jumpserver/jumpserver · error · StateError

not verify state

Error message

not verify state

What it means

verify(signature) finalizes a verification context; calling it on a context built with sign=DO_SIGN raises StateError('not verify state'). The wrapper enforces that terminal ops match the mode chosen in the constructor.

Source

Thrown at apps/common/utils/gmssl_python.py:571

		if self._sign == DO_SIGN:
			if gmssl.sm2_sign_update(byref(self), data, c_size_t(len(data))) != 1:
				raise NativeError('libgmssl inner error')
		else:
			if gmssl.sm2_verify_update(byref(self), data, c_size_t(len(data))) != 1:
				raise NativeError('libgmssl inner error')

	def sign(self):
		if self._sign != DO_SIGN:
			raise StateError('not sign state')
		sig = create_string_buffer(SM2_MAX_SIGNATURE_SIZE)
		siglen = c_size_t()
		if gmssl.sm2_sign_finish(byref(self), sig, byref(siglen)) != 1:
			raise NativeError('libgmssl inner error')
		return sig[:siglen.value]

	def verify(self, signature):
		if self._sign != DO_VERIFY:
			raise StateError('not verify state')
		if gmssl.sm2_verify_finish(byref(self), signature, c_size_t(len(signature))) != 1:
			return False
		return True


class sm9_bn_t(Structure):
	_fields_ = [
		("d", c_uint64 * 8)
	]

class sm9_fp2_t(Structure):
	_fields_ = [
		("d", sm9_bn_t * 2)
	]

class Sm9Point(Structure):
	_fields_ = [
		("X", sm9_bn_t),

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Construct a separate DO_VERIFY context with the public key for verification
2. Remember: DO_SIGN context -> sign(); DO_VERIFY context -> verify(sig)

Example fix

// before
ctx = Sm2SignCtx(priv_key)  # sign mode
ctx.update(data); sig = ctx.sign()
ctx.update(data); ctx.verify(sig)
// after
v = Sm2SignCtx(pub_key, sign=DO_VERIFY)
v.update(data)
assert v.verify(sig)

from gmssl_python import DO_VERIFY
assert ctx._sign == DO_VERIFY, 'this context is for signing'

def is_verify_ctx(ctx) -> bool:
    return getattr(ctx, '_sign', None) == DO_VERIFY

try:
    ok = ctx.verify(sig)
except StateError as e:
    raise WrongMode('create a DO_VERIFY context to verify') from e

When it happens

Trigger: Calling verify(sig) on a signing context — e.g. reusing the same object to sign then immediately verify without constructing a DO_VERIFY context.

Common situations: Attempting same-process sign-then-verify round-trip tests with a single context object; API misuse from copy-paste.

Related errors

• has no public key
• has no private key
• not sign state
• gmssl reqsign failed: {}
• Invalid SM3 digest size

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/644b5af4ac318013. Report an issue: GitHub.