Crate voa_openpgp

Crate voa_openpgp 

Source
Expand description

§VOA-OpenPGP

A library for using OpenPGP verifiers in VOA.

⚠️ DO NOT USE IN PRODUCTION: This VOA backend is still in an early experimental development stage.

See https://uapi-group.org/specifications/specs/file_hierarchy_for_the_verification_of_os_artifacts/#openpgp

§Documentation

§Examples

§Import

OpenPGP certificates can be written to their dedicated directory structures in a VOA hierarchy.

It is supported to import single binary or ASCII-armored files, as well as directory structures that contain a number of OpenPGP packet files which comprise an OpenPGP certificate when concatenated (this structured form is in use by the archlinux-keyring project).

use voa_core::VerifierWriter;
use voa_openpgp::OpenPgpImport;
use tempfile::{NamedTempFile, tempdir};

// Write a generic OpenPGP certificate to a temporary file.
let mut temp_file = NamedTempFile::new()?;
openpgp_cert()?.to_writer(&mut temp_file)?;
let input_path = temp_file.path();

// Import the OpenPGP certificate.
let import = OpenPgpImport::from_file(input_path)?;

// Prepare a temporary output directory.
let temp_dir = tempdir()?;
let output_dir = temp_dir.path();

// Write the OpenPGP verifier to a VOA hierarchy in the temporary output directory.
//
// There, the verifier is written to the configured directory, e.g.
// `os/purpose/context/openpgp/f1d2d2f924e986ac86fdf7b36c94bcdf32beec15.openpgp`
import.write_to_hierarchy(
    output_dir,
    "os".parse()?,
    "purpose".parse()?,
    Some("context".parse()?),
)?;

assert!(
    output_dir
        .join("os")
        .join("purpose")
        .join("context")
        .join("openpgp")
        .join(import.file_name())
        .exists()
);

§Verification

⚠️ DO NOT USE IN PRODUCTION: The verification mechanism in this VOA backend is still in an early experimental development stage.

Simple verification of artifacts using one or more OpenPGP signatures and verifiers from VOA is straight forward:

use std::path::PathBuf;
use voa_openpgp::{verify_from_file, OpenpgpCert, OpenpgpSignature, VoaOpenpgp};

let voa = VoaOpenpgp::new();
let certs = voa.lookup("os".parse()?, "purpose".parse()?, "context".parse()?);
let cert_refs: Vec<&OpenpgpCert> = certs.iter().collect();

verify_from_file(
    &PathBuf::from("/path/to/a/file.tar.zst"),
    &cert_refs,
    &[&OpenpgpSignature::from_file(&PathBuf::from("/path/to/a/file.tar.zst.sig"))?],
)?;

§Contributing

Please refer to the contribution guidelines to learn how to contribute to this project.

§License

This project can be used under the terms of the Apache-2.0 or MIT. Contributions to this project, unless noted otherwise, are automatically licensed under the terms of both of those licenses.

Re-exports§

pub use import::OpenPgpImport;

Modules§

import
Import of OpenPGP certificates as VOA verifiers.

Structs§

OpenpgpCert
An OpenPGP certificate for “Verification of OS Artifacts (VOA)”
OpenpgpSignature
A detached OpenPGP signature for use in VOA verification.
VoaOpenpgp
An OpenPGP-specific view of a VOA hierarchy

Enums§

Error
The error that can occur when using OpenPGP verifiers in VOA.

Functions§

verify_from_file
Verifies one or more signatures for a signed_file with one or more certs.