Artifact [60e0a2697f]

Artifact 60e0a2697f4f77d10798077ef78ae82890eef2a09a7d14ec114da60f9c2a5831:

• File examples/tinygo/main.go — part of check-in [a87790f468] at 2026-10-26 12:45:46 on branch main — feat(sshverify): make in-process SSH signature verification opt-in

  internal/clearsign keeps the SSH envelope, SSHSIG parsing, namespace, hash and SHA-1 checks, none of which need cryptography, and hands the key parse and signature check to an SSHVerifier that the new public package sshverify registers from init. The library therefore no longer links golang.org/x/crypto/ssh and the ECDSA, P-256, Ed25519 and RSA code it pulls in; html-artifact-publisher's TinyGo engine drops from 1,347,569 to 1,093,647 bytes gzipped (3,777,936 to 3,208,411 raw).

  Without the verifier nothing is accepted unchecked: a well-formed SSH signature is ErrSSHVerifierUnavailable, which wraps ErrCannotVerify, so a seed under an SSH horizon-seed-key is refused, the held one is kept, and the sync or rebuild fails naming the package to import. Malformed signatures are still bad. The cli package (and so cmd/libfossil) and examples/tinygo import sshverify; a go list guard keeps x/crypto/ssh out of the root and db closures. (user: [email protected], size: 1248) [annotate] [blame] [check-ins using] [more...]

// Example: the whole public API, sync included, built with TinyGo for the
// js/wasm target, as an application ships go-libfossil to a browser or an
// edge runtime.
//
// It imports no SQLite driver. A TinyGo host supplies one for its own
// storage (a database/sql driver over the host's SQLite) and registers it;
// the ncruces driver, which embeds SQLite as a wasm module run by an
// interpreter, is for standard Go builds. CI builds this example with TinyGo
// so the module keeps compiling there.
//
// It imports sshverify, which links SSH signature verification, so the
// build covers a store whose horizon-seed-key is an SSH key. An application
// that never verifies an SSH signature leaves it out and is smaller.
package main

import (
	"context"
	"log"

	"github.com/danmestas/go-libfossil"
	_ "github.com/danmestas/go-libfossil/sshverify"
)

func main() {
	r, err := libfossil.Open("notes.fossil")
	if err != nil {
		log.Fatalf("open: %v", err)
	}
	defer r.Close()
	t := libfossil.NewHTTPTransport("https://example.org/notes")
	res, err := r.Sync(context.Background(), t, libfossil.SyncOpts{Pull: true})
	if err != nil {
		log.Fatalf("sync: %v", err)
	}
	log.Printf("pulled %d artifacts in %d rounds", res.FilesRecvd, res.Rounds)
}