initial commit via gitinitshit
This commit is contained in:
@@ -0,0 +1,3 @@
|
||||
# Notes
|
||||
# Prose
|
||||
# Scratch
|
||||
@@ -0,0 +1,25 @@
|
||||
# Anonymous Cryptographic Proofs and Auth
|
||||
For when you need to share a file/authenticate anonymously, but want choices to prove anything anonymously/pseudoanonymously/full name/new name/etc
|
||||
|
||||
Also for when you may want to burn those keys to destroy any evidence you were involved
|
||||
|
||||
## Method
|
||||
Step 1: Collecting Information
|
||||
Including
|
||||
- an input file to sign
|
||||
- a secure passphrase for use on an ssh key
|
||||
- a secure passphrase for use as an sha256/sha512 salt
|
||||
Step 2: Generating New Single-Use SSH Key Pair
|
||||
- ed25519 by default
|
||||
- secured with provided passphrase
|
||||
Step 3: Generating Checksums
|
||||
- Normal sha256 and sha512 checksums are generated of the input file and logged
|
||||
- sha256(passphrase+file contents) and sha512(passphrase+file contents) disgests are calculated and logged
|
||||
Step 4: Signing Files
|
||||
- Original file is signed by the ssh key with a detached signature file
|
||||
- checksums file is signed by the ssh key with a detached signature file
|
||||
Step 5: Verification
|
||||
- Both file and checksums files signates are checkeed against the ssh public key
|
||||
- The original file is tested with normal sha256, normal sha512, salted sha256, and salted sha512
|
||||
Step 6: Output Public Files
|
||||
- Public files are added to a new directory and compressed with 7zip
|
||||
@@ -0,0 +1,480 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# SSH File Signing Tool
|
||||
# Purpose: Creates cryptographic signatures for files using SSH keys with dual-layer verification
|
||||
# Dependencies: cracklib-runtime, openssh-client(s)
|
||||
# Author: [Your name]
|
||||
# Date: $(date +%Y-%m-%d)
|
||||
#
|
||||
# Features:
|
||||
# - SSH signature verification using private key
|
||||
# - Salted SHA256/SHA512 checksums for independent verification
|
||||
# - Enforces strong 50+ character passphrases via cracklib
|
||||
# - Creates complete verification package with instructions
|
||||
#
|
||||
|
||||
# Debug mode (uncomment to enable)
|
||||
# set -x
|
||||
|
||||
# Shell safety options
|
||||
set -Eeuo pipefail # Exit on error, undefined vars, pipe failures
|
||||
IFS=$'\n\t' # Safe field splitting (newline and tab only)
|
||||
trap 'error_handler $?' ERR # Trap errors and call error handler
|
||||
|
||||
# ============================================================================
|
||||
# HELP AND USAGE
|
||||
# ============================================================================
|
||||
|
||||
show_help() {
|
||||
cat << EOF
|
||||
SSH File Signing Tool - Cryptographic File Signature Generator
|
||||
|
||||
Creates cryptographic signatures for files using SSH keys with dual-layer verification:
|
||||
1. SSH signature using private key (cryptographic proof)
|
||||
2. Salted checksums for independent verification (passphrase-based)
|
||||
|
||||
Usage: $(basename "$0") [OPTIONS]
|
||||
|
||||
Options:
|
||||
-h, --help Show this help message and exit
|
||||
|
||||
Features:
|
||||
• Generates ed25519 (or other) SSH key pair with strong passphrase
|
||||
• Creates detached signatures for files using SSH signing
|
||||
• Generates normal and salted SHA256/SHA512 checksums
|
||||
• Creates complete verification package with public key and instructions
|
||||
• Enforces strong 50+ character passphrases validated by cracklib
|
||||
• Two independent verification methods (key-based and passphrase-based)
|
||||
|
||||
Output:
|
||||
Creates a public_files directory containing:
|
||||
- Signed file
|
||||
- Signature files (.sig)
|
||||
- Checksums file with normal and salted hashes
|
||||
- Public key and allowed_signers file
|
||||
- Verification instructions
|
||||
|
||||
Security:
|
||||
• Private key protected with unique 50+ character passphrase
|
||||
• Checksum salt uses different 50+ character passphrase
|
||||
• Both passphrases must pass cracklib security checks
|
||||
• Passphrases cleared from memory after use
|
||||
|
||||
EOF
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Parse command-line arguments
|
||||
if [[ "${1:-}" == "-h" ]] || [[ "${1:-}" == "--help" ]]; then
|
||||
show_help
|
||||
fi
|
||||
|
||||
# ============================================================================
|
||||
# CONFIGURATION AND CONSTANTS
|
||||
# ============================================================================
|
||||
|
||||
# Default values (can be overridden during execution)
|
||||
default_email="anonymous@anonymous.com"
|
||||
default_algo="ed25519"
|
||||
default_working_dir="$PWD"
|
||||
default_key_name="Signing_Key_$default_algo"
|
||||
default_public_files_dir_name="public_files"
|
||||
txt_help_file_name="How_to_Verify_Files.txt"
|
||||
|
||||
# ANSI color codes for output formatting
|
||||
RED='\033[0;31m' # Error messages
|
||||
GREEN='\033[0;32m' # Success messages
|
||||
BLUE='\033[0;34m' # Section headers
|
||||
YELLOW='\033[0;33m' # Warnings
|
||||
NO_COLOR='\033[0m' # Reset color
|
||||
|
||||
# ============================================================================
|
||||
# ERROR HANDLING
|
||||
# ============================================================================
|
||||
|
||||
error_handler() {
|
||||
local retcode="$1"
|
||||
echo -e "\n${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NO_COLOR}"
|
||||
echo -e "${RED}ERROR: Command failed with exit code $retcode${NO_COLOR}"
|
||||
echo -e "${RED}Line: $BASH_LINENO | Time: ${SECONDS}s | Timestamp: $(date '+%Y-%m-%d %H:%M:%S')${NO_COLOR}"
|
||||
echo -e "${RED}Command: $BASH_COMMAND${NO_COLOR}"
|
||||
echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NO_COLOR}\n"
|
||||
exit "$retcode"
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 1: SYSTEM REQUIREMENTS CHECK
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[1/7] Checking System Requirements${NO_COLOR}"
|
||||
|
||||
# List of required commands
|
||||
required_commands=("ssh-keygen" "sha256sum" "sha512sum" "cracklib-check" \
|
||||
"chown" "chmod" "find" "basename" "cat" "mkdir" \
|
||||
"cp" "awk" "readlink" "stat" "du")
|
||||
|
||||
# Check for missing commands
|
||||
missing_commands=()
|
||||
for cmd in "${required_commands[@]}"; do
|
||||
if ! command -v "$cmd" &> /dev/null; then
|
||||
missing_commands+=("$cmd")
|
||||
fi
|
||||
done
|
||||
|
||||
# Exit if any commands are missing
|
||||
if [ ${#missing_commands[@]} -gt 0 ]; then
|
||||
echo -e "${RED}✗ Missing required commands: ${missing_commands[*]}${NO_COLOR}"
|
||||
echo -e "${YELLOW}Install missing packages and try again${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}✓ All required commands available${NO_COLOR}"
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 2: USER INPUT COLLECTION
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[2/7] Gathering Configuration${NO_COLOR}"
|
||||
|
||||
# Get file to sign
|
||||
read -p "Enter path to file to sign: " file_to_sign
|
||||
|
||||
# Collect SSH key passphrase (hidden input)
|
||||
read -s -p "Enter unique 50+ character passphrase for SSH key: " ssh_passphrase
