libsignify_rs/

signify.rs

//
// signify-rs: cryptographically sign and verify files
// signify-rs: cryptographically sign and verify files
// src/signify.rs: Configuration and Mode definitions
//
// Copyright (c) 2025, 2026 Ali Polatel <alip@chesswob.org>
// SPDX-License-Identifier: ISC
//

use crate::crypto;
use crate::error::{Error, Result};
use crate::ops::{check_checksums, KeyGenerator, Signer, Verifier};
use std::path::PathBuf;

/// Operation mode.
#[derive(Debug, PartialEq, Eq, Clone, Copy)]
pub enum Mode {
    /// Check signatures.
    Check,
    /// Generate key pair.
    Generate,
    /// Sign a file.
    Sign,
    /// Verify a signature.
    Verify,
}

/// Runtime configuration.
///
/// This struct holds all configuration options parsed from command-line arguments
/// or set programmatically.
///
/// # Examples
///
/// ```
/// use libsignify_rs::signify::{Signify, Mode};
/// use std::path::PathBuf;
///
/// let mut signify = Signify::default();
/// signify.mode = Some(Mode::Sign);
/// signify.seckey = Some(PathBuf::from("key.sec"));
/// signify.embed = true;
///
/// assert_eq!(signify.mode, Some(Mode::Sign));
/// assert!(signify.embed);
/// ```
#[derive(Default, Debug, Clone)]
pub struct Signify {
    /// Operation mode.
    pub mode: Option<Mode>,
    /// Comment for key generation.
    pub comment: Option<String>,
    /// Embedding mode flag.
    pub embed: bool,
    /// Message file path.
    pub msg_file: Option<PathBuf>,
    /// No password flag.
    pub nopass: bool,
    /// Public key path.
    pub pubkey: Option<PathBuf>,
    /// Quiet mode flag.
    pub quiet: bool,
    /// Secret key path.
    pub seckey: Option<PathBuf>,
    /// Signature file path.
    pub sig_file: Option<PathBuf>,
    /// Gzip mode flag.
    pub gzip: bool,
    /// Key ID for keyring lookup.
    pub key_id: Option<i32>,
    /// Positional arguments.
    pub args: Vec<PathBuf>,
}

impl Signify {
    /// Execute the requested operation based on configuration.
    ///
    /// # Errors
    /// Returns errors if the operation fails or arguments are missing.
    pub fn execute(&self) -> Result<()> {
        match self.mode {
            Some(Mode::Generate) => self.execute_generate(),
            Some(Mode::Sign) => self.execute_sign(),
            Some(Mode::Verify) => self.execute_verify(),
            Some(Mode::Check) => self.execute_check(),
            None => Err(Error::MissingMode),
        }
    }

    fn execute_generate(&self) -> Result<()> {
        let pubkey_path = self
            .pubkey
            .clone()
            .unwrap_or_else(|| PathBuf::from("key.pub"));
        let seckey_path = self
            .seckey
            .clone()
            .unwrap_or_else(|| PathBuf::from("key.sec"));
        let rounds = if self.nopass {
            0
        } else {
            crypto::DEFAULT_ROUNDS
        };
        let comment = self.comment.as_deref().unwrap_or("signify key");

        let mut generator = KeyGenerator::new().rounds(rounds).comment(comment);
        if let Some(id) = self.key_id {
            generator = generator.key_id(id);
        }
        generator.generate(&pubkey_path, &seckey_path)
    }

    fn execute_sign(&self) -> Result<()> {
        let Some(seckey_path) = &self.seckey else {
            return Err(Error::RequiredArg("-s"));
        };

        let Some(msg_path) = &self.msg_file else {
            return Err(Error::Arg("missing -m".into()));
        };

        let sig_path = self.sig_file.clone().unwrap_or_else(|| {
            let mut path = msg_path.clone();
            path.set_extension("sig");
            path
        });

        let mut signer = Signer::new()
            .seckey(seckey_path)
            .embed(self.embed)
            .gzip(self.gzip);

        if let Some(id) = self.key_id {
            signer = signer.key_id(id);
        }

        signer.sign(msg_path, &sig_path)
    }

    fn execute_verify(&self) -> Result<()> {
        let (msg_path, sig_path) = if self.gzip {
            let sig = self
                .sig_file
                .clone()
                .or_else(|| self.args.first().cloned())
                .unwrap_or_else(|| PathBuf::from("-"));
            let msg = self.msg_file.clone().unwrap_or_else(|| PathBuf::from("-"));
            (msg, sig)
        } else {
            let msg = if self.embed {
                self.msg_file.clone().unwrap_or_else(|| {
                    self.sig_file.as_ref().map_or_else(
                        || PathBuf::from("msg.out"),
                        |sig| {
                            let mut path = sig.clone();
                            path.set_extension("");
                            path
                        },
                    )
                })
            } else if let Some(msg) = &self.msg_file {
                msg.clone()
            } else {
                return Err(Error::Arg("missing -m".into()));
            };

            let sig = self
                .sig_file
                .clone()
                .or_else(|| self.args.first().cloned())
                .unwrap_or_else(|| {
                    let mut path = msg.clone();
                    if let Some(ext) = path.extension() {
                        let mut ext_str = ext.to_os_string();
                        ext_str.push(".sig");
                        path.set_extension(ext_str);
                    } else {
                        path.set_extension("sig");
                    }
                    path
                });
            (msg, sig)
        };

        let mut verifier = Verifier::new()
            .quiet(self.quiet)
            .embed(self.embed)
            .gzip(self.gzip);

        if let Some(path) = &self.pubkey {
            verifier = verifier.pubkey(path);
        }

        verifier.verify(&msg_path, &sig_path)
    }

    fn execute_check(&self) -> Result<()> {
        let Some(pubkey_path) = &self.pubkey else {
            return Err(Error::RequiredArg("-p"));
        };

        let Some(sig_path) = &self.sig_file else {
            return Err(Error::RequiredArg("-x"));
        };

        check_checksums(pubkey_path, sig_path, self.quiet)
    }
}