assertslpsign

README

asserts-lp-sign

asserts-lp-sign is a Go client library for Canonical's Launchpad signing service (lp-signing). It implements a sign-only snapd asserts external keypair-manager backend (KeypairMgrBackend): private keys remain server-side and the library only requests detached signatures over lp-signing's boxed HTTP API.

It is consumed as a Go module:

require github.com/canonical/asserts-lp-sign v0.1.0

The package identifier is assertslpsign (Go identifiers cannot contain hyphens): import "github.com/canonical/asserts-lp-sign" then reference assertslpsign.NewKeypairMgrBackend.

See cmd/lpsigndemo for a complete example wiring NewKeypairMgrBackend into asserts.NewExternalKeypairManagerWithBackend and signing an assertion through an asserts.Database.

Development

Requires a Go toolchain (≥ 1.20) on PATH, or the Go snap at /snap/bin/go — the Makefile autodetects both; override with make GO=<path> if needed. Go ≥ 1.20 builds and tests the library (go build ./..., go test ./...); make lint and make test additionally install the pinned staticcheck, whose build requires Go ≥ 1.26 — toolchains ≥ 1.21 fetch that automatically

make test     # lint + run the test suite (gocheck)
make lint     # gofmt, go vet, staticcheck
make fmt      # auto-format

License

GNU General Public License v3 — see LICENSE. Copyright (C) 2026 Canonical Ltd.

Documentation

Index

• Variables
• type Config
• type KeyConfig
• type KeypairMgrBackend
  • func NewKeypairMgrBackend(cfg Config) (*KeypairMgrBackend, error)
  • func (b *KeypairMgrBackend) CheckFeatures() (asserts.ExtKeypairMgrSigning, error)
  • func (b *KeypairMgrBackend) LoadByCanonicalFingerprint(fingerprint string) (*asserts.ExtKeypairMgrLoadedKey, error)
  • func (b *KeypairMgrBackend) LoadByID(keyID string) (*asserts.ExtKeypairMgrLoadedKey, error)
  • func (b *KeypairMgrBackend) RSAPKCSSign(keyHandle string, prepared []byte) ([]byte, error)
  • func (b *KeypairMgrBackend) Sign(keyHandle string, content []byte) ([]byte, error)

Variables

var ErrKeyNotFound = errors.New("key not found")

ErrKeyNotFound is returned by LoadByID, LoadByCanonicalFingerprint and Sign when no configured key matches the requested id or handle.

Types

type Config

type Config struct {
	BaseURL          string
	ClientPrivateKey string
	Keys             []KeyConfig

	// HTTPClient is the HTTP client used to talk to lp-signing. If nil,
	// a client with a 30 second timeout is used.
	HTTPClient *http.Client
}

Config describes how to connect to the Launchpad signing service.

type KeyConfig

type KeyConfig struct {
	AccountKey  *asserts.AccountKey
	Fingerprint string
}

KeyConfig maps one account-key assertion to the Launchpad fingerprint used for signing.

type KeypairMgrBackend

type KeypairMgrBackend struct {
	// contains filtered or unexported fields
}

KeypairMgrBackend is a sign-only asserts external keypair manager backend backed by lp-signing.

func NewKeypairMgrBackend

func NewKeypairMgrBackend(cfg Config) (*KeypairMgrBackend, error)

NewKeypairMgrBackend creates a sign-only lp-signing backend from constructor-supplied configuration.

func (*KeypairMgrBackend) CheckFeatures

func (b *KeypairMgrBackend) CheckFeatures() (asserts.ExtKeypairMgrSigning, error)

func (*KeypairMgrBackend) LoadByCanonicalFingerprint

func (b *KeypairMgrBackend) LoadByCanonicalFingerprint(fingerprint string) (*asserts.ExtKeypairMgrLoadedKey, error)

LoadByCanonicalFingerprint loads a configured key by its canonical fingerprint.

func (*KeypairMgrBackend) LoadByID

func (b *KeypairMgrBackend) LoadByID(keyID string) (*asserts.ExtKeypairMgrLoadedKey, error)

func (*KeypairMgrBackend) RSAPKCSSign

func (b *KeypairMgrBackend) RSAPKCSSign(keyHandle string, prepared []byte) ([]byte, error)

func (*KeypairMgrBackend) Sign

func (b *KeypairMgrBackend) Sign(keyHandle string, content []byte) ([]byte, error)