podman

1
// Copyright 2019 The Go Authors. All rights reserved.
2
// Use of this source code is governed by a BSD-style
3
// license that can be found in the LICENSE file.
4

5
// Package note defines the notes signed by the Go module database server.
6
//
7
// A note is text signed by one or more server keys.
8
// The text should be ignored unless the note is signed by
9
// a trusted server key and the signature has been verified
10
// using the server's public key.
11
//
12
// A server's public key is identified by a name, typically the "host[/path]"
13
// giving the base URL of the server's transparency log.
14
// The syntactic restrictions on a name are that it be non-empty,
15
// well-formed UTF-8 containing neither Unicode spaces nor plus (U+002B).
16
//
17
// A Go module database server signs texts using public key cryptography.
18
// A given server may have multiple public keys, each
19
// identified by a 32-bit hash of the public key.
20
//
21
// # Verifying Notes
22
//
23
// A [Verifier] allows verification of signatures by one server public key.
24
// It can report the name of the server and the uint32 hash of the key,
25
// and it can verify a purported signature by that key.
26
//
27
// The standard implementation of a Verifier is constructed
28
// by [NewVerifier] starting from a verifier key, which is a
29
// plain text string of the form "<name>+<hash>+<keydata>".
30
//
31
// A [Verifiers] allows looking up a Verifier by the combination
32
// of server name and key hash.
33
//
34
// The standard implementation of a Verifiers is constructed
35
// by VerifierList from a list of known verifiers.
36
//
37
// A [Note] represents a text with one or more signatures.
38
// An implementation can reject a note with too many signatures
39
// (for example, more than 100 signatures).
40
//
41
// A [Signature] represents a signature on a note, verified or not.
42
//
43
// The [Open] function takes as input a signed message
44
// and a set of known verifiers. It decodes and verifies
45
// the message signatures and returns a [Note] structure
46
// containing the message text and (verified or unverified) signatures.
47
//
48
// # Signing Notes
49
//
50
// A [Signer] allows signing a text with a given key.
51
// It can report the name of the server and the hash of the key
52
// and can sign a raw text using that key.
53
//
54
// The standard implementation of a Signer is constructed
55
// by [NewSigner] starting from an encoded signer key, which is a
56
// plain text string of the form "PRIVATE+KEY+<name>+<hash>+<keydata>".
57
// Anyone with an encoded signer key can sign messages using that key,
58
// so it must be kept secret. The encoding begins with the literal text
59
// "PRIVATE+KEY" to avoid confusion with the public server key.
60
//
61
// The [Sign] function takes as input a Note and a list of Signers
62
// and returns an encoded, signed message.
63
//
64
// # Signed Note Format
65
//
66
// A signed note consists of a text ending in newline (U+000A),
67
// followed by a blank line (only a newline),
68
// followed by one or more signature lines of this form:
69
// em dash (U+2014), space (U+0020),
70
// server name, space, base64-encoded signature, newline.
71
//
72
// Signed notes must be valid UTF-8 and must not contain any
73
// ASCII control characters (those below U+0020) other than newline.
74
//
75
// A signature is a base64 encoding of 4+n bytes.
76
//
77
// The first four bytes in the signature are the uint32 key hash
78
// stored in big-endian order.
79
//
80
