-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
31 changed files
with
273 additions
and
167 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
|
|
||
| # sign hash envelope | ||
| npm run -s transmute -- scitt sign ./tests/fixtures/private.sig.key.cbor ./tests/fixtures/message.json --output ./tests/fixtures/message.hash-envelope.cbor > ./tests/fixtures/message.hash-envelope.diag | ||
| npm run -s transmute -- scitt verify ./tests/fixtures/public.sig.key.cbor ./tests/fixtures/message.hash-envelope.cbor 3073d614f853aaec9a1146872c7bab75495ee678c8864ed3562f8787555c1e22 --output ./tests/fixtures/message.hash-envelope.verified.data > ./tests/fixtures/message.hash-envelope.diag |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| import fs from 'fs' | ||
| import * as cose from '@transmute/cose' | ||
| import * as edn from '@transmute/edn' | ||
| import { Arguments } from "../types" | ||
|
|
||
| import { setSecret, setOutput, debug } from '@actions/core' | ||
|
|
||
| import { env } from '../action' | ||
|
|
||
| export const handler = async function ({ positionals, values }: Arguments) { | ||
| positionals = positionals.slice(1) | ||
| const operation = positionals.shift() | ||
| switch (operation) { | ||
| case 'sign': { | ||
| const output = values.output | ||
| const verbose = values.verbose || false | ||
| const [pathToPrivateKey, pathToMessage] = positionals | ||
| const privateKey = cose.cbor.decode(fs.readFileSync(pathToPrivateKey)) | ||
| const thumbprint: any = privateKey.get(2) || await cose.key.thumbprint.calculateCoseKeyThumbprint(privateKey) | ||
| if (verbose) { | ||
| const message = `🔑 ${Buffer.from(thumbprint).toString('hex')}` | ||
| debug(message) | ||
| } | ||
| if (env.github()) { | ||
| if (privateKey.get(-4)) { | ||
| setSecret(Buffer.from(privateKey.get(-4)).toString('hex')) | ||
| } | ||
| } | ||
| let alg = values.alg | ||
| if (privateKey.get(3)) { | ||
| alg = cose.IANACOSEAlgorithms[`${privateKey.get(3)}`].Name | ||
| } | ||
|
|
||
| if (!alg) { | ||
| const message = `❌ --alg is required when not present in private key` | ||
| console.error(message) | ||
| throw new Error(message) | ||
| } | ||
| const message = fs.readFileSync(pathToMessage) | ||
| const coseSign1 = await cose.hash | ||
| .signer({ | ||
| remote: cose.crypto.signer({ | ||
| privateKeyJwk: await cose.key.convertCoseKeyToJsonWebKey(privateKey), | ||
| }), | ||
| }) | ||
| .sign({ | ||
| protectedHeader: cose.ProtectedHeader([ | ||
| [cose.Protected.Alg, privateKey.get(3)], | ||
| [cose.Protected.PayloadHashAlgorithm, cose.Hash.SHA256], | ||
| // TODO: other commmand line options for headers | ||
| ]), | ||
| unprotectedHeader: new Map<any, any>(), | ||
| payload: message, | ||
| }) | ||
|
|
||
| if (output) { | ||
| fs.writeFileSync(output, Buffer.from(coseSign1)) | ||
| } | ||
|
|
||
| if (env.github()) { | ||
| setOutput('cbor', Buffer.from(coseSign1).toString('hex')) | ||
| } else { | ||
| const text = await cose.cbor.diagnose(Buffer.from(coseSign1)) | ||
| console.log(text) | ||
| } | ||
| break | ||
| } | ||
| case 'verify': { | ||
| const output = values.output | ||
| const verbose = values.verbose || false | ||
| const [pathToPublicKey, pathToSignatures, hash] = positionals | ||
| const publicKey = cose.cbor.decode(fs.readFileSync(pathToPublicKey)) | ||
| const thumbprint: any = publicKey.get(2) || await cose.key.thumbprint.calculateCoseKeyThumbprint(publicKey) | ||
| if (verbose) { | ||
| const message = `🔑 ${Buffer.from(thumbprint).toString('hex')}` | ||
| debug(message) | ||
| } | ||
| if (env.github()) { | ||
| if (publicKey.get(-4)) { | ||
| setSecret(Buffer.from(publicKey.get(-4)).toString('hex')) | ||
