pqsig

package

v0.1.0-alpha01 Latest Latest Go to latest Published: Oct 24, 2026 License: MIT Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/stackql/stackql-provider-registry

Links

Open Source Insights

Documentation ¶

Overview ¶

Package pqsig signs and verifies provider documents using FIPS 204 ML-DSA-65.

Index ¶

Constants
func Sign(doc []byte, kid string, key *mldsa.PrivateKey) ([]byte, error)
func Validate(data []byte) error
type Verifier
- func NewVerifier(keys map[string]string) (Verifier, error)
type VerifierConfig

Constants ¶

View Source

const (
	Algorithm      = "ML-DSA-65"
	Context        = "stackql-provider-doc-bytes-v1"
	SignatureField = "x-stackql-signature"
)

Variables ¶

This section is empty.

Functions ¶

func Sign ¶

func Sign(doc []byte, kid string, key *mldsa.PrivateKey) ([]byte, error)

Sign appends a strictly framed signature field without re-encoding the payload. An existing raw-v1 frame is replaced. The separating newline is not payload.

func Validate ¶

func Validate(data []byte) error

Validate checks that an unsigned payload can carry the signature's final top-level YAML field. Values, aliases, numbers and formatting are not rewritten.

Types ¶

type Verifier ¶

type Verifier interface {
	Verify(doc []byte) ([]byte, error)
}

Verifier authenticates a document and returns the exact signed payload bytes. Callers must parse these returned bytes, not the envelope-bearing document.

func NewVerifier ¶

func NewVerifier(keys map[string]string) (Verifier, error)

NewVerifier copies and validates a kid -> hex public key trust store. nil selects the embedded production keys. An empty trust store is an error.

type VerifierConfig ¶

type VerifierConfig struct {
	NopVerify  bool              `json:"nopVerify" yaml:"nopVerify"`
	PublicKeys map[string]string `json:"publicKeys,omitempty" yaml:"publicKeys,omitempty"`
}

VerifierConfig is the registry's opt-in verification configuration. A nil PublicKeys uses the embedded trust roots; an explicit keyset replaces them.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL