seal

Documentation

Overview

Package seal provides ed25519 detached signatures over a package's SHA256SUMS (plan §7, §19). SHA256SUMS already covers the entire sealed zone, so signing it authenticates the whole package. Uses only crypto/ed25519 from the standard library — no third-party crypto.

Index

• func GenerateKey(privPath, pubPath string) error
• func Sign(pkgDir, keyPath string) error
• func SignFile(dataPath, keyPath, sigPath string) error
• func VerifyFileSig(dataPath, sigPath, trustedPubPath string) error
• type VerifyResult
  • func Verify(pkgDir, expectedPubHex string) (*VerifyResult, error)

Functions

func GenerateKey

func GenerateKey(privPath, pubPath string) error

GenerateKey writes a new ed25519 keypair as PEM files.

func Sign

func Sign(pkgDir, keyPath string) error

Sign creates SEAL.sig over the package's SHA256SUMS using the private key at keyPath. The signature file records the public key so verify is self-contained; chain-of-custody records who signed out of band.

func SignFile

func SignFile(dataPath, keyPath, sigPath string) error

SignFile writes a detached ed25519 signature for an arbitrary file (used for knowledge/rule pack distribution, plan D5).

func VerifyFileSig

func VerifyFileSig(dataPath, sigPath, trustedPubPath string) error

VerifyFileSig verifies a detached signature against a trusted public key PEM. Returns an error describing the failure; nil means valid.

Types

type VerifyResult

type VerifyResult struct {
	Present   bool
	Valid     bool
	PublicKey string
	Reason    string
}

VerifyResult reports signature verification.

func Verify

func Verify(pkgDir, expectedPubHex string) (*VerifyResult, error)

Verify checks SEAL.sig against the current SHA256SUMS. Optionally pins an expected public key (hex); if provided and mismatched, fails.