|
||||
echo
|
||||
read -s -p "Re-enter SSH key passphrase: " ssh_passphrase_check
|
||||
echo
|
||||
|
||||
# Collect checksum verification passphrase (hidden input)
|
||||
read -s -p "Enter unique 50+ character passphrase for checksum verification: " checksum_passphrase
|
||||
echo
|
||||
read -s -p "Confirm checksum verification passphrase: " checksum_passphrase_check
|
||||
echo
|
||||
|
||||
# ============================================================================
|
||||
# PASSPHRASE VALIDATION
|
||||
# ============================================================================
|
||||
|
||||
# Get passphrase lengths
|
||||
checksum_passphrase_len=${#checksum_passphrase}
|
||||
ssh_passphrase_len=${#ssh_passphrase}
|
||||
|
||||
# Validate SSH passphrase
|
||||
if [[ "$ssh_passphrase" != "$ssh_passphrase_check" ]]; then
|
||||
echo -e "${RED}✗ SSH passphrases do not match${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $ssh_passphrase_len -lt 50 ]; then
|
||||
echo -e "${RED}✗ SSH passphrase must be at least 50 characters (current: $ssh_passphrase_len)${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cracklib_check=$(echo "$ssh_passphrase" | cracklib-check)
|
||||
if [[ ! "$cracklib_check" =~ OK$ ]]; then
|
||||
echo -e "${RED}✗ SSH passphrase not secure enough: $cracklib_check${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
echo -e "${GREEN}✓ SSH passphrase validated${NO_COLOR}"
|
||||
|
||||
# Validate checksum passphrase
|
||||
if [[ "$checksum_passphrase" != "$checksum_passphrase_check" ]]; then
|
||||
echo -e "${RED}✗ Checksum passphrases do not match${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $checksum_passphrase_len -lt 50 ]; then
|
||||
echo -e "${RED}✗ Checksum passphrase must be at least 50 characters (current: $checksum_passphrase_len)${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cracklib_check=$(echo "$checksum_passphrase" | cracklib-check)
|
||||
if [[ ! "$cracklib_check" =~ OK$ ]]; then
|
||||
echo -e "${RED}✗ Checksum passphrase not secure enough: $cracklib_check${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Ensure the two passphrases are different
|
||||
if [[ "$checksum_passphrase" == "$ssh_passphrase" ]]; then
|
||||
echo -e "${RED}✗ Checksum passphrase MUST be different from SSH passphrase${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}✓ Checksum passphrase validated${NO_COLOR}"
|
||||
|
||||
# Collect optional configuration (press Enter to use defaults)
|
||||
read -p "Working directory [default: $default_working_dir]: " working_dir
|
||||
read -p "Email for signatures [default: $default_email]: " email
|
||||
read -p "Public key comment [default: $default_email]: " comment
|
||||
read -p "Key algorithm [default: $default_algo]: " algo
|
||||
read -p "Key filename [default: $default_key_name]: " key_name
|
||||
read -p "Public files directory name [default: $default_public_files_dir_name]: " public_files_dir_name
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 3: CONFIGURATION VALIDATION
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[3/7] Validating Configuration${NO_COLOR}"
|
||||
|
||||
# Apply defaults for empty inputs
|
||||
if [ -z "$working_dir" ]; then
|
||||
working_dir="$default_working_dir"
|
||||
fi
|
||||
|
||||
if [ -z "$email" ]; then
|
||||
email="$default_email"
|
||||
fi
|
||||
|
||||
if [ -z "$comment" ]; then
|
||||
comment="$default_email"
|
||||
fi
|
||||
|
||||
if [ -z "$algo" ]; then
|
||||
algo="$default_algo"
|
||||
fi
|
||||
|
||||
if [ -z "$key_name" ]; then
|
||||
key_priv_path="$working_dir/$default_key_name"
|
||||
else
|
