Signing and verifying the deployer card
Top half, signing, in three steps: the deployer card minus its signatures field is canonicalized with RFC 8785 into a 959-byte payload. The protected header {"alg":"HS256","typ":"JOSE","kid":"deployer-key-1"} and the payload are each base64url-encoded and joined with a period into a 1,348-character signing input, which HMAC-SHA256 signs to give signatures[0] with protected eyJhbGci and signature yPk834ji. Bottom half, verifying, in four steps: the published card rebuilds the same payload and its signature matches, so verification returns True. An edited copy whose description reads "Deploys a tagged build to production." rebuilds a different payload, and verification returns False.
SIGN
VERIFY
deployer card
11 members,
plus signatures
canonical payload, RFC 8785
sorted keys, no spaces, no signatures
959 bytes, from capabilities to version
canonicalize
rules 1 to 3
protected header
{"alg":"HS256","typ":"JOSE",
"kid":"deployer-key-1"}
JWS signing input
BASE64URL(header) '.' BASE64URL(payload)
1,348 characters on one line
base64url
base64url
signatures[0]
protected "eyJhbGci"
signature "yPk834ji"
HMAC-SHA256
HS256, key deployer-key-1
the kit: HS256, one shared key
real cards: ES256 or RS256, with
a public key in a JWKS at jku
published card
description as signed
recompute
"yPk834ji"
rebuild
True
step 5
match
edited copy
"Deploys a tagged build
to production."
recompute
new payload,
another value
rebuild
False
step 6
differs