handle repository signatures, was more of an adventure than i initially thought

api/plc.go

···
 	"net/url"
 	"strings"
 
-	key "github.com/bluesky-social/indigo/key"
 	did "github.com/whyrusleeping/go-did"
 	otel "go.opentelemetry.io/otel"
 )
···
 	Sig         string  `json:"sig" cborgen:"sig,omitempty"`
 }
 
-func (s *PLCServer) CreateDID(ctx context.Context, sigkey *key.Key, recovery string, handle string, service string) (string, error) {
+func (s *PLCServer) CreateDID(ctx context.Context, sigkey *did.PrivKey, recovery string, handle string, service string) (string, error) {
 	if s.C == nil {
 		s.C = http.DefaultClient
 	}
 
 	op := CreateOp{
 		Type:        "create",
-		SigningKey:  sigkey.DID(),
+		SigningKey:  sigkey.Public().DID(),
 		RecoveryKey: recovery,
 		Handle:      handle,
 		Service:     service,

api/plc_test.go

···
 	"fmt"
 	"testing"
 
-	key "github.com/bluesky-social/indigo/key"
 	"github.com/lestrrat-go/jwx/jwk"
+	did "github.com/whyrusleeping/go-did"
 )
 
 type testVector struct {
···
 		t.Fatal(err)
 	}
 
-	mk := key.Key{
+	mk := did.PrivKey{
 		Raw:  &spk,
-		Type: "P-256",
+		Type: did.KeyTypeP256,
 	}
 
-	if mk.DID() != tv.Did {
+	if mk.Public().DID() != tv.Did {
 		t.Fatal("keys generated different DIDs")
 	}
 

bgs/bgs.go

···
 
 			u = new(User)
 			u.ID = subj.Uid
+			u.Did = evt.Repo
 		}
 
 		// TODO: if the user is already in the 'slow' path, we shouldnt even bother trying to fast path this event
 
-		if err := bgs.repoman.HandleExternalUserEvent(ctx, host.ID, u.ID, evt.RepoAppend.Prev, evt.RepoAppend.Ops, evt.RepoAppend.Car); err != nil {
+		if err := bgs.repoman.HandleExternalUserEvent(ctx, host.ID, u.ID, u.Did, evt.RepoAppend.Prev, evt.RepoAppend.Ops, evt.RepoAppend.Car); err != nil {
 			if !errors.Is(err, carstore.ErrRepoBaseMismatch) {
-				return err
+				return fmt.Errorf("handle user event failed: %w", err)
 			}
 
 			ai, err := bgs.Index.LookupUser(ctx, u.ID)

carstore/repo_test.go

···
 
 	"github.com/bluesky-social/indigo/api"
 	"github.com/bluesky-social/indigo/repo"
+	"github.com/bluesky-social/indigo/util"
 	sqlbs "github.com/ipfs/go-bs-sqlite3"
 	"github.com/ipfs/go-cid"
 	flatfs "github.com/ipfs/go-ds-flatfs"
···
 			t.Fatal(err)
 		}
 
-		nroot, err := rr.Commit(ctx)
+		kmgr := &util.FakeKeyManager{}
+		nroot, err := rr.Commit(ctx, kmgr.SignForUser)
 		if err != nil {
 			t.Fatal(err)
 		}
···
 }
 
 func setupRepo(ctx context.Context, bs blockstore.Blockstore) (cid.Cid, error) {
-	nr := repo.NewRepo(ctx, bs)
+	nr := repo.NewRepo(ctx, "did:foo", bs)
 
 	if _, _, err := nr.CreateRecord(ctx, "app.bsky.feed.post", &api.PostRecord{
 		Text: fmt.Sprintf("hey look its a tweet %s", time.Now()),
···
 		return cid.Undef, err
 	}
 
-	ncid, err := nr.Commit(ctx)
+	kmgr := &util.FakeKeyManager{}
+	ncid, err := nr.Commit(ctx, kmgr.SignForUser)
 	if err != nil {
 		return cid.Undef, err
 	}
···
 			b.Fatal(err)
 		}
 
