Sweep Webhooks

package main

import (
	"bytes"
	"crypto/ed25519"
	"encoding/base64"
	"strings"

	"golang.org/x/crypto/ssh"
)

const publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOeJEPa2w1I10acMaQlng0BnGtfBwxDnM9lVHJGe+h5j"

func verify(signatureB64 string, rawBody []byte) bool {
	parsed, _, _, rest, err := ssh.ParseAuthorizedKey([]byte(publicKey))
	if err != nil ||
		parsed.Type() != ssh.KeyAlgoED25519 ||
		len(bytes.TrimSpace(rest)) != 0 {
		return false
	}

	cryptoKey, ok := parsed.(ssh.CryptoPublicKey)
	if !ok {
		return false
	}

	pub, ok := cryptoKey.CryptoPublicKey().(ed25519.PublicKey)
	if !ok || len(pub) != ed25519.PublicKeySize {
		return false
	}

	signature, err := base64.StdEncoding.DecodeString(
		strings.TrimSpace(signatureB64),
	)
	if err != nil || len(signature) != ed25519.SignatureSize {
		return false
	}

	return ed25519.Verify(pub, rawBody, signature)
}

import base64

from cryptography.exceptions import InvalidSignature
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.hazmat.primitives.serialization import load_ssh_public_key

PUBLIC_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOeJEPa2w1I10acMaQlng0BnGtfBwxDnM9lVHJGe+h5j"

public_key = load_ssh_public_key(PUBLIC_KEY.encode())
assert isinstance(public_key, Ed25519PublicKey)


def verify(signature_b64: str, raw_body: bytes) -> bool:
    try:
        public_key.verify(base64.b64decode(signature_b64), raw_body)
        return True
    except (InvalidSignature, ValueError):
        return False

const crypto = require("crypto");

const PUBLIC_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOeJEPa2w1I10acMaQlng0BnGtfBwxDnM9lVHJGe+h5j";

function parseSshEd25519(line) {
  const blob = Buffer.from(line.split(" ")[1], "base64");
  const algoLen = blob.readUInt32BE(0);
  const algo = blob.subarray(4, 4 + algoLen).toString();
  const keyLen = blob.readUInt32BE(4 + algoLen);
  const raw = blob.subarray(8 + algoLen, 8 + algoLen + keyLen);
  if (algo !== "ssh-ed25519" || raw.length !== 32) throw new Error("not an ssh-ed25519 key");
  return crypto.createPublicKey({
    key: Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]),
    format: "der",
    type: "spki",
  });
}

const publicKey = parseSshEd25519(PUBLIC_KEY);

function verify(signatureB64, rawBody) {
  const signature = Buffer.from(signatureB64.trim(), "base64");
  if (signature.length !== 64) return false;
  return crypto.verify(null, rawBody, publicKey, signature);
}