blob: 773dc356237adf6734fa4e590d7d614f749361f2 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
# yubisigner-cli
Command-line version of [yubisigner](https://github.com/Ch1ffr3punk/yubisigner) by Stefan Claas, for signing files with YubiKey PIV Ed25519 keys.
## What is this?
This is a CLI tool extracted from the original yubisigner GUI application. It provides the same cryptographic signing functionality but in a command-line interface suitable for scripting and automation.
## Why CLI?
The original yubisigner is a Fyne GUI application. To integrate YubiKey PIV signing with automated workflows like NeoMutt mail2news posting, a CLI version was needed.
## How it was created
This tool was created by extracting the core signing logic from the original `yubisigner.go`:
### Extracted functions (with original line references)
| Function | Original lines | Purpose |
|----------|---------------|---------|
| `normalizeToCRLF` | 538-544 | RFC-compliant line ending normalization |
| `ensureUTF8` | 547-552 | UTF-8 validation and sanitization |
| `calculateHashesRAM` | 1621-1640 | Calculate 4 hashes (RIPEMD-256, SHA-256, SM3, Streebog-256) |
| `formatHashes` | 1746-1766 | Format hashes with right-aligned names |
| `formatSignatureRFC` | 1996-2007 | Format signature with 64-char line breaks |
| `openYubiKey` | 2073-2092 | Open YubiKey at specified index |
| `signEd25519Data` | 1843-1862 | Sign data with Ed25519 (PIV slot 9c) |
| `signDataInternal` | 1769-1840 | Main signing workflow (Ed25519 only) |
### Constants preserved
- `Ed25519SignatureSize`, `Ed25519PublicKeySize`, `Ed25519CombinedSize` (lines 95-99)
- `AlgorithmED25519` (lines 69-73)
### Changes from original
1. **GUI removed**: All Fyne GUI code stripped out
2. **Ed25519 only**: Only Ed25519 support (original supports ECDSA/RSA too)
3. **CLI flags**: Added flag parsing for command-line arguments
4. **No PKCS#11**: Direct YubiKey PIV access only (no PKCS#11 smartcard support)
5. **Simplified output**: Direct signature file write (no GUI dialogs)
The core cryptographic logic is **exactly the same** as the original yubisigner. All signing functions are verbatim copies with comments indicating source line numbers.
## Requirements
- Go 1.21+
- YubiKey with PIV Ed25519 key in slot 9c (Signature slot)
- Dependencies:
- `github.com/go-piv/piv-go/v2/piv`
- `github.com/c0mm4nd/go-ripemd`
- `github.com/martinlindhe/gogost/gost34112012256`
- `github.com/tjfoc/gmsm/sm3`
## Build
```bash
go build -o yubisigner-cli main.go
```
## Usage
```bash
yubisigner-cli \
--input <file> \
--author "Your Name" \
--email "you@example.com" \
--url "https://example.com" \
--comment "Optional comment"
```
Output: `<file>.sig` (detached signature)
### Optional arguments
- `--email` (default: "n/a")
- `--url` (default: "n/a")
- `--telefax` (default: "n/a")
- `--comment` (default: "n/a")
- `--pin` (PIN will be prompted if not provided)
- `--output` (default: `<input>.sig`)
## Signature format
Identical to original yubisigner:
```
Author: Gab Virebent
Signed at: 2026-05-30 23:15:00 +0000
Filename: message.txt
File size: 1234 bytes
Email: gabriel1@virebent.art
Telefax: n/a
URL: https://contact.virebent.art
Comment: Posted via NeoMutt mail2news
RIPEMD-256: abc123...
SHA-256: def456...
SM3: 789abc...
Streebog-256: fedcba...
-----BEGIN YUBISIGNER ED25519 SIGNATURE-----
0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
...
-----END YUBISIGNER ED25519 SIGNATURE-----
```
## Integration with NeoMutt
See [neomutt-config](https://git.virebent.art/virebent/neomutt-config) for mail2news integration with automatic YubiKey signing via the `vim-yubisigner` wrapper.
## License
MIT (same as original yubisigner)
## Credits
- **Stefan Claas** ([@Ch1ffr3punk](https://github.com/Ch1ffr3punk)): Original yubisigner GUI application
- **Gab Virebent**: CLI extraction for automation workflows
All cryptographic logic is Stefan's work. This is purely a CLI wrapper around his signing implementation.
|
