Merge pull request #2896 from mtrmac/simplesequoia-stub

mtrmac · web-flow · commit e41267885f05 · 2025-07-11T14:12:07.000+02:00
Add a new Signer API for creating simple signing signatures with Sequoia-PGP
diff --git a/signature/simplesequoia/options.go b/signature/simplesequoia/options.go
@@ -0,0 +1,37 @@
+package simplesequoia
+
+import (
+	"errors"
+	"strings"
+)
+
+type Option func(*simpleSequoiaSigner) error
+
+// WithSequoiaHome returns an Option for NewSigner, specifying a Sequoia home directory to use.
+func WithSequoiaHome(sequoiaHome string) Option {
+	return func(s *simpleSequoiaSigner) error {
+		s.sequoiaHome = sequoiaHome
+		return nil
+	}
+}
+
+// WithKeyFingerprint returns an Option for NewSigner, specifying a key to sign with, using the provided Sequoia-PGP key fingerprint.
+func WithKeyFingerprint(keyFingerprint string) Option {
+	return func(s *simpleSequoiaSigner) error {
+		s.keyFingerprint = keyFingerprint
+		return nil
+	}
+}
+
+// WithPassphrase returns an Option for NewSigner, specifying a passphrase for the private key.
+func WithPassphrase(passphrase string) Option {
+	return func(s *simpleSequoiaSigner) error {
+		// The gpgme implementation can’t use passphrase with \n; reject it here for consistent behavior.
+		// FIXME: We don’t need it in this API at all, but the "\n" check exists in the current call stack. That should go away.
+		if strings.Contains(passphrase, "\n") {
+			return errors.New("invalid passphrase: must not contain a line break")
+		}
+		s.passphrase = passphrase
+		return nil
+	}
+}
diff --git a/signature/simplesequoia/signer_stub.go b/signature/simplesequoia/signer_stub.go
@@ -0,0 +1,26 @@
+package simplesequoia
+
+import (
+	"errors"
+
+	"github.com/containers/image/v5/signature/signer"
+)
+
+// simpleSequoiaSigner is a signer.SignerImplementation implementation for simple signing signatures using Sequoia.
+type simpleSequoiaSigner struct {
+	// This is not really used, we just keep the struct fields so that the With… Option functions can be compiled.
+
+	sequoiaHome    string // "" if using the system's default
+	keyFingerprint string
+	passphrase     string // "" if not provided.
+}
+
+// NewSigner returns a signature.Signer which creates "simple signing" signatures using the user's default
+// Sequoia PGP configuration.
+//
+// The set of options must identify a key to sign with, probably using a WithKeyFingerprint.
+//
+// The caller must call Close() on the returned Signer.
+func NewSigner(opts ...Option) (*signer.Signer, error) {
+	return nil, errors.New("Sequoia-PGP support is not enabled in this build")
+}
