diracdeltas/code-integrity-everywhere — pull request #2 by diracdeltas (2014-07-16 23:06:22+00:00)
Title: Add sample code for manifest signature verification

1. Creates a sample manifest.json, manifest.json.sig, and 4096-bit RSA application signing key.
2. Computes and verifies signature over the sha256sum of the sample manifest.json file contents on startup. We sign the hash of the file contents rathern than the contents themselves because the signing key (in production) resides on an airgapped machine; it's easier to manually type in a hex-encoded sha256sum than the entire file contents as input.

TODO: Decide whether to use nsIDataSignatureVerifier (which is built-into Firefox but does not support ECC keys), or include a Javascript signature verification library so that we can support ECC and/or standard GPG detached signature format.