Download this file
| 1 | package appconfig |
| 2 | |
| 3 | import ( |
| 4 | "crypto/ecdh" |
| 5 | "crypto/sha256" |
| 6 | "encoding/hex" |
| 7 | ) |
| 8 | |
| 9 | // KeyFingerprint names a secrets keypair without revealing either half: |
| 10 | // "sha256:" and the lowercase hex SHA-256 of the public key's uncompressed |
| 11 | // SEC1 bytes — the same bytes CARLOS_SECRETS_PUBKEY base64-decodes to. It |
| 12 | // is the ONE renderer of the edges file's secrets_key_fp, shared by the |
| 13 | // nearest-region spec (§6.1, R9) and the move-any-app spec (§6, T2): a box |
| 14 | // that can open this deployment's sealed config publishes exactly the |
| 15 | // string the console derives from its own public key. |
| 16 | func KeyFingerprint(pub *ecdh.PublicKey) string { |
| 17 | sum := sha256.Sum256(pub.Bytes()) |
| 18 | return "sha256:" + hex.EncodeToString(sum[:]) |
| 19 | } |
| 20 | |
| 21 | // PublicFingerprint is KeyFingerprint of a base64 CARLOS_SECRETS_PUBKEY. |
| 22 | func PublicFingerprint(b64 string) (string, error) { |
| 23 | pub, err := ParsePublicKey(b64, "CARLOS_SECRETS_PUBKEY") |
| 24 | if err != nil { |
| 25 | return "", err |
| 26 | } |
| 27 | return KeyFingerprint(pub), nil |
| 28 | } |
| 29 | |
amadan