backseat-signed 0.1.0

Authenticate cryptographic links from a signed derivate to its source input
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

use crate::errors::*;
use sequoia_openpgp::cert::prelude::*;
use sequoia_openpgp::packet::Signature;
use sequoia_openpgp::parse::{PacketParser, PacketParserResult, Parse};
use sequoia_openpgp::types::SignatureType;
use sequoia_openpgp::Packet;
use sequoia_openpgp::{Cert, Fingerprint};

pub fn pubkey(bytes: &[u8]) -> Result<Vec<SigningKey>> {
    let mut keys = Vec::new();

    let ppr = PacketParser::from_bytes(bytes)?;
    for certo in CertParser::from(ppr) {
        let cert = certo.context("Error reading pgp key")?;
        keys.push(SigningKey { cert });
    }

    if keys.is_empty() {
        bail!("Failed to find any pgp public keys")
    }

    Ok(keys)
}

pub fn signature(bytes: &[u8]) -> Result<Vec<Signature>> {
    let mut sigs = Vec::new();

    let mut ppr = PacketParser::from_bytes(&bytes)?;
    while let PacketParserResult::Some(pp) = ppr {
        let (packet, next_ppr) = pp.recurse()?;
        ppr = next_ppr;
        debug!("Found packet in signature block: {packet:?}");
        if let Packet::Signature(sig) = packet {
            sigs.push(sig);
        }
    }

    if sigs.is_empty() {
        bail!("Failed to decode any pgp signatures")
    }

    Ok(sigs)
}

pub struct SigningKey {
    cert: Cert,
}

pub fn verify(keyring: &[SigningKey], sigs: &[Signature], msg: &[u8]) -> Result<Fingerprint> {
    for sig in sigs {
        let body = match sig.typ() {
            SignatureType::Binary => msg,
            other => bail!("Signature type is currently not supported: {other:?}"),
        };

        for pubkey in keyring {
            for key in pubkey.cert.keys() {
                let key = key.key();

                let key_fp = key.fingerprint();
                debug!("Attempting verification with {:X}", key_fp);

                match sig.clone().verify_message(key, body) {
                    Ok(_) => {
                        debug!("Successfully verified signature");
                        return Ok(key_fp);
                    }
                    Err(err) => {
                        debug!("Signature verification failed: {err:#}");
                    }
                }
            }
        }
    }

    bail!("Failed to verify message")
}