Safe Haskell	None
Language	Haskell2010

Codec.Encryption.OpenPGP.Signatures

Contents

Builder-based API (Phase 2)
Text normalization mode

Synopsis

data SignError
- = SignBackendError String
- | SignUnsupportedCertificationType SigType
- | SignUnsupportedKeySignatureType SigType
- | SignV6SaltSizeMismatch HashAlgorithm Word8 Int
- | SignProducedWrongLength String Int Int
renderSignError :: SignError -> String
data CertificationState
- = CertificationNotYetKnown
- | CertificationActive
- | CertificationRevoked
certificationStateAt :: Maybe UTCTime -> [(SignaturePayload, Verification)] -> (SignaturePayload, Verification) -> CertificationState
data VerificationError
- = IssuerSubpacketMismatch
- | IssuerSubpacketUncheckable String
- | IssuerKeyIdProhibitedInV6Signature
- | IssuerFingerprintSubpacketMismatch
- | UnsupportedCriticalSubpacket SigType
- | UnknownCriticalPacketInStream Word8
- | BrokenCriticalPacketInStream Word8 String
- | ExternalVerificationError String
- | NonSignaturePacket
- | UnexpectedSignaturePayloadShape
- | MissingHashAlgorithm
- | HashComputationFailed String
- | UnexpectedKeyVersion
- | SignatureHashUnsupportedByAlgorithm HashAlgorithm PubKeyAlgorithm
- | KeyRevoked
- | SigningKeyUnavailableAtSignatureTime
- | MissingIssuer
- | SigningKeyNotFound (Maybe EightOctetKeyId) (Maybe Fingerprint)
- | MultipleVerificationSuccesses Int
- | UnsupportedKeyType PubKeyAlgorithm
- | SignatureMismatch PubKeyAlgorithm Fingerprint
- | SignatureShapeMismatch PubKeyAlgorithm
- | SignatureEncodingInvalid PubKeyAlgorithm String
- | SignaturePolicyHashUnsupported HashAlgorithm
- | SignaturePolicyPKAMismatch PubKeyAlgorithm PubKeyAlgorithm
- | SignatureExpired
- | CandidateKeyFailures [VerificationError]
- | InvalidSubkeyBackSignature VerificationError
renderVerificationError :: VerificationError -> String
verifySigWith :: (Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification) -> Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification
verifyAgainstKeyring :: PublicKeyring -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
verifyAgainstKeys :: [TKUnknown] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
verifyTKWith :: forall (k :: TKKind). (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TK k -> Either VerificationError (TK k)
verifyUnknownTKWith :: (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TKUnknown -> Either VerificationError TKUnknown
signCertificationWithRSA :: SigType -> SomePKPayload -> UserId -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signDirectKeyWithRSA :: SigType -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signKeyRevocationWithRSA :: SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signSubkeyRevocationWithRSA :: SomePKPayload -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signCertRevocationWithRSA :: SomePKPayload -> UserId -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signUserIDwithRSA :: SomePKPayload -> UserId -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
crossSignSubkeyWithRSA :: SomePKPayload -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> PrivateKey -> Either SignError SignaturePayload
signDataWithEd25519 :: SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithEd25519V6 :: SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithEd448 :: SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithEd448V6 :: SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithRSA :: SigType -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithRSAV6 :: SigType -> SignatureSalt -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithRSABuilder :: SigBuilder Unhashed V4Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload
signDataWithRSAV6Builder :: SigBuilder Unhashed V6Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload
signDataWithEd25519Builder :: SigBuilder Unhashed V4Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload
signDataWithEd25519V6Builder :: SigBuilder Unhashed V6Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload
signDataWithEd448Builder :: SigBuilder Unhashed V4Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload
signDataWithEd448V6Builder :: SigBuilder Unhashed V6Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload
signDataWithAlgorithmicBuilder :: forall (algo :: PubKeyAlgorithm). BuilderSigningAlgorithm algo => SigBuilder Unhashed V4Sig algo -> PrivateKeyFor algo -> ByteString -> Either SignError SignaturePayload
data TextNormalizationMode
- = RFC9580Strict
- | CleartextCompat

Documentation

data SignError Source #

Constructors

SignBackendError String
SignUnsupportedCertificationType SigType
SignUnsupportedKeySignatureType SigType
SignV6SaltSizeMismatch HashAlgorithm Word8 Int
SignProducedWrongLength String Int Int