||||
key_priv_path="$working_dir/$key_name"
|
||||
fi
|
||||
|
||||
if [ -z "$public_files_dir_name" ]; then
|
||||
public_files_dir_path="$working_dir/$default_public_files_dir_name"
|
||||
else
|
||||
public_files_dir_path="$working_dir/$public_files_dir_name"
|
||||
fi
|
||||
|
||||
# Validate working directory
|
||||
if [ ! -d "$working_dir" ]; then
|
||||
echo -e "${RED}✗ Working directory does not exist: $working_dir${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -w "$working_dir" ]; then
|
||||
echo -e "${RED}✗ Working directory is not writable: $working_dir${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "$working_dir" || exit 1
|
||||
|
||||
# Validate algorithm
|
||||
valid_algos=("rsa" "ecdsa" "ecdsa-sk" "ed25519" "ed25519-sk" "dsa")
|
||||
if [[ ! " ${valid_algos[@]} " =~ " ${algo} " ]]; then
|
||||
echo -e "${RED}✗ Invalid algorithm '$algo'${NO_COLOR}"
|
||||
echo -e "${YELLOW}Valid algorithms: ${valid_algos[*]}${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check for existing key files (prevent accidental overwrite)
|
||||
if [ -f "$key_priv_path" ] || [ -f "$key_priv_path.pub" ]; then
|
||||
echo -e "${RED}✗ Key files already exist: $key_priv_path${NO_COLOR}"
|
||||
echo -e "${YELLOW}Choose a different key name or remove existing keys${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check for existing output directory (prevent accidental overwrite)
|
||||
if [ -d "$public_files_dir_path" ]; then
|
||||
echo -e "${RED}✗ Output directory already exists: $public_files_dir_path${NO_COLOR}"
|
||||
echo -e "${YELLOW}Choose a different directory name or remove existing directory${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
# Convert to absolute path for consistency
|
||||
file_to_sign="$(readlink -f "$file_to_sign")"
|
||||
|
||||
# Validate file exists
|
||||
if [ ! -f "$file_to_sign" ]; then
|
||||
echo -e "${RED}✗ File not found: $file_to_sign${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Validate file is readable
|
||||
if [ ! -r "$file_to_sign" ]; then
|
||||
echo -e "${RED}✗ File not readable: $file_to_sign${NO_COLOR}"
|
||||
echo -e "${YELLOW}Check file permissions${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check file size (warn if > 100MB as entire file is loaded into memory for checksums)
|
||||
file_size=$(stat -f%z "$file_to_sign" 2>/dev/null || stat -c%s "$file_to_sign" 2>/dev/null || echo 0)
|
||||
if [ "$file_size" -gt 104857600 ]; then
|
||||
file_size_mb=$(( file_size / 1048576 ))
|
||||
echo -e "${YELLOW}⚠ Warning: Large file (${file_size_mb}MB) will be loaded into memory${NO_COLOR}"
|
||||
read -p "Continue? [y/N]: " confirm
|
||||
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
|
||||
echo "Operation aborted by user"
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Define file paths and extract metadata
|
||||
file_to_sign_basename="$(basename "$file_to_sign")"
|
||||
file_size_human="$(du -h "$file_to_sign" 2>/dev/null | cut -f1 || echo 'unknown')"
|
||||
sig_file_path="$file_to_sign.sig"
|
||||
key_pub_path="$key_priv_path.pub"
|
||||
allowed_signers_path="$working_dir/allowed_signers"
|
||||
file_to_sign_checksums_path="$file_to_sign.checksums"
|
||||
file_to_sign_checksums_sig_path="$file_to_sign_checksums_path.sig"
|
||||
|
||||
# Display validated configuration
|
||||
echo -e "${GREEN}✓ Configuration validated${NO_COLOR}"
|
||||
echo -e " File to sign: $file_to_sign_basename ($file_size_human)"
|
||||
echo -e " Algorithm: $algo"
|
||||
echo -e " Email: $email"
|
||||
echo -e " Working directory: $working_dir"
|
||||
echo -e " Output directory: $public_files_dir_path"
