Support package signatures

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * Update APM Go Agent to 1.14.0. [#759](https://github.com/elastic/package-registry/pull/759)
 * Update Gorilla to 1.8.0 [#759](https://github.com/elastic/package-registry/pull/759)
+* Support package signatures [#760](https://github.com/elastic/package-registry/pull/760)
 
 ### Deprecated
 

packages/package.go

@@ -89,6 +89,7 @@ type BasePackage struct {
 	Conditions          *Conditions          `config:"conditions,omitempty" json:"conditions,omitempty" yaml:"conditions,omitempty"`
 	Owner               *Owner               `config:"owner,omitempty" json:"owner,omitempty" yaml:"owner,omitempty"`
 	Categories          []string             `config:"categories,omitempty" json:"categories,omitempty" yaml:"categories,omitempty"`
+	Signature           string               `config:"signature,omitempty" json:"signature,omitempty" yaml:"signature,omitempty"`
 }
 
 // BasePolicyTemplate is used for the package policy templates in the /search endpoint
@@ -313,6 +314,12 @@ func NewPackage(basePath string, fsBuilder FileSystemBuilder) (*Package, error)
 	if err != nil {
 		return nil, errors.Wrapf(err, "loading package data streams failed (path '%s')", p.BasePath)
 	}
+
+	// Read package signature
+	p.Signature, err = readSignature(basePath)
+	if err != nil {
+		return nil, errors.Wrapf(err, "can't read package signature (package path '%s')", p.BasePath)
+	}
 	return p, nil
 }
 

packages/signature.go

@@ -0,0 +1,23 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package packages
+
+import (
+	"os"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+func readSignature(basePath string) (string, error) {
+	signatureFile := basePath + ".sig"
+	signature, err := os.ReadFile(signatureFile)
+	if errors.Is(err, os.ErrNotExist) {
+		return "", nil // signature file isn't present
+	} else if err != nil {
+		return "", errors.Wrap(err, "can't read signature file")
+	}
+	return strings.TrimSpace(string(signature)), nil
+}

testdata/generated/package-zip.json

@@ -19,6 +19,7 @@
     "crm",
     "azure"
   ],
+  "signature": "e16ddaf4f91df524b27bf4f2e4b1ac09",
   "format_version": "1.0.0",
   "readme": "/package/example/1.0.1/docs/README.md",
   "license": "basic",

testdata/local-storage/example-1.0.1.zip.sig

@@ -0,0 +1 @@
+e16ddaf4f91df524b27bf4f2e4b1ac09