Documentation
¶
Index ¶
- func CanonicalizeJCS(doc []byte) ([]byte, error)
- func CanonicalizeJCSExcluding(doc []byte, excludeField string) ([]byte, error)
- func ParsePublicKeyResponse(body []byte) (any, error)
- func ParseSignature(body []byte) ([]byte, error)
- func VerifyDetached(content, signature []byte, key any) error
- func VerifyDetachedArtifact(content, signaturePayload, publicKeyPayload []byte) error
- func VerifyDetachedJWS(doc []byte, jws string, pub ed25519.PublicKey) error
- func VerifyFileTuple(catalogID string, version int, url, digest string, validUntil time.Time, ...) error
- func VerifyJSON(doc []byte, excludeField, sigValueB64 string, pub ed25519.PublicKey) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CanonicalizeJCS ¶
CanonicalizeJCS returns doc, with the top-level "proof" field removed (if present) and every object's keys sorted, compact-separated, matching RFC 8785 for the string/bool/integer-only documents DeDi manifests and indexes carry today (see the implementer caveat in onix-catalog-crawler-plugin-requirements.md §7.2 -- a generic encoding/json round trip is not RFC 8785-complete for arbitrary floats, but is sufficient here since Go's map marshaling already sorts keys and uses compact separators).
func CanonicalizeJCSExcluding ¶
CanonicalizeJCSExcluding is CanonicalizeJCS generalized to remove an arbitrary top-level field before canonicalizing, for documents that sign themselves under a different field name than DeDi's "proof" convention -- e.g. the decentralized-catalog file spec's self-signed catalog files and catalog-index entries, which both remove "signature" instead (the same non-circularity requirement: a document cannot authentically sign its own eventual signature).
func ParsePublicKeyResponse ¶
ParsePublicKeyResponse supports DeDi public-key lookup JSON, legacy JSON wrappers that expose raw key strings, and direct PEM/DER responses.
func ParseSignature ¶
ParseSignature accepts either a raw detached signature body or a base64-encoded signature, and also supports JSON payloads that expose a "signature" field.
func VerifyDetached ¶
VerifyDetached verifies a detached signature over content using the parsed public key. RSA and ECDSA use SHA-256; Ed25519 verifies the raw content.
func VerifyDetachedArtifact ¶
VerifyDetachedArtifact parses the signature and public key payloads, then verifies the detached signature against the supplied content bytes.
func VerifyDetachedJWS ¶
VerifyDetachedJWS verifies a DeDi manifest/index's compact detached-JWS proof.jws ("header_b64..signature_b64") against doc: doc is canonicalized with its "proof" field removed (§7.2), the signing input is reconstructed per §7.3, and the signature is checked with Ed25519 over that input.
Unlike the document-inclusive check this replaces, this never signs or verifies over content that itself contains the signature being checked.
func VerifyFileTuple ¶
func VerifyFileTuple(catalogID string, version int, url, digest string, validUntil time.Time, sigValueB64 string, pub ed25519.PublicKey) error
VerifyFileTuple verifies a catalog-index file entry's per-entry signature: a plain Ed25519 signature over the JCS-canonicalized tuple {catalogId, version, url, digest, validUntil} (file spec, "The signed entry is a tuple, not a bare hash"). This is the matching counterpart to artifactsigner.SignFileTuple and must stay byte-for-byte in sync with it -- duplicated rather than shared to avoid a circular import (artifactsigner already imports this package for CanonicalizeJCS), matching the existing dediJWSHeader duplication between the two packages.
func VerifyJSON ¶
VerifyJSON verifies the file spec's self-signing convention: a plain Ed25519 signature over the JCS canonicalization of doc with excludeField removed (the matching counterpart to artifactsigner.SignJSON). Used for both self-signed catalog files/change files and self-signed catalog-index entries -- both sign "the document with `signature` removed", never a derived tuple.
Types ¶
This section is empty.
Source Files