From 6c48e1c3954aa4f361941eaf565570fabef93685 Mon Sep 17 00:00:00 2001 From: Meghan Denny Date: Fri, 17 Jul 2026 11:44:21 -0700 Subject: [PATCH] Signature: ssh: support rsa-sha2-256 --- git.zig | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/git.zig b/git.zig index f0a7b314016388b5adc3e647e00a10e5be5440a9..6ed3054f902454e65b257a1c6e6c36676f5b1864 100644 --- a/git.zig +++ b/git.zig @@ -2562,6 +2562,19 @@ pub const Signature = union(enum) { if (std.mem.eql(u8, sigformat, "ssh-rsa")) { // intentionally skipped, rsa with sha1 } + if (std.mem.eql(u8, sigformat, "rsa-sha2-256")) blk: { + const ns = std.crypto.Certificate.rsa; + const pk_e_len = pkfixed.readInt(u32, .big) catch break :blk; + var pk_e = pkfixed.readSlice(pk_e_len) catch break :blk; + if (pk_e[0] == 0) pk_e = pk_e[1..]; + const pk_n_len = pkfixed.readInt(u32, .big) catch break :blk; + var pk_n = pkfixed.readSlice(pk_n_len) catch break :blk; + if (pk_n[0] == 0) pk_n = pk_n[1..]; + const pk = ns.PublicKey.fromBytes(pk_e, pk_n) catch break :blk; + const sig_len = sigfixed.readInt(u32, .big) catch break :blk; + const sig = sigfixed.readSlice(sig_len) catch break :blk; + valid = if (pgp_rsa_verify(pk_n.len, sig, signed_data.items, pk, .sha2_256)) true else |err| if (err == error.unrecognized) null else false; + } if (std.mem.eql(u8, sigformat, "ssh-ed25519")) blk: { const ed = std.crypto.sign.Ed25519; const pk_len = pkfixed.readInt(u32, .big) catch break :blk; @@ -2623,7 +2636,6 @@ pub const Signature = union(enum) { // ssh-dss (dsa) // sk-ecdsa-sha2-nistp256@openssh.com // sk-ssh-ed25519@openssh.com - // rsa-sha2-256 // rsa-sha2-512 return .{ .ssh = .{ -- 2.54.0