-		nroot, err := rr.Commit(ctx)
+		kmgr := &util.FakeKeyManager{}
+		nroot, err := rr.Commit(ctx, kmgr.SignForUser)
 		if err != nil {
 			b.Fatal(err)
 		}
···
 			b.Fatal(err)
 		}
 
-		nroot, err := rr.Commit(ctx)
+		kmgr := &util.FakeKeyManager{}
+		nroot, err := rr.Commit(ctx, kmgr.SignForUser)
 		if err != nil {
 			b.Fatal(err)
 		}
···
 			b.Fatal(err)
 		}
 
-		nroot, err := rr.Commit(ctx)
+		kmgr := &util.FakeKeyManager{}
+		nroot, err := rr.Commit(ctx, kmgr.SignForUser)
 		if err != nil {
 			b.Fatal(err)
 		}

cmd/bigsky/main.go

···
 			return err
 		}
 
-		repoman := repomgr.NewRepoManager(db, cstore)
+		didr := &api.PLCServer{Host: cctx.String("plc")}
+		kmgr := indexer.NewKeyManager(didr, nil)
+
+		repoman := repomgr.NewRepoManager(db, cstore, kmgr)
 
 		evtman := events.NewEventManager()
 
···
 		// not necessary to generate notifications, should probably make the
 		// indexer just take optional callbacks for notification stuff
 		notifman := notifs.NewNotificationManager(db, repoman.GetRecord)
-
-		didr := &api.PLCServer{Host: cctx.String("plc")}
 
 		ix, err := indexer.NewIndexer(db, notifman, evtman, didr, repoman, true)
 		if err != nil {

cmd/gosky/main.go

···
 	atproto "github.com/bluesky-social/indigo/api/atproto"
 	bsky "github.com/bluesky-social/indigo/api/bsky"
 	cliutil "github.com/bluesky-social/indigo/cmd/gosky/util"
-	"github.com/bluesky-social/indigo/key"
 	"github.com/bluesky-social/indigo/repo"
 	"github.com/ipfs/go-cid"
 	"github.com/lestrrat-go/jwx/jwa"
···
 	rejson "github.com/polydawn/refmt/json"
 	"github.com/polydawn/refmt/shared"
 	cli "github.com/urfave/cli/v2"
+	"github.com/whyrusleeping/go-did"
 )
 
 func main() {
···
 			return err
 		}
 
-		fmt.Println("KEYDID: ", sigkey.DID())
+		fmt.Println("KEYDID: ", sigkey.Public().DID())
 
 		ndid, err := s.CreateDID(context.TODO(), sigkey, recoverydid, handle, service)
 		if err != nil {
···
 	},
 }
 
-func loadKey(kfile string) (*key.Key, error) {
+func loadKey(kfile string) (*did.PrivKey, error) {
 	kb, err := os.ReadFile(kfile)
 	if err != nil {
 		return nil, err
···
 		return nil, fmt.Errorf("need a curve set")
 	}
 
-	return &key.Key{
+	var out string
+	kts := string(curve.(jwa.EllipticCurveAlgorithm))
+	switch kts {
+	case "P-256":
+		out = did.KeyTypeP256
+	default:
+		return nil, fmt.Errorf("unrecognized key type: %s", kts)
+	}
+
+	return &did.PrivKey{
 		Raw:  &spk,
-		Type: string(curve.(jwa.EllipticCurveAlgorithm)),
+		Type: out,
 	}, nil
 }
 

cmd/stress/main.go

···
 
 		ctx := context.Background()
 
-		r := repo.NewRepo(ctx, membs)
+		r := repo.NewRepo(ctx, "did:plc:foobar", membs)
 
 		root, err := testing.GenerateFakeRepo(r, l)
 		if err != nil {

go.mod

···
 	github.com/ipfs/go-log/v2 v2.5.1
 	github.com/ipld/go-car v0.5.0
 	github.com/ipld/go-car/v2 v2.5.1
+	github.com/ipsn/go-secp256k1 v0.0.0-20180726113642-9d62b9f0bc52
 	github.com/labstack/echo/v4 v4.10.0
 	github.com/lestrrat-go/jwx v1.2.25
 	github.com/lestrrat-go/jwx/v2 v2.0.8
···
 	github.com/stretchr/testify v1.8.1
 	github.com/urfave/cli/v2 v2.23.7
 	github.com/whyrusleeping/cbor-gen v0.0.0-20230126041949-52956bd4c9aa
-	github.com/whyrusleeping/go-did v0.0.0-20221105001742-8d9e0ffb0d59
+	github.com/whyrusleeping/go-did v0.0.0-20230210051655-85c9ba6709ab
 	go.opentelemetry.io/otel v1.11.2
 	go.opentelemetry.io/otel/exporters/jaeger v1.11.2
 	go.opentelemetry.io/otel/sdk v1.11.2

