#moonpgp

Module: justinwongcn/moonpgp · Package documentation ·

#Install

moon add justinwongcn/moonpgp

import {
  "justinwongcn/moonpgp",
  "justinwongcn/moonpgp/mime",
  "justinwongcn/moonpgp/mail",
}

#A taste of the API

///|
test "a tiny round trip" {
  let key = @moonpgp.generate_ed25519_key("alice@example.com")
  let armored = @moonpgp.pgp().encryption().recipient(key.to_public()).finish()(
    b"hi, from the README",
  )
  let open = @moonpgp.pgp().decryption().decryption_key(key).finish()
  match open(armored) {
    Data(data) => assert_eq(data, b"hi, from the README")
    Verified(data) => assert_eq(data, b"hi, from the README")
    SignatureError(_) => fail("unexpected signature error")
  }
}

///|
test "wrong passphrases are a typed error" {
  let key = @moonpgp.generate_ed25519_key("alice@example.com").lock("right")
  try {
    let _ = key.unlock("wrong")
    fail("unlocking must fail")
  } catch {
    @moonpgp.PgpError::WrongPassphrase(_) => () // the expected failure class
    _ => fail("expected WrongPassphrase")
  }
}

///|
test "detached signatures and verification" {
  let signer = @moonpgp.generate_ed25519_key("signer@example.com")
  let data = b"release tarball bytes or document payload"
  let sig = @moonpgp.sign_detached(data, signer)
  let status = @moonpgp.verify_detached(data, sig, signer.to_public())
  assert_eq(status, @moonpgp.VerifyStatus::Ok)
}

///|
test "pgp/mime sign and verify" {
  let key = @moonpgp.generate_ed25519_key("mime@example.com")
  let message = @mime.build_pgp_mime_signed("Hello from MoonBit\n", key)
  let (_, status) = @mime.verify_pgp_mime_signed(message, key.to_public())
  assert_eq(status, @api.Ok)
}

git clone https://github.com/justinwongcn/moonpgp
cd moonpgp
moon run cmd/main -- help

#Features

• Keys: generate, import, export, lock and unlock with a passphrase. RSA, Ed25519 (legacy EdDSA), and Curve25519/X25519 are covered; new keys are v4, and v6 works too — generate_ed25519_v6_key_with_signing_subkey produces the gpg dual-subkey shape on v6: a cert-only primary, an X25519 encryption subkey and an Ed25519 signing subkey carrying the v6 cross-certification. All bound subkeys are kept, each judged by its own key flags, and helpers check capabilities, expiry, and revocation. Certificates also grow and change in place: revoke a key or a single subkey, issue a standalone .rev certificate (gpg's --gen-revoke certificates apply too), add fresh encryption or signing subkeys to an existing key, set or extend expiry at generation time (KeyGenBuilder::expires) or later (set_expiry, set_subkey_expiry), and manage identities with add_user_id, revoke_user_id and set_primary_user_id.
• Messages: public-key or passphrase encryption, detached/inline/cleartext signatures, session-key operations, ZIP/ZLIB compression on output. On input, BZip2-compressed messages decrypt as well — the format gpg emits under --compress-algo bzip2 — through a pure-MoonBit codec that verifies every block and stream CRC. Document signatures come from the primary key when it may sign, otherwise from a signing subkey (its binding carries the cross-certification gpg requires). Anything this library encrypts uses AES; CAST5 and 3DES exist for decryption only.
• v6 messages: v6 PKESK/SKESK and v2 SEIPD with OCB, EAX, or GCM AEAD, end to end. In the encryption builder, .password_v6 adds a v6 passphrase recipient; v4 and v6 shapes don't mix in one message. Regular v4 recipient and passphrase flows default to v1 SEIPD.
• Passphrase protection: iterated-and-salted S2K and Argon2, including the AEAD-protected secret-key formats.
• Email: mime parses and verifies PGP/MIME; mail builds RFC 5322 messages, signed and encrypted PGP/MIME included. The SMTP/IMAP clients under example/ are examples rather than library API, and they only run on native.

#Interop and local checks

moon check --target all --deny-warn
moon build --target all
moon test --target native
moon fmt --check

#Security and limitations

• Import verifies the signatures it understands (User ID certifications, subkey bindings, v6 direct-key signatures), but that's signature checking, not trust management: whether a key really belongs to someone is for your application to decide.
• RSA, Ed25519, and X25519 arithmetic runs on @bigint and is not constant-time, and a GC runtime makes no promise about wiping private keys from memory.
• Decrypting untrusted Argon2-protected data is capped at 64 MiB of memory by default; over-limit requests are rejected before anything is allocated. Some APIs let you set a different limit.
• The encryption APIs don't pad v2 SEIPD messages, so ciphertext length gives away roughly how long the plaintext is.
• On targets without a platform clock, expiration checks are off and revocation dates can't be evaluated; revocation signatures are still checked cryptographically.

#License