// The remaining n bytes are the result of using the specified key
81
// to sign the note text (including the final newline but not the
82
// separating blank line).
83
//
84
// # Generating Keys
85
//
86
// There is only one key type, Ed25519 with algorithm identifier 1.
87
// New key types may be introduced in the future as needed,
88
// although doing so will require deploying the new algorithms to all clients
89
// before starting to depend on them for signatures.
90
//
91
// The [GenerateKey] function generates and returns a new signer
92
// and corresponding verifier.
93
//
94
// # Example
95
//
96
// Here is a well-formed signed note:
97
//
98
//	If you think cryptography is the answer to your problem,
99
//	then you don't know what your problem is.
100
//
101
//	— PeterNeumann x08go/ZJkuBS9UG/SffcvIAQxVBtiFupLLr8pAcElZInNIuGUgYN1FFYC2pZSNXgKvqfqdngotpRZb6KE6RyyBwJnAM=
102
//
103
// It can be constructed and displayed using:
104
//
105
//	skey := "PRIVATE+KEY+PeterNeumann+c74f20a3+AYEKFALVFGyNhPJEMzD1QIDr+Y7hfZx09iUvxdXHKDFz"
106
//	text := "If you think cryptography is the answer to your problem,\n" +
107
//		"then you don't know what your problem is.\n"
108
//
109
//	signer, err := note.NewSigner(skey)
110
//	if err != nil {
111
//		log.Fatal(err)
112
//	}
113
//
114
//	msg, err := note.Sign(&note.Note{Text: text}, signer)
115
//	if err != nil {
116
//		log.Fatal(err)
117
//	}
118
//	os.Stdout.Write(msg)
119
//
120
// The note's text is two lines, including the final newline,
121
// and the text is purportedly signed by a server named
122
// "PeterNeumann". (Although server names are canonically
123
// base URLs, the only syntactic requirement is that they
124
// not contain spaces or newlines).
125
//
126
// If [Open] is given access to a [Verifiers] including the
127
// [Verifier] for this key, then it will succeed at verifying
128
// the encoded message and returning the parsed [Note]:
129
//
130
//	vkey := "PeterNeumann+c74f20a3+ARpc2QcUPDhMQegwxbzhKqiBfsVkmqq/LDE4izWy10TW"
131
//	msg := []byte("If you think cryptography is the answer to your problem,\n" +
132
//		"then you don't know what your problem is.\n" +
133
//		"\n" +
134
//		"— PeterNeumann x08go/ZJkuBS9UG/SffcvIAQxVBtiFupLLr8pAcElZInNIuGUgYN1FFYC2pZSNXgKvqfqdngotpRZb6KE6RyyBwJnAM=\n")
135
//
136
//	verifier, err := note.NewVerifier(vkey)
137
//	if err != nil {
138
//		log.Fatal(err)
139
//	}
140
//	verifiers := note.VerifierList(verifier)
141
//
142
//	n, err := note.Open([]byte(msg), verifiers)
143
//	if err != nil {
144
//		log.Fatal(err)
145
//	}
146
//	fmt.Printf("%s (%08x):\n%s", n.Sigs[0].Name, n.Sigs[0].Hash, n.Text)
147
//
148
// You can add your own signature to this message by re-signing the note:
149
//
150
//	skey, vkey, err := note.GenerateKey(rand.Reader, "EnochRoot")
151
//	if err != nil {
152
//		log.Fatal(err)
153
//	}
154
//	_ = vkey // give to verifiers
155
//
156
//	me, err := note.NewSigner(skey)
157
//	if err != nil {
158
//		log.Fatal(err)
159
//	}
160
//
161
//	msg, err := note.Sign(n, me)
162
//	if err != nil {
163
//		log.Fatal(err)
164
//	}
165
//	os.Stdout.Write(msg)
166
//
167
// This will print a doubly-signed message, like:
168
//
169
//	If you think cryptography is the answer to your problem,
170
//	then you don't know what your problem is.
171
//
172
//	— PeterNeumann x08go/ZJkuBS9UG/SffcvIAQxVBtiFupLLr8pAcElZInNIuGUgYN1FFYC2pZSNXgKvqfqdngotpRZb6KE6RyyBwJnAM=
173
//	— EnochRoot rwz+eBzmZa0SO3NbfRGzPCpDckykFXSdeX+MNtCOXm2/5n2tiOHp+vAF1aGrQ5ovTG01oOTGwnWLox33WWd1RvMc+QQ=
174
package note
175

