Class: Confium::PKI::CMS::SignedDataBuilder

Inherits:
Object
  • Object
show all
Defined in:
lib/confium/pki/cms/signed_data_builder.rb

Constant Summary collapse

SIGNATURE_ALGORITHM_OID = 
{
  ed25519: "1.3.101.112",
  ecdsa_p256: "1.2.840.10045.4.3.2",
}.freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ SignedDataBuilder

Returns a new instance of SignedDataBuilder.



34
35
36
37
 
# File 'lib/confium/pki/cms/signed_data_builder.rb', line 34

def initialize
  @content = nil
  @signers = []
end

Instance Attribute Details

#content ⇒ Object

Returns the value of attribute content.



27
28
29
 
# File 'lib/confium/pki/cms/signed_data_builder.rb', line 27

def content
  @content
end

Instance Method Details

#add_signer(cert_der:, private_key:, algorithm:) ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/confium/pki/cms/signed_data_builder.rb', line 39

def add_signer(cert_der:, private_key:, algorithm:)
  algorithm = algorithm.to_sym unless algorithm.is_a?(Symbol)
  unless SIGNATURE_ALGORITHM_OID.key?(algorithm)
    raise ArgumentError,
          "unsupported algorithm: #{algorithm.inspect} \
           (expected one of: #{SIGNATURE_ALGORITHM_OID.keys.join(', ')})"
  end
  @signers << {
    cert_der: cert_der,
    private_key: private_key,
    algorithm: algorithm,
  }
end

#build ⇒ Confium::PKI::CMS::SignedData

Build a SignedData with a detached signature over @content. For multi-signer composites, the first signer is used as the primary; additional signers are ignored until the upstream Rust build_detached_signature supports multi-signer input.

Returns:

  • (Confium::PKI::CMS::SignedData)

Raises:

  • (ArgumentError) 


59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/confium/pki/cms/signed_data_builder.rb', line 59

def build
  raise ArgumentError, "at least one signer is required" if @signers.empty?
  raise ArgumentError, "#content is required (detached builder)" if @content.nil?

  primary = @signers.first
  payload_bytes = @content.respond_to?(:bytes) ? @content.bytes : @content
  signature = sign_payload(primary[:algorithm], primary[:private_key], payload_bytes)
  algorithm_oid = SIGNATURE_ALGORITHM_OID.fetch(primary[:algorithm])

  SignedData.build_detached(
    signature,
    algorithm_oid,
    @signers.map { |s| s[:cert_der] },
  )
end