minisign 0.0.5 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43e641548c51311a548098b0102d122dfd770db04384fc905d8fb133e0d90feb
-  data.tar.gz: 157e8e96644b65392e1f4f20f06976ec093ab275c2c2b83a2e4ec85b57282884
+  metadata.gz: 8dd11c61143149fd612a6c08a084a4e5831ec66f860c6a706edea18fc53bec00
+  data.tar.gz: f7b6013996e7e72b35ad8c500e2bf5d24ebc2a9abe0d1d09bda86cfaca2d4ba8
 SHA512:
-  metadata.gz: 3fda3b616d567b60fbd35e9fdb825bf6ac659a0cd93c80379a8c61004d7d6e3a02dbb05cddc76db7eef046224bad82a10e335c979d574f971ea7d89c945a65be
-  data.tar.gz: 45605deb3b08e44a9f49ffd7f64aea6c511c7e24dc6fef9951bb816ce08480ab8a6ef4041b1634cd910933f2b4b84e272207249b0a0d238e9ce17d7bd82da020
+  metadata.gz: 615740c7d8fde14c2de494b2f7f9d28ebfaff2cb583210e29ee18573b97180d2a3d1ff3631085cdb53803d35a08cd31d01457c321a45d6d8b684849bcf69cb08
+  data.tar.gz: d89f2cace36de94f4909420161a120888a929b3a097b00cbfa33e7081f7dcb15bacd93ca21be52df9f36009c5b3f1455b75dd49c29c99c3299d6130c8561a8b7

data/lib/minisign.rb

@@ -9,23 +9,42 @@ require 'openssl'
 module Minisign
   # Parse a .minisig file's contents
   class Signature
-    attr_reader :signature, :comment, :comment_signature
-
-    # @!attribute [r] signature
-    #   @return [String] the ed25519 verify key
-    # @!attribute [r] comment_signature
-    #   @return [String] the signature for the trusted comment
-    # @!attribute [r] comment
-    #   @return [String] the trusted comment
-
     # @param str [String] The contents of the .minisig file
     # @example
     #   Minisign::Signature.new(File.read('test/example.txt.minisig'))
     def initialize(str)
-      lines = str.split("\n")
-      @signature = Base64.decode64(lines[1])[10..]
-      @comment = lines[2].split('trusted comment: ')[1]
-      @comment_signature = Base64.decode64(lines[3])
+      @lines = str.split("\n")
+    end
+
+    # @return [String] the key id
+    # @example
+    #   Minisign::Signature.new(File.read('test/example.txt.minisig')).key_id
+    #   #=> "E86FECED695E8E0"
+    def key_id
+      encoded_signature[2..9].bytes.map { |c| c.to_s(16) }.reverse.join.upcase
+    end
+
+    # @return [String] the trusted comment
+    # @example
+    #   Minisign::Signature.new(File.read('test/example.txt.minisig')).trusted_comment
+    #   #=> "timestamp:1653934067\tfile:example.txt\thashed"
+    def trusted_comment
+      @lines[2].split('trusted comment: ')[1]
+    end
+
+    def trusted_comment_signature
+      Base64.decode64(@lines[3])
+    end
+
+    # @return [String] the signature
+    def signature
+      encoded_signature[10..]
+    end
+
+    private
+
+    def encoded_signature
+      Base64.decode64(@lines[1])
     end
   end
 
@@ -37,10 +56,19 @@ module Minisign
     # @example
     #   Minisign::PublicKey.new('RWTg6JXWzv6GDtDphRQ/x7eg0LaWBcTxPZ7i49xEeiqXVcR+r79OZRWM')
     def initialize(str)
-      @public_key = Base64.strict_decode64(str)[10..]
+      @decoded = Base64.strict_decode64(str)
+      @public_key = @decoded[10..]
       @verify_key = Ed25519::VerifyKey.new(@public_key)
     end
 
+    # @return [String] the key id
+    # @example
+    #   Minisign::PublicKey.new('RWTg6JXWzv6GDtDphRQ/x7eg0LaWBcTxPZ7i49xEeiqXVcR+r79OZRWM').key_id
+    #   #=> "E86FECED695E8E0"
+    def key_id
+      @decoded[2..9].bytes.map { |c| c.to_s(16) }.reverse.join.upcase
+    end
+
     # Verify a message's signature
     #
     # @param sig [Minisign::Signature]
@@ -50,13 +78,20 @@ module Minisign
     # @raise RuntimeError on tampered trusted comments
     def verify(sig, message)
       blake = OpenSSL::Digest.new('BLAKE2b512')
+      ensure_matching_key_ids(sig.key_id, key_id)
       @verify_key.verify(sig.signature, blake.digest(message))
       begin
-        @verify_key.verify(sig.comment_signature, sig.signature + sig.comment)
+        @verify_key.verify(sig.trusted_comment_signature, sig.signature + sig.trusted_comment)
       rescue Ed25519::VerifyError
         raise 'Comment signature verification failed'
       end
-      "Signature and comment signature verified\nTrusted comment: #{sig.comment}"
+      "Signature and comment signature verified\nTrusted comment: #{sig.trusted_comment}"
+    end
+
+    private
+
+    def ensure_matching_key_ids(key_id1, key_id2)
+      raise "Signature key id is #{key_id1}\nbut the key id in the public key is #{key_id2}" unless key_id1 == key_id2
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: minisign
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.7
 platform: ruby
 authors:
 - Jesse Shawl
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-30 00:00:00.000000000 Z
+date: 2022-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ed25519
@@ -34,7 +34,8 @@ files:
 homepage: https://rubygems.org/gems/minisign
 licenses:
 - MIT
-metadata: {}
+metadata:
+  rubygems_mfa_required: 'true'
 post_install_message: 
 rdoc_options: []
 require_paths: