45 lines
1.1 KiB
Go
45 lines
1.1 KiB
Go
package update
|
|
|
|
import (
|
|
domain "RenewCMS/internal/domain/update"
|
|
"crypto/ed25519"
|
|
"encoding/base64"
|
|
"errors"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
var (
|
|
errSignatureEncoding = errors.New("the signature is not a base64 encoded ed25519 signature")
|
|
errSignatureMismatch = errors.New("the signature does not match the checksums file")
|
|
)
|
|
|
|
type Ed25519SignatureVerifier struct {
|
|
key ed25519.PublicKey
|
|
}
|
|
|
|
var _ domain.SignatureVerifier = &Ed25519SignatureVerifier{}
|
|
|
|
func NewEd25519SignatureVerifier(key ed25519.PublicKey) *Ed25519SignatureVerifier {
|
|
return &Ed25519SignatureVerifier{key: key}
|
|
}
|
|
|
|
func (v *Ed25519SignatureVerifier) Verify(checksumsPath string, signaturePath string) error {
|
|
content, err := os.ReadFile(checksumsPath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
rawSignature, err := os.ReadFile(signaturePath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
signature, err := base64.StdEncoding.DecodeString(strings.TrimSpace(string(rawSignature)))
|
|
if err != nil || len(signature) != ed25519.SignatureSize {
|
|
return errSignatureEncoding
|
|
}
|
|
if len(v.key) != ed25519.PublicKeySize || !ed25519.Verify(v.key, content, signature) {
|
|
return errSignatureMismatch
|
|
}
|
|
return nil
|
|
}
|