libsignify_rs/

ops.rs

//
// signify-rs: cryptographically sign and verify files
// src/ops.rs: Cryptographic operations
//
// Copyright (c) 2025, 2026 Ali Polatel <alip@chesswob.org>
// Based in part upon OpenBSD's signify which is:
//   Copyright (c) 2013 Ted Unangst <tedu@openbsd.org>
//   Copyright (c) 2016 Marc Espie <espie@openbsd.org>
//   Copyright (c) 2019 Adrian Perez de Castro <aperez@igalia.com>
//   Copyright (c) 2019 Scott Bennett and other contributors
//   SPDX-License-Identifier: ISC
//
// SPDX-License-Identifier: ISC

use crate::crypto::{
    self, derive_checksum, generate_keypair, kdf, COMMENTHDR, KDFALG, KEYNUMLEN, PKALG, SALT_LEN,
    SECKEY_LEN,
};
use crate::error::{Error, Result};
use crate::file::{parse, write, EncKey, PubKey, Sig};
use crate::utils::log_untrusted_buf;
use crate::utils::read_password;
use crate::utils::{check_keyname_compliance, get_signify_dir};
use base64ct::{Base64, Encoding as _};
use data_encoding::HEXLOWER;
use memchr::memchr;
use memchr::memmem;
use rand_core::{OsRng, TryRngCore as _};
use sha2::{Digest as _, Sha256, Sha512};
use std::fs::OpenOptions;
use std::io::stdout;
use std::io::BufReader;
use std::io::Cursor;
use std::io::{copy, stderr, stdin};
use std::io::{Read, Seek, SeekFrom, Write};
use std::path::{Path, PathBuf};
use std::str;
use zeroize::Zeroizing;

type EmbeddedSigResult = Result<(Sig, Vec<u8>, Box<dyn Read>)>;

/// Gzip header structure.
struct GzipHeader {
    /// Gzip flags.
    flg: u8,
    /// Header bytes (magic, compression method, flags, mtime, xfl, os).
    head: [u8; 10],
    /// Extra field data.
    extra_field: Vec<u8>,
    /// Original filename field.
    name_field: Vec<u8>,
    /// Comment field.
    comment_vec: Vec<u8>,
}

/// Builder for key generation operations.
///
/// # Examples
///
/// ```rust
/// use libsignify_rs::KeyGenerator;
/// use tempfile::tempdir;
///
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// let dir = tempdir()?;
/// let pub_path = dir.path().join("key.pub");
/// let sec_path = dir.path().join("key.sec");
///
/// // Generate with default settings (secure KDF rounds)
/// KeyGenerator::new()
///     .rounds(0) // No encryption for automated testing
///     .comment("test-key")
///     .generate(&pub_path, &sec_path)?;
///
/// assert!(pub_path.exists());
/// assert!(sec_path.exists());
/// # Ok(())
/// # }
/// ```
#[derive(Default)]
pub struct KeyGenerator {
    rounds: u32,
    comment: Option<String>,
    key_id: Option<i32>,
}

impl KeyGenerator {
    /// Create a new `KeyGenerator` with default settings.
    #[must_use]
    pub fn new() -> Self {
        Self {
            rounds: crypto::DEFAULT_ROUNDS,
            comment: None,
            key_id: None,
        }
    }

    /// Set KDF rounds (0 for no encryption).
    ///
    /// Default is 42.
    #[must_use]
    pub fn rounds(mut self, rounds: u32) -> Self {
        self.rounds = rounds;
        self
    }

    /// Set key comment.
    ///
    /// Default is "signify key".
    #[must_use]
    pub fn comment(mut self, comment: impl Into<String>) -> Self {
        self.comment = Some(comment.into());
        self
    }

    /// Set key ID for keyring integration.
    #[must_use]
    pub fn key_id(mut self, key_id: i32) -> Self {
        self.key_id = Some(key_id);
        self
    }

    /// Execute key generation.
    ///
    /// # Errors
    /// Returns errors if file I/O or KDF fails.
    pub fn generate(self, pubkey_path: &Path, seckey_path: &Path) -> Result<()> {
        let comment = self.comment.as_deref().unwrap_or("signify key");

        let (public_key, secret_key) = generate_keypair();

        let mut keynum = [0_u8; KEYNUMLEN];
        OsRng.try_fill_bytes(&mut keynum)?;

        let mut salt = [0_u8; SALT_LEN];
        OsRng.try_fill_bytes(&mut salt)?;

        let xorkey = if self.rounds > 0 {
            let pass = prompt_password(true, self.key_id)?;
            let mut out = Zeroizing::new(vec![0u8; SECKEY_LEN]);
            kdf(&pass, &salt, self.rounds, &mut out)?;
            out
        } else {
            Zeroizing::new(vec![0u8; SECKEY_LEN])
        };

        let checksum = derive_checksum(&secret_key);

        let mut xored_seckey = [0_u8; SECKEY_LEN];
        for i in 0..SECKEY_LEN {
            xored_seckey[i] = secret_key[i] ^ xorkey[i];
        }

        let enc_key = EncKey {
            pkalg: PKALG,
            kdfalg: KDFALG,
            kdfrounds: self.rounds,
            salt,
            checksum,
            keynum,
            seckey: xored_seckey,
        };

        let pub_key = PubKey {
            pkalg: PKALG,
            keynum,
            pubkey: public_key,
        };

        let comment_len = comment.len().checked_add(11).ok_or(Error::Overflow)?;
        let mut seckey_comment = Vec::with_capacity(comment_len);
        seckey_comment.extend_from_slice(comment.as_bytes());
        seckey_comment.extend_from_slice(b" secret key");
        write(seckey_path, &seckey_comment, &enc_key.to_bytes())?;

        let mut pubkey_comment = Vec::with_capacity(comment_len);
        pubkey_comment.extend_from_slice(comment.as_bytes());
        pubkey_comment.extend_from_slice(b" public key");
        write(pubkey_path, &pubkey_comment, &pub_key.to_bytes())
    }
}

