fail better

opentdf · Jan 22, 2025 · c880c6b · c880c6b
1 parent b820265
commit c880c6b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 13 deletions.
diff --git a/cli/src/cli.ts b/cli/src/cli.ts
@@ -562,11 +562,8 @@ export const handleArgs = (args: string[]) => {
             log('DEBUG', `About to TDF3 decrypt [${argv.file}]`);
             const ct = await client.read(await parseReadOptions(argv));
             const destination = argv.output ? createWriteStream(argv.output) : process.stdout;
-            try {
-              await ct.pipeTo(Writable.toWeb(destination));
-            } catch (e) {
-              log('ERROR', `Failed to pipe to destination stream: ${e}`);
-            }
+            await ct.pipeTo(Writable.toWeb(destination));
+
             const lastRequest = authProvider.requestLog[authProvider.requestLog.length - 1];
             log('SILLY', `last request is ${JSON.stringify(lastRequest)}`);
             let accessToken = null;

diff --git a/lib/tdf3/src/tdf.ts b/lib/tdf3/src/tdf.ts
@@ -922,14 +922,6 @@ export async function readStream(cfg: DecryptConfiguration) {
     integrityAlgorithm
   );
 
-  const rootSig = isLegacyTDF
-    ? base64.encode(hex.encodeArrayBuffer(payloadSig))
-    : base64.encodeArrayBuffer(payloadSig);
-
-  if (manifest.encryptionInformation.integrityInformation.rootSignature.sig !== rootSig) {
-    throw new IntegrityError('Failed integrity check on root signature');
-  }
-
   if (!cfg.noVerifyAssertions) {
     for (const assertion of manifest.assertions || []) {
       // Create a default assertion key
@@ -948,6 +940,14 @@ export async function readStream(cfg: DecryptConfiguration) {
     }
   }
 
+  const rootSig = isLegacyTDF
+    ? base64.encode(hex.encodeArrayBuffer(payloadSig))
+    : base64.encodeArrayBuffer(payloadSig);
+
+  if (manifest.encryptionInformation.integrityInformation.rootSignature.sig !== rootSig) {
+    throw new IntegrityError('Failed integrity check on root signature');
+  }
+
   let mapOfRequestsOffset = 0;
   const chunkMap = new Map(
     segments.map(({ hash, encryptedSegmentSize = encryptedSegmentSizeDefault, segmentSize = segmentSizeDefault }) => {