Harden PKI license verification, database seat reconciliation, and binary packaging

src/server_enrollment.py

@@ -408,10 +408,30 @@ def check_and_renew_hub_pki(
     return False, False
 
 
-def extract_license_info_from_cert(cert_pem: str) -> Dict[str, Any]:
+def verify_certificate_signature(cert_pem: Any, issuer_ca_pem: Any) -> bool:
+    """
+    Cryptographically verifies that cert_pem was signed by the private key corresponding to issuer_ca_pem.
+    """
+    try:
+        from cryptography.hazmat.primitives.asymmetric import padding
+        cert = x509.load_pem_x509_certificate(cert_pem.encode("utf-8")) if isinstance(cert_pem, str) else cert_pem
+        issuer = x509.load_pem_x509_certificate(issuer_ca_pem.encode("utf-8")) if isinstance(issuer_ca_pem, str) else issuer_ca_pem
+        issuer.public_key().verify(
+            cert.signature,
+            cert.tbs_certificate_bytes,
+            padding.PKCS1v15(),
+            cert.signature_hash_algorithm
+        )
+        return True
+    except Exception:
+        return False
+
+
+def extract_license_info_from_cert(cert_pem: str, upstream_ca_pem: Optional[str] = None) -> Dict[str, Any]:
     """
     Extracts embedded licensing attributes, validity, and metadata from a PEM X.509 certificate.
     Supports decoding seat quota and license IDs embedded via LOGAR custom enterprise OIDs.
+    Cryptographically verifies the signature if upstream_ca_pem is provided.
     """
     try:
         cert = x509.load_pem_x509_certificate(cert_pem.encode("utf-8"))
@@ -490,6 +510,12 @@ def extract_license_info_from_cert(cert_pem: str) -> Dict[str, Any]:
             break
 
     is_self_signed = (cert.subject == cert.issuer)
+    signature_verified = False
+
+    if upstream_ca_pem:
+        signature_verified = verify_certificate_signature(cert, upstream_ca_pem)
+    elif is_self_signed:
+        signature_verified = verify_certificate_signature(cert, cert)
 
     return {
         "valid": True,
@@ -501,6 +527,7 @@ def extract_license_info_from_cert(cert_pem: str) -> Dict[str, Any]:
         "issuer_cn": issuer_cn,
         "is_ca": is_ca,
         "is_self_signed": is_self_signed,
+        "signature_verified": signature_verified,
         "fingerprint": cert.fingerprint(hashes.SHA256()).hex().upper(),
         "not_valid_before": not_before.isoformat(),
         "not_valid_after": not_after.isoformat(),