Migrating from v0.27 to v0.28: signing & verification extracted to standalone modules¶

The OpenPGP/WKD signing and verification code has been extracted from go-tool-base into standalone modules so it can be reused without the framework:

• gitlab.com/phpboyscout/signing — the Backend contract + registry, the signing mechanics (openpgpkey), the verification trust model (verify), and the light local (PEM) backend.
• gitlab.com/phpboyscout/signing-aws-kms — the AWS KMS backend (its own module so consumers that don't sign with KMS never inherit the AWS SDK).

go-tool-base now consumes these modules. This is a hard cut-over: the in-tree packages have been removed (no compatibility aliases), in keeping with the pre-1.0 policy of preferring a clean break.

Breaking Changes¶

Moved import paths¶

Packages: pkg/openpgpkey, pkg/signing, pkg/signing/local, pkg/signing/kms

Repoint imports:

Migration:

go get gitlab.com/phpboyscout/[email protected]
go get gitlab.com/phpboyscout/[email protected]   # only if you sign with AWS KMS

Then update imports. The AWS KMS package was renamed kms → awskms; if you only blank-import it to register the backend, just change the path:

// Before
import _ "gitlab.com/phpboyscout/go-tool-base/pkg/signing/kms"
// After
import _ "gitlab.com/phpboyscout/signing-aws-kms"

The verification surface moved to signing/verify¶

Package: pkg/setup → gitlab.com/phpboyscout/signing/verify

TrustSet, LoadTrustSet, KeyResolver, BuildKeyResolver, KeyResolverConfig, NewEmbeddedResolver, NewWKDResolver, WKDResolverConfig, CompositeResolver, WKDURLs, the ErrKeyResolver* / ErrWeakKey / ErrSignature* sentinels, and the DefaultRequireSignature / DefaultKeySource / DefaultExternalKeyEmail / DefaultRequireExternalCrosscheck variables were re-exported from pkg/setup. They now live in signing/verify.

Before:

ts, err := setup.LoadTrustSet(armoredPub)
setup.DefaultRequireSignature = true

After:

import "gitlab.com/phpboyscout/signing/verify"

ts, err := verify.LoadTrustSet(armoredPub)
verify.DefaultRequireSignature = true

DefaultRequireChecksum is not part of this move — checksum enforcement is gtb's, and it stays in pkg/setup.

KeyResolverConfig seams are now stdlib¶

Package: signing/verify

KeyResolverConfig.Logger is now a *slog.Logger (was the framework logger.Logger), and the nil-default HTTP client is a plain stdlib *http.Client. Bridge gtb's logger and inject a hardened client:

verify.BuildKeyResolver(verify.KeyResolverConfig{
    // …
    Logger:     slog.New(myLogger.Handler()), // logger.Logger → *slog.Logger
    HTTPClient: gtbhttp.NewClient(),           // inject your hardened client
}, embeddedKeys...)

The Backend contract is now CLI-agnostic¶

Package: gitlab.com/phpboyscout/signing

signing.Backend no longer includes RegisterFlags(*pflag.FlagSet). The contract is now just:

type Backend interface {
    Name() string
    NewSigner(ctx context.Context, keyID string) (crypto.Signer, error)
}

A backend that needs per-backend CLI flags implements an optional interface that the CLI front-end type-asserts for; the module core no longer depends on a flag library:

for _, n := range signing.Names() {
    b, _ := signing.Get(n)
    if fr, ok := b.(interface{ RegisterFlags(*pflag.FlagSet) }); ok {
        fr.RegisterFlags(cmd.Flags())
    }
}

If you implemented a custom backend, keep your RegisterFlags method (the aws-kms backend does, for --kms-region) — it is simply no longer mandated by the interface.

Notes for scaffolded tools¶

gtb generate/regenerate now emit verify.Default* (rather than setup.Default*) into a signing-enabled tool's generated signing.go; the generator's go mod tidy pass resolves the signing dependency automatically. Re-running gtb regenerate after upgrading picks this up.

New modules¶

• signing and signing-aws-kms have their own documentation (https://signing.phpboyscout.uk) and pkg.go.dev reference, including a backend catalogue, the trust model, a threat model, and a guide to implementing your own backend.