{"header":{"message":"Adding a handler for the sshsig format","description":null,"timestamp":"2026-06-20T13:36:27.891573156Z","authors":[{}]},"hash":"OLTQZKVMFVGGX5CPTACH7ECKDVINGJE2RVFG6NJ5WWRTCDZQTVTAC","authors":[{"key":"4a2HRdWi1jDSEAsuk3yWcagztBipc84Wt9boC5pMhy5B"}],"deps":{"hashes":[["OLTQZKVMFVGGX5CPTACH7ECKDVINGJE2RVFG6NJ5WWRTCDZQTVTAC","Adding a handler for the sshsig format"],["AA",null],["7FRJYUI62VW257VVFQXND6OKSAILVTHGEJCXFE6CG6FIOIUTDVYAC","Reboot because of a bad change"]],"deps":["7FRJYUI62VW257VVFQXND6OKSAILVTHGEJCXFE6CG6FIOIUTDVYAC"],"known":[]},"hunks":[{"FileAdd":{"meta":{"basename":"sshsig.rs","metadata":0},"context":[{"change":2,"pos":71328}],"contents":[{"Add":"use byteorder::{BigEndian, WriteBytesExt};"},{"Add":"use sha2::Digest;"},{"Add":""},{"Add":"use crate::encoding::{Encoding, Reader};"},{"Add":"use crate::key::{self, KeyPair, PublicKey};"},{"Add":"use crate::signature::Signature;"},{"Add":"use crate::{Error, PublicKeyBase64};"},{"Add":""},{"Add":"const MAGIC_PREAMBLE: &[u8] = b\"SSHSIG\";"},{"Add":"const SIG_VERSION: u32 = 0x01;"},{"Add":"const BEGIN_ARMOR: &str = \"-----BEGIN SSH SIGNATURE-----\";"},{"Add":"const END_ARMOR: &str = \"-----END SSH SIGNATURE-----\";"},{"Add":""},{"Add":"/// An SSH signature in the format described in OpenSSH's PROTOCOL.sshsig."},{"Add":"///"},{"Add":"/// The PEM-armored form looks like:"},{"Add":"/// ```text"},{"Add":"/// -----BEGIN SSH SIGNATURE-----"},{"Add":"/// U1NIU0lHAAAAAQ..."},{"Add":"/// -----END SSH SIGNATURE-----"},{"Add":"/// ```"},{"Add":"pub struct SshSig {"},{"Add":" pub version: u32,"},{"Add":" pub public_key: PublicKey,"},{"Add":" /// Namespace (e.g. `\"git\"`, `\"file\"`) — must not be empty."},{"Add":" pub namespace: String,"},{"Add":" pub reserved: Vec,"},{"Add":" /// `\"sha256\"` or `\"sha512\"`."},{"Add":" pub hash_algorithm: String,"},{"Add":" /// Inner SSH-format signature blob: `string sig_type, string sig_bytes`."},{"Add":" pub signature: Vec,"},{"Add":"}"},{"Add":""},{"Add":"impl SshSig {"},{"Add":" /// Parse an sshsig from its raw binary encoding."},{"Add":" pub fn from_bytes(data: &[u8]) -> Result {"},{"Add":" if data.len() < MAGIC_PREAMBLE.len()"},{"Add":" || &data[..MAGIC_PREAMBLE.len()] != MAGIC_PREAMBLE"},{"Add":" {"},{"Add":" return Err(Error::CouldNotReadKey);"},{"Add":" }"},{"Add":" let mut reader = data.reader(MAGIC_PREAMBLE.len());"},{"Add":" let version = reader.read_u32()?;"},{"Add":" if version != SIG_VERSION {"},{"Add":" return Err(Error::CouldNotReadKey);"},{"Add":" }"},{"Add":" let public_key_bytes = reader.read_string()?;"},{"Add":" let mut public_key = key::parse_public_key(public_key_bytes)?;"},{"Add":" let namespace = std::str::from_utf8(reader.read_string()?)"},{"Add":" .map_err(|_| Error::CouldNotReadKey)?"},{"Add":" .to_string();"},{"Add":" let reserved = reader.read_string()?.to_vec();"},{"Add":" let hash_algorithm = std::str::from_utf8(reader.read_string()?)"},{"Add":" .map_err(|_| Error::CouldNotReadKey)?"