go.sum

···
 github.com/ipfs/go-car v0.0.4/go.mod h1:eZX0EppfsvSQN8IsJnx57bheogWMgQjJVWU/fDA7ySQ=
 github.com/ipfs/go-cid v0.0.1/go.mod h1:GHWU/WuQdMPmIosc4Yn1bcCT7dSeX4lBafM7iqUPQvM=
 github.com/ipfs/go-cid v0.0.2/go.mod h1:GHWU/WuQdMPmIosc4Yn1bcCT7dSeX4lBafM7iqUPQvM=
-github.com/ipfs/go-cid v0.0.3/go.mod h1:GHWU/WuQdMPmIosc4Yn1bcCT7dSeX4lBafM7iqUPQvM=
 github.com/ipfs/go-cid v0.0.4/go.mod h1:4LLaPOQwmk5z9LBgQnpkivrx8BJjUyGwTXCd5Xfj6+M=
 github.com/ipfs/go-cid v0.0.5/go.mod h1:plgt+Y5MnOey4vO4UlUazGqdbEXuFYitED67FexhXog=
 github.com/ipfs/go-cid v0.0.6/go.mod h1:6Ux9z5e+HpkQdckYoX1PG/6xqKspzlEIR5SDmgqgC/I=
···
 github.com/ipfs/go-ipfs-util v0.0.2 h1:59Sswnk1MFaiq+VcaknX7aYEyGyGDAA73ilhEK2POp8=
 github.com/ipfs/go-ipfs-util v0.0.2/go.mod h1:CbPtkWJzjLdEcezDns2XYaehFVNXG9zrdrtMecczcsQ=
 github.com/ipfs/go-ipld-cbor v0.0.2/go.mod h1:wTBtrQZA3SoFKMVkp6cn6HMRteIB1VsmHA0AQFOn7Nc=
-github.com/ipfs/go-ipld-cbor v0.0.6 h1:pYuWHyvSpIsOOLw4Jy7NbBkCyzLDcl64Bf/LZW7eBQ0=
-github.com/ipfs/go-ipld-cbor v0.0.6/go.mod h1:ssdxxaLJPXH7OjF5V4NSjBbcfh+evoR4ukuru0oPXMA=
 github.com/ipfs/go-ipld-cbor v0.0.7-0.20230126201833-a73d038d90bc h1:eUEo764smNy0EVRuMTSmirmuh552Mf2aBjfpDcLnDa8=
 github.com/ipfs/go-ipld-cbor v0.0.7-0.20230126201833-a73d038d90bc/go.mod h1:X7SgEIwC4COC5OWfcepZBWafO5kA1Rmt9ZsLLbhihQk=
 github.com/ipfs/go-ipld-format v0.0.1/go.mod h1:kyJtbkDALmFHv3QR6et67i35QzO3S0dCDnkOJhcZkms=
···
 github.com/ipld/go-ipld-prime v0.19.0 h1:5axC7rJmPc17Emw6TelxGwnzALk0PdupZ2oj2roDj04=
 github.com/ipld/go-ipld-prime v0.19.0/go.mod h1:Q9j3BaVXwaA3o5JUDNvptDDr/x8+F7FG6XJ8WI3ILg4=
 github.com/ipld/go-ipld-prime/storage/bsadapter v0.0.0-20211210234204-ce2a1c70cd73 h1:TsyATB2ZRRQGTwafJdgEUQkmjOExRV0DNokcihZxbnQ=
+github.com/ipsn/go-secp256k1 v0.0.0-20180726113642-9d62b9f0bc52 h1:QG4CGBqCeuBo6aZlGAamSkxWdgWfZGeE49eUOWJPA4c=
+github.com/ipsn/go-secp256k1 v0.0.0-20180726113642-9d62b9f0bc52/go.mod h1:fdg+/X9Gg4AsAIzWpEHwnqd+QY3b7lajxyjE1m4hkq4=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
