// ComputeSignature compute the signature of all blocks of all files in a given container,
// by reading them from disk, relative to `basePath`, and notifying `consumer` of its
// progress
501274
func ComputeSignature(ctx context.Context, container *tlc.Container, pool wsync.Pool, consumer *state.Consumer) ([]wsync.BlockHash, error) {
	var signature []wsync.BlockHash

	err := ComputeSignatureToWriter(ctx, container, pool, consumer, func(bl wsync.BlockHash) error {
		signature = append(signature, bl)
		return nil
	})
	if err != nil {
		return nil, errors.WithStack(err)
	}

	return signature, nil
}
859022
func (r SignedWriteCommand) AuthenticationSignature() [12]byte {
	b := [12]byte{}
	copy(b[:], r[3:])
	return b
}
714948
func (*NoopBlockVerifier) VerifyBlockSignature(sd []*common.SignedData, config *common.ConfigEnvelope) error {
	return nil
}
257088
func (_ *SigningMethodNone) Verify(_ []byte, _ Signature, _ interface{}) error {
	return nil
}
264673
func verifyInputSignature(n string, t reflect.Type) reflect.Type {
	if t.Kind() != reflect.Func {
		panic(fmt.Sprintf(
			"handler for %q is not a function but a %v", n, t.Kind(),
		))
	}

	if t.NumIn() != 2 {
		panic(fmt.Sprintf(
			"expected handler for %q to have 2 arguments but it had %v",
			n, t.NumIn(),
		))
	}

	if t.In(0) != _ctxType {
		panic(fmt.Sprintf(
			"the first argument of the handler for %q must be of type "+
				"context.Context, and not: %v", n, t.In(0),
		))

	}

	reqBodyType := t.In(1)

	if !isValidReqResType(reqBodyType) {
		panic(fmt.Sprintf(
			"the second argument of the handler for %q must be "+
				"a struct pointer, a map[string]interface{}, or interface{}, and not: %v",
			n, reqBodyType,
		))
	}

	return reqBodyType
}
826883
func (r *Request) ApplySignature(authorization string) error {
	r.HTTPRequest.Header.Set("Authorization", authorization)
	return nil
}
1066003
func ComputePkScript(sigScript []byte, witness wire.TxWitness) (PkScript, error) {
	var pkScript PkScript

	// Ensure that either an input's signature script or a witness was
	// provided.
	if len(sigScript) == 0 && len(witness) == 0 {
		return pkScript, ErrUnsupportedScriptType
	}

	// We'll start by checking the input's signature script, if provided.
	switch {
	// If a signature script is provided with a length long enough to
	// represent a P2PKH script, then we'll attempt to parse the compressed
	// public key from it.
	case len(sigScript) == pubKeyHashSigScriptLen ||
		len(sigScript) == pubKeyHashSigScriptLen+1:

		// The public key should be found as the last part of the
		// signature script. We'll attempt to parse it to ensure this is
		// a P2PKH redeem script.
		pubKey := sigScript[len(sigScript)-compressedPubKeyLen:]
		if btcec.IsCompressedPubKey(pubKey) {
			pubKeyHash := hash160(pubKey)
			script, err := payToPubKeyHashScript(pubKeyHash)
			if err != nil {
				return pkScript, err
			}

			pkScript.class = PubKeyHashTy
			copy(pkScript.script[:], script)
			return pkScript, nil
		}

		// If it isn't, we'll assume it is a P2SH signature script.
		fallthrough

	// If we failed to parse a compressed public key from the script in the
	// case above, or if the script length is not that of a P2PKH one, and
	// our redeem script is only composed of data pushed, we can assume it's
	// a P2SH signature script.
	case len(sigScript) > 0 && IsPushOnlyScript(sigScript):
		// The redeem script will always be the last data push of the
		// signature script, so we'll parse the script into opcodes to
		// obtain it.
		parsedOpcodes, err := parseScript(sigScript)
		if err != nil {
			return pkScript, err
		}
		redeemScript := parsedOpcodes[len(parsedOpcodes)-1].data

		scriptHash := hash160(redeemScript)
		script, err := payToScriptHashScript(scriptHash)
		if err != nil {
			return pkScript, err
		}

		pkScript.class = ScriptHashTy
		copy(pkScript.script[:], script)
		return pkScript, nil

	case len(sigScript) > 0:
		return pkScript, ErrUnsupportedScriptType
	}

	// If a witness was provided instead, we'll use the last item of the
	// witness stack to determine the proper witness type.
	lastWitnessItem := witness[len(witness)-1]

	switch {
	// If the witness stack has a size of 2 and its last item is a
	// compressed public key, then this is a P2WPKH witness.
	case len(witness) == 2 && len(lastWitnessItem) == compressedPubKeyLen:
		pubKeyHash := hash160(lastWitnessItem)
		script, err := payToWitnessPubKeyHashScript(pubKeyHash)
		if err != nil {
			return pkScript, err
		}

		pkScript.class = WitnessV0PubKeyHashTy
		copy(pkScript.script[:], script)
		return pkScript, nil

