libsignify-gzip

A C++17 library for verifying Ed25519-signed gzip archives. Signatures are embedded in the gzip comment field, making signed archives self-contained and easy to distribute.

Features

• Ed25519 signature verification (via libsodium)
• BLAKE3 content hashing for integrity verification
• Self-contained signatures stored in gzip comment field
• Modern C++17 API with tl::expected error handling
• In-memory and file-based verification
• Public key loading from files or base64

Requirements

• C++17 compiler
• CMake 3.16+
• zlib
• libsodium

BLAKE3 and tl::expected are fetched automatically via CMake.

Building

mkdir build && cd build
cmake ..
make

To build with tests:

cmake -DBUILD_TESTS=ON ..
make
ctest

Installation

cmake --install . --prefix /usr/local

Usage

Verify a signed archive

#include <signify-gzip/signify_gzip.hpp>

// Verify with key file path
auto result = signify::verify("archive.gz", "key.pub");
if (result.has_value()) {
    std::cout << "Verification successful" << std::endl;
} else {
    std::cerr << result.error().message() << std::endl;
}

Load key and verify

auto key = signify::PublicKey::from_file("key.pub");
if (!key) {
    std::cerr << key.error().message() << std::endl;
    return 1;
}

auto result = signify::verify("archive.gz", *key);

In-memory verification

std::vector<uint8_t> gzip_data = /* read file */;
auto key = signify::PublicKey::from_file("key.pub");

auto result = signify::verify(gzip_data.data(), gzip_data.size(), *key);

Load key from base64

auto key = signify::PublicKey::from_base64("RWTe5//5LhzMD...");

Error Handling

All functions return tl::expected<T, std::error_code>. Error codes include:

• FileNotFound - Input file does not exist
• FileReadError - Failed to read file
• InvalidGzip - Not a valid gzip file
• NoSignature - No signature in gzip comment
• InvalidSignature - Malformed signature data
• InvalidPublicKey - Malformed public key
• FingerprintMismatch - Key fingerprint doesn't match signature
• VerificationFailed - Signature verification failed
• DecompressionError - Gzip decompression failed

License

Apache License 2.0