attest

Documentation

Overview

Package attest signs and verifies compliance-evidence digests. It is stdlib-only (ed25519, ECDSA P-256, or ML-DSA (FIPS 204), PKCS#8 keys), adding authenticity on top of the integrity digest the evidence document already carries.

Index

• func Fingerprint(sig Signature) string
• func Verify(payload []byte, sig Signature) error
• type Signature
• type Signer
  • func LoadSigner(pemPath string) (*Signer, error)
  • func (s *Signer) Sign(payload []byte) (Signature, error)

Functions

func Fingerprint

func Fingerprint(sig Signature) string

Fingerprint is a short sha256 of the signing public key, for trust display.

func Verify

func Verify(payload []byte, sig Signature) error

Verify checks sig over payload using the public key embedded in sig.

Types

type Signature

type Signature struct {
	Alg       string `json:"alg"`
	Value     string `json:"value"`
	PublicKey string `json:"publicKey"`
}

Signature is a detached signature over an evidence digest, carrying the public key (SPKI DER) so it is self-verifying against a trusted fingerprint.

type Signer

type Signer struct {
	// contains filtered or unexported fields
}

Signer holds a parsed private key and its algorithm.

func LoadSigner

func LoadSigner(pemPath string) (*Signer, error)

LoadSigner reads a PKCS#8 PEM private key (ed25519, ECDSA P-256, or ML-DSA).

func (*Signer) Sign

func (s *Signer) Sign(payload []byte) (Signature, error)

Sign returns a detached signature over payload.