feat: implement reader-facing signature validation #13

New issue

Closed

opened 2025-09-27 20:41:46 +00:00 by treadful · 2 comments

treadful commented

2025-09-27 20:41:46 +00:00

Owner

There's a few options.

Simply display a checkmark and signature after the server validates (maybe offer raw downloads?)
Implement client-side validation, where the client fetches the raw file and validates the signature on its own.
Implement in the CLI client to validate foreign signatures

1 is relatively easy but requires trust of the server. 2 will no doubt have implementation difficulties between whatever JS (WASM?) ECDSA/secp256k implementation we get. 3 might be the most straight forward option, since most of the code needed is already there.

feat(server): server-side signature validation #94
feat(client): client-side signature validation #95
feat(server): authentication instructions in footer #96

There's a few options. 1) Simply display a checkmark and signature after the server validates (maybe offer raw downloads?) 2) Implement client-side validation, where the client fetches the raw file and validates the signature on its own. 3) Implement in the CLI client to validate foreign signatures 1 is relatively easy but requires trust of the server. 2 will no doubt have implementation difficulties between whatever JS (WASM?) ECDSA/secp256k implementation we get. 3 might be the most straight forward option, since most of the code needed is already there. - [ ] feat(server): server-side signature validation #94 - [ ] feat(client): client-side signature validation #95 - [ ] feat(server): authentication instructions in footer #96

treadful added this to the 0.1 milestone

2025-09-27 20:41:46 +00:00

treadful added the

feature

label

2025-09-27 20:41:46 +00:00

treadful referenced this issue

2025-10-21 03:42:56 +00:00

feat: signature storage and retreival #44

treadful commented

2025-11-23 19:58:51 +00:00

Author

Owner

Maybe push option 2 into the distant future.

Option 1 could be done on the server while doing real validation (to ensure storage wasn't fooled with). And option 3 just needs to be exposed to users somehow.

I think all options are valid and this issue should be split up.

Wondering if client-side validation could be implemented with WASM to allow the use of the same code as the server and client does. This might take a while though since there'll be some new learning but it'll be simpler in the long run. Maybe push option 2 into the distant future. Option 1 could be done on the server while doing real validation (to ensure storage wasn't fooled with). And option 3 just needs to be exposed to users somehow. I think all options are valid and this issue should be split up.

treadful referenced this issue

2025-11-23 20:02:35 +00:00

feat(server): server-side signature validation #94

treadful referenced this issue

2025-11-23 20:04:50 +00:00

feat(client): client-side signature validation #95

treadful referenced this issue

2025-11-23 20:06:49 +00:00

feat(server): authentication instructions in footer #96

treadful commented

2025-11-23 20:08:30 +00:00

Author

Owner

Should be noted that option 3 has already been implemented in the CLI client. It just needs to be exposed to the user on the Web page.

Closing this issue since it's been broken out into the 3 options.

Should be noted that option 3 has already been implemented in the CLI client. It just needs to be exposed to the user on the Web page. Closing this issue since it's been broken out into the 3 options.

treadful closed this issue

2025-11-23 20:08:30 +00:00