/// Builder for signing operations.
///
/// # Examples
///
/// Basic signing:
///
/// ```rust
/// use libsignify_rs::{KeyGenerator, Signer};
/// use tempfile::tempdir;
/// use std::fs;
///
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// let dir = tempdir()?;
/// let pub_path = dir.path().join("key.pub");
/// let sec_path = dir.path().join("key.sec");
/// let msg_path = dir.path().join("msg.txt");
/// let sig_path = dir.path().join("msg.sig");
///
/// // Setup: Generate keys and message
/// KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// fs::write(&msg_path, "test message")?;
///
/// // Sign
/// Signer::new()
///     .seckey(&sec_path)
///     .sign(&msg_path, &sig_path)?;
///
/// assert!(sig_path.exists());
/// # Ok(())
/// # }
/// ```
///
/// Embedded signature:
///
/// ```rust
/// # use libsignify_rs::{KeyGenerator, Signer};
/// # use tempfile::tempdir;
/// # use std::fs;
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// # let dir = tempdir()?;
/// # let pub_path = dir.path().join("key.pub");
/// # let sec_path = dir.path().join("key.sec");
/// # let msg_path = dir.path().join("msg.txt");
/// # let sig_path = dir.path().join("msg.sig");
/// # KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// # fs::write(&msg_path, "test message")?;
/// Signer::new()
///     .seckey(&sec_path)
///     .embed(true)
///     .sign(&msg_path, &sig_path)?;
/// # Ok(())
/// # }
/// ```
///
/// Gzip signing:
///
/// ```rust
/// # use libsignify_rs::{KeyGenerator, Signer};
/// # use tempfile::tempdir;
/// # use std::fs;
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// # let dir = tempdir()?;
/// # let pub_path = dir.path().join("key.pub");
/// # let sec_path = dir.path().join("key.sec");
/// # let msg_path = dir.path().join("archive.gz"); // Input must be a file
/// # let sig_path = dir.path().join("archive.gz.sig"); // Output is signed gzip
/// # KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// use flate2::write::GzEncoder;
/// use flate2::Compression;
/// use std::fs::File;
/// use std::io::Write;
///
/// // Create a valid gzip file to sign
/// let f = File::create(&msg_path)?;
/// let mut e = GzEncoder::new(f, Compression::default());
/// e.write_all(b"compressed content")?;
/// e.finish()?;
///
/// Signer::new()
///     .seckey(&sec_path)
///     .gzip(true)
///     .sign(&msg_path, &sig_path)?;
/// # Ok(())
/// # }
/// ```
pub struct Signer {
    seckey: Option<PathBuf>,
    embed: bool,
    gzip: bool,
    key_id: Option<i32>,
}

impl Default for Signer {
    fn default() -> Self {
        Self::new()
    }
}

impl Signer {
    /// Create a new `Signer`.
    #[must_use]
    pub fn new() -> Self {
        Self {
            seckey: None,
            embed: false,
            gzip: false,
            key_id: None,
        }
    }

    /// Set secret key path.
    #[must_use]
    pub fn seckey(mut self, path: impl Into<PathBuf>) -> Self {
        self.seckey = Some(path.into());
        self
    }

    /// Set embed mode (signify -e).
    ///
    /// If true, creates an embedded signature.
    #[must_use]
    pub fn embed(mut self, embed: bool) -> Self {
        self.embed = embed;
        self
    }

    /// Set gzip mode (signify -z).
    ///
    /// If true, signs a gzip archive.
    #[must_use]
    pub fn gzip(mut self, gzip: bool) -> Self {
        self.gzip = gzip;
        self
    }

    /// Set key ID (for keyring support).
    #[must_use]
    pub fn key_id(mut self, key_id: i32) -> Self {
        self.key_id = Some(key_id);
        self
    }

    /// Sign a file.
    ///
    /// # Errors
    /// Returns errors if I/O, decryption, or signing fails.
    pub fn sign(self, msg_path: &Path, sig_path: &Path) -> Result<()> {
        let seckey_path = self.seckey.as_deref().ok_or(Error::RequiredArg("-s"))?;

        let (enc_key, comment_bytes) = parse::<EncKey, _>(seckey_path, EncKey::from_bytes)?;

        let xorkey = if enc_key.kdfrounds > 0 {
            let pass = prompt_password(false, self.key_id)?;
            let mut out = Zeroizing::new(vec![0u8; SECKEY_LEN]);
            kdf(&pass, &enc_key.salt, enc_key.kdfrounds, &mut out)?;
            out
        } else {
            Zeroizing::new(vec![0u8; SECKEY_LEN])
        };

        let mut seckey = [0_u8; SECKEY_LEN];
        for i in 0..SECKEY_LEN {
            seckey[i] = enc_key.seckey[i] ^ xorkey[i];
        }

        let checksum = derive_checksum(&seckey);
        if checksum != enc_key.checksum {
            return Err(Error::IncorrectPassphrase);
        }

        if self.gzip {
            if self.embed {
                return Err(Error::Io(std::io::Error::new(
                    std::io::ErrorKind::InvalidInput,
                    "cannot combine -e (embed) and -z (gzip)",
                )));
            }
            return sign_gzip(
                &seckey,
                enc_key.keynum,
                seckey_path,
                msg_path,
                sig_path,
                &comment_bytes,
            );
        }

        // Determine paths and streams.
        let is_stdout = sig_path.to_str() == Some("-");
        let is_stdin = msg_path.to_str() == Some("-");

