feat: update button (download, verify, stage)

internal/infrastructure/update/ed25519SignatureVerifier.go

@@ -0,0 +1,44 @@
+package update
+
+import (
+	domain "RenewCMS/internal/domain/update"
+	"crypto/ed25519"
+	"encoding/base64"
+	"errors"
+	"os"
+	"strings"
+)
+
+var (
+	errSignatureEncoding = errors.New("the signature is not a base64 encoded ed25519 signature")
+	errSignatureMismatch = errors.New("the signature does not match the checksums file")
+)
+
+type Ed25519SignatureVerifier struct {
+	key ed25519.PublicKey
+}
+
+var _ domain.SignatureVerifier = &Ed25519SignatureVerifier{}
+
+func NewEd25519SignatureVerifier(key ed25519.PublicKey) *Ed25519SignatureVerifier {
+	return &Ed25519SignatureVerifier{key: key}
+}
+
+func (v *Ed25519SignatureVerifier) Verify(checksumsPath string, signaturePath string) error {
+	content, err := os.ReadFile(checksumsPath)
+	if err != nil {
+		return err
+	}
+	rawSignature, err := os.ReadFile(signaturePath)
+	if err != nil {
+		return err
+	}
+	signature, err := base64.StdEncoding.DecodeString(strings.TrimSpace(string(rawSignature)))
+	if err != nil || len(signature) != ed25519.SignatureSize {
+		return errSignatureEncoding
+	}
+	if len(v.key) != ed25519.PublicKeySize || !ed25519.Verify(v.key, content, signature) {
+		return errSignatureMismatch
+	}
+	return nil
+}