crypto

Content digests (SHA-256/512; SHA-1 and MD5 for legacy-checksum interop) and Ed25519 signing.

Naming convention: import the module under its bare name (import "crypto"), reach members with a backslash, and call methods in camelCase: crypto\someMethod.

Methods

sha256Hex

Return the lowercase hex SHA-256 digest of data.

Signature: crypto\sha256Hex(data) -> string - source

Returns: string

sha256File

Return the lowercase hex SHA-256 digest of the file at path.

Signature: crypto\sha256File(path) -> string - source

Returns: string

sha512Hex

Return the lowercase hex SHA-512 digest of data.

Signature: crypto\sha512Hex(data) -> string - source

Returns: string

sha512File

Return the lowercase hex SHA-512 digest of the file at path.

Signature: crypto\sha512File(path) -> string - source

Returns: string

sha1Hex

Return the lowercase hex SHA-1 digest of data. For interop with legacy/git checksums only - SHA-1 is not collision-resistant; use sha256 for anything security-relevant.

Signature: crypto\sha1Hex(data) -> string - source

Returns: string

sha1File

Return the lowercase hex SHA-1 digest of the file at path. For interop with legacy/git checksums only - SHA-1 is not collision-resistant; use sha256 for anything security-relevant.

Signature: crypto\sha1File(path) -> string - source

Returns: string

sign

Sign data with key, the hex private key, and return the lowercase hex signature. alg is "ed25519". Read key with magus\secret.read so it comes from the workspace's secret provider and stays out of run logs; an error never echoes it.

Signature: crypto\sign(alg, data, key) -> string - source

Returns: string

signFile

Sign the file at path with key, the hex private key read through magus\secret.read, write the detached signature to path + ".sig", and return the lowercase hex signature. alg is "ed25519".

Signature: crypto\signFile(alg, path, key) -> string - source

Returns: string

verify

Report whether sig_hex is a valid signature over data for the hex public key pub_hex. alg is "ed25519".

Signature: crypto\verify(alg, data, sig_hex, pub_hex) -> bool - source

Returns: bool

publicKey

Return the lowercase hex PUBLIC key for key, the hex private key read through magus\secret.read, so a publisher can print what its readers must pin. alg is "ed25519".

Signature: crypto\publicKey(alg, key) -> string - source

Returns: string

md5Hex

Return the lowercase hex MD5 digest of data. For interop with legacy checksum manifests only - MD5 is broken; use sha256 for anything security-relevant.

Signature: crypto\md5Hex(data) -> string - source

Returns: string

md5File

Return the lowercase hex MD5 digest of the file at path. For interop with legacy checksum manifests only - MD5 is broken; use sha256 for anything security-relevant.

Signature: crypto\md5File(path) -> string - source

Returns: string

hmacSha256

Return the raw HMAC-SHA256 of data keyed by key, as a BYTE LIST. key and data may each be a str or a byte list, which is what lets one result key the next call - the shape an AWS SigV4 signing chain needs (kDate to kRegion to kService to kSigning). Use hmac_sha256_hex for the final signature you actually send.

Signature: crypto\hmacSha256(key, data) -> []byte - source

Returns: []byte

hmacSha256Hex

Return the lowercase hex HMAC-SHA256 of data keyed by key - the form a signature header carries, once the signing key has been derived with hmac_sha256.

Signature: crypto\hmacSha256Hex(key, data) -> string - source

Returns: string

base64EncodeBytes

Encode raw bytes as standard (padded) base64. The byte-list counterpart to encoding/base64's encode, for data that came from another byte-level call and must not round-trip through a rune-oriented str.

Signature: crypto\base64EncodeBytes(data) -> string - source

Returns: string

base64DecodeBytes

Decode standard (padded) base64 into a byte list; errors on invalid input. Returns bytes rather than a str so arbitrary binary survives - a decoded key or archive would not.

Signature: crypto\base64DecodeBytes(s) -> []byte - source

Returns: []byte