Verify signature on ingestion

from pathlib import Path

from typing import Annotated

import minisign

import typer

from pyrage import decrypt, x25519

from poolpay.paths import age_secret_key_file

from poolpay.paths import age_secret_key_file, minisign_public_key_file

from poolpay.paths import socket_path as default_socket_path

from poolpay.wire.Client import Client

    socket_path: Annotated[

        Path, typer.Argument(help="Path to the wire socket to send the messages to")

    ] = default_socket_path,

    verify_signature: Annotated[

        bool, typer.Option(help="Only ingest if the messages signed")

    ] = True,

) -> None:

    messages_string = _decrypt_if_necessary(messages_path.read_text(encoding="utf-8"))

    """

    Ingest a file of messages into the wire server.

    """

    with messages_path.open("rb") as f:

        payload = f.read()

    if verify_signature:

        public_key_string = "\n".join(

            l

            for l in minisign_public_key_file.read_text(encoding="utf-8").splitlines()

            if not l.startswith("untrusted comment:")

        )

        public_key = minisign.PublicKey.from_base64(public_key_string)

        # Append .minisig suffix (keeping all others intact) to get signature_path

        signature_path = messages_path.with_suffix(messages_path.suffix + ".minisig")

        with signature_path.open("rb") as f:

            signature = minisign.Signature.from_bytes(f.read())

        public_key.verify(payload, signature)

    messages_string = _decrypt_if_necessary(payload.decode("utf-8"))

    messages = tuple(json.loads(m) for m in messages_string.splitlines())