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 4: SSH KEY PAIR GENERATION
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[4/7] Generating SSH Key Pair${NO_COLOR}"
|
||||
|
||||
# Generate SSH key pair with passphrase protection
|
||||
# Using -N flag to provide passphrase non-interactively
|
||||
ssh-keygen -t "$algo" -C "$comment" -f "$key_priv_path" -N "$ssh_passphrase" -q 2>/dev/null
|
||||
|
||||
# Verify key files were created successfully
|
||||
if [ ! -f "$key_priv_path" ] || [ ! -f "$key_pub_path" ]; then
|
||||
echo -e "${RED}✗ Key generation failed${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}✓ SSH key pair generated${NO_COLOR}"
|
||||
|
||||
# Clear passphrase confirmation variables from memory (security)
|
||||
unset ssh_passphrase_check
|
||||
unset checksum_passphrase_check
|
||||
|
||||
# Set restrictive permissions on private key (600 = owner read/write only)
|
||||
chown "$USER:$USER" "$key_priv_path" 2>/dev/null || true
|
||||
chmod 600 "$key_priv_path"
|
||||
|
||||
# Create allowed_signers file (required for SSH signature verification)
|
||||
pub_key_text="$(cat "$key_pub_path")"
|
||||
echo "$email $pub_key_text" > "$allowed_signers_path"
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 5: CHECKSUM GENERATION
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[5/7] Generating Checksums${NO_COLOR}"
|
||||
|
||||
# Load file contents into memory (needed for salted checksums)
|
||||
file_to_sign_contents="$(cat "$file_to_sign")"
|
||||
|
||||
# Generate normal SHA256 and SHA512 checksums
|
||||
echo -e "sha256 $(sha256sum "$file_to_sign")\nsha512 $(sha512sum "$file_to_sign")" > "$file_to_sign_checksums_path"
|
||||
|
||||
# Generate salted SHA256 checksum (passphrase + file contents)
|
||||
echo -n "sha256 (private salt+\`cat file\`): " >> "$file_to_sign_checksums_path"
|
||||
echo -n "${checksum_passphrase}${file_to_sign_contents}" | sha256sum | awk '{print $1" "}' >> "$file_to_sign_checksums_path"
|
||||
echo "$file_to_sign_basename" >> "$file_to_sign_checksums_path"
|
||||
|
||||
# Generate salted SHA512 checksum (passphrase + file contents)
|
||||
echo -n "sha512 (private salt+\`cat file\`): " >> "$file_to_sign_checksums_path"
|
||||
echo -n "${checksum_passphrase}${file_to_sign_contents}" | sha512sum | awk '{print $1" "}' >> "$file_to_sign_checksums_path"
|
||||
echo "$file_to_sign_basename" >> "$file_to_sign_checksums_path"
|
||||
|
||||
echo -e "${GREEN}✓ Checksums generated (normal + salted)${NO_COLOR}"
|
||||
|
||||
# Clear sensitive data from memory
|
||||
unset file_to_sign_contents
|
||||
unset checksum_passphrase
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 6: FILE SIGNING AND VERIFICATION
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[6/7] Signing Files${NO_COLOR}"
|
||||
|
||||
# Sign the original file
|
||||
echo "$ssh_passphrase" | ssh-keygen -Y sign -f "$key_priv_path" -n file "$file_to_sign" -q 2>/dev/null
|
||||
|
||||
if [ ! -f "$sig_file_path" ]; then
|
||||
echo -e "${RED}✗ Failed to create signature for $file_to_sign_basename${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Sign the checksums file
|
||||
echo "$ssh_passphrase" | ssh-keygen -Y sign -f "$key_priv_path" -n file "$file_to_sign_checksums_path" -q 2>/dev/null
|
||||
|
||||
if [ ! -f "$file_to_sign_checksums_sig_path" ]; then
|
||||
echo -e "${RED}✗ Failed to create signature for checksums file${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}✓ Files signed successfully${NO_COLOR}"
|
||||
|
||||
# Verify signatures immediately after creation (sanity check)
|
||||
echo "Verifying signatures..."