| } | ||
| } | ||
| let alg = values.alg | ||
| if (publicKey.get(3)) { | ||
| alg = cose.IANACOSEAlgorithms[`${publicKey.get(3)}`].Name | ||
| } | ||
|
|
||
| if (!alg) { | ||
| const message = `❌ --alg is required when not present in public key` | ||
| console.error(message) | ||
| throw new Error(message) | ||
| } | ||
| const coseSign1 = fs.readFileSync(pathToSignatures) | ||
| const result = await cose.attached | ||
| .verifier({ | ||
| resolver: { | ||
| resolve: async () => { | ||
| return cose.key.convertCoseKeyToJsonWebKey(publicKey) | ||
| } | ||
| } | ||
| }) | ||
| .verify({ | ||
| coseSign1 | ||
| }) | ||
| if (hash) { | ||
| if (hash.toLowerCase() !== Buffer.from(result).toString('hex')) { | ||
| throw new Error(`Signature verification failed for hash: ${Buffer.from(result).toString('hex')}`) | ||
| } | ||
| } else { | ||
| throw new Error(`Unable to verify signature for hash: ${Buffer.from(result).toString('hex')}`) | ||
| } | ||
| if (output) { | ||
| fs.writeFileSync(output, Buffer.from(result)) | ||
| } | ||
| if (env.github()) { | ||
| setOutput('cbor', Buffer.from(result).toString('hex')) | ||
| } else { | ||
| const text = await cose.cbor.diagnose(Buffer.from(coseSign1)) | ||
| console.log(text) | ||
| } | ||
| break | ||
| } | ||
| default: { | ||
| const message = `😕 Unknown Command` | ||
| console.error(message) | ||
| throw new Error(message) | ||
| } | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| export * from './handler' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| import crypto from 'crypto' | ||
|
|
||
| import * as cose from '@transmute/cose' | ||
|
|
||
| it('cose sanity', async () => { | ||
| const privateKey = await cose.key.generate<cose.key.CoseKey>('ES256', 'application/cose-key') | ||
| const publicKey = await cose.key.extractPublicCoseKey(privateKey) | ||
| const signer = cose.attached.signer({ | ||
| remote: cose.crypto.signer({ | ||
| privateKeyJwk: await cose.key.convertCoseKeyToJsonWebKey(privateKey), | ||
| }), | ||
| }) | ||
| const verifier = cose.attached.verifier({ | ||
| resolver: { | ||
| resolve: async () => { | ||
| return cose.key.convertCoseKeyToJsonWebKey(publicKey) | ||
| } | ||
| } | ||
| }) | ||
| const message = new TextEncoder().encode('hello world') | ||
| const coseSign1 = await signer.sign({ | ||
| protectedHeader: cose.ProtectedHeader([ | ||
| [cose.Protected.Alg, privateKey.get(3)], | ||
| ]), | ||
| unprotectedHeader: new Map<any, any>(), | ||
| payload: message, | ||
| }) | ||
| const result = await verifier.verify({ | ||
| coseSign1 | ||
| }) | ||
| expect(new TextDecoder().decode(result)).toBe('hello world') | ||
| }) | ||
|
|
||
| it('scitt sanity', async () => { | ||
| const privateKey = await cose.key.generate<cose.key.CoseKey>('ES256', 'application/cose-key') | ||
| const publicKey = await cose.key.extractPublicCoseKey(privateKey) | ||
| const signer = await cose.hash.signer({ | ||
| remote: cose.crypto.signer({ | ||
| privateKeyJwk: await cose.key.convertCoseKeyToJsonWebKey(privateKey), | ||
| }), | ||
| }) | ||
| const verifier = cose.attached.verifier({ | ||
| resolver: { | ||
| resolve: async () => { | ||
| return cose.key.convertCoseKeyToJsonWebKey(publicKey) | ||
| } | ||
| } | ||
| }) | ||
| const message = new TextEncoder().encode('hello world') | ||
| const coseSign1 = await signer.sign({ | ||
| protectedHeader: cose.ProtectedHeader([ | ||
| [cose.Protected.Alg, privateKey.get(3)], | ||
| [cose.Protected.PayloadHashAlgorithm, cose.Hash.SHA256], | ||
| ]), | ||
| unprotectedHeader: new Map<any, any>(), | ||
| payload: message, | ||
| }) | ||
| const result = await verifier.verify({ | ||
