From 98806e712f5ea30970becdf66a91e42f8f33f5b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1?= <nabijaczleweli@nabijaczleweli.xyz>
Date: Wed, 19 Aug 2020 18:26:26 +0200
Subject: [PATCH] Add crypto module with depessimised webhook signing from
 gitsrht-update-hook

---
 crypto/webhook.go | 51 +++++++++++++++++++++++++++++++++++++++++++++++
 go.mod            |  2 ++
 go.sum            | 10 +++++++++-
 3 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 crypto/webhook.go

diff --git a/crypto/webhook.go b/crypto/webhook.go
new file mode 100644
index 0000000000000000000000000000000000000000..c2f133dfb0e78666bd53c1b7c37b2b3e358d8c27
--- /dev/null
+++ b/crypto/webhook.go
@@ -0,0 +1,51 @@
+package crypto
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"log"
+
+	"github.com/vaughan0/go-ini"
+	"golang.org/x/crypto/ed25519"
+)
+
+var (
+	webhookKey ed25519.PrivateKey
+)
+
+func initWebhookKey(logger *log.Logger, config ini.File) {
+	if webhookKey != nil {
+		return
+	}
+
+	b64key, ok := config.Get("webhooks", "private-key")
+	if !ok {
+		logger.Fatalf("No webhook key configured")
+	}
+	seed, err := base64.StdEncoding.DecodeString(b64key)
+	if err != nil {
+		logger.Fatalf("base64 decode webhooks private key: %v", err)
+	}
+	webhookKey = ed25519.NewKeyFromSeed(seed)
+}
+
+func SignWebhookPayload(payload []byte, logger *log.Logger, config ini.File) (string, string) {
+	var (
+		nonceSeed [8]byte
+		nonceHex  [16]byte
+	)
+
+	_, err := rand.Read(nonceSeed[:])
+	if err != nil {
+		logger.Fatalf("generate nonce: %v", err)
+	}
+	hex.Encode(nonceHex[:], nonceSeed[:])
+	nonce := string(nonceHex[:])
+
+	initWebhookKey(logger, config)
+	signature := base64.StdEncoding.EncodeToString(
+		ed25519.Sign(webhookKey, append(payload, nonceHex[:]...)))
+
+	return nonce, signature
+}
diff --git a/go.mod b/go.mod
index 4a50a1bc0f88011a51e6d9ea0f7748c3f53a5d1e..6f954976182772c12e589cd406e99e3668a996d3 100644
--- a/go.mod
+++ b/go.mod
@@ -3,4 +3,6 @@ module git.sr.ht/~sircmpwn/core-go
 go 1.13
 
 require (
+	github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec
+	golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de
 )
diff --git a/go.sum b/go.sum
index 8b137891791fe96927ad78e64b0aad7bded08bdc..62028af0e6da7327332ce95285708e3aa0ab4c8d 100644
--- a/go.sum
+++ b/go.sum
@@ -1 +1,9 @@
-
+github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec h1:DGmKwyZwEB8dI7tbLt/I/gQuP559o/0FrAkHKlQM/Ks=
+github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec/go.mod h1:owBmyHYMLkxyrugmfwE/DLJyW8Ro9mkphwuVErQ0iUw=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de h1:ikNHVSjEfnvz6sxdSPCaPt572qowuyMDMJLLm3Db3ig=
+golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=