},{"Add":" .to_string();"},{"Add":" let signature = reader.read_string()?.to_vec();"},{"Add":" // For RSA keys the hash is determined by the signature type, not the"},{"Add":" // public-key blob (which defaults to SHA2-256). Update it now so that"},{"Add":" // verify_detached uses the correct digest."},{"Add":" if let Ok(sig_type) = signature.reader(0).read_string() {"},{"Add":" public_key.set_algorithm(sig_type);"},{"Add":" }"},{"Add":" Ok(SshSig {"},{"Add":" version,"},{"Add":" public_key,"},{"Add":" namespace,"},{"Add":" reserved,"},{"Add":" hash_algorithm,"},{"Add":" signature,"},{"Add":" })"},{"Add":" }"},{"Add":""},{"Add":" /// Parse an sshsig from its PEM-armored text form."},{"Add":" pub fn from_pem(pem: &str) -> Result {"},{"Add":" let mut in_sig = false;"},{"Add":" let mut base64_data = String::new();"},{"Add":" for line in pem.lines() {"},{"Add":" let line = line.trim();"},{"Add":" if line == BEGIN_ARMOR {"},{"Add":" in_sig = true;"},{"Add":" continue;"},{"Add":" }"},{"Add":" if line == END_ARMOR {"},{"Add":" break;"},{"Add":" }"},{"Add":" if in_sig {"},{"Add":" base64_data.push_str(line);"},{"Add":" }"},{"Add":" }"},{"Add":" if base64_data.is_empty() {"},{"Add":" return Err(Error::CouldNotReadKey);"},{"Add":" }"},{"Add":" let bytes = data_encoding::BASE64_MIME.decode(base64_data.as_bytes())?;"},{"Add":" Self::from_bytes(&bytes)"},{"Add":" }"},{"Add":""},{"Add":" /// Serialize this sshsig to its raw binary encoding."},{"Add":" pub fn to_bytes(&self) -> Result, Error> {"},{"Add":" let mut out: Vec = Vec::new();"},{"Add":" out.extend_from_slice(MAGIC_PREAMBLE);"},{"Add":" out.write_u32::(self.version)?;"},{"Add":" out.extend_ssh_string(&self.public_key.public_key_bytes());"},{"Add":" out.extend_ssh_string(self.namespace.as_bytes());"},{"Add":" out.extend_ssh_string(&self.reserved);"},{"Add":" out.extend_ssh_string(self.hash_algorithm.as_bytes());"},{"Add":" out.extend_ssh_string(&self.signature);"},{"Add":" Ok(out)"},{"Add":" }"},{"Add":""},{"Add":" /// Serialize this sshsig to its PEM-armored text form."},{"Add":" pub fn to_pem(&self) -> Result {"},{"Add":" let bytes = self.to_bytes()?;"},{"Add":" let encoded = data_encoding::BASE64_MIME"},{"Add":" .encode(&bytes)"},{"Add":" .replace(\"\\r\\n\", \"\\n\");"},{"Add":" let mut result = String::new();"},{"Add":" result.push_str(BEGIN_ARMOR);"},{"Add":" result.push('\\n');"},{"Add":" result.push_str(&encoded);"},{"Add":" result.push_str(END_ARMOR);"},{"Add":" result.push('\\n');"},{"Add":" Ok(result)"},{"Add":" }"},{"Add":""},{"Add":" /// Compute the blob that is actually signed/verified, per PROTOCOL.sshsig:"},{"Add":" ///"},{"Add":" /// ```text"},{"Add":" /// \"SSHSIG\" string namespace string reserved string hash_algorithm string H(message)"},{"Add":" /// ```"},{"Add":" fn signed_payload("},{"Add":" namespace: &str,"},{"Add":" reserved: &[u8],"},{"Add":" hash_algorithm: &str,"},{"Add":" message: &[u8],"},{"Add":" ) -> Result, Error> {"},{"Add":" let hash: Vec = match hash_algorithm {"},{"Add":" \"sha256\" => sha2::Sha256::digest(message).to_vec(),"},{"Add":" \"sha512\" => sha2::Sha512::digest(message).to_vec(),"},{"Add":" _ => return Err(Error::CouldNotReadKey),"},{"Add":" };"},{"Add":" let mut blob: Vec = Vec::new();"},{"Add":" blob.extend_from_slice(MAGIC_PREAMBLE);"},{"Add":" blob.extend_ssh_string(namespace.as_bytes());"},{"Add":" blob.extend_ssh_string(reserved);"},{"Add":" blob.extend_ssh_string(hash_algorithm.as_bytes());"},{"Add":" blob.extend_ssh_string(&hash);"},{"Add":" Ok(blob)"},{"Add":" }"},{"Add":""},{"Add":" /// Verify the signature against `message`."},{"Add":" ///"},{"Add":" /// Returns `Ok(true)` if the signature is valid, `Ok(false)` otherwise."},{"Add":" pub fn verify(&self, message: &[u8]) -> Result {"},{"Add":" let payload ="},{"Add":" Self::signed_payload(&self.namespace, &self.reserved, &self.hash_algorithm, message)?;"},{"Add":" let mut sig_reader = self.signature.reader(0);"},{"Add":" let _sig_type = sig_reader.read_string()?;"},{"Add":" let sig_bytes = sig_reader.read_string()?;"},{"Add":" Ok(self.public_key.verify_detached(&payload, sig_bytes))"},{"Add":" }"},{"Add":""},{"Add":" /// Sign `message` with `key`, producing an `SshSig`."},{"Add":" ///"},{"Add":" /// `namespace` identifies the signing context (e.g. `\"git\"` or `\"file\"`)."},{"Add":" /// `hash_algorithm` must be `\"sha256\"` or `\"sha512\"`."},{"Add":" #[allow(unreachable_patterns)]"},{"Add":" pub fn sign("},{"Add":" key: &KeyPair,"},{"Add":" namespace: &str,"},{"Add":" message: &[u8],"},{"Add":" hash_algorithm: &str,"},{"Add":" ) -> Result {"},{"Add":" let payload = Self::signed_payload(namespace, &[], hash_algorithm, message)?;"},{"Add":" let sig = key.sign_detached(&payload)?;"},{"Add":" let mut signature: Vec = Vec::new();"},{"Add":" match &sig {"},{"Add":" Signature::Ed25519(ref bytes) => {"},{"Add":" signature.extend_ssh_string(b\"ssh-ed25519\");"},{"Add":" signature.extend_ssh_string(&bytes.0[..]);"},{"Add":" }"},{"Add":" #[cfg(feature = \"openssl\")]"},{"Add":" Signature::RSA { ref hash, ref bytes } => {"},{"Add":" let name: &[u8] = match hash {"},{"Add":" key::SignatureHash::SHA2_256 => b\"rsa-sha2-256\","},{"Add":" key::SignatureHash::SHA2_512 => b\"rsa-sha2-512\","},{"Add":" key::SignatureHash::SHA1 => b\"ssh-rsa\","},{"Add":" };"},{"Add":" signature.extend_ssh_string(name);"},{"Add":" signature.extend_ssh_string(bytes);"},{"Add":" }"},{"Add":" #[cfg(feature = \"p256\")]"},{"Add":" Signature::P256(ref bytes) => {"},{"Add":" signature.extend_ssh_string(b\"ecdsa-sha2-nistp256\");"},{"Add":" signature.extend_ssh_string(bytes);"},{"Add":" }"},{"Add":" // RSA and P256 variants exist in the enum even when features are"},{"Add":" // disabled; they simply cannot be constructed in that case."