|
||||
if echo "$ssh_passphrase" | ssh-keygen -Y verify -f "$allowed_signers_path" -I "$email" -n file -s "$sig_file_path" < "$file_to_sign" > /dev/null 2>&1; then
|
||||
if echo "$ssh_passphrase" | ssh-keygen -Y verify -f "$allowed_signers_path" -I "$email" -n file -s "$file_to_sign_checksums_sig_path" < "$file_to_sign_checksums_path" > /dev/null 2>&1; then
|
||||
echo -e "${GREEN}✓ Signatures verified successfully${NO_COLOR}"
|
||||
else
|
||||
echo -e "${RED}✗ Checksums signature verification failed${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo -e "${RED}✗ File signature verification failed${NO_COLOR}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ============================================================================
|
||||
# PHASE 7: PUBLIC FILES PACKAGE CREATION
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${BLUE}[7/7] Creating Public Files Package${NO_COLOR}"
|
||||
|
||||
# Create output directory
|
||||
mkdir "$public_files_dir_path"
|
||||
|
||||
# Copy files to public package
|
||||
cp "$key_pub_path" "$public_files_dir_path"
|
||||
cp "$allowed_signers_path" "$public_files_dir_path"
|
||||
cp "$file_to_sign" "$public_files_dir_path"
|
||||
cp "$sig_file_path" "$public_files_dir_path"
|
||||
cp "$file_to_sign_checksums_path" "$public_files_dir_path"
|
||||
cp "$file_to_sign_checksums_sig_path" "$public_files_dir_path"
|
||||
|
||||
# Generate basenames for help text
|
||||
allowed_signers_path_basename="$(basename "$allowed_signers_path")"
|
||||
sig_file_path_basename="$(basename "$sig_file_path")"
|
||||
checksums_sig_file_basename="$(basename "$file_to_sign_checksums_sig_path")"
|
||||
checksums_file_basename="$(basename "$file_to_sign_checksums_path")"
|
||||
|
||||
# Create verification instructions file
|
||||
help_txt="To Verify Signatures (Linux):\n\tssh-keygen -Y verify -f \"$allowed_signers_path_basename\" -I \"$email\" -n file -s \"$sig_file_path_basename\" < \"$file_to_sign_basename\"\n\tssh-keygen -Y verify -f \"$allowed_signers_path_basename\" -I \"$email\" -n file -s \"$checksums_sig_file_basename\" < \"$checksums_file_basename\"\n\nTo Verify Normal Checksums (Linux):\n\tsha256sum $file_to_sign_basename\n\tsha512sum $file_to_sign_basename\n\t\tThen compare to values in $checksums_file_basename\n\nTo Verify Authenticated Checksums Via Private Salt (Linux):\n\tprivate_salt=\"<PROVIDED SALT HERE>\"\n\techo -n \"\${private_salt}\$(cat $file_to_sign_basename)\" | sha256sum\n\techo -n \"\${private_salt}\$(cat $file_to_sign_basename)\" | sha512sum\n\t\tThen compare to values in $checksums_file_basename"
|
||||
echo -e "$help_txt" > "$public_files_dir_path/$txt_help_file_name"
|
||||
|
||||
echo -e "${GREEN}✓ Public files package created${NO_COLOR}"
|
||||
|
||||
# ============================================================================
|
||||
# COMPLETION SUMMARY
|
||||
# ============================================================================
|
||||
|
||||
echo -e "\n${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NO_COLOR}"
|
||||
echo -e "${GREEN}✓ Operation Completed Successfully${NO_COLOR}"
|
||||
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NO_COLOR}"
|
||||
|
||||
echo -e "\n${BLUE}Public Files Package:${NO_COLOR} $public_files_dir_path"
|
||||
echo -e " • $file_to_sign_basename (signed file)"
|
||||
echo -e " • $sig_file_path_basename (file signature)"
|
||||
echo -e " • $checksums_file_basename (checksums file)"
|
||||
echo -e " • $checksums_sig_file_basename (checksums signature)"
|
||||
echo -e " • $allowed_signers_path_basename (allowed signers list)"
|
||||
echo -e " • $(basename "$key_pub_path") (public key)"
|
||||
echo -e " • $txt_help_file_name (verification instructions)"
|
||||
|
||||
echo -e "\n${YELLOW}Private Files (KEEP SECRET):${NO_COLOR}"
|
||||
echo -e " • ${RED}$key_priv_path${NO_COLOR} (private key)"
|
||||
echo -e " • ${RED}Checksum passphrase${NO_COLOR} (for independent verification)"
|
||||
|
||||
echo -e "\n${GREEN}Next Steps:${NO_COLOR}"
|
||||
echo -e " 1. Distribute the public files package to recipients"
|
||||
echo -e " 2. Keep your private key and checksum passphrase secure"
|
||||
echo -e " 3. Recipients can verify signatures using the instructions file"
|
||||
echo -e " 4. Optionally provide the checksum passphrase for independent verification\n"
|
||||
|
||||
# Final security: clear all passphrases from memory
|
||||
unset ssh_passphrase
|
||||
Reference in New Issue
Block a user