fedem::sign::Verifier Class Reference

#include <Verifier.hh>

Static Public Member Functions
static VerifyResult	verify (std::string const &soPath, std::string const &trustedKeysDir)
static bool	isCached (std::string const &soPath)
static bool	shouldLoad (std::string const &policy, TrustLevel level) noexcept

Static Private Member Functions
static VerifyResult	verifyUncached (std::string const &soPath, std::string const &trustedKeysDir)
	Full verification without cache — called by verify() on first access. More...

Member Function Documentation

verify()

VerifyResult fedem::sign::Verifier::verify ( std::string const &  soPath, std::string const &  trustedKeysDir  )

static

Verify the DSO at soPath.

Steps:

1. Read .dso_manifest + .dso_sig ELF sections.
2. Strip sections → temp file → compute SHA-256.
3. Compare hash with manifest.sha256.
4. Search trustedKeysDir for a *.pub whose fingerprint matches manifest.publicKeyId.
5. Ed25519-verify the signature over the manifest JSON.

Result is cached by soPath — subsequent calls return the cached value.

Parameters

soPath	path to the DSO
trustedKeysDir	directory containing *.pub files (PEM Ed25519)

References map, mtx, and verifyUncached().

Referenced by fedem::dso::DSOLoader::loadSigned(), and main().

Here is the call graph for this function:

Here is the caller graph for this function:

isCached()

bool fedem::sign::Verifier::isCached ( std::string const &  soPath )

static

Returns true when soPath already has a cached result. Useful for suppressing redundant log lines across sessions.

References mtx.

shouldLoad()

bool fedem::sign::Verifier::shouldLoad ( std::string const &  policy, TrustLevel  level  )

staticnoexcept

Decide whether to load a DSO given a policy string and trust level.

Parameters

policy	"off" | "warn" | "strict"
level	result of verify()

Returns

true → proceed with loading

References fedem::sign::REJECTED, and fedem::sign::TRUSTED.

verifyUncached()

VerifyResult fedem::sign::Verifier::verifyUncached ( std::string const &  soPath, std::string const &  trustedKeysDir  )

staticprivate

Full verification without cache — called by verify() on first access.

References fedem::sign::ManifestResult::data, fedem::sign::VerifyResult::data, fedem::sign::VerifyResult::detail, fedem::sign::ManifestResult::error, fedem::sign::findTrustedKey(), fedem::sign::ManifestResult::hasManifest, fedem::sign::VerifyResult::hasManifest, fedem::sign::ManifestResult::hasSig, fedem::sign::makeStrippedCopy(), fedem::sign::ManifestResult::manifestJson, fedem::sign::ManifestData::publicKeyId, fedem::sign::Manifest::read(), fedem::sign::REJECTED, fedem::sign::ManifestData::sha256, fedem::sign::sha256File(), fedem::sign::ManifestResult::sig, fedem::sign::VerifyResult::trust, fedem::sign::TRUSTED, fedem::sign::UNKNOWN, fedem::sign::UNSIGNED, and fedem::sign::verifySignature().

Referenced by verify().

Here is the call graph for this function:

Here is the caller graph for this function:

---

The documentation for this class was generated from the following files:

• src/sign/Verifier.hh
• src/sign/Verifier.cpp