1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
package market
import (
"crypto/rand"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
"os"
"strings"
"github.com/bluesky-social/indigo/atproto/atcrypto"
)
type secp256k1JWK struct {
Kty string `json:"kty"`
Crv string `json:"crv"`
Use string `json:"use,omitempty"`
Alg string `json:"alg,omitempty"`
D string `json:"d"`
}
func ParseSecp256k1JWK(data []byte) ([]byte, error) {
var jwk secp256k1JWK
if err := json.Unmarshal(data, &jwk); err != nil {
return nil, fmt.Errorf("market: secp256k1 jwk: %w", err)
}
if jwk.Kty != "EC" || jwk.Crv != "secp256k1" || jwk.D == "" {
return nil, fmt.Errorf("market: not a secp256k1 private JWK")
}
raw, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(jwk.D, "="))
if err != nil {
return nil, fmt.Errorf("market: secp256k1 jwk d: %w", err)
}
if len(raw) != 32 {
return nil, fmt.Errorf("market: secp256k1 jwk d is %d bytes, want 32", len(raw))
}
return raw, nil
}
func LoadOrCreateAttestationKey(path string) ([]byte, error) {
data, err := os.ReadFile(path)
if err == nil {
return ParseSecp256k1JWK(data)
}
if !errors.Is(err, os.ErrNotExist) {
return nil, err
}
priv := make([]byte, 32)
if _, err := rand.Read(priv); err != nil {
return nil, err
}
jwk := secp256k1JWK{
Kty: "EC",
Crv: "secp256k1",
Use: "sig",
Alg: "ES256K",
D: base64.RawURLEncoding.EncodeToString(priv),
}
out, err := json.MarshalIndent(jwk, "", " ")
if err != nil {
return nil, err
}
out = append(out, '\n')
if err := os.WriteFile(path, out, 0o600); err != nil {
return nil, err
}
_ = os.Chmod(path, 0o600)
return priv, nil
}
func LoadOrCreateSignerFile(path string) (*Signer, error) {
raw, err := LoadOrCreateAttestationKey(path)
if err != nil {
return nil, err
}
priv, err := atcrypto.ParsePrivateBytesK256(raw)
if err != nil {
return nil, err
}
return &Signer{PrivateKey: priv}, nil
}