},{"Add":" _ => return Err(Error::CouldNotReadKey),"},{"Add":" }"},{"Add":" Ok(SshSig {"},{"Add":" version: SIG_VERSION,"},{"Add":" public_key: key.clone_public_key(),"},{"Add":" namespace: namespace.to_string(),"},{"Add":" reserved: Vec::new(),"},{"Add":" hash_algorithm: hash_algorithm.to_string(),"},{"Add":" signature,"},{"Add":" })"},{"Add":" }"},{"Add":"}"},{"Add":""},{"Add":"#[cfg(test)]"},{"Add":"mod tests {"},{"Add":" use super::*;"},{"Add":" use crate::format::decode_secret_key;"},{"Add":""},{"Add":" const ED25519_KEY: &str = \"-----BEGIN OPENSSH PRIVATE KEY-----"},{"Add":"b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABDLGyfA39"},{"Add":"J2FcJygtYqi5ISAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIN+Wjn4+4Fcvl2Jl"},{"Add":"KpggT+wCRxpSvtqqpVrQrKN1/A22AAAAkOHDLnYZvYS6H9Q3S3Nk4ri3R2jAZlQlBbUos5"},{"Add":"FkHpYgNw65KCWCTXtP7ye2czMC3zjn2r98pJLobsLYQgRiHIv/CUdAdsqbvMPECB+wl/UQ"},{"Add":"e+JpiSq66Z6GIt0801skPh20jxOO3F52SoX1IeO5D5PXfZrfSZlw6S8c7bwyp2FHxDewRx"},{"Add":"7/wNsnDM0T7nLv/Q=="},{"Add":"-----END OPENSSH PRIVATE KEY-----\";"},{"Add":""},{"Add":" #[test]"},{"Add":" fn roundtrip_sign_verify() {"},{"Add":" let key = decode_secret_key(ED25519_KEY, Some(\"blabla\")).unwrap();"},{"Add":" let message = b\"hello, sshsig\";"},{"Add":""},{"Add":" let sig = SshSig::sign(&key, \"test\", message, \"sha256\").unwrap();"},{"Add":" assert!(sig.verify(message).unwrap());"},{"Add":" assert!(!sig.verify(b\"wrong message\").unwrap());"},{"Add":" }"},{"Add":""},{"Add":" #[test]"},{"Add":" fn roundtrip_pem() {"},{"Add":" let key = decode_secret_key(ED25519_KEY, Some(\"blabla\")).unwrap();"},{"Add":" let message = b\"pem roundtrip\";"},{"Add":""},{"Add":" let sig = SshSig::sign(&key, \"test\", message, \"sha256\").unwrap();"},{"Add":" let pem = sig.to_pem().unwrap();"},{"Add":""},{"Add":" assert!(pem.starts_with(BEGIN_ARMOR));"},{"Add":" assert!(pem.contains(END_ARMOR));"},{"Add":""},{"Add":" let sig2 = SshSig::from_pem(&pem).unwrap();"},{"Add":" assert!(sig2.verify(message).unwrap());"},{"Add":" }"},{"Add":""},{"Add":" #[test]"},{"Add":" fn roundtrip_sha512() {"},{"Add":" let key = decode_secret_key(ED25519_KEY, Some(\"blabla\")).unwrap();"},{"Add":" let message = b\"sha512 test\";"},{"Add":""},{"Add":" let sig = SshSig::sign(&key, \"file\", message, \"sha512\").unwrap();"},{"Add":" assert!(sig.verify(message).unwrap());"},{"Add":""},{"Add":" let pem = sig.to_pem().unwrap();"},{"Add":" let sig2 = SshSig::from_pem(&pem).unwrap();"},{"Add":" assert!(sig2.verify(message).unwrap());"},{"Add":" }"},{"Add":"}"}]}},{"Edit":{"inode":{"change":2,"pos":92032},"path":"ssh-keys/src/format/mod.rs","line":23,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":92293}],"down_context":[{"change":2,"pos":92293}],"flag":"BLOCK","start":9607,"end":9654,"inode":{"change":2,"pos":92032}}},"contents":[{"Add":"pub mod sshsig;"},{"Add":"pub use self::sshsig::SshSig;"},{"Add":""}]}},{"Edit":{"inode":{"change":2,"pos":157024},"path":"ssh-keys/Cargo.toml","line":26,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":157703}],"down_context":[{"change":2,"pos":157703}],"flag":"BLOCK","start":9655,"end":9679,"inode":{"change":2,"pos":157024}}},"contents":[{"Add":"\"src/format/sshsig.rs\","}]}}],"owner":"pijul","repo":"thrussh","token":"CY154V3dnR3gPCZscPDji21gbOqvf6HCLhT1bsJEg18=","login":null}

…

Dependencies

Change contents