torchwood: fix cosignatures of checkpoints with extension lines

Reported by @rozbb.

Author: FiloSottile

NEWS.md

@@ -1,3 +1,10 @@
+## v0.6.1
+
+### torchwood
+
+- Fix `CosignatureSigner`/`CosignatureVerifier` to correctly sign and verify
+  checkpoints with extension lines, according to c2sp.org/tlog-cosignature.
+
 ## v0.6.0
 
 Switched to Go project LICENSE (BSD-3-Clause).

cosignature.go

@@ -77,21 +77,18 @@ func formatCosignatureV1(t uint64, msg []byte) ([]byte, error) {
 	//
 	//      cosignature/v1
 	//      time TTTTTTTTTT
-	//      origin line
-	//      NNNNNNNNN
-	//      tree hash
+	//      [checkpoint]
 	//
-	// where TTTTTTTTTT is the current UNIX timestamp, and the following
-	// three lines are the first three lines of the note. All other
-	// lines are not processed by the witness, so are not signed.
+	// where TTTTTTTTTT is the current UNIX timestamp.
 
 	c, err := ParseCheckpoint(string(msg))
 	if err != nil {
 		return nil, fmt.Errorf("message being signed is not a valid checkpoint: %w", err)
 	}
-	return []byte(fmt.Sprintf(
-		"cosignature/v1\ntime %d\n%s\n%d\n%s\n",
-		t, c.Origin, c.N, base64.StdEncoding.EncodeToString(c.Hash[:]))), nil
+	if string(msg) != c.String() {
+		return nil, errors.New("message being signed does not match parsed checkpoint")
+	}
+	return []byte(fmt.Sprintf("cosignature/v1\ntime %d\n%s", t, msg)), nil
 }
 
 // CosignatureSigner is a [note.Signer] that produces timestamped

cosignature_test.go

@@ -1,6 +1,7 @@
 package torchwood_test
 
 import (
+	"bytes"
 	"crypto/ed25519"
 	"crypto/rand"
 	"testing"
@@ -20,7 +21,7 @@ func TestSignerRoundtrip(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	msg := "test\n123\nf+7CoKgXKE/tNys9TTXcr/ad6U/K3xvznmzew9y6SP0=\n"
+	msg := "test\n123\nf+7CoKgXKE/tNys9TTXcr/ad6U/K3xvznmzew9y6SP0=\nextension 1\nextension 2\n"
 	n, err := note.Sign(&note.Note{Text: msg}, s)
 	if err != nil {
 		t.Fatal(err)
@@ -29,4 +30,9 @@ func TestSignerRoundtrip(t *testing.T) {
 	if _, err := note.Open(n, note.VerifierList(s.Verifier())); err != nil {
 		t.Fatal(err)
 	}
+
+	nn := bytes.Replace(n, []byte("extension 2"), []byte("extension X"), 1)
+	if _, err := note.Open(nn, note.VerifierList(s.Verifier())); err == nil {
+		t.Fatal("expected error verifying modified note, got nil")
+	}
 }