Export Signify methods, support BLAKE2s

.github/workflows/ci.yaml

@@ -29,6 +29,9 @@ jobs:
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
+      - name: tests
+        run: go test ./...
+
       - name: make
         run: make
 

.github/workflows/golangci-lint.yml

@@ -15,10 +15,10 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
+          go-version: stable
           cache: false
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9

.golangci.yml

@@ -14,12 +14,15 @@ linters:
     - fatcontext
     - gocheckcompilerdirectives
     - gochecksumtype
+    - gocritic
+    - gocyclo
     - godox
     - gomoddirectives
     - gomodguard
     - gosec
     - gosmopolitan
     - loggercheck
+    - maintidx
     - makezero
     - misspell
     - musttag
@@ -56,6 +59,7 @@ linters:
     - perfsprint
     - maintidx
     - noctx
+    - testpackage
     # enable later
     - gocritic
     - staticcheck

Makefile

@@ -42,6 +42,10 @@ reload-rules:
 	udevadm control --reload
 	udevadm trigger
 
+.PHONY: test
+test:
+	go test ./...
+
 podman:
 	podman run --arch=amd64 --rm --mount type=bind,source=$(CURDIR),target=/src -w /src -it ghcr.io/tillitis/tkey-builder:4 make -j
 

README.md

@@ -14,52 +14,39 @@ See [Release notes](RELEASE.md).
 
 ## Usage
 
-Get a public key, possibly modifying the key pair by using a User
-Supplied Secret, and storing the public key in file `-p pubkey`.
+Run with `-h`. See examples below. For details, see manual page in
+`doc/tkey-sign.1` and source in
+[doc/tkey-sign.scd](doc/tkey-sign.scd).
 
-```
-tkey-sign -G/--getkey [-d/--port device] [-s/--speed speed]
-[--uss] [--uss-file secret-file] -p/--public pubkey
-```
-
-Sign a file, specified with `-m message`, possibly modifying the
-measured key pair by using a User Supplied Secret, and storing the
-signature in `-x sigfile` or, by default, in `message.sig`. You need
-to supply the public key file as well which `tkey-sign` will
-automatically verify that it's the expected public key.
-
-```
-tkey-sign -S/--sign [-d/--port device] [-s speed] -m message
-[--uss] [--uss-file secret-file] -p/--public pubkey [-x sig-file]
-```
+The key and signature files are compatible with OpenBSD's `signify(1)`
+but the way the signing works is not. Instead of signing the entire
+file `tkey-sign` signs a digest of the message. The hash algorithm can
+be SHA-512 (default) and BLAKE2s.
 
-Verify a signature of file `-m message` with public key in `-p pubkey`.
-Signature is by default in `message.sig` but can be specified
-with `-x sigfile`. Doesn't need a connected TKey.
+In order to be at least slightly compatible with `signify`,
+`tkey-sign` when using the SHA-512 digest, does it in a way that is
+compatible with:
 
 ```
-tkey-sign -V/--verify -m message -p/--public pubkey [-x sigfile]
+sha512sum message-file >digestfile
+signify -V -m digestfile -x message-file.sig -p key.pub
 ```
 
-Alternatively you can use OpenBSD's *signify(1)* to verify the
-signature but you need to compute the SHA-512 of the file first and
-feed that to the verification. We provide a handy script that does
-this:
+See the helper script `signify-verify`.
 
-```
-signify-verify message pubkey
-```
+NB! This is slightly worrisome since it potentially includes the path
+(not necessarily just basename) of the `message-file` into the message
+that is signed depending on how you call `sha512sum`.
 
-Exit code is 0 on success and non-zero on failure.
-
-See the manual page for details.
+There is no similar support for BLAKE2s digests.
 
 ## Examples
 
 All examples either load the device app automatically or works with an
 already loaded device app.
 
 Store the public key in a file.
+
 ```
 $ tkey-sign -G -p key.pub
 ```
@@ -98,8 +85,8 @@ $ go install github.com/tillitis/tkey-sign-cli/cmd/tkey-sign@latest
 After this the `tkey-sign` command should be available in your
 `$GOBIN` directory.
 
-Note that this doesn't set the version and other stuff you get if you
-use `make`.
+Note that this doesn't include the manual page and doesn't set the
+version you get with `make`.
 
 ### Building
 

RELEASE.md

@@ -1,5 +1,12 @@
 # Release notes
 
+## Upcoming release
+
+- Introduce package signify. Export Signify types to import and export
+  them to buffers and files.
+
+- Add support for BLAKE2s hashing.
+
 ## v1.1.1
 
 - Update tkeyclient to v1.3.1 to handle TKey Unlocked (product ID 8)