        // Pre-calculate signature comment (used in headers).
        let mut sig_comment = Vec::new();
        if seckey_path.to_str() == Some("-") {
            sig_comment.extend_from_slice(b"signature from ");
            sig_comment.extend_from_slice(&comment_bytes);
        } else {
            let basename = check_keyname_compliance(None, seckey_path)?;
            sig_comment.extend_from_slice(b"verify with ");
            sig_comment.extend_from_slice(basename.as_bytes());
            sig_comment.extend_from_slice(b".pub");
        };

        sign_standard(SignParams {
            seckey: &seckey,
            keynum: enc_key.keynum,
            msg_path,
            sig_path,
            embed: self.embed,
            is_stdout,
            is_stdin,
            sig_comment: &sig_comment,
        })
    }
}

/// Builder for verification operations.
///
/// # Examples
///
/// Basic verification:
///
/// ```rust
/// use libsignify_rs::{KeyGenerator, Signer, Verifier};
/// use tempfile::tempdir;
/// use std::fs;
///
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// let dir = tempdir()?;
/// let pub_path = dir.path().join("key.pub");
/// let sec_path = dir.path().join("key.sec");
/// let msg_path = dir.path().join("msg.txt");
/// let sig_path = dir.path().join("msg.sig");
///
/// // Setup
/// KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// fs::write(&msg_path, "test message")?;
/// Signer::new().seckey(&sec_path).sign(&msg_path, &sig_path)?;
///
/// // Verify
/// Verifier::new()
///     .pubkey(&pub_path)
///     .quiet(true)
///     .verify(&msg_path, &sig_path)?;
/// # Ok(())
/// # }
/// ```
///
/// Embedded verification:
///
/// ```rust
/// # use libsignify_rs::{KeyGenerator, Signer, Verifier};
/// # use tempfile::tempdir;
/// # use std::fs;
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// # let dir = tempdir()?;
/// # let pub_path = dir.path().join("key.pub");
/// # let sec_path = dir.path().join("key.sec");
/// # let msg_path = dir.path().join("msg.txt");
/// # let sig_path = dir.path().join("msg.sig");
/// # KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// # fs::write(&msg_path, "test message")?;
/// // Sign with embed
/// Signer::new()
///     .seckey(&sec_path)
///     .embed(true)
///     .sign(&msg_path, &sig_path)?;
///
/// // Remove original message to verify extraction
/// fs::remove_file(&msg_path)?;
///
/// // Verify embedded
/// Verifier::new()
///     .pubkey(&pub_path)
///     .quiet(true)
///     .embed(true)
///     .verify(&msg_path, &sig_path)?;
/// # Ok(())
/// # }
/// ```
///
/// Gzip verification:
///
/// ```rust
/// # use libsignify_rs::{KeyGenerator, Signer, Verifier};
/// # use tempfile::tempdir;
/// # use std::fs::File;
/// # use std::path::Path;
/// # use flate2::{write::GzEncoder, Compression};
/// # use std::io::Write;
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// # let dir = tempdir()?;
/// # let pub_path = dir.path().join("key.pub");
/// # let sec_path = dir.path().join("key.sec");
/// # let msg_path = dir.path().join("archive.gz");
/// # let sig_path = dir.path().join("archive.gz.sig");
/// # KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// # let f = File::create(&msg_path)?;
/// # let mut e = GzEncoder::new(f, Compression::default());
/// # e.write_all(b"data")?;
/// # e.finish()?;
/// // Sign gzip
/// Signer::new()
///     .seckey(&sec_path)
///     .gzip(true)
///     .sign(&msg_path, &sig_path)?;
///
/// // Verify gzip
/// Verifier::new()
///     .pubkey(&pub_path)
///     .quiet(true)
///     .gzip(true)
///     .verify(&Path::new("-"), &sig_path)?; // Output to stdout (-) or file
/// # Ok(())
/// # }
/// ```
///
/// Handling verification failures:
///
/// ```rust
/// # use libsignify_rs::{KeyGenerator, Signer, Verifier};
/// # use tempfile::tempdir;
/// # use std::fs;
/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
/// # let dir = tempdir()?;
/// # let pub_path = dir.path().join("key.pub");
/// # let sec_path = dir.path().join("key.sec");
/// # let msg_path = dir.path().join("msg.txt");
/// # let sig_path = dir.path().join("msg.sig");
/// # KeyGenerator::new().rounds(0).generate(&pub_path, &sec_path)?;
/// # fs::write(&msg_path, "original message")?;
/// # Signer::new().seckey(&sec_path).sign(&msg_path, &sig_path)?;
///
/// // Tamper with the message
/// fs::write(&msg_path, "tampered message")?;
///
/// // Verification should fail
/// let result = Verifier::new()
///     .pubkey(&pub_path)
///     .verify(&msg_path, &sig_path);
///
/// assert!(result.is_err());
/// # Ok(())
/// # }
/// ```
pub struct Verifier {
    pubkey: Option<PathBuf>,
    quiet: bool,
    embed: bool,
    gzip: bool,
}

impl Default for Verifier {
    fn default() -> Self {
        Self::new()
    }
}

impl Verifier {
    /// Create a new `Verifier`.
    #[must_use]
    pub fn new() -> Self {
        Self {
            pubkey: None,
            quiet: false,
            embed: false,
            gzip: false,
        }
    }

    /// Set public key path.
    #[must_use]
    pub fn pubkey(mut self, path: impl Into<PathBuf>) -> Self {
        self.pubkey = Some(path.into());
        self
    }

    /// Set quiet mode.
    ///
    /// If true, suppresses "Signature Verified" output.
    #[must_use]
    pub fn quiet(mut self, quiet: bool) -> Self {
        self.quiet = quiet;
        self
    }

    /// Set embed mode (signify -I).
    ///
    /// Used when verifying an embedded signature.
    #[must_use]
    pub fn embed(mut self, embed: bool) -> Self {
        self.embed = embed;
        self
    }

    /// Set gzip mode (signify -z).
    ///
    /// Used when verifying a signed gzip archive.
    #[must_use]
    pub fn gzip(mut self, gzip: bool) -> Self {
        self.gzip = gzip;
        self
    }