176
import (
177
	"bytes"
178
	"crypto/ed25519"
179
	"crypto/sha256"
180
	"encoding/base64"
181
	"encoding/binary"
182
	"errors"
183
	"fmt"
184
	"io"
185
	"strconv"
186
	"strings"
187
	"unicode"
188
	"unicode/utf8"
189
)
190

191
// A Verifier verifies messages signed with a specific key.
192
type Verifier interface {
193
	// Name returns the server name associated with the key.
194
	Name() string
195

196
	// KeyHash returns the key hash.
197
	KeyHash() uint32
198

199
	// Verify reports whether sig is a valid signature of msg.
200
	Verify(msg, sig []byte) bool
201
}
202

203
// A Signer signs messages using a specific key.
204
type Signer interface {
205
	// Name returns the server name associated with the key.
206
	Name() string
207

208
	// KeyHash returns the key hash.
209
	KeyHash() uint32
210

211
	// Sign returns a signature for the given message.
212
	Sign(msg []byte) ([]byte, error)
213
}
214

215
// keyHash computes the key hash for the given server name and encoded public key.
216
func keyHash(name string, key []byte) uint32 {
217
	h := sha256.New()
218
	h.Write([]byte(name))
219
	h.Write([]byte("\n"))
220
	h.Write(key)
221
	sum := h.Sum(nil)
222
	return binary.BigEndian.Uint32(sum)
223
}
224

225
var (
226
	errVerifierID   = errors.New("malformed verifier id")
227
	errVerifierAlg  = errors.New("unknown verifier algorithm")
228
	errVerifierHash = errors.New("invalid verifier hash")
229
)
230

231
const (
232
	algEd25519 = 1
233
)
234

235
// isValidName reports whether name is valid.
236
// It must be non-empty and not have any Unicode spaces or pluses.
237
func isValidName(name string) bool {
238
	return name != "" && utf8.ValidString(name) && strings.IndexFunc(name, unicode.IsSpace) < 0 && !strings.Contains(name, "+")
239
}
240

241
// NewVerifier construct a new [Verifier] from an encoded verifier key.
242
func NewVerifier(vkey string) (Verifier, error) {
243
	name, vkey := chop(vkey, "+")
244
	hash16, key64 := chop(vkey, "+")
245
	hash, err1 := strconv.ParseUint(hash16, 16, 32)
246
	key, err2 := base64.StdEncoding.DecodeString(key64)
247
	if len(hash16) != 8 || err1 != nil || err2 != nil || !isValidName(name) || len(key) == 0 {
248
		return nil, errVerifierID
249
	}
250
	if uint32(hash) != keyHash(name, key) {
251
		return nil, errVerifierHash
252
	}
253

254
	v := &verifier{
255
		name: name,
256
		hash: uint32(hash),
257
	}
258

259
	alg, key := key[0], key[1:]
260
	switch alg {
261
	default:
262
		return nil, errVerifierAlg
263

264
	case algEd25519:
265
		if len(key) != 32 {
266
			return nil, errVerifierID
267
		}
268
		v.verify = func(msg, sig []byte) bool {
269
			return ed25519.Verify(key, msg, sig)
270
		}
271
	}
272

273
	return v, nil
274
}
275

276
// chop chops s at the first instance of sep, if any,
277
// and returns the text before and after sep.
278
// If sep is not present, chop returns before is s and after is empty.
279
func chop(s, sep string) (before, after string) {
280
	i := strings.Index(s, sep)
281
	if i < 0 {
282
		return s, ""
283
	}
284
	return s[:i], s[i+len(sep):]
285
}
286

287
// verifier is a trivial Verifier implementation.
288
type verifier struct {
289
	name   string
290
	hash   uint32
291
	verify func([]byte, []byte) bool
292
}
293

294
func (v *verifier) Name() string                { return v.name }
295
func (v *verifier) KeyHash() uint32             { return v.hash }
296
func (v *verifier) Verify(msg, sig []byte) bool { return v.verify(msg, sig) }
297

298
// NewSigner constructs a new [Signer] from an encoded signer key.
299
func NewSigner(skey string) (Signer, error) {
300
	priv1, skey := chop(skey, "+")
301
	priv2, skey := chop(skey, "+")
302
	name, skey := chop(skey, "+")
303
	hash16, key64 := chop(skey, "+")
304
	hash, err1 := strconv.ParseUint(hash16, 16, 32)
305
	key, err2 := base64.StdEncoding.DecodeString(key64)
306
	if priv1 != "PRIVATE" || priv2 != "KEY" || len(hash16) != 8 || err1 != nil || err2 != nil || !isValidName(name) || len(key) == 0 {
307
		return nil, errSignerID
308
	}
309

310
	// Note: hash is the hash of the public key and we have the private key.
311
	// Must verify hash after deriving public key.
312

313
	s := &signer{
314
		name: name,
315
		hash: uint32(hash),
316
	}
317

318
	var pubkey []byte
319

320
	alg, key := key[0], key[1:]
321
	switch alg {
322
	default:
323
		return nil, errSignerAlg
324

325
	case algEd25519:
326
		if len(key) != 32 {
327
			return nil, errSignerID
328
		}
329
		key = ed25519.NewKeyFromSeed(key)
330
		pubkey = append([]byte{algEd25519}, key[32:]...)
331
		s.sign = func(msg []byte) ([]byte, error) {
332
			return ed25519.Sign(key, msg), nil
333
		}
334
	}
335

