GitRoot

 1// SPDX-FileCopyrightText: 2025 Romain Maneschi <romain@gitroot.dev>
 2//
 3// SPDX-License-Identifier: EUPL-1.2
 4
 5package main
 6
 7import (
 8	"github.com/42wim/sshsig"
 9	"github.com/go-git/go-git/v5/plumbing"
10	"github.com/go-git/go-git/v5/plumbing/object"
11)
12
13const (
14	namespace = "git"
15)
16
17func Verify(p string, c *object.Commit) error {
18	encoded := &plumbing.MemoryObject{}
19	c.EncodeWithoutSignature(encoded)
20	r, err := encoded.Reader()
21	if err != nil {
22		return err
23	}
24	defer r.Close()
25	return sshsig.Verify(r, []byte(c.PGPSignature), []byte(p), namespace)
26}