Documentation
¶
Overview ¶
Package jwssign implements JWS compact serialization signing via PKCS#11. It supports SoftHSM2 and YubiHSM2 backends for the 3-tier signing model (dev/softhsm/yubihsm).
Index ¶
- func ParsePKCS11URI(uri string) (module, token, pin string, err error)
- type Config
- type Signer
- func (s *Signer) Close() error
- func (s *Signer) JWKS() jose.JSONWebKeySet
- func (s *Signer) PublicJWK() jose.JSONWebKey
- func (s *Signer) Sign(payload json.RawMessage) (string, error)
- func (s *Signer) SignAggregate(dir, pattern, outputPath string) error
- func (s *Signer) SignDirectory(dir, pattern string) ([]string, error)
- func (s *Signer) SignFile(jsonPath string) (string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ParsePKCS11URI ¶
ParsePKCS11URI parses a PKCS#11 URI into module, token, and pin components. Format: pkcs11:module=/path/to/lib.so;token=label;pin=1234
Types ¶
type Config ¶
type Config struct {
// PKCS11Module is the path to the PKCS#11 shared library.
PKCS11Module string
// TokenLabel is the PKCS#11 token label.
TokenLabel string
// PIN is the PKCS#11 token PIN.
PIN string
// KeyLabel is the label of the signing key in the HSM.
KeyLabel string
// KeyID is the hex ID of the key (default "01").
KeyID string
// Issuer is the JWT "iss" claim.
Issuer string
// JKU is the JWS Key URL header value.
JKU string
}
Config holds the configuration for creating a Signer.
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer signs JSON payloads as JWS compact serialization.
func NewSignerFromConfig ¶
NewSignerFromConfig creates a signer from a parsed PKCS11 URI string.
func (*Signer) JWKS ¶
func (s *Signer) JWKS() jose.JSONWebKeySet
JWKS returns a JSON Web Key Set containing the public key.
func (*Signer) PublicJWK ¶
func (s *Signer) PublicJWK() jose.JSONWebKey
PublicJWK returns the public key as a JSON Web Key.
func (*Signer) Sign ¶
func (s *Signer) Sign(payload json.RawMessage) (string, error)
Sign signs a JSON payload and returns a JWS compact serialization string. The payload is wrapped in a JWT envelope with iss and iat claims.
func (*Signer) SignAggregate ¶
SignAggregate reads all JSON files matching a pattern, combines them into a list payload, signs it, and writes to the output path.
func (*Signer) SignDirectory ¶
SignDirectory signs all files matching a glob pattern in a directory.
Source Files