    /// Verify a signature.
    ///
    /// # Errors
    /// Returns errors if verification fails.
    pub fn verify(self, msg_path: &Path, sig_path: &Path) -> Result<()> {
        if self.gzip {
            return verify_gzip(self.pubkey.as_deref(), msg_path, sig_path, self.quiet);
        }

        // Standard embedded/detached verify:
        // Determine signature and input stream.
        let (signature, stream, output_path, comment_opt) = if self.embed {
            let (sig_obj, prelude, rest_reader) = parse_embedded_signature(sig_path)?;
            let stream = Cursor::new(prelude).chain(rest_reader);

            let out_path = if self.embed { Some(msg_path) } else { None };
            (sig_obj, Box::new(stream) as Box<dyn Read>, out_path, None)
        } else {
            // Detached
            let (sig_obj, comment_content) = parse::<Sig, _>(sig_path, Sig::from_bytes)?;
            let file = OpenOptions::new()
                .read(true)
                .open(msg_path)
                .map_err(Error::Io)?;

            // Detached verification never extracts/writes.
            (
                sig_obj,
                Box::new(file) as Box<dyn Read>,
                None,
                Some(comment_content),
            )
        };

        let pub_key_obj = if let Some(path) = &self.pubkey {
            let (pk, _) = parse::<PubKey, _>(path, PubKey::from_bytes)?;
            pk
        } else {
            // Try autolocate using comment_opt or reading file header.
            let comment = if let Some(comment_bytes) = comment_opt {
                comment_bytes
            } else {
                // Re-read header for autolocate if needed,
                // e.g. embedded case where we didn't preserve comment.
                let mut f = OpenOptions::new()
                    .read(true)
                    .open(sig_path)
                    .map_err(Error::Io)?;
                let mut buf = vec![0u8; 4096];
                let n = f.read(&mut buf).map_err(Error::Io)?;
                let nl = memchr(b'\n', &buf[..n]).ok_or(Error::InvalidCommentHeader)?;
                buf[..nl].to_vec()
            };
            autolocate_key(&comment)?
        };

        if signature.keynum != pub_key_obj.keynum {
            return Err(Error::KeyMismatch);
        }

        // Prepare output writer if needed.
        let mut writer: Option<Box<dyn Write>> = if let Some(path) = output_path {
            let f = OpenOptions::new()
                .write(true)
                .create_new(true)
                .open(path)
                .map_err(Error::Io)?;
            Some(Box::new(f))
        } else {
            None
        };

        // Verify stream.
        let writer_ref = writer.as_mut().map(|w| &mut **w as &mut dyn Write);
        crypto::verify_stream(stream, writer_ref, &pub_key_obj.pubkey, &signature.sig)?;

        if !self.quiet {
            println!("Signature Verified");
        }

        Ok(())
    }
}

/// Prompt for password.
fn prompt_password(confirm: bool, key_id: Option<i32>) -> Result<zeroize::Zeroizing<Vec<u8>>> {
    let pass = read_password("passphrase: ", key_id)?;

    if confirm && key_id.is_none() {
        eprint!("confirm passphrase: ");
        stderr().flush().map_err(Error::Io)?;
        let pass2 = read_password("passphrase: ", None)?;
        if pass != pass2 {
            return Err(Error::PasswordMismatch);
        }
    }
    Ok(pass)
}

/// Parameters for signing operations.
struct SignParams<'a> {
    /// Secret key bytes.
    seckey: &'a [u8; 64],
    /// Key ID.
    keynum: [u8; 8],
    /// Path to the message file.
    msg_path: &'a Path,
    /// Path to the signature file.
    sig_path: &'a Path,
    /// Whether to embed the signature.
    embed: bool,
    /// Whether output is stdout.
    is_stdout: bool,
    /// Whether input is stdin.
    is_stdin: bool,
    /// Signature comment to include.
    sig_comment: &'a [u8],
}

fn sign_standard(params: SignParams) -> Result<()> {
    // Helper to create header bytes from signature bytes.
    let make_header = |sig_bytes: &[u8]| -> Result<Vec<u8>> {
        // Unwrap is safe because it's fixed length.
        #[expect(clippy::disallowed_methods)]
        let sig_obj = Sig {
            pkalg: PKALG,
            keynum: params.keynum,
            sig: sig_bytes.try_into().unwrap(),
        };
        let encoded = Base64::encode_string(&sig_obj.to_bytes());
        let mut h = Vec::new();
        h.extend_from_slice(COMMENTHDR.as_bytes());
        h.extend_from_slice(params.sig_comment);
        h.push(b'\n');
        h.extend_from_slice(encoded.as_bytes());
        h.push(b'\n');
        Ok(h)
    };

    let out_file = if params.is_stdout {
        None
    } else {
        Some(
            OpenOptions::new()
                .write(true)
                .create_new(true)
                .open(params.sig_path)
                .map_err(Error::Io)?,
        )
    };

    if params.embed {
        if let Some(mut file) = out_file {
            // File output: Seek and patch.
            // 1. Write dummy header.
            let dummy_sig = [0u8; 64];
            let header = make_header(&dummy_sig)?;
            file.write_all(&header).map_err(Error::Io)?;

            // 2. Stream input.
            let mut reader: Box<dyn Read> = if params.is_stdin {
                Box::new(stdin())
            } else {
                Box::new(
                    OpenOptions::new()
                        .read(true)
                        .open(params.msg_path)
                        .map_err(Error::Io)?,
                )
            };

            let kp = ed25519_compact::KeyPair {
                pk: ed25519_compact::PublicKey::from_slice(&params.seckey[32..])
                    .map_err(Error::Crypto)?,
                sk: ed25519_compact::SecretKey::from_slice(params.seckey).map_err(Error::Crypto)?,
            };
            let mut ctx = kp.sk.sign_incremental(ed25519_compact::Noise::default());

            let mut buf = [0u8; 64 * 1024];
            loop {
                let n = reader.read(&mut buf).map_err(Error::Io)?;
                if n == 0 {
                    break;
                }
                ctx.absorb(&buf[..n]);
                file.write_all(&buf[..n]).map_err(Error::Io)?;
            }

