fidius-host::signing Rust

Ed25519 signature verification for plugin dylibs.

Functions

fidius-host::signing::sig_path_for

pub

fn sig_path_for (path : & Path) -> std :: path :: PathBuf

Compute the detached signature file path for a given file.

Appends .sig to the full filename (e.g., foo.dylib → foo.dylib.sig).

Source

pub fn sig_path_for(path: &Path) -> std::path::PathBuf {
    path.with_extension(format!(
        "{}.sig",
        path.extension().and_then(|e| e.to_str()).unwrap_or("")
    ))
}

fidius-host::signing::verify_signature

pub

fn verify_signature (dylib_path : & Path , trusted_keys : & [VerifyingKey]) -> Result < () , LoadError >

Verify a plugin dylib's signature against trusted public keys.

Reads the dylib bytes and the detached .sig file, then verifies the Ed25519 signature against each trusted key until one matches.

Raises:

Exception	Description
LoadError::SignatureRequired	— if the .sig file doesn't exist
LoadError::SignatureInvalid	— if no trusted key verifies the signature

Source

pub fn verify_signature(dylib_path: &Path, trusted_keys: &[VerifyingKey]) -> Result<(), LoadError> {
    let path_str = dylib_path.display().to_string();
    let sig_path = sig_path_for(dylib_path);

    // Read the sig file
    let sig_bytes = std::fs::read(&sig_path).map_err(|e| {
        if e.kind() == std::io::ErrorKind::NotFound {
            LoadError::SignatureRequired {
                path: path_str.clone(),
            }
        } else {
            LoadError::Io(e)
        }
    })?;

    // Parse the signature (64 bytes)
    let signature = Signature::from_slice(&sig_bytes).map_err(|_| LoadError::SignatureInvalid {
        path: path_str.clone(),
    })?;

    // Read the dylib bytes
    let dylib_bytes = std::fs::read(dylib_path)?;

    // Try each trusted key
    for key in trusted_keys {
        if key.verify(&dylib_bytes, &signature).is_ok() {
            return Ok(());
        }
    }

    Err(LoadError::SignatureInvalid { path: path_str })
}