Instances

Instances details

Show SignError Source #
Instance details Defined in Codec.Encryption.OpenPGP.Signatures Methods showsPrec :: Int -> SignError -> ShowS Source # show :: SignError -> String Source # showList :: [SignError] -> ShowS Source #
Eq SignError Source #
Instance details Defined in Codec.Encryption.OpenPGP.Signatures Methods (==) :: SignError -> SignError -> Bool Source # (/=) :: SignError -> SignError -> Bool Source #

renderSignError :: SignError -> String Source #

data CertificationState Source #

Constructors

CertificationNotYetKnown
CertificationActive
CertificationRevoked

Instances

Instances details

Show CertificationState Source #
Instance details Defined in Codec.Encryption.OpenPGP.Signatures Methods showsPrec :: Int -> CertificationState -> ShowS Source # show :: CertificationState -> String Source # showList :: [CertificationState] -> ShowS Source #
Eq CertificationState Source #
Instance details Defined in Codec.Encryption.OpenPGP.Signatures Methods (==) :: CertificationState -> CertificationState -> Bool Source # (/=) :: CertificationState -> CertificationState -> Bool Source #

certificationStateAt :: Maybe UTCTime -> [(SignaturePayload, Verification)] -> (SignaturePayload, Verification) -> CertificationState Source #

data VerificationError Source #

Constructors

IssuerSubpacketMismatch
IssuerSubpacketUncheckable String
IssuerKeyIdProhibitedInV6Signature
IssuerFingerprintSubpacketMismatch
UnsupportedCriticalSubpacket SigType
UnknownCriticalPacketInStream Word8
BrokenCriticalPacketInStream Word8 String
ExternalVerificationError String
NonSignaturePacket
UnexpectedSignaturePayloadShape
MissingHashAlgorithm
HashComputationFailed String
UnexpectedKeyVersion
SignatureHashUnsupportedByAlgorithm HashAlgorithm PubKeyAlgorithm
KeyRevoked
SigningKeyUnavailableAtSignatureTime
MissingIssuer
SigningKeyNotFound (Maybe EightOctetKeyId) (Maybe Fingerprint)
MultipleVerificationSuccesses Int
UnsupportedKeyType PubKeyAlgorithm
SignatureMismatch PubKeyAlgorithm Fingerprint
SignatureShapeMismatch PubKeyAlgorithm
SignatureEncodingInvalid PubKeyAlgorithm String
SignaturePolicyHashUnsupported HashAlgorithm
SignaturePolicyPKAMismatch PubKeyAlgorithm PubKeyAlgorithm
SignatureExpired
CandidateKeyFailures [VerificationError]
InvalidSubkeyBackSignature VerificationError	An embedded primary-key back-signature (type 0x19) in a subkey binding signature failed to verify.

Instances

Instances details

Show VerificationError Source #
Instance details Defined in Codec.Encryption.OpenPGP.Signatures Methods showsPrec :: Int -> VerificationError -> ShowS Source # show :: VerificationError -> String Source # showList :: [VerificationError] -> ShowS Source #
Eq VerificationError Source #
Instance details Defined in Codec.Encryption.OpenPGP.Signatures Methods (==) :: VerificationError -> VerificationError -> Bool Source # (/=) :: VerificationError -> VerificationError -> Bool Source #

renderVerificationError :: VerificationError -> String Source #

verifySigWith :: (Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification) -> Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification Source #

verifyAgainstKeyring :: PublicKeyring -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #

verifyAgainstKeys :: [TKUnknown] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification Source #

verifyTKWith :: forall (k :: TKKind). (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TK k -> Either VerificationError (TK k) Source #

verifyUnknownTKWith :: (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TKUnknown -> Either VerificationError TKUnknown Source #

signCertificationWithRSA Source #

Arguments

:: SigType	certification type (GenericCert, PersonaCert, CasualCert, PositiveCert)
-> SomePKPayload	public key "payload" of user ID being signed
-> UserId	user ID being signed
-> [SigSubPacket]	hashed signature subpackets
-> [SigSubPacket]	unhashed signature subpackets
-> PrivateKey	RSA signing key
-> Either SignError SignaturePayload

signDirectKeyWithRSA Source #

Arguments

:: SigType	key-scoped signature type (SignatureDirectlyOnAKey or KeyRevocationSig)
-> SomePKPayload	primary key "payload" being signed
-> [SigSubPacket]	hashed signature subpackets
-> [SigSubPacket]	unhashed signature subpackets
-> PrivateKey	RSA signing key
-> Either SignError SignaturePayload

signKeyRevocationWithRSA Source #

Arguments

:: SomePKPayload	primary key "payload" being revoked
-> [SigSubPacket]	hashed signature subpackets
-> [SigSubPacket]	unhashed signature subpackets
-> PrivateKey	RSA signing key
-> Either SignError SignaturePayload

signSubkeyRevocationWithRSA Source #

Arguments

:: SomePKPayload	primary key "payload"
-> SomePKPayload	public subkey "payload" being revoked
-> [SigSubPacket]	hashed signature subpackets
-> [SigSubPacket]	unhashed signature subpackets
-> PrivateKey	RSA signing key
-> Either SignError SignaturePayload

