note

Documentation

Overview

Package note provides note-compatible signature verifiers.

Index

• Constants
• func NewECDSAVerifier(key string) (sdb_note.Verifier, error)
• func NewVerifier(keyType, key string) (sdb_note.Verifier, error)

Constants

const (
	// Note represents a key type that the Go SumDB note will
	// know about.
	Note = ""

	// ECDSA is an ECDSA signature over SHA256.
	// This signature type has been agreed to be represented by algo ID 2 by the note authors.
	ECDSA = "ecdsa"
)

Functions

func NewECDSAVerifier

func NewECDSAVerifier(key string) (sdb_note.Verifier, error)

NewECDSAVerifier creates a new note verifier for checking ECDSA signatures over SHA256 digests. This implementation is compatible with the signature scheme used by the Sigstore Rékor Log.

The key is expected to be provided as a string in the following form:

<key_name>+<key_hash>+<key_bytes>

Where

<key_name> is a human readable identifier for the key, containing no whitespace or "+" symbols
<key_bytes> is base64 encoded blob starting with a 0x02 (algECDSAWithSHA256) byte and followed
    by the DER encoded public key in SPKI format.
<key_hash> is a 32bit hash of the key DER

e.g.:

"rekor.sigstore.dev+12345678+AjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNhtmPtrWm3U1eQXBogSMdGvXwBcK5AW5i0hrZLOC96l+smGNM7nwZ4QvFK/4sueRoVj//QP22Ni4Qt9DPfkWLc=

func NewVerifier

func NewVerifier(keyType, key string) (sdb_note.Verifier, error)

NewVerifier returns a verifier for the given key type and key.