Skip to content

Reference

Factual descriptions of everything the module exposes: configuration fields and their defaults, every sentinel error, every tunable, the backend registry, and the on-disk formats it reads and writes.

The generated Go API — signatures, doc comments, runnable Example tests — is on pkg.go.dev. These pages cover what a signature alone does not tell you: what a field defaults to, what happens when it is wrong, and which declared symbols this module never acts on.

Which package holds what

The module is gitlab.com/phpboyscout/go/signing. Five importable packages:

Import path What it does Import it when
.../go/signing The Backend contract and the process-global backend registry You resolve a signing key by backend name
.../go/signing/verify Trust sets, key resolvers, detached-signature verification You consume someone else's signed release
.../go/signing/openpgpkey Mints OpenPGP public keys, produces detached signatures, writes a WKD tree You publish OpenPGP-signed manifests
.../go/signing/minisign Produces and verifies prehashed minisign signatures over artefacts Your consumers are Rust tools that do not parse OpenPGP
.../go/signing/local The local backend: a PEM private key on disk You sign without a KMS

A verify-only consumer imports verify alone. That path pulls in ProtonMail/go-crypto and cockroachdb/errors, and with them what those two require: golang.org/x/crypto and cloudflare/circl arrive through go-crypto's OpenPGP implementation, golang.org/x/text through the error package's Sentry support. No cloud SDK, no framework. minisign is the narrower graph of the two: it needs golang.org/x/crypto for BLAKE2b but no OpenPGP stack at all.

Reference pages

  • Configuration fields — every exported config struct, field by field, with defaults and failure modes.
  • Errors — every exported sentinel, what raises it, and what to do.
  • Limits, defaults and tunables — size caps, the key strength floor, comment limits, and which package-level variables this module actually reads.
  • The backend registry — Register, Get, Names, the panic conditions, and what keyID means per backend.
  • File formats — the minisign signature and public-key files, the WKD directory layout, and the OpenPGP artefacts.

API stability

The module is pre-1.0 (v0.5.0 at the time of writing), so the usual Go pre-1.0 rules apply: minor-version bumps may break the API.

The package documentation marks signing (the Backend contract), openpgpkey.DetachSign and the whole minisign package as Beta. The stated evolution path for Backend is additive only — for instance capability discovery, or algorithms beyond RSA — because a breaking change there would break every out-of-tree backend module at once.

signing.ResetForTesting is exported but is a test helper. It clears the global registry, and production code must not call it.