336
	if uint32(hash) != keyHash(name, pubkey) {
337
		return nil, errSignerHash
338
	}
339

340
	return s, nil
341
}
342

343
var (
344
	errSignerID   = errors.New("malformed verifier id")
345
	errSignerAlg  = errors.New("unknown verifier algorithm")
346
	errSignerHash = errors.New("invalid verifier hash")
347
)
348

349
// signer is a trivial Signer implementation.
350
type signer struct {
351
	name string
352
	hash uint32
353
	sign func([]byte) ([]byte, error)
354
}
355

356
func (s *signer) Name() string                    { return s.name }
357
func (s *signer) KeyHash() uint32                 { return s.hash }
358
func (s *signer) Sign(msg []byte) ([]byte, error) { return s.sign(msg) }
359

360
// GenerateKey generates a signer and verifier key pair for a named server.
361
// The signer key skey is private and must be kept secret.
362
func GenerateKey(rand io.Reader, name string) (skey, vkey string, err error) {
363
	pub, priv, err := ed25519.GenerateKey(rand)
364
	if err != nil {
365
		return "", "", err
366
	}
367
	pubkey := append([]byte{algEd25519}, pub...)
368
	privkey := append([]byte{algEd25519}, priv.Seed()...)
369
	h := keyHash(name, pubkey)
370

371
	skey = fmt.Sprintf("PRIVATE+KEY+%s+%08x+%s", name, h, base64.StdEncoding.EncodeToString(privkey))
372
	vkey = fmt.Sprintf("%s+%08x+%s", name, h, base64.StdEncoding.EncodeToString(pubkey))
373
	return skey, vkey, nil
374
}
375

376
// NewEd25519VerifierKey returns an encoded verifier key using the given name
377
// and Ed25519 public key.
378
func NewEd25519VerifierKey(name string, key ed25519.PublicKey) (string, error) {
379
	if len(key) != ed25519.PublicKeySize {
380
		return "", fmt.Errorf("invalid public key size %d, expected %d", len(key), ed25519.PublicKeySize)
381
	}
382

383
	pubkey := append([]byte{algEd25519}, key...)
384
	hash := keyHash(name, pubkey)
385

386
	b64Key := base64.StdEncoding.EncodeToString(pubkey)
387
	return fmt.Sprintf("%s+%08x+%s", name, hash, b64Key), nil
388
}
389

390
// A Verifiers is a collection of known verifier keys.
391
type Verifiers interface {
392
	// Verifier returns the Verifier associated with the key
393
	// identified by the name and hash.
394
	// If the name, hash pair is unknown, Verifier should return
395
	// an UnknownVerifierError.
396
	Verifier(name string, hash uint32) (Verifier, error)
397
}
398

399
// An UnknownVerifierError indicates that the given key is not known.
400
// The Open function records signatures without associated verifiers as
401
// unverified signatures.
402
type UnknownVerifierError struct {
403
	Name    string
404
	KeyHash uint32
405
}
406

407
func (e *UnknownVerifierError) Error() string {
408
	return fmt.Sprintf("unknown key %s+%08x", e.Name, e.KeyHash)
409
}
410

411
// An ambiguousVerifierError indicates that the given name and hash
412
// match multiple keys passed to [VerifierList].
413
// (If this happens, some malicious actor has taken control of the
414
// verifier list, at which point we may as well give up entirely,
415
// but we diagnose the problem instead.)
416
type ambiguousVerifierError struct {
417
	name string
418
	hash uint32
419
}
420

421
func (e *ambiguousVerifierError) Error() string {
422
	return fmt.Sprintf("ambiguous key %s+%08x", e.name, e.hash)
423
}
424

425
// VerifierList returns a [Verifiers] implementation that uses the given list of verifiers.
426
func VerifierList(list ...Verifier) Verifiers {
427
	m := make(verifierMap)
428
	for _, v := range list {
429
		k := nameHash{v.Name(), v.KeyHash()}
430
		m[k] = append(m[k], v)
431
	}
432
	return m
433
}
434

