mooncakes.io

Native OpenPGP signature verification (extension module for mizchi/bit)

git

openpgp

pgp

signature

verify

moon add mizchi/bitx_openpgp@0.46.4

Download zip

Author

mizchi

Version

0.46.4

License

Apache-2.0

Repository

github.com/mizchi/bit-vcs

Last updated

4 days ago

Downloads

Dependencies

mizchi/experimental_crypto0.0.2

README

#
VerifyResult

source

pub struct VerifyResult {
  verified : Bool
  error : String?
}

Outcome of an OpenPGP verification attempt.

#
split_armored_public_keys

source

fn split_armored_public_keys(text : String) -> Array[String]

Split a blob that may contain several concatenated ASCII-armored public key blocks (e.g. a keyring file exported with gpg --armor --export) into the individual armored blocks. Whitespace/comments between blocks are ignored.

#
verify_detached_armored

source

fn verify_detached_armored(payload : Bytes, signature_armor : String, public_keys_armor : Array[String]) -> VerifyResult

Verify a detached, ASCII-armored OpenPGP signature over payload against a set of ASCII-armored public keys. Returns verified = true as soon as any key validates the signature. Keys that fail to parse, or signature schemes the underlying library does not support, are skipped rather than aborting the whole check, so a single bad key in the file cannot mask a good one.

#
verify_ssh_detached

source

fn verify_ssh_detached(payload : Bytes, signature_armor : String, allowed_signers_text : String) -> VerifyResult

Verify a detached SSHSIG (-----BEGIN SSH SIGNATURE-----) signature over payload against an OpenSSH allowed-signers file (the contents of gpg.ssh.allowedSignersFile). Git always signs with the git namespace, so that is what is enforced here. Returns verified = true as soon as any principal listed in the allowed-signers file validates the signature — mirroring ssh-keygen -Y find-principals followed by -Y verify.