            // 3. Patch.
            let real_sig = ctx.sign();
            let real_header = make_header(real_sig.as_ref())?;
            if real_header.len() != header.len() {
                return Err(Error::InvalidSignatureLength);
            }
            file.seek(SeekFrom::Start(0)).map_err(Error::Io)?;
            file.write_all(&real_header).map_err(Error::Io)?;
        } else {
            // Output is stdout.
            if params.is_stdin {
                // TODO: Stream from stdin to stdout.
                return Err(Error::Io(std::io::Error::new(
                    std::io::ErrorKind::InvalidInput,
                    "Cannot embedded-sign stdin to stdout",
                )));
            } else {
                // File input: Two pass (read hash, read write).
                let mut f = OpenOptions::new()
                    .read(true)
                    .open(params.msg_path)
                    .map_err(Error::Io)?;
                let sig = crypto::sign_stream(&mut f, params.seckey)?;
                let header = make_header(&sig)?;
                let mut out = stdout();
                out.write_all(&header).map_err(Error::Io)?;

                let mut f = OpenOptions::new()
                    .read(true)
                    .open(params.msg_path)
                    .map_err(Error::Io)?;
                copy(&mut f, &mut out).map_err(Error::Io)?;
            }
        }
    } else {
        // Detached (-S)
        let mut reader: Box<dyn Read> = if params.is_stdin {
            Box::new(stdin())
        } else {
            Box::new(
                OpenOptions::new()
                    .read(true)
                    .open(params.msg_path)
                    .map_err(Error::Io)?,
            )
        };
        let sig = crypto::sign_stream(&mut reader, params.seckey)?;
        let header = make_header(&sig)?;

        if let Some(mut f) = out_file {
            f.write_all(&header).map_err(Error::Io)?;
        } else {
            stdout().write_all(&header).map_err(Error::Io)?;
        }
    }

    Ok(())
}

/// Autolocate helper
/// Autolocate a key from a signature comment.
pub(crate) fn autolocate_key(comment: &[u8]) -> Result<PubKey> {
    let marker = b"verify with ";
    if let Some(idx) = memmem::find(comment, marker) {
        let start = idx.checked_add(marker.len()).ok_or(Error::Overflow)?;
        let keyname_slice = comment.get(start..).ok_or(Error::Overflow)?;
        let keyname_bytes = keyname_slice.trim_ascii();
        let keyname_str = str::from_utf8(keyname_bytes).map_err(|_e| Error::InvalidKeyName)?;
        let keyname = Path::new(keyname_str);
        let safepath = get_signify_dir();
        let keypath = safepath.join(keyname);
        let (pk, _) = parse::<PubKey, _>(&keypath, PubKey::from_bytes)
            .map_err(|err| Error::AutolocateFailed(keypath.clone(), Box::new(err)))?;
        Ok(pk)
    } else {
        Err(Error::MissingPubKey)
    }
}

/// Parse embedded signature, returning sig, prelude bytes, and rest reader.
///
/// # Errors
/// Returns errors from file I/O or parsing.
fn parse_embedded_signature(path: &Path) -> EmbeddedSigResult {
    let mut reader: Box<dyn Read> = if path.to_str() == Some("-") {
        Box::new(stdin())
    } else {
        let file = OpenOptions::new()
            .read(true)
            .open(path)
            .map_err(Error::Io)?;
        Box::new(file)
    };

    // Read header bounded.
    const HEADER_LIMIT: usize = 4096;
    let mut buffer = vec![0_u8; HEADER_LIMIT];
    let mut valid_len = 0;

    // Read up to limit.
    while valid_len < HEADER_LIMIT {
        let n = reader.read(&mut buffer[valid_len..]).map_err(Error::Io)?;
        if n == 0 {
            break;
        }
        valid_len = valid_len.checked_add(n).ok_or(Error::Overflow)?;
    }
    buffer.truncate(valid_len);

    let n1 = memchr(b'\n', &buffer).ok_or(Error::InvalidCommentHeader)?;
    let n2_start = n1.checked_add(1).ok_or(Error::Overflow)?;
    let n2 = memchr(b'\n', &buffer[n2_start..]).ok_or(Error::MissingSignatureNewline)?;
    let b64_start = n2_start;
    let b64_end = b64_start.checked_add(n2).ok_or(Error::Overflow)?;

    if b64_end > buffer.len() {
        return Err(Error::InvalidCommentHeader);
    }

    let b64_bytes = &buffer[b64_start..b64_end];
    let b64_str = str::from_utf8(b64_bytes).map_err(|_e| Error::InvalidSignatureUtf8)?;
    let sig_bytes = Base64::decode_vec(b64_str.trim()).map_err(Error::Base64Decode)?;
    let sig_obj = Sig::from_bytes(&sig_bytes)?;

    let msg_start = b64_end.checked_add(1).ok_or(Error::Overflow)?;

    // Construct prelude: (buffer[msg_start..]).
    let prelude = if msg_start < buffer.len() {
        buffer[msg_start..].to_vec()
    } else {
        Vec::new()
    };