	// For any other witnesses, we'll assume it's a P2WSH witness.
	default:
		scriptHash := sha256.Sum256(lastWitnessItem)
		script, err := payToWitnessScriptHashScript(scriptHash[:])
		if err != nil {
			return pkScript, err
		}

		pkScript.class = WitnessV0ScriptHashTy
		copy(pkScript.script[:], script)
		return pkScript, nil
	}
}
46955
func (bv *BlockValidationPolicyVerifier) VerifyBlockSignature(sd []*common.SignedData, envelope *common.ConfigEnvelope) error {
	policyMgr := bv.PolicyMgr
	// If the envelope passed isn't nil, we should use a different policy manager.
	if envelope != nil {
		bundle, err := channelconfig.NewBundle(bv.Channel, envelope.Config)
		if err != nil {
			buff := &bytes.Buffer{}
			protolator.DeepMarshalJSON(buff, envelope.Config)
			bv.Logger.Errorf("Failed creating a new bundle for channel %s, Config content is: %s", bv.Channel, buff.String())
			return err
		}
		bv.Logger.Infof("Initializing new PolicyManager for channel %s", bv.Channel)
		policyMgr = bundle.PolicyManager()
	}
	policy, exists := policyMgr.GetPolicy(policies.BlockValidation)
	if !exists {
		return errors.Errorf("policy %s wasn't found", policies.BlockValidation)
	}
	return policy.Evaluate(sd)
}
922832
func (r *Record) VerifySignature(s IdentityScheme) error {
	return s.Verify(r, r.signature)
}
1045285
func (pk *PublicKey) VerifySignatureV3(signed hash.Hash, sig *SignatureV3) (err error) {
	if !pk.CanSign() {
		return errors.InvalidArgumentError("public key cannot generate signatures")
	}

	suffix := make([]byte, 5)
	suffix[0] = byte(sig.SigType)
	binary.BigEndian.PutUint32(suffix[1:], uint32(sig.CreationTime.Unix()))
	signed.Write(suffix)
	hashBytes := signed.Sum(nil)

	if hashBytes[0] != sig.HashTag[0] || hashBytes[1] != sig.HashTag[1] {
		return errors.SignatureError("hash tag doesn't match")
	}

	if pk.PubKeyAlgo != sig.PubKeyAlgo {
		return errors.InvalidArgumentError("public key and signature use different algorithms")
	}

	switch pk.PubKeyAlgo {
	case PubKeyAlgoRSA, PubKeyAlgoRSASignOnly:
		rsaPublicKey := pk.PublicKey.(*rsa.PublicKey)
		if err = rsa.VerifyPKCS1v15(rsaPublicKey, sig.Hash, hashBytes, sig.RSASignature.bytes); err != nil {
			return errors.SignatureError("RSA verification failure")
		}
		return
	case PubKeyAlgoDSA:
		dsaPublicKey := pk.PublicKey.(*dsa.PublicKey)
		// Need to truncate hashBytes to match FIPS 186-3 section 4.6.
		subgroupSize := (dsaPublicKey.Q.BitLen() + 7) / 8
		if len(hashBytes) > subgroupSize {
			hashBytes = hashBytes[:subgroupSize]
		}
		if !dsa.Verify(dsaPublicKey, hashBytes, new(big.Int).SetBytes(sig.DSASigR.bytes), new(big.Int).SetBytes(sig.DSASigS.bytes)) {
			return errors.SignatureError("DSA verification failure")
		}
		return nil
	default:
		panic("shouldn't happen")
	}
	panic("unreachable")
}
670428
func (s *Signatory) verifySignature(block *clearsign.Block) (*openpgp.Entity, error) {
	return openpgp.CheckDetachedSignature(
		s.KeyRing,
		bytes.NewBuffer(block.Bytes),
		block.ArmoredSignature.Body,
	)
}
1088287
func (s *X509Signer) Sign(ctx context.Context, blob []byte) ([]byte, error) {
	if err := s.Validate(); err != nil {
		return nil, err
	}

	var hashFunc crypto.Hash
	switch s.algo {
	case x509.SHA256WithRSA:
		hashFunc = crypto.SHA256
	default:
		panic("someone forgot to implement hashing algo for new kind of a key")
	}

	h := hashFunc.New()
	h.Write(blob)
	digest := h.Sum(nil)

	return s.pkey.Sign(cryptorand.Get(ctx), digest, hashFunc)
}
655513
func (c *HyperClient) ContainerExecSignal(container, execID string, sig int64) error {
	req := types.ExecSignalRequest{
		ContainerID: container,
		ExecID:      execID,
		Signal:      sig,
	}
	_, err := c.client.ExecSignal(c.ctx, &req)
	if err != nil {
		return err
	}

	return nil
}
1314575
func buildChunkSignature(chunkData []byte, reqTime time.Time, region,
	previousSignature, secretAccessKey string) string {

	chunkStringToSign := buildChunkStringToSign(reqTime, region,
		previousSignature, chunkData)
	signingKey := getSigningKey(secretAccessKey, region, reqTime)
	return getSignature(signingKey, chunkStringToSign)
}
1347341
func ValidateED25519Signature(key, data, signature []byte) bool {
	if len(key) != ed25519.PublicKeySize || len(signature) != ed25519.SignatureSize {
		return false
	}

	var k [ed25519.PublicKeySize]byte
	var s [ed25519.SignatureSize]byte
	copy(k[:], key)
	copy(s[:], signature)

	return ed25519.Verify(&k, data, &s)
}
760779
func VerifySignature(msg []byte, sig *data.Signature, pk data.PublicKey) error {
	// method lookup is consistent due to Unmarshal JSON doing lower case for us.
	method := sig.Method
	verifier, ok := Verifiers[method]
	if !ok {
		return fmt.Errorf("signing method is not supported: %s", sig.Method)
	}

	if err := verifier.Verify(pk, sig.Signature, msg); err != nil {
		return fmt.Errorf("signature was invalid")
	}
	sig.IsValid = true
	return nil
}
1158946
func CompileSignaturePolicy(sigPolicyEnv *common.SignaturePolicyEnvelope) (GroupRetriever, error) {
	compiler := &signaturePolicyCompiler{}
	return compiler.Compile(sigPolicyEnv)
}