Add sign command (#66)

Author: casey

bin/version

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+sed -En 's/version[[:space:]]*=[[:space:]]*"([^"]+)"/\1/p' Cargo.toml | head -1

justfile

@@ -38,7 +38,7 @@ publish: tmp
   set -euxo pipefail
   git clone [email protected]:casey/filepack.git tmp
   cd tmp
-  VERSION=`sed -En 's/version[[:space:]]*=[[:space:]]*"([^"]+)"/\1/p' Cargo.toml | head -1`
+  VERSION=`bin/version`
   git tag -a $VERSION -m "Release $VERSION"
   git push origin $VERSION
   cargo publish
@@ -74,13 +74,34 @@ test-progress-bar: tmp
   cargo run --release create tmp
   rm tmp/data*
 
-download-release: tmp
-  #!/usr/bin/env bash
-  VERSION=`sed -En 's/version[[:space:]]*=[[:space:]]*"([^"]+)"/\1/p' Cargo.toml | head -1`
-  cd tmp
-  cargo run download --github-release casey/filepack/$VERSION
-
 check-error-variant-order: tmp
   cat src/error.rs | rg '^  ([A-Z].*) \{' -or '$1' > tmp/original.txt
   sort tmp/original.txt > tmp/sorted.txt
   diff tmp/{original,sorted}.txt
+
+sign-release: tmp
+  #!/usr/bin/env bash
+  set -euxo pipefail
+  VERSION=`bin/version`
+  gh release download \
+    --repo casey/filepack \
+    --pattern filepack.json \
+    --dir tmp \
+    $VERSION
+  cargo run sign tmp/filepack.json
+  gh release upload \
+    --clobber \
+    --repo casey/filepack \
+    $VERSION \
+    tmp/filepack.json
+
+verify-release: tmp
+  #!/usr/bin/env bash
+  set -euxo pipefail
+  VERSION=`bin/version`
+  gh release download \
+    --repo casey/filepack \
+    --pattern '*' \
+    --dir tmp \
+    $VERSION
+  cargo run verify tmp --key `cargo run key`

src/error.rs

@@ -129,6 +129,11 @@ pub(crate) enum Error {
   },
   #[snafu(display("root hash mismatch"))]
   RootHashMismatch { backtrace: Option<Backtrace> },
+  #[snafu(display("manifest has already been signed by public key `{public_key}`"))]
+  SignatureAlreadyExists {
+    backtrace: Option<Backtrace>,
+    public_key: PublicKey,
+  },
   #[snafu(display("invalid signature for public key `{public_key}`"))]
   SignatureInvalid {
     backtrace: Option<Backtrace>,

src/manifest.rs

@@ -24,6 +24,10 @@ impl Manifest {
 
     hasher.finalize().into()
   }
+
+  pub(crate) fn to_json(&self) -> String {
+    serde_json::to_string(self).unwrap()
+  }
 }
 
 #[cfg(test)]

src/metadata.rs

@@ -8,6 +8,10 @@ pub(crate) struct Metadata {
 
 impl Metadata {
   pub(crate) const FILENAME: &'static str = "metadata.json";
+
+  pub(crate) fn to_json(&self) -> String {
+    serde_json::to_string(self).unwrap()
+  }
 }
 
 impl From<Template> for Metadata {

src/private_key.rs

@@ -52,6 +52,14 @@ impl PrivateKey {
     Ok(private_key)
   }
 
+  pub(crate) fn load_and_sign(path: &Utf8Path, message: &[u8]) -> Result<(PublicKey, Signature)> {
+    let private_key = Self::load(path)?;
+
+    let signature = private_key.sign(message);
+
+    Ok((private_key.public_key(), signature))
+  }
+
   pub(crate) fn public_key(&self) -> PublicKey {
     self.clone().into()
   }

src/public_key.rs

@@ -42,11 +42,14 @@ impl PublicKey {
     Ok(public_key)
   }
 
-  pub(crate) fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), SignatureError> {
+  pub(crate) fn verify(&self, message: &[u8], signature: &Signature) -> Result<()> {
     self
       .0
       .verify_strict(message, signature.as_ref())
       .map_err(SignatureError)
+      .context(error::SignatureInvalid {
+        public_key: self.clone(),
+      })
   }
 }
 

src/subcommand.rs

@@ -11,6 +11,7 @@ mod hash;
 mod key;
 mod keygen;
 mod man;
+mod sign;
 mod verify;
 
 #[derive(Parser)]
@@ -34,6 +35,8 @@ pub(crate) enum Subcommand {
   Keygen,
   #[command(about = "Print man page")]
   Man,
+  #[command(about = "Add signature to manifest")]
+  Sign(sign::Sign),
   #[command(about = "Verify manifest")]
   Verify(verify::Verify),
 }
@@ -46,6 +49,7 @@ impl Subcommand {
       Self::Key => key::run(options),
       Self::Keygen => keygen::run(options),
       Self::Man => man::run(),
+      Self::Sign(sign) => sign.run(options),
       Self::Verify(verify) => verify.run(options),
     }
   }

src/subcommand/create.rs

@@ -41,7 +41,7 @@ impl Create {
         error::MetadataAlreadyExists { path: &path },
       }
       let metadata = Metadata::from(template);
-      let json = serde_json::to_string(&metadata).unwrap();
+      let json = metadata.to_json();
       fs::write(&path, json).context(error::Io { path: &path })?;
     }
 
@@ -181,18 +181,13 @@ impl Create {
     if self.sign {
       let private_key_path = options.key_dir()?.join(MASTER_PRIVATE_KEY);
 
-      let private_key = PrivateKey::load(&private_key_path)?;
-
-      let signature = private_key.sign(manifest.root_hash().as_bytes());
-
-      let public_key = private_key.public_key();
+      let (public_key, signature) =
+        PrivateKey::load_and_sign(&private_key_path, manifest.root_hash().as_bytes())?;
 
       manifest.signatures.insert(public_key, signature);
     }
 
-    let json = serde_json::to_string(&manifest).unwrap();
-
-    fs::write(&manifest_path, &json).context(error::Io {
+    fs::write(&manifest_path, manifest.to_json()).context(error::Io {
       path: manifest_path,
     })?;
 

src/subcommand/hash.rs

@@ -2,13 +2,13 @@ use super::*;
 
 #[derive(Parser)]
 pub(crate) struct Hash {
-  #[arg(help = "Hash file at <PATH>, defaulting to standard input")]
-  path: Option<Utf8PathBuf>,
+  #[arg(help = "Hash <FILE>, defaulting to standard input")]
+  file: Option<Utf8PathBuf>,
 }
 
 impl Hash {
   pub(crate) fn run(self, options: Options) -> Result {
-    let hash = if let Some(path) = self.path {
+    let hash = if let Some(path) = self.file {
       options.hash_file(&path).context(error::Io { path })?.hash
     } else {
       let mut hasher = Hasher::new();