is an example of a means for carrying out the function performed by the element for the purpose of carrying out the invention.

As used herein, unless otherwise specified, the use of the ordinal numbers "first," "second," "third," etc. to describe common objects merely refers to different instances of similar objects, and is not intended to imply such The objects being described must have a given order in time, space, ordinal, or in any other way.

While the invention has been described in terms of a limited number of embodiments, those skilled in the art will appreciate, having the benefit of the above description, that other embodiments are conceivable within the scope of the invention thus described. Furthermore, it should be noted that the language used in this specification has been principally selected for readability and teaching purposes, rather than to explain or define the subject matter of the invention. Accordingly, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. This disclosure is intended to be illustrative, not restrictive, as to the scope of the present invention, which is defined by the appended claims.

Claims

A script verification method, executed in an operating system, including the steps:

execute script file;

Determine whether the script file is a script file to be verified;

If it is a script file to be verified, obtain the script file path based on the script file, and write the script file path into the character device file;

reading the character device file to obtain the script file to be verified based on the script file path in the character device file; and

The signature verification is performed on the script file to be verified, and if the verification is successful, the script file is continuously executed.
The method of claim 1, wherein the step of judging whether the script file is the script file to be verified comprises:

Obtain the script interpreter parameters in the script file, and determine whether the script interpreter parameter specifies the predetermined script interpreter;

If it is a predetermined script interpreter, it is determined that the script file is the script file to be verified.
The method of claim 2, further comprising the step of:

If the script interpreter parameter is not obtained, obtain the script file parameter, and determine whether the file specified by the script file parameter is an elf file or a java file;

If it is not an elf file or a java file, it is determined that the script file is the script file to be verified.
The method of claim 1, further comprising the step of: if the signature verification fails, terminate the execution of the script file, and generate a signature verification failure message to display on the interface;

After the signature verification is performed on the script file to be verified, the method further includes the step of: writing the verification result into the character device file.
The method according to any one of claims 1-4, wherein, performing signature verification on the script file comprises:

Call the script verification method to verify the signature of the script file.
The method according to any one of claims 1-4, wherein the step of performing signature verification on the script file comprises:

Obtain annotation information from the end of the script file, and obtain signature data based on the annotation information; obtain the script content in the script file;

calculating a first digest of the script content based on a digest algorithm;

Decrypting the signature data based on the signature certificate to generate a second digest;

Compare whether the first digest and the second digest are the same. If they are the same, the verification is successful.
The method of claim 6, wherein the step of decrypting the signature data based on the signature certificate comprises:

converting the signature data into signature information of a predetermined structure;

Verification of the signing certificate in order to verify the identity of the publisher of the script file;

The signature information is decrypted based on the signature certificate to generate a second digest.
A script signing method, executed in a computing device, comprising the steps of:

Get the script content in the script file;

computing a digest of the script content based on a digest algorithm;

Signing the digest based on the private key, generating signature information, and converting the signature information into signature data; and

The signature data is added to the end of the script file based on a comment method to serve as comment information of the script file.
A computing device comprising:

at least one processor; and

a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the program instructions comprising means for performing the method of any of claims 1-8 instruction.
A readable storage medium storing program instructions which, when read and executed by a computing device, cause the computing device to perform the method according to any one of claims 1-8.