Make SCTsigner an object (#263)

* move sct signer to object

# Conflicts:
#	internal/scti/handlers_test.go

# Conflicts:
#	internal/scti/handlers_test.go

# Conflicts:
#	internal/scti/signatures_test.go

* typo

Author: phbnf

internal/scti/ctlog.go

@@ -30,6 +30,9 @@ type log struct {
 	storage Storage
 }
 
+// signSCT builds an SCT for a leaf.
+type signSCT func(leaf *rfc6962.MerkleTreeLeaf) (*rfc6962.SignedCertificateTimestamp, error)
+
 // Storage provides functions to store certificates in a static-ct-api log.
 type Storage interface {
 	// Add assigns an index to the provided Entry, stages the entry for integration, and returns a future for the assigned index.
@@ -71,9 +74,8 @@ func NewLog(ctx context.Context, origin string, signer crypto.Signer, cv ChainVa
 		return nil, fmt.Errorf("unsupported key type: %v", keyType)
 	}
 
-	log.signSCT = func(leaf *rfc6962.MerkleTreeLeaf) (*rfc6962.SignedCertificateTimestamp, error) {
-		return buildV1SCT(signer, leaf)
-	}
+	sctSigner := &sctSigner{signer: signer}
+	log.signSCT = sctSigner.Sign
 
 	log.chainValidator = cv
 

internal/scti/handlers_test.go

@@ -96,7 +96,7 @@ func setupTestLog(t *testing.T) (*log, string) {
 	t.Helper()
 	storageDir := t.TempDir()
 
-	signer, err := setupSigner(fakeSignature)
+	sctSigner, err := setupSCTSigner(fakeSignature)
 	if err != nil {
 		t.Fatalf("Failed to create test signer: %v", err)
 	}
@@ -112,7 +112,7 @@ func setupTestLog(t *testing.T) (*log, string) {
 		rejectUnexpired: false,
 	}
 
-	log, err := NewLog(t.Context(), origin, signer, cv, newPOSIXStorageFunc(t, storageDir), newFixedTimeSource(fakeTime))
+	log, err := NewLog(t.Context(), origin, sctSigner.signer, cv, newPOSIXStorageFunc(t, storageDir), newFixedTimeSource(fakeTime))
 	if err != nil {
 		t.Fatalf("newLog(): %v", err)
 	}

internal/scti/signatures.go

@@ -31,8 +31,9 @@ import (
 
 const nanosPerMilli int64 = int64(time.Millisecond / time.Nanosecond)
 
-// signSCT builds an SCT for a leaf.
-type signSCT func(leaf *rfc6962.MerkleTreeLeaf) (*rfc6962.SignedCertificateTimestamp, error)
+type sctSigner struct {
+	signer crypto.Signer
+}
 
 // serializeSCTSignatureInput serializes the passed in sct and log entry into
 // the correct format for signing.
@@ -63,9 +64,7 @@ func serializeSCTSignatureInput(sct rfc6962.SignedCertificateTimestamp, entry rf
 	}
 }
 
-// TODO(phboneff): create an SCTSigner object
-// TODO(phboneff): see if we can change leaf to idx and entry
-func buildV1SCT(signer crypto.Signer, leaf *rfc6962.MerkleTreeLeaf) (*rfc6962.SignedCertificateTimestamp, error) {
+func (sctSigner *sctSigner) Sign(leaf *rfc6962.MerkleTreeLeaf) (*rfc6962.SignedCertificateTimestamp, error) {
 	// Serialize SCT signature input to get the bytes that need to be signed
 	sctInput := rfc6962.SignedCertificateTimestamp{
 		SCTVersion: rfc6962.V1,
@@ -78,20 +77,20 @@ func buildV1SCT(signer crypto.Signer, leaf *rfc6962.MerkleTreeLeaf) (*rfc6962.Si
 	}
 
 	h := sha256.Sum256(data)
-	signature, err := signer.Sign(rand.Reader, h[:], crypto.SHA256)
+	signature, err := sctSigner.signer.Sign(rand.Reader, h[:], crypto.SHA256)
 	if err != nil {
 		return nil, fmt.Errorf("failed to sign SCT data: %v", err)
 	}
 
 	digitallySigned := rfc6962.DigitallySigned{
 		Algorithm: tls.SignatureAndHashAlgorithm{
 			Hash:      tls.SHA256,
-			Signature: tls.SignatureAlgorithmFromPubKey(signer.Public()),
+			Signature: tls.SignatureAlgorithmFromPubKey(sctSigner.signer.Public()),
 		},
 		Signature: signature,
 	}
 
-	logID, err := getCTLogID(signer.Public())
+	logID, err := getCTLogID(sctSigner.signer.Public())
 	if err != nil {
 		return nil, fmt.Errorf("failed to get logID for signing: %v", err)
 	}

internal/scti/signatures_test.go

@@ -16,7 +16,6 @@ package scti
 
 import (
 	"bytes"
-	"crypto"
 	"crypto/ecdsa"
 	"crypto/sha256"
 	"crypto/x509"
@@ -250,7 +249,7 @@ func TestBuildV1MerkleTreeLeafForCert(t *testing.T) {
 		t.Fatalf("failed to set up test cert: %v", err)
 	}
 
-	signer, err := setupSigner(fakeSignature)
+	sctSigner, err := setupSCTSigner(fakeSignature)
 	if err != nil {
 		t.Fatalf("could not create signer: %v", err)
 	}
@@ -267,7 +266,7 @@ func TestBuildV1MerkleTreeLeafForCert(t *testing.T) {
 	} else if len(rest) > 0 {
 		t.Fatalf("extra data (%d bytes) on reconstructing MerkleTreeLeaf", len(rest))
 	}
-	got, err := buildV1SCT(signer, &leaf)
+	got, err := sctSigner.Sign(&leaf)
 	if err != nil {
 		t.Fatalf("buildV1SCT()=nil,%v; want _,nil", err)
 	}
@@ -313,7 +312,7 @@ func TestSignV1SCTForPrecertificate(t *testing.T) {
 		t.Fatalf("failed to set up test precert: %v", err)
 	}
 
-	signer, err := setupSigner(fakeSignature)
+	sctSigner, err := setupSCTSigner(fakeSignature)
 	if err != nil {
 		t.Fatalf("could not create signer: %v", err)
 	}
@@ -331,7 +330,7 @@ func TestSignV1SCTForPrecertificate(t *testing.T) {
 		t.Fatalf("extra data (%d bytes) on reconstructing MerkleTreeLeaf", len(rest))
 	}
 
-	got, err := buildV1SCT(signer, &leaf)
+	got, err := sctSigner.Sign(&leaf)
 	if err != nil {
 		t.Fatalf("buildV1SCT()=nil,%v; want _,nil", err)
 	}
@@ -393,14 +392,14 @@ func TestGetCTLogID(t *testing.T) {
 
 // Creates a fake signer for use in interaction tests.
 // It will always return fakeSig when asked to sign something.
-func setupSigner(fakeSig []byte) (crypto.Signer, error) {
+func setupSCTSigner(fakeSig []byte) (*sctSigner, error) {
 	block, _ := pem.Decode([]byte(testdata.DemoPublicKey))
 	key, err := x509.ParsePKIXPublicKey(block.Bytes)
 	if err != nil {
 		return nil, err
 	}
 
-	return testdata.NewSignerWithFixedSig(key, fakeSig), nil
+	return &sctSigner{testdata.NewSignerWithFixedSig(key, fakeSig)}, nil
 }
 
 func TestBuildCp(t *testing.T) {