signCertRevocationWithRSA Source #

Arguments

:: SomePKPayload	primary key "payload"
-> UserId	user ID certification being revoked
-> [SigSubPacket]	hashed signature subpackets
-> [SigSubPacket]	unhashed signature subpackets
-> PrivateKey	RSA signing key
-> Either SignError SignaturePayload

signUserIDwithRSA Source #

Arguments

:: SomePKPayload	public key "payload" of user ID being signed
-> UserId	user ID being signed
-> [SigSubPacket]	hashed signature subpackets
-> [SigSubPacket]	unhashed signature subpackets
-> PrivateKey	RSA signing key
-> Either SignError SignaturePayload

crossSignSubkeyWithRSA Source #

Arguments

:: SomePKPayload	public key "payload" of key being signed
-> SomePKPayload	public subkey "payload" of key being signed
-> [SigSubPacket]	hashed signature subpackets for binding sig
-> [SigSubPacket]	unhashed signature subpackets for binding sig
-> [SigSubPacket]	hashed signature subpackets for embedded sig
-> [SigSubPacket]	unhashed signature subpackets for embedded sig
-> PrivateKey	RSA signing key
-> PrivateKey	RSA signing subkey
-> Either SignError SignaturePayload

signDataWithEd25519 :: SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #

signDataWithEd25519V6 :: SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #

signDataWithEd448 :: SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #

signDataWithEd448V6 :: SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #

signDataWithRSA :: SigType -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #

signDataWithRSAV6 :: SigType -> SignatureSalt -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload Source #

Builder-based API (Phase 2)

signDataWithRSABuilder :: SigBuilder Unhashed V4Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload Source #

Builder-based signature creation for RSA

Example usage: builder <- sigBuilderInit BinarySig RSA SHA512 builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithRSABuilder builder'' rsaPrivateKey payload

signDataWithRSAV6Builder :: SigBuilder Unhashed V6Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload Source #

Builder-based signature creation for RSA (v6)

signDataWithEd25519Builder :: SigBuilder Unhashed V4Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #

Builder-based signature creation for Ed25519 (v4)

Example usage: builder <- sigBuilderInit BinarySig Ed25519 SHA512 builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithEd25519Builder builder'' ed25519PrivateKey payload

signDataWithEd25519V6Builder :: SigBuilder Unhashed V6Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #

Builder-based signature creation for Ed25519 (v6)

Example usage: builder <- sigBuilderInitV6 BinarySig Ed25519 SHA512 salt builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithEd25519V6Builder builder'' ed25519PrivateKey payload

signDataWithEd448Builder :: SigBuilder Unhashed V4Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #

Builder-based signature creation for Ed448 (v4)

Example usage: builder <- sigBuilderInit BinarySig Ed448 SHA512 builder' <- addHashedSubs hashedSubpackets builder builder'' <- addUnhashedSubs unhashedSubpackets builder' sig <- signDataWithEd448Builder builder'' ed448PrivateKey payload

signDataWithEd448V6Builder :: SigBuilder Unhashed V6Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload Source #

Builder-based signature creation for Ed448 (v6)

signDataWithAlgorithmicBuilder :: forall (algo :: PubKeyAlgorithm). BuilderSigningAlgorithm algo => SigBuilder Unhashed V4Sig algo -> PrivateKeyFor algo -> ByteString -> Either SignError SignaturePayload Source #

Text normalization mode

data TextNormalizationMode Source #

Controls how text payload is normalized for CanonicalTextSig.

RFC 9580 §5.2.1.2 requires only CRLF normalization for type 0x01 signatures. Trailing-whitespace stripping is only mandated by §7 (Cleartext Signature Framework). Use CleartextCompat for GnuPG-compatible behaviour when producing cleartext-armored signatures; use RFC9580Strict for inline text signatures.

Constructors

RFC9580Strict	CRLF normalization only; no trailing-whitespace stripping. Correct for inline type 0x01 document signatures.
CleartextCompat	CRLF normalization plus per-line trailing-whitespace stripping. Required by the Cleartext Signature Framework (RFC 9580 §7).

Instances

Instances details

Show TextNormalizationMode Source #
Instance details Defined in Codec.Encryption.OpenPGP.Subpackets Methods showsPrec :: Int -> TextNormalizationMode -> ShowS Source # show :: TextNormalizationMode -> String Source # showList :: [TextNormalizationMode] -> ShowS Source #
Eq TextNormalizationMode Source #
Instance details Defined in Codec.Encryption.OpenPGP.Subpackets Methods (==) :: TextNormalizationMode -> TextNormalizationMode -> Bool Source # (/=) :: TextNormalizationMode -> TextNormalizationMode -> Bool Source #