45 lines
1.3 KiB
JavaScript
45 lines
1.3 KiB
JavaScript
/**
|
|
* Pear / Bare: load crypto via CJS bridge (`require` provided by runtime). No `node:module`.
|
|
*/
|
|
|
|
import b4a from 'b4a'
|
|
import bridge from './bare-os-boot-manifest-sig-bridge.cjs'
|
|
|
|
const { verify, Ed25519PublicKey } = bridge
|
|
|
|
/**
|
|
* @param {Uint8Array | null | undefined} manifestBytes
|
|
* @param {Uint8Array | null | undefined} signatureBytes
|
|
* @param {string} publicKeyHex 64 hex chars (32-byte Ed25519 public key)
|
|
* @returns {boolean}
|
|
*/
|
|
export function verifyBootManifestEd25519(manifestBytes, signatureBytes, publicKeyHex) {
|
|
if (!manifestBytes?.length || !signatureBytes?.length) return false
|
|
const hex = String(publicKeyHex || '').trim().toLowerCase().replace(/^0x/, '')
|
|
if (!/^[0-9a-f]{64}$/.test(hex)) return false
|
|
/** @type {Uint8Array} */
|
|
let sig
|
|
if (signatureBytes.length === 64) {
|
|
sig = signatureBytes
|
|
} else {
|
|
const t = b4a.toString(signatureBytes, 'utf8').trim()
|
|
if (/^[0-9a-f]{128}$/i.test(t)) {
|
|
sig = b4a.from(t, 'hex')
|
|
} else {
|
|
try {
|
|
sig = b4a.from(t, 'base64')
|
|
} catch {
|
|
return false
|
|
}
|
|
}
|
|
}
|
|
if (sig.length !== 64) return false
|
|
try {
|
|
const pub = b4a.from(hex, 'hex')
|
|
const key = new Ed25519PublicKey(pub)
|
|
return verify('ed25519', manifestBytes, key, sig)
|
|
} catch {
|
|
return false
|
|
}
|
|
}
|