Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[FEATURE] Verify ML-DSA signatures embedded in provider docs (x-stackql-signature), with .sig fallback

Cerrado
  • ¿Algo no está bien?
#153 1 comentario 0 reacciones 0 asignados Ver en GitHub

Ya se ha fusionado un pull request relacionado.

  • #155 de @jeffreyaven — fusionado

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
38/100
Tipo de issue
Nueva funcionalidad
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
go
Área
cryptography, security

Línea de trabajo

Start with internal/anysdk/registry.go and the VerifierConfig definition, then check whether stackql/stackql-provider-registry#482 has released the signing/pqsig package this work depends on. Follow the existing .sig verification path and use canonicalisation from the shared registry package. Done means the listed ML-DSA cases pass per document, legacy fallback is configurable, and verification remains off by default.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement go

Middle step of the registry's move to quantum-safe, embedded provider-doc signatures: stackql/stackql-provider-registry#482 (signing package) -> this issue (verification) -> stackql/stackql#856 (bump, config, docs). Verification is off by default in stackql (nopVerify: true), so this ships without changing user-facing behaviour. omnisdk, which is replacing any-sdk, gets the same verifier under stackql-labs/omnisdk#17.

NOTE: Must be compliant with at least FIPS 204.

What changes

  • internal/anysdk/registry.go: getVerifiedDocBytes fetches <doc>.sig (local path, local cache or remote) and calls edcrypto.VerifyFileFromCertificateBytes. New path, tried first: if the doc carries x-stackql-signature, pop it, canonicalise the remainder with the registry's shared package (RFC 8785 JSON), mldsa.Verify against the embedded public key selected by kid, context stackql-provider-doc-v1. No key: fall back to the .sig path. Both present: embedded wins.
  • Dependency: bump github.com/stackql/stackql-provider-registry from v0.0.2-alpha01 to the release that ships signing/pqsig. go.mod to go 1.27 for crypto/mldsa (currently 1.26.10).
  • VerifierConfig: add allowLegacySig (default true for the transition) so the .sig fallback can be switched off later. nopVerify untouched.
  • Canonicalisation comes from the shared registry package. Do not reimplement it here or signatures will not match.
  • Tests: fixtures signed at test time with ephemeral ML-DSA keys. Cases: valid, tampered after signing, unknown kid, no key with and without .sig, both present.

Sequence and dependencies

  1. Blocked by stackql/stackql-provider-registry#482 step 1 (package release).
  2. This issue, then an any-sdk release.
  3. Unblocks stackql/stackql#856, which in turn unblocks the registry dropping .sig files.

Notes

  • Verification stays at doc-read time. Archive pull stays unverified; that is stackql/stackql#832's scope.
  • Provider docs drive execution (local_templated and friends), so coverage must stay per doc, not only provider.yaml.
Lenguaje dominante
Go
Estrellas
0
Forks
1
Merge medio
1 h 51 min
PR fusionados (30 d)
7

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stackql/any-sdk

Todos los issues de stackql/any-sdk

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.