···
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/whyrusleeping/cbor v0.0.0-20171005072247-63513f603b11 h1:5HZfQkwe0mIfyDmc1Em5GqlNRzcdtlv4HTNmdpt7XH0=
-github.com/whyrusleeping/cbor-gen v0.0.0-20200123233031-1cdf64d27158/go.mod h1:Xj/M2wWU+QdTdRbu/L/1dIZY8/Wb2K9pAhtroQuxJJI=
-github.com/whyrusleeping/cbor-gen v0.0.0-20230109192608-0173f1e641ac h1:vSeRURgERu0v7h+bKvlP0wuT+inofyu61R15qka/Xh0=
-github.com/whyrusleeping/cbor-gen v0.0.0-20230109192608-0173f1e641ac/go.mod h1:fgkXqYy7bV2cFeIEOkVTZS/WjXARfBqSH6Q2qHL33hQ=
 github.com/whyrusleeping/cbor-gen v0.0.0-20230126041949-52956bd4c9aa h1:EyA027ZAkuaCLoxVX4r1TZMPy1d31fM6hbfQ4OU4I5o=
 github.com/whyrusleeping/cbor-gen v0.0.0-20230126041949-52956bd4c9aa/go.mod h1:fgkXqYy7bV2cFeIEOkVTZS/WjXARfBqSH6Q2qHL33hQ=
 github.com/whyrusleeping/chunker v0.0.0-20181014151217-fe64bd25879f h1:jQa4QT2UP9WYv2nzyawpKMOCl+Z/jW7djv2/J50lj9E=
-github.com/whyrusleeping/go-did v0.0.0-20221105001742-8d9e0ffb0d59 h1:dRYr/sfpZjX8evmbFrOG7ldkzdk5TLMGRVM40k1AZPQ=
-github.com/whyrusleeping/go-did v0.0.0-20221105001742-8d9e0ffb0d59/go.mod h1:mX/AQ/SS9KrCwO8V+IWyIozytxw5gw75cMHymoJvMGo=
+github.com/whyrusleeping/go-did v0.0.0-20230209234736-e14671c25e01 h1:YPGD8CeME7k4QgW0/lb1bR8nYSQDQbxoTPqb4zKke78=
+github.com/whyrusleeping/go-did v0.0.0-20230209234736-e14671c25e01/go.mod h1:mX/AQ/SS9KrCwO8V+IWyIozytxw5gw75cMHymoJvMGo=
+github.com/whyrusleeping/go-did v0.0.0-20230210051655-85c9ba6709ab h1:u1P8OjfkqR7LGZV91TMS76NEecUPa/boX29FBMNq+nw=
+github.com/whyrusleeping/go-did v0.0.0-20230210051655-85c9ba6709ab/go.mod h1:qPtRyexGM5XMHFIfjH+EiA/A/1n2JakWEdMPC53pJAE=
 github.com/whyrusleeping/go-keyspace v0.0.0-20160322163242-5b898ac5add1/go.mod h1:8UvriyWtv5Q5EOgjHaSseUEdkQfvwFv1I/In/O2M9gc=
 github.com/whyrusleeping/go-logging v0.0.0-20170515211332-0457bb6b88fc/go.mod h1:bopw91TMyo8J3tvftk8xmU2kPmlrt4nScJQZU2hE5EM=
 github.com/whyrusleeping/go-notifier v0.0.0-20170827234753-097c5d47330f/go.mod h1:cZNvX9cFybI01GriPRMXDtczuvUhgbcYr9iCGaNlRv8=

