Functions for signing and verification of tar files
PKI.sign.tar appends a signature to a tar file
PKI.verify.tar verifies the signature in a tar file
string, file name of the file to sign
optional, certificate to embed in the signature
with the public key matching
file name, connection or raw vector determining how to store the signed tar file
PKI.tar.sign adds extra entry
.signature with the
signature based on the contents of the
tarfile. Note that
any existing signatures are retained.
key is a mandatory
private key used to sign the content.
certificate is optional
but if present, it will be embedded in the signature.
tarfile can be in compressed form (gzip, bzip2 or xz) in
which case it is decompressed internally before the signature is
output is a file name then the same compression is
applied to the output, otherwise the output is uncompressed.
PKI.verify.tar retrieves the last
.signature entry from
the tar file (if
tarfile is a file name then the same
compression auto-detection is applied as above) and
verifies the signature against either the supplied (public)
or against the key or certificate stored in the signature. The result
FALSE except when
set. In that case the result is the certificate contained in the
signature if the validation succeeded (and thus it can be further
verified against a chain of trust), otherwise
The signature format is ASN.1 DER encoded as follows:
SEQ(signature BITSTRING, subjectPublicKeyInfo, Certificate[opt])
subjectPublicKeyInfo can be
NULL in which case the
certificate must be present (in X.509 DER format).
The signature is appended as tar entry named
.signature. However, terminating blocks are not removed from
the file, so the signature is placed after the EOF blocks and thus
doesn't affect extraction.