minisign 0.0.3 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab99f429385b0f4e6588f199322c1d3b4f0e74fc3653d44d9b7e3be64a16c1a4
-  data.tar.gz: 87d81af21c0f8dfe4cd90846f921014dcc7383ea7a09ee5811ff22102fc3a8ba
+  metadata.gz: 8dd11c61143149fd612a6c08a084a4e5831ec66f860c6a706edea18fc53bec00
+  data.tar.gz: f7b6013996e7e72b35ad8c500e2bf5d24ebc2a9abe0d1d09bda86cfaca2d4ba8
 SHA512:
-  metadata.gz: d2009870037a601e9417f2ea753486aa5a9b1dcca7effb7293924649978320992969c28113056953e95afeb854f05f25b1738e3dd5af203346a66b325d013884
-  data.tar.gz: 771fa8348725c66211b95eff9e3790c0a57dfa8bcd67fafeaebe2276982a8704e69763f3a62d273192ee813449b44e72ebe22ff424ad7efd28df6c2d0a7e2366
+  metadata.gz: 615740c7d8fde14c2de494b2f7f9d28ebfaff2cb583210e29ee18573b97180d2a3d1ff3631085cdb53803d35a08cd31d01457c321a45d6d8b684849bcf69cb08
+  data.tar.gz: d89f2cace36de94f4909420161a120888a929b3a097b00cbfa33e7081f7dcb15bacd93ca21be52df9f36009c5b3f1455b75dd49c29c99c3299d6130c8561a8b7

data/lib/minisign.rb

@@ -4,35 +4,94 @@ require 'ed25519'
 require 'base64'
 require 'openssl'
 
+# `minisign` is a rubygem for verifying {https://jedisct1.github.io/minisign minisign} signatures.
+# @author Jesse Shawl
 module Minisign
   # Parse a .minisig file's contents
   class Signature
-    attr_reader :signature, :comment, :comment_signature
-
+    # @param str [String] The contents of the .minisig file
+    # @example
+    #   Minisign::Signature.new(File.read('test/example.txt.minisig'))
     def initialize(str)
-      lines = str.split("\n")
-      @signature = Base64.decode64(lines[1])[10..]
-      @comment = lines[2].split('trusted comment: ')[1]
-      @comment_signature = Base64.decode64(lines[3])
+      @lines = str.split("\n")
+    end
+
+    # @return [String] the key id
+    # @example
+    #   Minisign::Signature.new(File.read('test/example.txt.minisig')).key_id
+    #   #=> "E86FECED695E8E0"
+    def key_id
+      encoded_signature[2..9].bytes.map { |c| c.to_s(16) }.reverse.join.upcase
+    end
+
+    # @return [String] the trusted comment
+    # @example
+    #   Minisign::Signature.new(File.read('test/example.txt.minisig')).trusted_comment
+    #   #=> "timestamp:1653934067\tfile:example.txt\thashed"
+    def trusted_comment
+      @lines[2].split('trusted comment: ')[1]
+    end
+
+    def trusted_comment_signature
+      Base64.decode64(@lines[3])
+    end
+
+    # @return [String] the signature
+    def signature
+      encoded_signature[10..]
+    end
+
+    private
+
+    def encoded_signature
+      Base64.decode64(@lines[1])
     end
   end
 
   # Parse ed25519 verify key from minisign public key
   class PublicKey
+    # Parse the ed25519 verify key from the minisign public key
+    #
+    # @param str [String] The minisign public key
+    # @example
+    #   Minisign::PublicKey.new('RWTg6JXWzv6GDtDphRQ/x7eg0LaWBcTxPZ7i49xEeiqXVcR+r79OZRWM')
     def initialize(str)
-      @public_key = Base64.strict_decode64(str)[10..]
+      @decoded = Base64.strict_decode64(str)
+      @public_key = @decoded[10..]
       @verify_key = Ed25519::VerifyKey.new(@public_key)
     end
 
+    # @return [String] the key id
+    # @example
+    #   Minisign::PublicKey.new('RWTg6JXWzv6GDtDphRQ/x7eg0LaWBcTxPZ7i49xEeiqXVcR+r79OZRWM').key_id
+    #   #=> "E86FECED695E8E0"
+    def key_id
+      @decoded[2..9].bytes.map { |c| c.to_s(16) }.reverse.join.upcase
+    end
+
+    # Verify a message's signature
+    #
+    # @param sig [Minisign::Signature]
+    # @param message [String] the content that was signed
+    # @return [String] the trusted comment
+    # @raise Ed25519::VerifyError on invalid signatures
+    # @raise RuntimeError on tampered trusted comments
     def verify(sig, message)
       blake = OpenSSL::Digest.new('BLAKE2b512')
+      ensure_matching_key_ids(sig.key_id, key_id)
       @verify_key.verify(sig.signature, blake.digest(message))
       begin
-        @verify_key.verify(sig.comment_signature, sig.signature + sig.comment)
+        @verify_key.verify(sig.trusted_comment_signature, sig.signature + sig.trusted_comment)
       rescue Ed25519::VerifyError
         raise 'Comment signature verification failed'
       end
-      "Signature and comment signature verified\nTrusted comment: #{sig.comment}"
+      "Signature and comment signature verified\nTrusted comment: #{sig.trusted_comment}"
+    end
+
+    private
+
+    def ensure_matching_key_ids(key_id1, key_id2)
+      raise "Signature key id is #{key_id1}\nbut the key id in the public key is #{key_id2}" unless key_id1 == key_id2
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: minisign
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.7
 platform: ruby
 authors:
 - Jesse Shawl
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-30 00:00:00.000000000 Z
+date: 2022-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519
@@ -34,7 +34,8 @@ files:
 homepage: https://rubygems.org/gems/minisign
 licenses:
 - MIT
-metadata: {}
+metadata:
+  rubygems_mfa_required: 'true'
 post_install_message: 
 rdoc_options: []
 require_paths: