mirror of
https://github.com/luxfi/esign.git
synced 2026-10-30 16:58:18 +00:00
zeekay
165ae41805
This commit lands the first end-to-end signable surface:
* pkg/sign — Signer/Verifier interfaces, Ed25519 implementation
(stdlib crypto/ed25519), method-dispatch helper. 8 unit tests:
round-trip, deterministic-from-seed, bad-seed-length, tampered
payload + sig, bad pubkey, bad sig length, zero-value verifier.
* pkg/envelope — added Signature.SignerHashHex() and SeqString
helper used by the verifier-side error reporting.
* pkg/api — Handler with pluggable Store, in-memory MemStore for
tests + small deployments. CreateRequest / SignRequest /
TransitionRequest / VerifyResponse types form the wire surface.
Handler.Sign runs cryptographic verify BEFORE calling
envelope.AddSignature so a malformed sig never lands in the
envelope. 3 e2e tests cover happy path, sig tampering detection,
and crypto-fails-before-store ordering.
* pkg/api — opcode table (Create/Get/Sign/Transition/Verify/Audit
+ Ping). ZAPServer serves [4B BE length][2B LE opcode][JSON body]
framing with per-conn pipelining + idle timeout. Tests: ping,
end-to-end create→sent→sign→verify, unknown opcode error,
bad-JSON error.
* cmd/esignd — standalone daemon. `--zap :9650` by default.
SIGINT/SIGTERM shutdown drains inflight conns before exit.
Test summary: 3 packages, 22 tests, all green.
37 lines
1.2 KiB
Go
37 lines
1.2 KiB
Go
// Copyright 2026 Lux Industries Inc. and the luxfi/esign authors.
|
|
// Licensed under the Apache License, Version 2.0 (see LICENSE).
|
|
|
|
package sign
|
|
|
|
import "github.com/luxfi/esign/pkg/envelope"
|
|
|
|
// Method is the canonical wire-form of envelope.SignMethod, re-exported
|
|
// in this package so callers can dispatch without importing envelope.
|
|
type Method = envelope.SignMethod
|
|
|
|
// VerifierFor returns the canonical Verifier for the given method, or
|
|
// ErrUnknownMethod if no implementation is registered. The returned
|
|
// Verifier is stateless and safe to share across goroutines.
|
|
//
|
|
// Only Ed25519 is wired today; ML-DSA-65, FROST, MPCECDSA, ECDSA-P256,
|
|
// and RSA-PSS land in follow-on commits.
|
|
func VerifierFor(m Method) (Verifier, error) {
|
|
switch m {
|
|
case envelope.MethodEd25519:
|
|
return Ed25519Verifier{}, nil
|
|
default:
|
|
return nil, ErrUnknownMethod
|
|
}
|
|
}
|
|
|
|
// Verify is a one-shot helper: looks up the verifier for `method` and
|
|
// runs Verify in one call. Returns ErrUnknownMethod if the algorithm
|
|
// isn't registered.
|
|
func Verify(method Method, pubKey, payload, sig []byte) error {
|
|
v, err := VerifierFor(method)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return v.Verify(pubKey, payload, sig)
|
|
}
|