vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-13 00:34:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 14

Wire secure runtime RC qualification

Browse source
This commit is contained in:
rcourtman 2026-08-31 01:50:48 +01:00
parent 92b5f3a9e1
commit 7650fdaba3
18 changed files with 1184 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

32
scripts/release_update_key.go
View file

@ -3,6 +3,7 @@
package main
import (
"bytes"
"crypto/ed25519"
"crypto/sha256"
"crypto/x509"
@ -21,6 +22,7 @@ func usage() {
fmt.Fprintln(os.Stderr, " release_update_key.go openssh-private-key --private-key <base64-ed25519-key-or-seed> [--comment <comment>]")
fmt.Fprintln(os.Stderr, " release_update_key.go fingerprint (--private-key <base64-ed25519-key-or-seed> | --public-key <base64-ed25519-public-key>)")
fmt.Fprintln(os.Stderr, " release_update_key.go sign --private-key <base64-ed25519-key-or-seed> --file <path>")
fmt.Fprintln(os.Stderr, " release_update_key.go verify --public-key <base64-ed25519-public-key> --file <path> --signature-file <path>")
os.Exit(1)
}
@ -147,6 +149,36 @@ func main() {
fail(err)
}
fmt.Println(signature)
case "verify":
verifyCmd := flag.NewFlagSet("verify", flag.ExitOnError)
publicKey := verifyCmd.String("public-key", "", "base64-encoded Ed25519 public key or PKIX public key")
filePath := verifyCmd.String("file", "", "path to the signed file")
signaturePath := verifyCmd.String("signature-file", "", "path to the base64-encoded Ed25519 signature")
_ = verifyCmd.Parse(os.Args[2:])
if *publicKey == "" || *filePath == "" || *signaturePath == "" {
usage()
}
key, err := decodePublicKey(*publicKey)
if err != nil {
fail(err)
}
data, err := os.ReadFile(*filePath)
if err != nil {
fail(fmt.Errorf("read file for verification: %w", err))
}
signatureText, err := os.ReadFile(*signaturePath)
if err != nil {
fail(fmt.Errorf("read signature for verification: %w", err))
}
signature, err := base64.StdEncoding.DecodeString(string(bytes.TrimSpace(signatureText)))
if err != nil {
fail(fmt.Errorf("invalid base64 signature: %w", err))
}
if !ed25519.Verify(key, data, signature) {
fail(fmt.Errorf("signature verification failed"))
}
fmt.Println("signature verified")
default:
usage()
}