Cerbero.Snapshot.Signature (cerbero v0.1.0)

Copy Markdown View Source

Optional Ed25519 tamper-proofing for snapshots.

The checksum detects corruption and hand-edits, but anyone who can commit can regenerate it. A signature binds the checksum to a private key: sign at export (mix cerbero.snapshot --sign-key), pin the public key(s) in .cerbero.exs snapshot_verify_keys, and a regenerated checksum no longer verifies — tampering needs the seed, not just commit access. Key distribution is deliberately minimal: verify keys are base64 strings committed in config; the seed lives wherever the exporting side keeps secrets. The signature signs the checksum string, which itself covers the canonical content (checksum and signature fields excluded), so sign-then-embed never invalidates the checksum.

Summary

Functions

generate()

Generate a keypair: {public_key_base64, seed_base64}.

sign(stamped, seed_b64)

Sign a stamped snapshot map (requires its "checksum").

verify(raw, verify_keys)

Verify a raw snapshot's signature. A present signature must always verify over the checksum (a broken one is a corruption signal even with no keys configured); configured verify keys additionally require the signature to exist and its key to be one of them.

Functions

generate()

@spec generate() :: {String.t(), String.t()}

Generate a keypair: {public_key_base64, seed_base64}.

sign(stamped, seed_b64)

@spec sign(map(), String.t()) :: map()

Sign a stamped snapshot map (requires its "checksum").

verify(raw, verify_keys)

@spec verify(map(), [String.t()]) :: :ok | {:error, term()}

Verify a raw snapshot's signature. A present signature must always verify over the checksum (a broken one is a corruption signal even with no keys configured); configured verify keys additionally require the signature to exist and its key to be one of them.