jsign 0.0.1

data/lib/jsign.rb

@@ -0,0 +1,79 @@
+# encoding: utf-8
+
+require 'tempfile'
+require 'base64'
+require 'openssl'
+
+
+module Jsign
+
+  class << self
+
+    def check_for_keyfile!(key_filename)
+      raise "Key #{key_filename.inspect} doesn't exist!" unless
+        File.file?(key_filename)
+    end
+    private :check_for_keyfile!
+
+
+    # Given a json serialisation of a hash, return another json
+    # serialisation which includes a key "_jsign" and a value which is
+    # the Base64-encoded signature of the *original* json. Well,
+    # nearly - any internal whitespace after the last value in the
+    # original json is stripped.
+    #
+    # @param [String] json The json serialisation to sign.
+    # @param [String] key_filename The filename of the private key to
+    #  sign with.
+    # @return [String] another json string containing the signature,
+    #  which can be passed to Jsign.verify.
+    def sign(json, key_filename)
+      check_for_keyfile!(key_filename)
+
+      # Remove any whitespace inside the last bracket.
+      stripped_json = json.sub(/\s+}\Z/, "}")
+      sig = ""
+      # Use openssl -sha256 to do the signing. This will probably
+      # be configurable in a future version, but it'll do for now
+      digest = OpenSSL::Digest::SHA256.new
+      key = OpenSSL::PKey::RSA.new(File.read(key_filename))
+      sig = key.sign(digest, stripped_json)
+
+      # Use the urlsafe version so we don't get newline literals
+      enc_sig = Base64.urlsafe_encode64(sig).strip
+      return stripped_json.sub(/}\Z/, %Q[,"_jsign":"#{enc_sig}"}])
+    end
+
+
+    # Given a string of json and the filename of a public key,
+    # see if the json string contains a signature which the public
+    # key validates.  This doesn't actually do any JSON decoding.
+    #
+    # @param [String] json The putative JSON string
+    # @param [String] pubkey_filename The filename of the public key
+    # @return [Boolean] true if the public key validates the
+    #   signature, false otherwise.
+    def verify(json, pubkey_filename)
+      check_for_keyfile!(pubkey_filename)
+      
+      # Note that we mirror the whitespace stripping here:
+      # this is so that we have a chance to survive being 
+      # deserialised and reserialised.
+      if m = json.match(/\A(.+?)\s*,"_jsign":"([^"]+)"}/)
+        enc_sig = m[2]
+
+        sig = Base64.urlsafe_decode64(enc_sig)
+        reconstructed_json = m[1]+"}"
+
+        digest = OpenSSL::Digest::SHA256.new
+        key = OpenSSL::PKey::RSA.new(File.read(pubkey_filename))
+        return key.verify(digest, sig, reconstructed_json)
+        
+      else
+        return false
+      end
+    end
+
+
+  end # class << self
+end # module Jsign

data/lib/jsign.rb~

@@ -0,0 +1,96 @@
+# encoding: utf-8
+
+require 'tempfile'
+require 'base64'
+
+
+module Jsign
+
+  class << self
+
+    def check_for_openssl!
+      raise "Can't find the openssl command!" unless
+        system "which openssl > /dev/null"
+    end
+    private :check_for_openssl!
+    
+    def check_for_keyfile!(key_filename)
+      raise "Key #{key_filename.inspect} doesn't exist!" unless
+        File.file?(key_filename)
+    end
+    private :check_for_keyfile!
+
+
+    # Given a json serialisation of a hash, return another json
+    # serialisation which includes a key "_jsign" and a value which is
+    # the Base64-encoded signature of the *original* json. Well,
+    # nearly - any internal whitespace after the last value in the
+    # original json is stripped.
+    #
+    # @param [String] json The json serialisation to sign.
+    # @param [String] key_filename The filename of the private key to
+    #  sign with.
+    # @return [String] another json string containing the signature,
+    #  which can be passed to Jsign.verify.
+    def sign(json, key_filename)
+      check_for_openssl!
+      check_for_keyfile!(key_filename)
+
+      # Remove any whitespace inside the last bracket.
+      stripped_json = json.sub(/\s+}\Z/, "}")
+      sig = ""
+      # Use openssl -sha256 to do the signing. This will probably
+      # be configurable in a future version, but it'll do for now
+      IO.popen("openssl dgst -sha256 -sign #{key_filename}","r+"){|f|
+        f.write stripped_json
+        f.close_write
+        sig = f.read.strip
+      }
+      # Use the urlsafe version so we don't get newline literals
+      enc_sig = Base64.urlsafe_encode64(sig).strip
+      return stripped_json.sub(/}\Z/, %Q[,"_jsign":"#{enc_sig}"}])
+    end
+
+
+    # Given a string of json and the filename of a public key,
+    # see if the json string contains a signature which the public
+    # key validates.  This doesn't actually do any JSON decoding.
+    #
+    # @param [String] json The putative JSON string
+    # @param [String] pubkey_filename The filename of the public key
+    # @return [Boolean] true if the public key validates the
+    #   signature, false otherwise.
+    def verify(json, pubkey_filename)
+      check_for_openssl!
+      check_for_keyfile!(pubkey_filename)
+      
+      # Note that we mirror the whitespace stripping here:
+      # this is so that we have a chance to survive being 
+      # deserialised and reserialised.
+      if m = json.match(/\A(.+?)\s*,"_jsign":"([^"]+)"}/)
+        # Write the signature out to a tempfile. We can't
+        # use -hex with openssl because it doesn't seem to
+        # support verifying with it.
+        Tempfile.open("jsign") do |tempfile|
+          enc_sig = m[2]
+          tempfile.write(Base64.urlsafe_decode64(enc_sig))
+          tempfile.close
+          reconstructed_json = m[1]+"}"
+          IO.popen(%W{openssl dgst -sha256 
+                    -verify #{pubkey_filename}
+                    -signature #{tempfile.path}}, "r+"){|f|
+            f.write( reconstructed_json )
+            f.close_write
+            msg = f.read().strip
+            return msg == "Verified OK"
+          }
+        end
+        
+      else
+        return false
+      end
+    end
+
+
+  end # class << self
+end # module Jsign

data/lib/jsign/version.rb

@@ -0,0 +1,5 @@
+# encoding: utf-8
+
+module Jsign
+  VERSION="0.0.1"
+end

metadata

@@ -0,0 +1,62 @@
+--- !ruby/object:Gem::Specification
+name: jsign
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+  prerelease: 
+platform: ruby
+authors:
+- Alex Young
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2011-06-05 00:00:00.000000000 +01:00
+default_executable: 
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: &21390960 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: *21390960
+description: Jsign uses OpenSSL to sign JSON serialisations. The signed objects are
+  valid JSON objects themselves.
+email:
+- alex@blackkettle.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/jsign/version.rb
+- lib/jsign.rb
+- lib/jsign.rb~
+has_rdoc: true
+homepage: http://github.com/regularfry/jsign
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: jsign
+rubygems_version: 1.6.2
+signing_key: 
+specification_version: 3
+summary: Make and verify signed JSON objects.
+test_files: []