Function SignPlugin

internal/plugin/sign.go:38–53

SignPlugin signs a plugin using the SHA256 hash of the tarball data. This is used when packaging and signing a plugin from tarball data. It creates a signature that includes the tarball hash and plugin metadata, allowing verification of the original tarball later.

(tarballData []byte, filename string, signer *provenance.Signatory)

// It creates a signature that includes the tarball hash and plugin metadata,
// allowing verification of the original tarball later.
func SignPlugin(tarballData []byte, filename string, signer *provenance.Signatory) (string, error) {
	// Extract plugin metadata from tarball data
	pluginMeta, err := ExtractTgzPluginMetadata(bytes.NewReader(tarballData))
	if err != nil {
		return "", fmt.Errorf("failed to extract plugin metadata: %w", err)
	}

	// Marshal plugin metadata to YAML bytes
	metadataBytes, err := yaml.Marshal(pluginMeta)
	if err != nil {
		return "", fmt.Errorf("failed to marshal plugin metadata: %w", err)
	}

	// Use the generic provenance signing function
	return signer.ClearSign(tarballData, filename, metadataBytes)
}

// ExtractTgzPluginMetadata extracts plugin metadata from a gzipped tarball reader
func ExtractTgzPluginMetadata(r io.Reader) (*Metadata, error) {