    Ok((sig_obj, prelude, reader))
}

/// Check a list of checksums.
///
/// # Errors
///
/// Returns `Error::Io` on file I/O errors.
/// Returns `Error::KeyMismatch` if keynum mismatch.
/// Returns `Error::VerifyFailed` if signature verification fails.
/// Returns `Error::CheckFailed` if one or more checksums fail verification.
pub fn check_checksums(pubkey_path: &Path, sig_path: &Path, quiet: bool) -> Result<()> {
    let (sig, mut prelude, mut reader) = parse_embedded_signature(sig_path)?;
    reader.read_to_end(&mut prelude).map_err(Error::Io)?;
    let msg = prelude;

    let (pub_key_obj, _) = parse::<PubKey, _>(pubkey_path, PubKey::from_bytes)?;

    if sig.keynum != pub_key_obj.keynum {
        return Err(Error::KeyMismatch);
    }

    crypto::verify(&msg, &pub_key_obj.pubkey, &sig.sig)?;

    let mut failed = false;
    for line in msg.split(|&b| b == b'\n') {
        let trimmed = line.trim_ascii();
        if trimmed.is_empty() {
            continue;
        }

        if !verify_checksum_line(trimmed, quiet) {
            failed = true;
        }
    }

    if failed {
        Err(Error::CheckFailed)
    } else {
        Ok(())
    }
}

/// Verify a single line from a checksum file.
#[must_use]
pub fn verify_checksum_line(line: &[u8], quiet: bool) -> bool {
    // Parse "ALGO (FILENAME) = HASH" -> Find " = ".
    let marker = b" = ";
    let Some(idx) = memmem::find(line, marker) else {
        return true;
    };

    let left = &line[..idx];
    let Some(right_start) = idx.checked_add(marker.len()) else {
        return false;
    };
    let right = &line[right_start..];
    let hash_str = right.trim_ascii();

    // Parse left: "ALGO (FILENAME)" -> Find first space.
    let Some(space_idx) = memchr::memchr(b' ', left) else {
        return true;
    };
    let algo = &left[..space_idx];
    let Some(rest_start) = space_idx.checked_add(1) else {
        return false;
    };
    let rest = &left[rest_start..];

    // Rest should be "(FILENAME)"
    if rest.len() < 2 || rest.first() != Some(&b'(') || rest.last() != Some(&b')') {
        return true;
    }
    let Some(filename_len) = rest.len().checked_sub(1) else {
        return false;
    };

    let filename = match std::str::from_utf8(&rest[1..filename_len]) {
        Ok(filename) => filename,
        Err(error) => {
            println!("?: FAIL: {error}");
            return false;
        }
    };
    let filepath = Path::new(filename);
    let filename = log_untrusted_buf(filename.as_bytes());

    if !filepath.exists() {
        println!("{filename}: FAIL");
        return false;
    }

    // Use 64KB buffer.
    const BUF_SIZE: usize = 64 * 1024;
    let mut buf = [0_u8; BUF_SIZE];

    let calculated_hash = match algo {
        b"SHA256" => {
            let mut hasher = Sha256::new();
            if let Ok(file) = OpenOptions::new().read(true).open(filepath) {
                let mut reader = BufReader::with_capacity(BUF_SIZE, file);
                loop {
                    match reader.read(&mut buf) {
                        Ok(0) => break,
                        Ok(n) => hasher.update(&buf[..n]),
                        Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
                        Err(_) => {
                            println!("{filename}: FAIL");
                            return false;
                        }
                    }
                }
                HEXLOWER.encode(&hasher.finalize())
            } else {
                println!("{filename}: FAIL");
                return false;
            }
        }
        b"SHA512" => {
            let mut hasher = Sha512::new();
            if let Ok(file) = OpenOptions::new().read(true).open(filepath) {
                let mut reader = BufReader::with_capacity(BUF_SIZE, file);
                loop {
                    match reader.read(&mut buf) {
                        Ok(0) => break,
                        Ok(n) => hasher.update(&buf[..n]),
                        Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
                        Err(_) => {
                            println!("{filename}: FAIL");
                            return false;
                        }
                    }
                }
                HEXLOWER.encode(&hasher.finalize())
            } else {
                println!("{filename}: FAIL");
                return false;
            }
        }
        _ => {
            println!("{filename}: FAIL");
            return false;
        }
    };

    if calculated_hash.as_bytes().eq_ignore_ascii_case(hash_str) {
        if !quiet {
            println!("{filename}: OK");
        }
        true
    } else {
        println!("{filename}: FAIL");
        false
    }
}

/// Helper to read gzip header.
fn read_gzip_header(sig_file: &mut dyn Read) -> Result<GzipHeader> {
    let mut head = [0u8; 10];
    sig_file.read_exact(&mut head).map_err(Error::Io)?;

    if head[0] != 0x1f || head[1] != 0x8b {
        return Err(Error::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            "Not a gzip file",
        )));
    }
    let flg = head[3];
    if (flg & 16) == 0 {
        return Err(Error::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            "Unsigned gzip archive (no comment)",
        )));
    }

    // Skip extra, name if present.
    let mut extra_field = Vec::new();
    if (flg & 4) != 0 {
        let mut xlen_b = [0u8; 2];
        sig_file.read_exact(&mut xlen_b).map_err(Error::Io)?;
        extra_field.extend_from_slice(&xlen_b);
        let xlen = u64::from(u16::from_le_bytes(xlen_b));
        let mut reader = sig_file.take(xlen);
        reader.read_to_end(&mut extra_field).map_err(Error::Io)?;
    }

    let mut name_field = Vec::new();
    if (flg & 8) != 0 {
        let mut buf = [0u8; 1];
        loop {
            sig_file.read_exact(&mut buf).map_err(Error::Io)?;
            name_field.push(buf[0]);
            if buf[0] == 0 {
                break;
            }
        }
    }

    // Read comment.
    let mut comment_vec = Vec::new();
    let mut buf = [0u8; 1];
    loop {
        sig_file.read_exact(&mut buf).map_err(Error::Io)?;
        if buf[0] == 0 {
            break;
        }
        comment_vec.push(buf[0]);
    }

    Ok(GzipHeader {
        flg,
        head,
        extra_field,
        name_field,
        comment_vec,
    })
}

/// Sign a gzip file.
pub fn sign_gzip(
    seckey: &[u8],
    keynum: [u8; 8],
    seckey_path: &Path,
    msg_path: &Path,
    sig_path: &Path,
    comment_bytes: &[u8],
) -> Result<()> {
    let is_stdout = sig_path.as_os_str() == "-";
    let is_stdin = msg_path.as_os_str() == "-";

    if is_stdin {
        return Err(Error::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidInput,
            "Gzip signing requires a regular file input (not stdin)",
        )));
    }

    let mut f = OpenOptions::new()
        .read(true)
        .open(msg_path)
        .map_err(Error::Io)?;

    let (head, data_start) = parse_gzip_for_signing(&mut f)?;

