module Capsium::Package::Verification

Integrity and digital-signature verification of a loaded package (ARCHITECTURE.md section 6), mixed into Package.

Public Instance Methods

() → bool

Source

# File lib/capsium/package/verification.rb, line 20
def signed? = @security.signed?

Whether security.json declares a digital signature for this package.

verify_integrity ()

() → Array[Security::ChecksumMismatch | Security::MissingFile | Security::UncheckedFile]

Source

# File lib/capsium/package/verification.rb, line 11
def verify_integrity
  @security.present? ? @security.verify(@path) : []
end

Verifies the package against security.json. Returns a list of typed errors; empty when no security.json is present or all checksums match.

verify_integrity! ()

() → void

Source

# File lib/capsium/package/verification.rb, line 15
def verify_integrity!
  @security.verify!(@path) if @security.present?
end

verify_signature ()

() → bool

Source

# File lib/capsium/package/verification.rb, line 27
def verify_signature = !signed? || Signer.signer_class_for(@path).new(@path).verify

Verifies the declared digital signature against the checksum-covered payload, through the signer matching the declared certificateType (OpenPgpSigner for OpenPGP, the RSA-SHA256 Signer otherwise). True when the package is unsigned (nothing declared) or the signature verifies; false on mismatch.

verify_signature! ()

() → void

Source

# File lib/capsium/package/verification.rb, line 29
def verify_signature!
  Signer.signer_class_for(@path).new(@path).verify! if signed?
end