| Safe Haskell | None |
|---|---|
| Language | Haskell2010 |
Codec.Encryption.OpenPGP.Signatures
Synopsis
- data SignError
- renderSignError :: SignError -> String
- data CertificationState
- certificationStateAt :: Maybe UTCTime -> [(SignaturePayload, Verification)] -> (SignaturePayload, Verification) -> CertificationState
- data VerificationError
- = IssuerSubpacketMismatch
- | IssuerSubpacketUncheckable String
- | IssuerKeyIdProhibitedInV6Signature
- | IssuerFingerprintSubpacketMismatch
- | UnsupportedCriticalSubpacket SigType
- | UnknownCriticalPacketInStream Word8
- | BrokenCriticalPacketInStream Word8 String
- | ExternalVerificationError String
- | NonSignaturePacket
- | UnexpectedSignaturePayloadShape
- | MissingHashAlgorithm
- | HashComputationFailed String
- | UnexpectedKeyVersion
- | SignatureHashUnsupportedByAlgorithm HashAlgorithm PubKeyAlgorithm
- | KeyRevoked
- | SigningKeyUnavailableAtSignatureTime
- | MissingIssuer
- | SigningKeyNotFound (Maybe EightOctetKeyId) (Maybe Fingerprint)
- | MultipleVerificationSuccesses Int
- | UnsupportedKeyType PubKeyAlgorithm
- | SignatureMismatch PubKeyAlgorithm Fingerprint
- | SignatureShapeMismatch PubKeyAlgorithm
- | SignatureEncodingInvalid PubKeyAlgorithm String
- | SignaturePolicyHashUnsupported HashAlgorithm
- | SignaturePolicyPKAMismatch PubKeyAlgorithm PubKeyAlgorithm
- | SignatureExpired
- | CandidateKeyFailures [VerificationError]
- | InvalidSubkeyBackSignature VerificationError
- renderVerificationError :: VerificationError -> String
- verifySigWith :: VerificationPolicy -> (Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification) -> Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification
- verifyAgainstKeyring :: PublicKeyring -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
- verifyAgainstKeys :: [TK 'PublicTK] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
- verifyAgainstKeysWithPolicy :: VerificationPolicy -> [TK 'PublicTK] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
- verifyAgainstPKPs :: [SomePKPayload] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
- verifyAgainstPKPsWithPolicy :: VerificationPolicy -> [SomePKPayload] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
- verifyTKWith :: forall (k :: TKKind). (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TK k -> Either VerificationError (TK k)
- signUserId :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> SigType -> KeyPkt 'SecretPkt -> UserId -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload)
- signUat :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> SigType -> KeyPkt 'SecretPkt -> UserAttribute -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload)
- signDirectKey :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> SigType -> KeyPkt 'SecretPkt -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload)
- signSubkeyBinding :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> KeyPkt 'SecretPkt -> KeyPkt 'SecretPkt -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload)
- signSubkeyRevocation :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> KeyPkt 'SecretPkt -> KeyPkt 'SecretPkt -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload)
- signCertRevocation :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> KeyPkt 'SecretPkt -> UserId -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload)
- crossSignSubkeyWithRSA :: HashAlgorithm -> SomePKPayload -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> PrivateKey -> Either SignError SignaturePayload
- signDataWithEd25519 :: HashAlgorithm -> SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataWithEd25519Legacy :: HashAlgorithm -> SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataWithEd25519V6 :: HashAlgorithm -> SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataWithEd448 :: HashAlgorithm -> SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataWithEd448V6 :: HashAlgorithm -> SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataWithRSA :: HashAlgorithm -> SigType -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataWithRSAV6 :: HashAlgorithm -> SigType -> SignatureSalt -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
- signDataV6 :: SignablePrivateKeyV6 key => HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> key -> Either SignError SignaturePayload
- payloadForUserId :: SomePKPayload -> UserId -> ByteString
- payloadForUat :: SomePKPayload -> UserAttribute -> ByteString
- payloadForDirectKey :: SomePKPayload -> ByteString
- payloadForSubkeyRevocation :: SomePKPayload -> SomePKPayload -> ByteString
- payloadForCertRevocation :: SomePKPayload -> UserId -> ByteString
- payloadForSubkeyBinding :: SomePKPayload -> SomePKPayload -> ByteString
- payloadForPrimaryKeyBinding :: SomePKPayload -> SomePKPayload -> ByteString
- class SignablePrivateKey key where
- signPayloadWith :: HashAlgorithm -> SigType -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> key -> Either SignError SignaturePayload
- class SignablePrivateKeyV6 key where
- signPayloadWithV6 :: HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> key -> Either SignError SignaturePayload
- signDataWithRSABuilder :: SigBuilder Unhashed V4Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload
- signDataWithRSAV6Builder :: SigBuilder Unhashed V6Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload
- signDataWithEd25519Builder :: SigBuilder Unhashed V4Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload
- signDataWithEd25519V6Builder :: SigBuilder Unhashed V6Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload
- signDataWithEd448Builder :: SigBuilder Unhashed V4Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload
- signDataWithEd448V6Builder :: SigBuilder Unhashed V6Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload
- signDataWithAlgorithmicBuilder :: forall (algo :: PubKeyAlgorithm). BuilderSigningAlgorithm algo => SigBuilder Unhashed V4Sig algo -> PrivateKeyFor algo -> ByteString -> Either SignError SignaturePayload
- data TextNormalizationMode
Verification
Constructors
| SignBackendError String | |
| SignUnsupportedCertificationType SigType | |
| SignUnsupportedKeySignatureType SigType | |
| SignV6SaltSizeMismatch HashAlgorithm Word8 Int | |
| SignProducedWrongLength String Int Int |
renderSignError :: SignError -> String Source #
data CertificationState Source #
Instances
| Show CertificationState Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures | |
| Eq CertificationState Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods (==) :: CertificationState -> CertificationState -> Bool Source # (/=) :: CertificationState -> CertificationState -> Bool Source # | |
certificationStateAt :: Maybe UTCTime -> [(SignaturePayload, Verification)] -> (SignaturePayload, Verification) -> CertificationState Source #
data VerificationError Source #
Constructors
Instances
| Show VerificationError Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures | |
| Eq VerificationError Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods (==) :: VerificationError -> VerificationError -> Bool Source # (/=) :: VerificationError -> VerificationError -> Bool Source # | |
verifySigWith :: VerificationPolicy -> (Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification) -> Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification Source #
verifyAgainstKeyring :: PublicKeyring -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #
verifyAgainstKeys :: [TK 'PublicTK] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #
verifyAgainstKeysWithPolicy :: VerificationPolicy -> [TK 'PublicTK] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #
Verify a signature against a list of keys with a custom verification policy.
verifyAgainstPKPs :: [SomePKPayload] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #
verifyAgainstPKPsWithPolicy :: VerificationPolicy -> [SomePKPayload] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #
Verify a signature against a list of public key payloads with a custom verification policy.
verifyTKWith :: forall (k :: TKKind). (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TK k -> Either VerificationError (TK k) Source #
signUserId :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> SigType -> KeyPkt 'SecretPkt -> UserId -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload) Source #
signUat :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> SigType -> KeyPkt 'SecretPkt -> UserAttribute -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload) Source #
signDirectKey :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> SigType -> KeyPkt 'SecretPkt -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload) Source #
signSubkeyBinding :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> KeyPkt 'SecretPkt -> KeyPkt 'SecretPkt -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload) Source #
signSubkeyRevocation :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> KeyPkt 'SecretPkt -> KeyPkt 'SecretPkt -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload) Source #
signCertRevocation :: (MonadRandom m, SignablePrivateKey key, SignablePrivateKeyV6 key) => HashAlgorithm -> KeyPkt 'SecretPkt -> UserId -> [SigSubPacket] -> [SigSubPacket] -> key -> m (Either SignError SignaturePayload) Source #
crossSignSubkeyWithRSA Source #
Arguments
| :: HashAlgorithm | |
| -> SomePKPayload | public key "payload" of key being signed |
| -> SomePKPayload | public subkey "payload" of key being signed |
| -> [SigSubPacket] | hashed signature subpackets for binding sig |
| -> [SigSubPacket] | unhashed signature subpackets for binding sig |
| -> [SigSubPacket] | hashed signature subpackets for embedded sig |
| -> [SigSubPacket] | unhashed signature subpackets for embedded sig |
| -> PrivateKey | RSA signing key |
| -> PrivateKey | RSA signing subkey |
| -> Either SignError SignaturePayload |
signDataWithEd25519 :: HashAlgorithm -> SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataWithEd25519Legacy :: HashAlgorithm -> SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataWithEd25519V6 :: HashAlgorithm -> SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataWithEd448 :: HashAlgorithm -> SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataWithEd448V6 :: HashAlgorithm -> SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataWithRSA :: HashAlgorithm -> SigType -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataWithRSAV6 :: HashAlgorithm -> SigType -> SignatureSalt -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #
signDataV6 :: SignablePrivateKeyV6 key => HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> key -> Either SignError SignaturePayload Source #
Payload builders
payloadForUserId :: SomePKPayload -> UserId -> ByteString Source #
payloadForUat :: SomePKPayload -> UserAttribute -> ByteString Source #
SignablePrivateKey typeclass
class SignablePrivateKey key where Source #
Methods
signPayloadWith :: HashAlgorithm -> SigType -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> key -> Either SignError SignaturePayload Source #
Instances
| SignablePrivateKey SecretKey Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods signPayloadWith :: HashAlgorithm -> SigType -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> SecretKey -> Either SignError SignaturePayload Source # | |
| SignablePrivateKey SecretKey Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods signPayloadWith :: HashAlgorithm -> SigType -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> SecretKey -> Either SignError SignaturePayload Source # | |
| SignablePrivateKey PrivateKey Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods signPayloadWith :: HashAlgorithm -> SigType -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> PrivateKey -> Either SignError SignaturePayload Source # | |
class SignablePrivateKeyV6 key where Source #
Methods
signPayloadWithV6 :: HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> key -> Either SignError SignaturePayload Source #
Instances
| SignablePrivateKeyV6 SecretKey Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods signPayloadWithV6 :: HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> SecretKey -> Either SignError SignaturePayload Source # | |
| SignablePrivateKeyV6 SecretKey Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods signPayloadWithV6 :: HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> SecretKey -> Either SignError SignaturePayload Source # | |
| SignablePrivateKeyV6 PrivateKey Source # | |
Defined in Codec.Encryption.OpenPGP.Signatures Methods signPayloadWithV6 :: HashAlgorithm -> SigType -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> PrivateKey -> Either SignError SignaturePayload Source # | |
Builder-based API (Phase 2)
signDataWithRSABuilder :: SigBuilder Unhashed V4Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload Source #
Builder-based signature creation for RSA
Example usage: builder <- sigBuilderInit BinarySig RSA SHA512 builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithRSABuilder builder'' rsaPrivateKey payload
signDataWithRSAV6Builder :: SigBuilder Unhashed V6Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload Source #
Builder-based signature creation for RSA (v6)
signDataWithEd25519Builder :: SigBuilder Unhashed V4Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #
Builder-based signature creation for Ed25519 (v4)
Example usage: builder <- sigBuilderInit BinarySig Ed25519 SHA512 builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithEd25519Builder builder'' ed25519PrivateKey payload
signDataWithEd25519V6Builder :: SigBuilder Unhashed V6Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #
Builder-based signature creation for Ed25519 (v6)
Example usage: builder <- sigBuilderInitV6 BinarySig Ed25519 SHA512 salt builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithEd25519V6Builder builder'' ed25519PrivateKey payload
signDataWithEd448Builder :: SigBuilder Unhashed V4Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #
Builder-based signature creation for Ed448 (v4)
Example usage: builder <- sigBuilderInit BinarySig Ed448 SHA512 builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithEd448Builder builder'' ed448PrivateKey payload
signDataWithEd448V6Builder :: SigBuilder Unhashed V6Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #
Builder-based signature creation for Ed448 (v6)
signDataWithAlgorithmicBuilder :: forall (algo :: PubKeyAlgorithm). BuilderSigningAlgorithm algo => SigBuilder Unhashed V4Sig algo -> PrivateKeyFor algo -> ByteString -> Either SignError SignaturePayload Source #
Text normalization mode
data TextNormalizationMode Source #
Controls how text payload is normalized for CanonicalTextSig.
RFC 9580 §5.2.1.2 requires only CRLF normalization for type 0x01
signatures. Trailing-whitespace stripping is only mandated by
§7 (Cleartext Signature Framework). Use CleartextCompat for
GnuPG-compatible behaviour when producing cleartext-armored
signatures; use RFC9580Strict for inline text signatures.
Constructors
| RFC9580Strict | CRLF normalization only; no trailing-whitespace stripping. Correct for inline type 0x01 document signatures. |
| CleartextCompat | CRLF normalization *plus* per-line trailing-whitespace stripping. Required by the Cleartext Signature Framework (RFC 9580 §7). |
Instances
| Show TextNormalizationMode Source # | |
Defined in Codec.Encryption.OpenPGP.Subpackets | |
| Eq TextNormalizationMode Source # | |
Defined in Codec.Encryption.OpenPGP.Subpackets Methods (==) :: TextNormalizationMode -> TextNormalizationMode -> Bool Source # (/=) :: TextNormalizationMode -> TextNormalizationMode -> Bool Source # | |