{"record":{"id":"644b5af4ac318013","repo":"jumpserver/jumpserver","slug":"not-verify-state","errorCode":null,"errorMessage":"not verify state","messagePattern":"not verify state","errorType":"exception","errorClass":"StateError","httpStatus":null,"severity":"error","filePath":"apps/common/utils/gmssl_python.py","lineNumber":571,"sourceCode":"\t\tif self._sign == DO_SIGN:\n\t\t\tif gmssl.sm2_sign_update(byref(self), data, c_size_t(len(data))) != 1:\n\t\t\t\traise NativeError('libgmssl inner error')\n\t\telse:\n\t\t\tif gmssl.sm2_verify_update(byref(self), data, c_size_t(len(data))) != 1:\n\t\t\t\traise NativeError('libgmssl inner error')\n\n\tdef sign(self):\n\t\tif self._sign != DO_SIGN:\n\t\t\traise StateError('not sign state')\n\t\tsig = create_string_buffer(SM2_MAX_SIGNATURE_SIZE)\n\t\tsiglen = c_size_t()\n\t\tif gmssl.sm2_sign_finish(byref(self), sig, byref(siglen)) != 1:\n\t\t\traise NativeError('libgmssl inner error')\n\t\treturn sig[:siglen.value]\n\n\tdef verify(self, signature):\n\t\tif self._sign != DO_VERIFY:\n\t\t\traise StateError('not verify state')\n\t\tif gmssl.sm2_verify_finish(byref(self), signature, c_size_t(len(signature))) != 1:\n\t\t\treturn False\n\t\treturn True\n\n\nclass sm9_bn_t(Structure):\n\t_fields_ = [\n\t\t(\"d\", c_uint64 * 8)\n\t]\n\nclass sm9_fp2_t(Structure):\n\t_fields_ = [\n\t\t(\"d\", sm9_bn_t * 2)\n\t]\n\nclass Sm9Point(Structure):\n\t_fields_ = [\n\t\t(\"X\", sm9_bn_t),","sourceCodeStart":553,"sourceCodeEnd":589,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/common/utils/gmssl_python.py#L553-L589","documentation":"verify(signature) finalizes a verification context; calling it on a context built with sign=DO_SIGN raises StateError('not verify state'). The wrapper enforces that terminal ops match the mode chosen in the constructor.","triggerScenarios":"Calling verify(sig) on a signing context — e.g. reusing the same object to sign then immediately verify without constructing a DO_VERIFY context.","commonSituations":"Attempting same-process sign-then-verify round-trip tests with a single context object; API misuse from copy-paste.","solutions":["Construct a separate DO_VERIFY context with the public key for verification","Remember: DO_SIGN context -> sign(); DO_VERIFY context -> verify(sig)"],"exampleFix":"// before\nctx = Sm2SignCtx(priv_key)  # sign mode\nctx.update(data); sig = ctx.sign()\nctx.update(data); ctx.verify(sig)\n// after\nv = Sm2SignCtx(pub_key, sign=DO_VERIFY)\nv.update(data)\nassert v.verify(sig)","handlingStrategy":"type-guard","validationCode":"from gmssl_python import DO_VERIFY\nassert ctx._sign == DO_VERIFY, 'this context is for signing'","typeGuard":"def is_verify_ctx(ctx) -> bool:\n    return getattr(ctx, '_sign', None) == DO_VERIFY","tryCatchPattern":"try:\n    ok = ctx.verify(sig)\nexcept StateError as e:\n    raise WrongMode('create a DO_VERIFY context to verify') from e","preventionTips":["Write sign-then-verify round-trip tests using two separate contexts"],"tags":["gmssl","sm2","state-error","verification"],"backgroundTag":"invalid-state-machine-usage","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}