codesign

Documentation

Overview

Package codesign verifies that a solo-provisioner release artifact carries a valid OpenPGP detached signature made by an embedded trust anchor — the project's release signing key. The public key(s) are compiled into the binary (//go:embed) so verification needs no network call and cannot be redirected to an attacker-controlled key endpoint.

This is the "sig-verify at download" layer described in docs/dev/daemon/cli-verification-design.md: a downloaded release binary (e.g. the auto-downloaded solo-provisioner-daemon) is trusted only if its detached .asc verifies against a key shipped in the verifying binary. A per-artifact SHA-256 is unsuitable as an authenticity control because a released binary cannot know the checksum of a version published after it; the signing key is stable across releases and therefore embeddable.

The verifier matches a signature to a key by issuer key id, so it accepts a signature made by the embedded primary key or by any subkey present in the embedded block. Validating that a signing subkey chains to an offline primary (the rotatable-subkey model in the design doc) is deferred to the self-upgrade work that owns that package's fuller key model; the current release key signs artifacts with its primary key directly.

Index

• func Verify(content io.Reader, armoredSig io.Reader) error

Functions

func Verify

func Verify(content io.Reader, armoredSig io.Reader) error

Verify reports whether content carries a valid OpenPGP detached signature (armoredSig) made by one of the embedded release keys. It returns nil on a good signature and a RejectedOperation error otherwise — an untrusted or tampered artifact must not be installed.

content is read to EOF; callers pass the raw artifact bytes (e.g. the downloaded binary), not its checksum.