435
type nameHash struct {
436
	name string
437
	hash uint32
438
}
439

440
type verifierMap map[nameHash][]Verifier
441

442
func (m verifierMap) Verifier(name string, hash uint32) (Verifier, error) {
443
	v, ok := m[nameHash{name, hash}]
444
	if !ok {
445
		return nil, &UnknownVerifierError{name, hash}
446
	}
447
	if len(v) > 1 {
448
		return nil, &ambiguousVerifierError{name, hash}
449
	}
450
	return v[0], nil
451
}
452

453
// A Note is a text and signatures.
454
type Note struct {
455
	Text           string      // text of note
456
	Sigs           []Signature // verified signatures
457
	UnverifiedSigs []Signature // unverified signatures
458
}
459

460
// A Signature is a single signature found in a note.
461
type Signature struct {
462
	// Name and Hash give the name and key hash
463
	// for the key that generated the signature.
464
	Name string
465
	Hash uint32
466

467
	// Base64 records the base64-encoded signature bytes.
468
	Base64 string
469
}
470

471
// An UnverifiedNoteError indicates that the note
472
// successfully parsed but had no verifiable signatures.
473
type UnverifiedNoteError struct {
474
	Note *Note
475
}
476

477
func (e *UnverifiedNoteError) Error() string {
478
	return "note has no verifiable signatures"
479
}
480

481
// An InvalidSignatureError indicates that the given key was known
482
// and the associated Verifier rejected the signature.
483
type InvalidSignatureError struct {
484
	Name string
485
	Hash uint32
486
}
487

488
func (e *InvalidSignatureError) Error() string {
489
	return fmt.Sprintf("invalid signature for key %s+%08x", e.Name, e.Hash)
490
}
491

492
var (
493
	errMalformedNote      = errors.New("malformed note")
494
	errInvalidSigner      = errors.New("invalid signer")
495
	errMismatchedVerifier = errors.New("verifier name or hash doesn't match signature")
496

497
	sigSplit  = []byte("\n\n")
498
	sigPrefix = []byte("— ")
499
)
500

501
// Open opens and parses the message msg, checking signatures from the known verifiers.
502
//
503
// For each signature in the message, Open calls known.Verifier to find a verifier.
504
// If known.Verifier returns a verifier and the verifier accepts the signature,
505
// Open records the signature in the returned note's Sigs field.
506
// If known.Verifier returns a verifier but the verifier rejects the signature,
507
// Open returns an InvalidSignatureError.
508
// If known.Verifier returns an UnknownVerifierError,
509
// Open records the signature in the returned note's UnverifiedSigs field.
510
// If known.Verifier returns any other error, Open returns that error.
511
//
512
// If no known verifier has signed an otherwise valid note,
513
// Open returns an [UnverifiedNoteError].
514
// In this case, the unverified note can be fetched from inside the error.
515
func Open(msg []byte, known Verifiers) (*Note, error) {
516
	if known == nil {
517
		// Treat nil Verifiers as empty list, to produce useful error instead of crash.
518
		known = VerifierList()
519
	}
520

521
	// Must have valid UTF-8 with no non-newline ASCII control characters.
522
	for i := 0; i < len(msg); {
523
		r, size := utf8.DecodeRune(msg[i:])
524
		if r < 0x20 && r != '\n' || r == utf8.RuneError && size == 1 {
525
			return nil, errMalformedNote
526
		}
527
		i += size
528
	}
529

530
	// Must end with signature block preceded by blank line.
531
	split := bytes.LastIndex(msg, sigSplit)
532
	if split < 0 {
533
		return nil, errMalformedNote
534
	}
535
	text, sigs := msg[:split+1], msg[split+2:]
536
	if len(sigs) == 0 || sigs[len(sigs)-1] != '\n' {
537
		return nil, errMalformedNote
538
	}
539

540
	n := &Note{
541
		Text: string(text),
542
	}
543

544
	// Parse and verify signatures.
545
	// Ignore duplicate signatures.
546
	seen := make(map[nameHash]bool)
547
	seenUnverified := make(map[string]bool)
548
	numSig := 0
549
	for len(sigs) > 0 {
550
		// Pull out next signature line.
551
		// We know sigs[len(sigs)-1] == '\n', so IndexByte always finds one.
552
		i := bytes.IndexByte(sigs, '\n')
553
		line := sigs[:i]
554
		sigs = sigs[i+1:]
555

