diff options
Diffstat (limited to 'src/access/sshsig.rs')
| -rw-r--r-- | src/access/sshsig.rs | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/src/access/sshsig.rs b/src/access/sshsig.rs index 1f01d21..b40da0d 100644 --- a/src/access/sshsig.rs +++ b/src/access/sshsig.rs @@ -79,6 +79,11 @@ impl PublicKey { /// The key that made `armored`, a signature of `message` for `namespace`, if it is /// one: valid, of an Ed25519 key, for that namespace. pub(crate) fn verify(armored: &str, namespace: &str, message: &[u8]) -> Result<PublicKey, String> { + verify_blob(&dearmor(armored)?, namespace, message) +} + +/// The SSHSIG blob an armored signature holds. +pub(crate) fn dearmor(armored: &str) -> Result<Vec<u8>, String> { let body: String = armored .trim() .strip_prefix(BEGIN) @@ -86,9 +91,17 @@ pub(crate) fn verify(armored: &str, namespace: &str, message: &[u8]) -> Result<P .ok_or("not an armored SSH signature")? .split_whitespace() .collect(); - let blob = BASE64 + BASE64 .decode(body) - .map_err(|error| format!("its base64 doesn't decode: {error}"))?; + .map_err(|error| format!("its base64 doesn't decode: {error}")) +} + +/// [`verify`] of a signature's SSHSIG blob (`dearmor`). +pub(crate) fn verify_blob( + blob: &[u8], + namespace: &str, + message: &[u8], +) -> Result<PublicKey, String> { let mut reader = Reader( blob.strip_prefix(MAGIC) .ok_or("not an SSH signature (no SSHSIG)")?, |