sign

Documentation

Overview

Package sign holds the request/assertion signing schemes Geiger modules need: RS256 JWT assertions (GCP, Salesforce, Snowflake), Azure SharedKey, HTTP Digest (MongoDB Atlas), and generic HMAC. AWS SigV4 lives in sigv4.go.

Index

• func AzureSharedKey(account string, accountKeyB64 string, stringToSign string) (string, error)
• func CanonicalizeHeaders(prefix string, headers map[string]string) string
• func DigestAuthHeader(user, pass, method, uri string, ch DigestChallenge, nc, cnonce string) string
• func HMACSHA1Hex(key, msg []byte) string
• func HMACSHA256Hex(key, msg []byte) string
• func ParseRSAPrivateKey(pemBytes []byte) (*rsa.PrivateKey, error)
• func RS256Assertion(pemBytes []byte, kid string, claims map[string]any, ttl time.Duration) (string, error)
• func SigV4(ctx context.Context, req *http.Request, ...) error
• type DigestChallenge
  • func ParseDigestChallenge(header string) DigestChallenge

Functions

func AzureSharedKey

func AzureSharedKey(account string, accountKeyB64 string, stringToSign string) (string, error)

AzureSharedKey computes the Authorization header value for the Azure Storage Shared Key scheme: "SharedKey {account}:{base64(HMAC-SHA256(key, StringToSign))}". stringToSign must already be assembled per the storage REST contract.

func CanonicalizeHeaders

func CanonicalizeHeaders(prefix string, headers map[string]string) string

CanonicalizeHeaders is a small helper for signing schemes that need sorted canonical header strings (e.g. x-ms-* for Azure).

func DigestAuthHeader

func DigestAuthHeader(user, pass, method, uri string, ch DigestChallenge, nc, cnonce string) string

DigestAuthHeader builds an RFC 2617 Digest Authorization header value (MD5, qop=auth) for MongoDB Atlas-style HTTP Digest auth. nc/cnonce make the response unique per request.

func HMACSHA1Hex

func HMACSHA1Hex(key, msg []byte) string

HMACSHA1Hex returns hex(HMAC-SHA1(key, msg)), used by the Duo Admin API's canonical-request signing scheme.

func HMACSHA256Hex

func HMACSHA256Hex(key, msg []byte) string

HMACSHA256Hex returns hex(HMAC-SHA256(key, msg)), used by exchange-style APIs (e.g. Coinbase legacy signing).

func ParseRSAPrivateKey

func ParseRSAPrivateKey(pemBytes []byte) (*rsa.PrivateKey, error)

ParseRSAPrivateKey accepts PKCS#1 or PKCS#8 PEM.

func RS256Assertion

func RS256Assertion(pemBytes []byte, kid string, claims map[string]any, ttl time.Duration) (string, error)

RS256Assertion builds a signed JWT for an OAuth jwt-bearer grant. kid may be empty. claims is the full claim set (iss, sub, aud, scope, …); iat/exp are set here if absent.

func SigV4

func SigV4(ctx context.Context, req *http.Request, accessKey, secretKey, session, service, region string, body []byte) error

SigV4 signs an AWS request in place using the aws-sdk-go-v2 signer. session may be empty for long-term keys. body is the exact request body (nil for empty). It mutates req's headers to carry the signature.

Types

type DigestChallenge

type DigestChallenge struct {
	Realm, Nonce, QOP, Opaque, Algorithm string
}

DigestChallenge holds the fields parsed from a WWW-Authenticate: Digest header.

func ParseDigestChallenge

func ParseDigestChallenge(header string) DigestChallenge

ParseDigestChallenge extracts fields from a WWW-Authenticate Digest header.