mirror of
https://github.com/NixOS/nix.git
synced 2025-11-17 07:52:43 +01:00
f3e1c47f47
The short answer for why we need to do this is so we can consistently do `#include "nix/..."`. Without this change, there are ways to still make that work, but they are hacky, and they have downsides such as making it harder to make sure headers from the wrong Nix library (e..g. `libnixexpr` headers in `libnixutil`) aren't being used. The C API alraedy used `nix_api_*`, so its headers are *not* put in subdirectories accordingly. Progress on #7876 We resisted doing this for a while because it would be annoying to not have the header source file pairs close by / easy to change file path/name from one to the other. But I am ameliorating that with symlinks in the next commit.
118 lines
3.2 KiB
C++
118 lines
3.2 KiB
C++
#include "nix/signature/local-keys.hh"
|
|
|
|
#include "nix/file-system.hh"
|
|
#include "nix/util.hh"
|
|
#include <sodium.h>
|
|
|
|
namespace nix {
|
|
|
|
BorrowedCryptoValue BorrowedCryptoValue::parse(std::string_view s)
|
|
{
|
|
size_t colon = s.find(':');
|
|
if (colon == std::string::npos || colon == 0)
|
|
return {"", ""};
|
|
return {s.substr(0, colon), s.substr(colon + 1)};
|
|
}
|
|
|
|
Key::Key(std::string_view s, bool sensitiveValue)
|
|
{
|
|
auto ss = BorrowedCryptoValue::parse(s);
|
|
|
|
name = ss.name;
|
|
key = ss.payload;
|
|
|
|
try {
|
|
if (name == "" || key == "")
|
|
throw FormatError("key is corrupt");
|
|
|
|
key = base64Decode(key);
|
|
} catch (Error & e) {
|
|
std::string extra;
|
|
if (!sensitiveValue)
|
|
extra = fmt(" with raw value '%s'", key);
|
|
e.addTrace({}, "while decoding key named '%s'%s", name, extra);
|
|
throw;
|
|
}
|
|
}
|
|
|
|
std::string Key::to_string() const
|
|
{
|
|
return name + ":" + base64Encode(key);
|
|
}
|
|
|
|
SecretKey::SecretKey(std::string_view s)
|
|
: Key{s, true}
|
|
{
|
|
if (key.size() != crypto_sign_SECRETKEYBYTES)
|
|
throw Error("secret key is not valid");
|
|
}
|
|
|
|
std::string SecretKey::signDetached(std::string_view data) const
|
|
{
|
|
unsigned char sig[crypto_sign_BYTES];
|
|
unsigned long long sigLen;
|
|
crypto_sign_detached(sig, &sigLen, (unsigned char *) data.data(), data.size(),
|
|
(unsigned char *) key.data());
|
|
return name + ":" + base64Encode(std::string((char *) sig, sigLen));
|
|
}
|
|
|
|
PublicKey SecretKey::toPublicKey() const
|
|
{
|
|
unsigned char pk[crypto_sign_PUBLICKEYBYTES];
|
|
crypto_sign_ed25519_sk_to_pk(pk, (unsigned char *) key.data());
|
|
return PublicKey(name, std::string((char *) pk, crypto_sign_PUBLICKEYBYTES));
|
|
}
|
|
|
|
SecretKey SecretKey::generate(std::string_view name)
|
|
{
|
|
unsigned char pk[crypto_sign_PUBLICKEYBYTES];
|
|
unsigned char sk[crypto_sign_SECRETKEYBYTES];
|
|
if (crypto_sign_keypair(pk, sk) != 0)
|
|
throw Error("key generation failed");
|
|
|
|
return SecretKey(name, std::string((char *) sk, crypto_sign_SECRETKEYBYTES));
|
|
}
|
|
|
|
PublicKey::PublicKey(std::string_view s)
|
|
: Key{s, false}
|
|
{
|
|
if (key.size() != crypto_sign_PUBLICKEYBYTES)
|
|
throw Error("public key is not valid");
|
|
}
|
|
|
|
bool PublicKey::verifyDetached(std::string_view data, std::string_view sig) const
|
|
{
|
|
auto ss = BorrowedCryptoValue::parse(sig);
|
|
|
|
if (ss.name != std::string_view { name }) return false;
|
|
|
|
return verifyDetachedAnon(data, ss.payload);
|
|
}
|
|
|
|
bool PublicKey::verifyDetachedAnon(std::string_view data, std::string_view sig) const
|
|
{
|
|
std::string sig2;
|
|
try {
|
|
sig2 = base64Decode(sig);
|
|
} catch (Error & e) {
|
|
e.addTrace({}, "while decoding signature '%s'", sig);
|
|
}
|
|
if (sig2.size() != crypto_sign_BYTES)
|
|
throw Error("signature is not valid");
|
|
|
|
return crypto_sign_verify_detached((unsigned char *) sig2.data(),
|
|
(unsigned char *) data.data(), data.size(),
|
|
(unsigned char *) key.data()) == 0;
|
|
}
|
|
|
|
bool verifyDetached(std::string_view data, std::string_view sig, const PublicKeys & publicKeys)
|
|
{
|
|
auto ss = BorrowedCryptoValue::parse(sig);
|
|
|
|
auto key = publicKeys.find(std::string(ss.name));
|
|
if (key == publicKeys.end()) return false;
|
|
|
|
return key->second.verifyDetachedAnon(data, ss.payload);
|
|
}
|
|
|
|
}
|