Orginize

packages/bare-os-booter/lib/boot/bare-os-boot-manifest-sig.bare.js

@@ -0,0 +1,44 @@
+/**
+ * Pear / Bare: load crypto via CJS bridge (`require` provided by runtime). No `node:module`.
+ */
+
+import b4a from 'b4a'
+import bridge from './bare-os-boot-manifest-sig-bridge.cjs'
+
+const { verify, Ed25519PublicKey } = bridge
+
+/**
+ * @param {Uint8Array | null | undefined} manifestBytes
+ * @param {Uint8Array | null | undefined} signatureBytes
+ * @param {string} publicKeyHex 64 hex chars (32-byte Ed25519 public key)
+ * @returns {boolean}
+ */
+export function verifyBootManifestEd25519(manifestBytes, signatureBytes, publicKeyHex) {
+  if (!manifestBytes?.length || !signatureBytes?.length) return false
+  const hex = String(publicKeyHex || '').trim().toLowerCase().replace(/^0x/, '')
+  if (!/^[0-9a-f]{64}$/.test(hex)) return false
+  /** @type {Uint8Array} */
+  let sig
+  if (signatureBytes.length === 64) {
+    sig = signatureBytes
+  } else {
+    const t = b4a.toString(signatureBytes, 'utf8').trim()
+    if (/^[0-9a-f]{128}$/i.test(t)) {
+      sig = b4a.from(t, 'hex')
+    } else {
+      try {
+        sig = b4a.from(t, 'base64')
+      } catch {
+        return false
+      }
+    }
+  }
+  if (sig.length !== 64) return false
+  try {
+    const pub = b4a.from(hex, 'hex')
+    const key = new Ed25519PublicKey(pub)
+    return verify('ed25519', manifestBytes, key, sig)
+  } catch {
+    return false
+  }
+}