From 02e06975d02bd8f02d811b4dd1d45ecad2374861 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: access: values signed by their users

access::envelope: cv1.<payload>.<signature>, the payload naming the
path, value, user, time and the envelope it replaces (prev), signed
with one of the user's SSH keys from the registry (keys). Checked
against the registry as the writer saw it.

Auth plan M7.
---
 src/access/sshsig.rs | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

(limited to 'src/access/sshsig.rs')

diff --git a/src/access/sshsig.rs b/src/access/sshsig.rs
index 1f01d21..b40da0d 100644
--- a/src/access/sshsig.rs
+++ b/src/access/sshsig.rs
@@ -79,6 +79,11 @@ impl PublicKey {
 /// The key that made `armored`, a signature of `message` for `namespace`, if it is
 /// one: valid, of an Ed25519 key, for that namespace.
 pub(crate) fn verify(armored: &str, namespace: &str, message: &[u8]) -> Result<PublicKey, String> {
+    verify_blob(&dearmor(armored)?, namespace, message)
+}
+
+/// The SSHSIG blob an armored signature holds.
+pub(crate) fn dearmor(armored: &str) -> Result<Vec<u8>, String> {
     let body: String = armored
         .trim()
         .strip_prefix(BEGIN)
@@ -86,9 +91,17 @@ pub(crate) fn verify(armored: &str, namespace: &str, message: &[u8]) -> Result<P
         .ok_or("not an armored SSH signature")?
         .split_whitespace()
         .collect();
-    let blob = BASE64
+    BASE64
         .decode(body)
-        .map_err(|error| format!("its base64 doesn't decode: {error}"))?;
+        .map_err(|error| format!("its base64 doesn't decode: {error}"))
+}
+
+/// [`verify`] of a signature's SSHSIG blob (`dearmor`).
+pub(crate) fn verify_blob(
+    blob: &[u8],
+    namespace: &str,
+    message: &[u8],
+) -> Result<PublicKey, String> {
     let mut reader = Reader(
         blob.strip_prefix(MAGIC)
             .ok_or("not an SSH signature (no SSHSIG)")?,
-- 
cgit v1.3.1