Method ClearSign

pkg/provenance/sign.go:200–237

ClearSign signs package data with the given key and pre-marshalled metadata. This is the core signing method that works with data in memory. The Signatory must have a valid Entity.PrivateKey for this to work.

(archiveData []byte, filename string, metadataBytes []byte)

// This is the core signing method that works with data in memory.
// The Signatory must have a valid Entity.PrivateKey for this to work.
func (s *Signatory) ClearSign(archiveData []byte, filename string, metadataBytes []byte) (string, error) {
	if s.Entity == nil {
		return "", errors.New("private key not found")
	} else if s.Entity.PrivateKey == nil {
		return "", errors.New("provided key is not a private key. Try providing a keyring with secret keys")
	}

	out := bytes.NewBuffer(nil)

	b, err := messageBlock(archiveData, filename, metadataBytes)
	if err != nil {
		return "", err
	}

	// Sign the buffer
	w, err := clearsign.Encode(out, s.Entity.PrivateKey, &defaultPGPConfig)
	if err != nil {
		return "", err
	}

	_, err = io.Copy(w, b)

	if err != nil {
		// NB: We intentionally don't call `w.Close()` here! `w.Close()` is the method which
		// actually does the PGP signing, and therefore is the part which uses the private key.
		// In other words, if we call Close here, there's a risk that there's an attempt to use the
		// private key to sign garbage data (since we know that io.Copy failed, `w` won't contain
		// anything useful).
		return "", fmt.Errorf("failed to write to clearsign encoder: %w", err)
	}

	err = w.Close()
	if err != nil {
		return "", fmt.Errorf("failed to either sign or armor message block: %w", err)
	}

	return out.String(), nil
}

// Verify checks a signature and verifies that it is legit for package data.
// This is the core verification method that works with data in memory.