44 lines
1.1 KiB
Go
44 lines
1.1 KiB
Go
//go:build !noSign
|
|
|
|
package license
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
|
|
"github.com/hyperboloide/lk"
|
|
)
|
|
|
|
// Sign marshals a licence and signs it, returning the base32 blob.
|
|
//
|
|
// This file carries the !noSign build tag so the signing path can be compiled
|
|
// out of the control plane. The server has no reason to hold signing code and
|
|
// no reason to ship it into a customer's data centre.
|
|
//
|
|
// privateKeyB32 comes from LICENSE_SIGNING_KEY on the issuing side only.
|
|
func Sign(l License, privateKeyB32 string) (string, error) {
|
|
if privateKeyB32 == "" {
|
|
return "", fmt.Errorf("no signing key provided")
|
|
}
|
|
priv, err := lk.PrivateKeyFromB32String(privateKeyB32)
|
|
if err != nil {
|
|
return "", fmt.Errorf("parse signing key: %w", err)
|
|
}
|
|
|
|
data, err := json.Marshal(l)
|
|
if err != nil {
|
|
return "", fmt.Errorf("marshal licence: %w", err)
|
|
}
|
|
|
|
signed, err := lk.NewLicense(priv, data)
|
|
if err != nil {
|
|
return "", fmt.Errorf("sign licence: %w", err)
|
|
}
|
|
|
|
blob, err := signed.ToB32String()
|
|
if err != nil {
|
|
return "", fmt.Errorf("encode licence: %w", err)
|
|
}
|
|
return blob, nil
|
|
}
|