| ... | ... | @@ -2562,6 +2562,19 @@ pub const Signature = union(enum) { |
| 2562 | 2562 | if (std.mem.eql(u8, sigformat, "ssh-rsa")) { |
| 2563 | 2563 | // intentionally skipped, rsa with sha1 |
| 2564 | 2564 | } |
| 2565 | if (std.mem.eql(u8, sigformat, "rsa-sha2-256")) blk: { |
| 2566 | const ns = std.crypto.Certificate.rsa; |
| 2567 | const pk_e_len = pkfixed.readInt(u32, .big) catch break :blk; |
| 2568 | var pk_e = pkfixed.readSlice(pk_e_len) catch break :blk; |
| 2569 | if (pk_e[0] == 0) pk_e = pk_e[1..]; |
| 2570 | const pk_n_len = pkfixed.readInt(u32, .big) catch break :blk; |
| 2571 | var pk_n = pkfixed.readSlice(pk_n_len) catch break :blk; |
| 2572 | if (pk_n[0] == 0) pk_n = pk_n[1..]; |
| 2573 | const pk = ns.PublicKey.fromBytes(pk_e, pk_n) catch break :blk; |
| 2574 | const sig_len = sigfixed.readInt(u32, .big) catch break :blk; |
| 2575 | const sig = sigfixed.readSlice(sig_len) catch break :blk; |
| 2576 | valid = if (pgp_rsa_verify(pk_n.len, sig, signed_data.items, pk, .sha2_256)) true else |err| if (err == error.unrecognized) null else false; |
| 2577 | } |
| 2565 | 2578 | if (std.mem.eql(u8, sigformat, "ssh-ed25519")) blk: { |
| 2566 | 2579 | const ed = std.crypto.sign.Ed25519; |
| 2567 | 2580 | const pk_len = pkfixed.readInt(u32, .big) catch break :blk; |
| ... | ... | @@ -2623,7 +2636,6 @@ pub const Signature = union(enum) { |
| 2623 | 2636 | // ssh-dss (dsa) |
| 2624 | 2637 | // sk-ecdsa-sha2-nistp256@openssh.com |
| 2625 | 2638 | // sk-ssh-ed25519@openssh.com |
| 2626 | | // rsa-sha2-256 |
| 2627 | 2639 | // rsa-sha2-512 |
| 2628 | 2640 | |
| 2629 | 2641 | return .{ .ssh = .{ |
Meghan Denny <hello@nektro.net> 2026-07-17 11:44:21 -07:00
Signed by SSH key SHA256:4hHJbtBRU58AYXwjL7fkz2fnQHdiye8x1QpTCQ0sHNw