556
		if !bytes.HasPrefix(line, sigPrefix) {
557
			return nil, errMalformedNote
558
		}
559
		line = line[len(sigPrefix):]
560
		name, b64 := chop(string(line), " ")
561
		sig, err := base64.StdEncoding.DecodeString(b64)
562
		if err != nil || !isValidName(name) || b64 == "" || len(sig) < 5 {
563
			return nil, errMalformedNote
564
		}
565
		hash := binary.BigEndian.Uint32(sig[0:4])
566
		sig = sig[4:]
567

568
		if numSig++; numSig > 100 {
569
			// Avoid spending forever parsing a note with many signatures.
570
			return nil, errMalformedNote
571
		}
572

573
		v, err := known.Verifier(name, hash)
574
		if _, ok := err.(*UnknownVerifierError); ok {
575
			// Drop repeated identical unverified signatures.
576
			if seenUnverified[string(line)] {
577
				continue
578
			}
579
			seenUnverified[string(line)] = true
580
			n.UnverifiedSigs = append(n.UnverifiedSigs, Signature{Name: name, Hash: hash, Base64: b64})
581
			continue
582
		}
583
		if err != nil {
584
			return nil, err
585
		}
586

587
		// Check that known.Verifier returned the right verifier.
588
		if v.Name() != name || v.KeyHash() != hash {
589
			return nil, errMismatchedVerifier
590
		}
591

592
		// Drop repeated signatures by a single verifier.
593
		if seen[nameHash{name, hash}] {
594
			continue
595
		}
596
		seen[nameHash{name, hash}] = true
597

598
		ok := v.Verify(text, sig)
599
		if !ok {
600
			return nil, &InvalidSignatureError{name, hash}
601
		}
602

603
		n.Sigs = append(n.Sigs, Signature{Name: name, Hash: hash, Base64: b64})
604
	}
605

606
	// Parsed and verified all the signatures.
607
	if len(n.Sigs) == 0 {
608
		return nil, &UnverifiedNoteError{n}
609
	}
610
	return n, nil
611
}
612

613
// Sign signs the note with the given signers and returns the encoded message.
614
// The new signatures from signers are listed in the encoded message after
615
// the existing signatures already present in n.Sigs.
616
// If any signer uses the same key as an existing signature,
617
// the existing signature is elided from the output.
618
func Sign(n *Note, signers ...Signer) ([]byte, error) {
619
	var buf bytes.Buffer
620
	if !strings.HasSuffix(n.Text, "\n") {
621
		return nil, errMalformedNote
622
	}
623
	buf.WriteString(n.Text)
624

625
	// Prepare signatures.
626
	var sigs bytes.Buffer
627
	have := make(map[nameHash]bool)
628
	for _, s := range signers {
629
		name := s.Name()
630
		hash := s.KeyHash()
631
		have[nameHash{name, hash}] = true
632
		if !isValidName(name) {
633
			return nil, errInvalidSigner
634
		}
635

636
		sig, err := s.Sign(buf.Bytes()) // buf holds n.Text
637
		if err != nil {
638
			return nil, err
639
		}
640

641
		var hbuf [4]byte
642
		binary.BigEndian.PutUint32(hbuf[:], hash)
643
		b64 := base64.StdEncoding.EncodeToString(append(hbuf[:], sig...))
644
		sigs.WriteString("— ")
645
		sigs.WriteString(name)
646
		sigs.WriteString(" ")
647
		sigs.WriteString(b64)
648
		sigs.WriteString("\n")
649
	}
650

651
	buf.WriteString("\n")
652

653
	// Emit existing signatures not replaced by new ones.
654
	for _, list := range [][]Signature{n.Sigs, n.UnverifiedSigs} {
655
		for _, sig := range list {
656
			name, hash := sig.Name, sig.Hash
657
			if !isValidName(name) {
658
				return nil, errMalformedNote
659
			}
660
			if have[nameHash{name, hash}] {
661
				continue
662
			}
663
			// Double-check hash against base64.
664
			raw, err := base64.StdEncoding.DecodeString(sig.Base64)
665
			if err != nil || len(raw) < 4 || binary.BigEndian.Uint32(raw) != hash {
666
				return nil, errMalformedNote
667
			}
668
			buf.WriteString("— ")
669
			buf.WriteString(sig.Name)
670
			buf.WriteString(" ")
671
			buf.WriteString(sig.Base64)
672
			buf.WriteString("\n")
673
		}
674
	}
675
	buf.Write(sigs.Bytes())
676

677
	return buf.Bytes(), nil
678
}
679