| coseSign1, | ||
| }) | ||
| const hash = crypto.createHash('sha256') | ||
| .update(message) | ||
| .digest(); | ||
| expect(hash.toString('hex')).toBe(Buffer.from(result).toString('hex')) | ||
| expect(hash.toString('hex')).toBe('b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9') | ||
| }) | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiRUNESC1FUytBMTI4S1ciLCJlcGsiOnsieCI6Im5iQnJvYzI2dkx6VGdwdjFLdnM0WXJuR1VWbXhfeXQxM2JOYlJBWE45RkJqbjctMHM2bTNVdVh5TnNGbE1oTHciLCJjcnYiOiJQLTM4NCIsImt0eSI6IkVDIiwieSI6IlItZ3dOTFhKZ2dibTR4ZjczSW1qdVBEeW1teTNnZ0w4cHM0Q21pNVV4bUlya2VEendNTjZlVjMtWDRDOXVaU28ifX0.-WWSqli_b-4UpkK5zyx_7MXuHj3zmHgw.eZvk12RYBaXt_Cdp.h4cBBt0_i56J6W20tv-ODpDqCy4Un4kx2jKCST-2QHKsl_Us_15wOe1W1BLFDlq8d4-9kkLhLu7NvudxqnF8MeQdwIcnvbrfc-s.s1oaIbSFf3OrcmPZDME9-g | ||
| eyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiRUNESC1FUytBMTI4S1ciLCJlcGsiOnsieCI6Ikp6bEN3ZG53WDBNVkhFUjU0emRGd3ZaZEJpZEQxUERSZnMxNFZQUzFreEZfM0JqN2NSUU9heThBQlJLaGZTWFgiLCJjcnYiOiJQLTM4NCIsImt0eSI6IkVDIiwieSI6InU2cVdhQVo0YUJtNTNjX0RSMU5VNFhNamdfMzRmVU1lV1pHdTFiNVZkM1hucUNwNGZiTmgtdXp4eWg1S24zd0IifX0.BR03I42qlSXJVIhMcHlU88ystAyuY1Ca.wWDF0Fdlw7OTQJev.iHClUHnRASOLn03LTr8wqOt1sEDfGBDAGyW10mQeiHh9bkXVXjThJf9viUspUhu-Xa9ZS7yichdTKl3ijGMRJ6totpePo8CfTxo.U5Eo6MWEHlOZzXnbS8MZvQ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,14 +1,14 @@ | ||
| { | ||
| "ciphertext": "OdKdK6rNvOPDZR89e4nnaDLskwmyt1oRznSWNf5mec6N8plaCzpRohG-7eK0hdm29EzUucbgKrXPeRh5V4jW4ZMwWyGQj7k_Z1A", | ||
| "iv": "9g_gN2OElWQHf0-5", | ||
| "ciphertext": "H8VmMXcmqEqQqcNtv-wTEKQNj98G6G811PVnuyUWCqu1oW-w2rmRzKUXXMFGBh7mRkeK4d0pkZ-sC7cn4X-tj2-ktBmlTAEpNOI", | ||
| "iv": "pTw3gSET0CNt5eI7", | ||
| "recipients": [ | ||
| { | ||
| "encrypted_key": "0bnz6BO332K3VnUGcpGsJy-hOxMXVszN", | ||
| "encrypted_key": "TBgu_8kSAe3ElzweqcbY19pdCsnV6Bcc", | ||
| "header": { | ||
| "alg": "ECDH-ES+A128KW" | ||
| } | ||
| } | ||
| ], | ||
| "tag": "qUp_2FGNbGrimPayFO6CoQ", | ||
| "protected": "eyJlbmMiOiJBMTI4R0NNIiwiZXBrIjp7IngiOiJXQl8yQWtVMVlOamlrbGk1RkZQdENkRlR2eGEzaTNaZ1BSUXlSS08wV2JMUmdiQTEzYTFSby0tc2xQMlpTMjMwIiwiY3J2IjoiUC0zODQiLCJrdHkiOiJFQyIsInkiOiJJRVdHTlJSR2c1blBYc09RS0d1a2phNDVwTVkzUFFiMFpJMU9sT19SWDBGR29PTElHdE4tZzU1WS1BU2hZQU9zIn19" | ||
| "tag": "aWyF8ZScnWnix8uAw7C_9w", | ||
| "protected": "eyJlbmMiOiJBMTI4R0NNIiwiZXBrIjp7IngiOiIwWHV6bTN0UGxxTWh0MHVXZ3ZrNnVWakRDbFBPdjRnek56M0FrMnZVMEgtTzhXNXIzT2V5M3FtSURMWlplYmpEIiwiY3J2IjoiUC0zODQiLCJrdHkiOiJFQyIsInkiOiI2Tm5iMUY0R2w4cnliLUx4ZkgtUUZ3LVRFaTZkQXIwLTV0UFlpM21GNE13Q2VmV3k1aE1JRy13RkRyTFRUdHlkIn19" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| ҄G�&9�/�X 0s��S��F�,{�uI^�xȆN�V/��U\ "X@�~c͘w�������/�y���8s Y�Z��c[�<��p�j AU��� ������]�Ǻ� |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| 18([h'a20126391a8f2f', {}, h'3073d614f853aaec9a1146872c7bab75495ee678c8864ed3562f8787555c1e22', h'19a17e63cd9877a8fcd115ebfed2f42fae7907d41383c038731a0c59eba95afe82635ba43c0ffe9570ed9c6a1f4155b497e1a51cedfc149e94c0e75da9c7ba83']) | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 0s��S��F�,{�uI^�xȆN�V/��U\ " |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| ҄C�&�XJ{"message":"⌛ My lungs taste the air of Time Blown past falling sands"} | ||
| X@W>���0���3�����)�����:���$�|�)Mճ� ��£X'|��X��S ^: | ||
| X@�D�� ��6$���2�`��/9�ZH �㩥�kɛY|��OIҏ)��e��$R̓�+A;��Z |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..6rNcoEn42DSlbx_vzeEZiAuAVJWXq-RgKoCaIQ06BFusXtLJzrw5OaNa8ZEg_9xdvmrxwfZ5Yl-ymAzsUZCEeQ | ||
| eyJhbGciOiJFUzI1NiIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19..KmH2h25eupWeZTKDlyWPYl1DAF6_c4dO4ofoDCSe5LxvXQhj56vtASybjgwWecYJgTSfGYU_A9mGtKtI9ivkYg |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.