access: values signed by their users

access::envelope: cv1.<payload>.<signature>, the payload naming the
path, value, user, time and the envelope it replaces (prev), signed
with one of the user's SSH keys from the registry (keys). Checked
against the registry as the writer saw it.

Auth plan M7.

1 files changed, 15 insertions, 2 deletions

diff --git a/src/access/sshsig.rs b/src/access/sshsig.rs
index 1f01d21..b40da0d 100644
--- a/src/access/sshsig.rs
+++ b/src/access/sshsig.rs
@@ -79,6 +79,11 @@ impl PublicKey {
 /// The key that made `armored`, a signature of `message` for `namespace`, if it is
 /// one: valid, of an Ed25519 key, for that namespace.
 pub(crate) fn verify(armored: &str, namespace: &str, message: &[u8]) -> Result<PublicKey, String> {
+    verify_blob(&dearmor(armored)?, namespace, message)
+}
+
+/// The SSHSIG blob an armored signature holds.
+pub(crate) fn dearmor(armored: &str) -> Result<Vec<u8>, String> {
     let body: String = armored
         .trim()
         .strip_prefix(BEGIN)
@@ -86,9 +91,17 @@ pub(crate) fn verify(armored: &str, namespace: &str, message: &[u8]) -> Result<P
         .ok_or("not an armored SSH signature")?
         .split_whitespace()
         .collect();
-    let blob = BASE64
+    BASE64
         .decode(body)
-        .map_err(|error| format!("its base64 doesn't decode: {error}"))?;
+        .map_err(|error| format!("its base64 doesn't decode: {error}"))
+}
+
+/// [`verify`] of a signature's SSHSIG blob (`dearmor`).
+pub(crate) fn verify_blob(
+    blob: &[u8],
+    namespace: &str,
+    message: &[u8],
+) -> Result<PublicKey, String> {
     let mut reader = Reader(
         blob.strip_prefix(MAGIC)
             .ok_or("not an SSH signature (no SSHSIG)")?,