    // Pass 1: Hash.
    let (header_msg, _) = hash_gzip_content(&mut f, data_start, seckey_path)?;

    // Sign.
    let kp = ed25519_compact::KeyPair {
        pk: ed25519_compact::PublicKey::from_slice(&seckey[32..]).map_err(Error::Crypto)?,
        sk: ed25519_compact::SecretKey::from_slice(seckey).map_err(Error::Crypto)?,
    };
    let sig = kp
        .sk
        .sign(&header_msg, Some(ed25519_compact::Noise::default()));

    let sig_comment = make_sig_comment(seckey_path, comment_bytes)?;

    let sig_header = {
        let sig_obj = Sig {
            pkalg: PKALG,
            keynum,
            sig: sig
                .as_ref()
                .try_into()
                .map_err(|_| Error::InvalidSignatureLength)?, // Safe: Fixed length
        };
        let encoded = Base64::encode_string(&sig_obj.to_bytes());
        let mut h = Vec::new();
        h.extend_from_slice(COMMENTHDR.as_bytes());
        h.extend_from_slice(&sig_comment);
        h.push(b'\n');
        h.extend_from_slice(encoded.as_bytes());
        h.push(b'\n');
        h
    };

    let mut out: Box<dyn Write> = if is_stdout {
        Box::new(stdout())
    } else {
        Box::new(
            OpenOptions::new()
                .write(true)
                .create_new(true)
                .open(sig_path)
                .map_err(Error::Io)?,
        )
    };

    write_signed_gzip(
        &mut out,
        &head,
        &sig_header,
        &header_msg,
        &mut f,
        data_start,
    )
}

fn parse_gzip_for_signing(f: &mut std::fs::File) -> Result<([u8; 10], u64)> {
    let mut head = [0u8; 10];
    f.read_exact(&mut head).map_err(Error::Io)?;

    if head[0] != 0x1f || head[1] != 0x8b {
        return Err(Error::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            "Not a gzip file",
        )));
    }

    let flg = head[3];
    if (flg & 4) != 0 {
        let mut xlen_b = [0u8; 2];
        f.read_exact(&mut xlen_b).map_err(Error::Io)?;
        let xlen = i64::from(u16::from_le_bytes(xlen_b));
        f.seek(SeekFrom::Current(xlen)).map_err(Error::Io)?;
    }

    if (flg & 8) != 0 {
        let mut buf = [0u8; 1];
        loop {
            f.read_exact(&mut buf).map_err(Error::Io)?;
            if buf[0] == 0 {
                break;
            }
        }
    }

    if (flg & 16) != 0 {
        let mut buf = [0u8; 1];
        loop {
            f.read_exact(&mut buf).map_err(Error::Io)?;
            if buf[0] == 0 {
                break;
            }
        }
    }

    if (flg & 2) != 0 {
        f.seek(SeekFrom::Current(2)).map_err(Error::Io)?;
    }

    let data_start = f.stream_position().map_err(Error::Io)?;
    Ok((head, data_start))
}

fn hash_gzip_content(
    f: &mut std::fs::File,
    data_start: u64,
    seckey_path: &Path,
) -> Result<(Vec<u8>, usize)> {
    const BLK_SIZE: usize = 0x0001_0000;
    let mut block = vec![0u8; BLK_SIZE];

    // Scan passes.
    loop {
        match f.read(&mut block) {
            Ok(0) => break,
            Ok(_) => continue,
            Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
            Err(e) => return Err(Error::Io(e)),
        }
    }

    let mut header_msg = Vec::new();
    let time_now = "0000-00-00T00:00:00Z";
    let keyname = if seckey_path.as_os_str() == "-" {
        "stdin"
    } else {
        seckey_path.to_str().ok_or(Error::InvalidPath)?
    };
    write!(
        &mut header_msg,
        "date={time_now}\nkey={keyname}\nalgorithm=SHA256\nblocksize={BLK_SIZE}\n\n",
    )
    .map_err(Error::Io)?;

    f.seek(SeekFrom::Start(data_start)).map_err(Error::Io)?;
    loop {
        match f.read(&mut block) {
            Ok(0) => break,
            Ok(n) => {
                let hash = Sha256::digest(&block[..n]);
                let hex = HEXLOWER.encode(&hash);
                header_msg.extend_from_slice(hex.as_bytes());
                header_msg.push(b'\n');
            }
            Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
            Err(e) => return Err(Error::Io(e)),
        }
    }

    Ok((header_msg, BLK_SIZE))
}

fn write_signed_gzip(
    out: &mut dyn Write,
    head: &[u8; 10],
    sig_header: &[u8],
    header_msg: &[u8],
    input: &mut std::fs::File,
    data_start: u64,
) -> Result<()> {
    let fake_header = [0x1f, 0x8b, 8, 16, 0, 0, 0, 0, head[8], 3];
    out.write_all(&fake_header).map_err(Error::Io)?;
    out.write_all(sig_header).map_err(Error::Io)?;
    out.write_all(header_msg).map_err(Error::Io)?;
    out.write_all(&[0u8]).map_err(Error::Io)?;

    input.seek(SeekFrom::Start(data_start)).map_err(Error::Io)?;
    copy(input, out).map_err(Error::Io)?;
    Ok(())
}

/// Verify a gzip signature.
pub fn verify_gzip(
    pubkey: Option<&Path>,
    msg_path: &Path,
    sig_path: &Path,
    quiet: bool,
) -> Result<()> {
    let mut sig_file: Box<dyn Read> = if sig_path.as_os_str() == "-" {
        Box::new(stdin())
    } else {
        Box::new(
            OpenOptions::new()
                .read(true)
                .open(sig_path)
                .map_err(Error::Io)?,
        )
    };

    let header = read_gzip_header(sig_file.as_mut())?;

    // Parse signature from comment.
    let (sig_obj, header_list) = parse_sig_from_comment(&header.comment_vec)?;

    // Verify signature of header list.
    let pub_key_obj = if let Some(path) = pubkey {
        let (pk, _) = parse::<PubKey, _>(path, PubKey::from_bytes)?;
        pk
    } else {
        autolocate_key(&header.comment_vec)?
    };

    if sig_obj.keynum != pub_key_obj.keynum {
        return Err(Error::KeyMismatch);
    }
    crypto::verify(header_list, &pub_key_obj.pubkey, &sig_obj.sig)?;

    // Parse header lines.
    let header_str = str::from_utf8(header_list).map_err(|_| Error::InvalidCommentHeader)?;
    let mut lines = header_str.lines();
    let blocksize = parse_header_metadata(&mut lines)?;

    // Output setup.
    let mut out_writer: Option<Box<dyn Write>> = if msg_path.as_os_str() == "-" {
        Some(Box::new(stdout()))
    } else {
        Some(Box::new(
            OpenOptions::new()
                .write(true)
                .create_new(true)
                .open(msg_path)
                .map_err(Error::Io)?,
        ))
    };

    // Write header.
    if let Some(w) = out_writer.as_mut() {
        w.write_all(&header.head).map_err(Error::Io)?;
        if !header.extra_field.is_empty() {
            w.write_all(&header.extra_field).map_err(Error::Io)?;
        }
        if !header.name_field.is_empty() {
            w.write_all(&header.name_field).map_err(Error::Io)?;
        }
        w.write_all(&header.comment_vec).map_err(Error::Io)?;
        w.write_all(&[0u8]).map_err(Error::Io)?;
    }

    if (header.flg & 2) != 0 {
        let mut crc = [0u8; 2];
        sig_file.read_exact(&mut crc).map_err(Error::Io)?;
        if let Some(w) = out_writer.as_mut() {
            w.write_all(&crc).map_err(Error::Io)?;
        }
    }

    verify_payload_blocks(sig_file.as_mut(), lines, blocksize, out_writer.as_mut())?;

    if !quiet {
        eprintln!("Signature Verified");
    }
    Ok(())
}

fn parse_sig_from_comment(comment_vec: &[u8]) -> Result<(Sig, &[u8])> {
    let n1 = memchr(b'\n', comment_vec).ok_or(Error::InvalidCommentHeader)?;
    let n2_start = n1.checked_add(1).ok_or(Error::Overflow)?;
    let n2 = memchr(b'\n', &comment_vec[n2_start..]).ok_or(Error::MissingSignatureNewline)?;
    let sig_end = n2_start.checked_add(n2).ok_or(Error::Overflow)?;

    let header_list = &comment_vec[sig_end.checked_add(1).ok_or(Error::Overflow)?..];

    let b64_bytes = &comment_vec[n2_start..sig_end];
    let b64_str = str::from_utf8(b64_bytes).map_err(|_e| Error::InvalidSignatureUtf8)?;
    let sig_bytes = Base64::decode_vec(b64_str.trim()).map_err(Error::Base64Decode)?;
    let sig_obj = Sig::from_bytes(&sig_bytes)?;

    Ok((sig_obj, header_list))
}

fn parse_header_metadata(lines: &mut std::str::Lines) -> Result<usize> {
    let mut algo = "SHA256";
    let mut blocksize = 0x0001_0000;

    for l in lines.by_ref() {
        if l.is_empty() {
            break;
        }
        if let Some(val) = l.strip_prefix("algorithm=") {
            algo = val;
        } else if let Some(val) = l.strip_prefix("blocksize=") {
            blocksize = val.parse().unwrap_or(0x0001_0000);
        }
    }

    if algo != "SHA256" && algo != "SHA512/256" {
        return Err(Error::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            format!("Unsupported algorithm: {algo}"),
        )));
    }
    Ok(blocksize)
}

fn verify_payload_blocks(
    sig_file: &mut dyn Read,
    lines: std::str::Lines,
    blocksize: usize,
    mut out_writer: Option<&mut Box<dyn Write>>,
) -> Result<()> {
    let mut buf = vec![0u8; blocksize];
    for hash_line in lines {
        let n = loop {
            match sig_file.read(&mut buf) {
                Ok(n) => break n,
                Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
                Err(e) => return Err(Error::Io(e)),
            }
        };

        if n == 0 {
            return Err(Error::Io(std::io::Error::new(
                std::io::ErrorKind::UnexpectedEof,
                "Premature end of archive",
            )));
        }
        let hash = Sha256::digest(&buf[..n]);
        let hash_hex = HEXLOWER.encode(&hash);

        if hash_hex != hash_line {
            return Err(Error::VerifyFailed);
        }
        if let Some(w) = out_writer.as_mut() {
            w.write_all(&buf[..n]).map_err(Error::Io)?;
        }
    }

    // Ensure EOF.
    let n = loop {
        match sig_file.read(&mut buf) {
            Ok(n) => break n,
            Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
            Err(e) => return Err(Error::Io(e)),
        }
    };
    if n != 0 {
        return Err(Error::Io(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            "Trailing data in archive",
        )));
    }
    Ok(())
}

fn make_sig_comment(seckey_path: &Path, comment_bytes: &[u8]) -> Result<Vec<u8>> {
    let mut sig_comment = Vec::new();
    if seckey_path.as_os_str() == "-" {
        sig_comment.extend_from_slice(b"signature from ");
        sig_comment.extend_from_slice(comment_bytes);
    } else {
        let basename = check_keyname_compliance(None, seckey_path)?;
        sig_comment.extend_from_slice(b"verify with ");
        sig_comment.extend_from_slice(basename.as_bytes());
        sig_comment.extend_from_slice(b".pub");
    };
    Ok(sig_comment)
}