indexer/keymgr.go

···
+package indexer
+
+import (
+	"context"
+	"crypto"
+	"fmt"
+	"time"
+
+	"github.com/bluesky-social/indigo/plc"
+	did "github.com/whyrusleeping/go-did"
+)
+
+type KeyManager struct {
+	didr plc.PLCClient
+
+	signingKey *did.PrivKey
+}
+
+func NewKeyManager(didr plc.PLCClient, k *did.PrivKey) *KeyManager {
+	return &KeyManager{
+		didr:       didr,
+		signingKey: k,
+	}
+}
+
+type cachedKey struct {
+	cachedAt time.Time
+	pub      crypto.PublicKey
+}
+
+func (km *KeyManager) VerifyUserSignature(ctx context.Context, did string, sig []byte, msg []byte) error {
+	k, err := km.getKey(ctx, did)
+	if err != nil {
+		return err
+	}
+
+	return k.Verify(msg, sig)
+}
+
+func (km *KeyManager) getKey(ctx context.Context, did string) (*did.PubKey, error) {
+	// TODO: caching should be done at the DID document level, that way we can
+	// have a thing that subscribes to plc updates for cache busting
+	doc, err := km.didr.GetDocument(ctx, did)
+	if err != nil {
+		return nil, err
+	}
+
+	pubk, err := doc.GetPublicKey("#signingKey")
+	if err != nil {
+		return nil, err
+	}
+
+	return pubk, nil
+}
+
+func (km *KeyManager) SignForUser(ctx context.Context, did string, msg []byte) ([]byte, error) {
+	if km.signingKey == nil {
+		return nil, fmt.Errorf("key manager does not have a signing key, cannot sign")
+	}
+
+	return km.signingKey.Sign(msg)
+}

indexer/posts_test.go

···
 		t.Fatal(err)
 	}
 
-	repoman := repomgr.NewRepoManager(maindb, cs)
+	repoman := repomgr.NewRepoManager(maindb, cs, &util.FakeKeyManager{})
 	notifman := notifs.NewNotificationManager(maindb, repoman.GetRecord)
 	evtman := events.NewEventManager()
 

key/key.go

···
-package key
-
-import (
-	"crypto/ecdsa"
-	"crypto/ed25519"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/sha256"
-	"crypto/x509"
-	"fmt"
-
-	"github.com/multiformats/go-multibase"
-	"github.com/multiformats/go-varint"
-)
-
-const (
-	MCed25519 = 0xED
-	MCP256    = 0x1200
-)
-
-type Key struct {
-	Raw  interface{}
-	Type string
-}
-
-func (k *Key) Sign(b []byte) ([]byte, error) {
-	switch k.Type {
-	case "ed25519":
-		return ed25519.Sign(k.Raw.(ed25519.PrivateKey), b), nil
-	case "P-256":
-		h := sha256.Sum256(b)
-		//return ecdsa.SignASN1(rand.Reader, k.Raw.(*ecdsa.PrivateKey), h[:])
-		r, s, err := ecdsa.Sign(rand.Reader, k.Raw.(*ecdsa.PrivateKey), h[:])
-		if err != nil {
-			return nil, err
-		}
-
-		return append(r.Bytes(), s.Bytes()...), nil
-	default:
-		return nil, fmt.Errorf("unsupported key type: %s", k.Type)
-	}
-}
-
-func (k *Key) DID() string {
-	var buf []byte
-	switch k.Type {
-	case "ed25519":
-		kb := k.Raw.(ed25519.PrivateKey)
-		buf := make([]byte, 8+len(kb))
-		n := varint.PutUvarint(buf, MCed25519)
-		copy(buf[n:], kb)
-		buf = buf[:n+len(kb)]
-	case "P-256":
-		sk := k.Raw.(*ecdsa.PrivateKey)
-		enc := elliptic.MarshalCompressed(elliptic.P256(), sk.X, sk.Y)
-
-		buf = make([]byte, 8+len(enc))
-		n := varint.PutUvarint(buf, MCP256)
-		copy(buf[n:], enc)
-		buf = buf[:n+len(enc)]
-	default:
-		return "<invalid key type>"
-	}
-
-	kstr, err := multibase.Encode(multibase.Base58BTC, buf)
-	if err != nil {
-		panic(err)
-	}
-
-	return "did:key:" + kstr
-}
-
-func (k *Key) RawBytes() ([]byte, error) {
-	switch k.Type {
-	case "ed25519":
-		return k.Raw.([]byte), nil
-	case "P-256":
-		b, err := x509.MarshalECPrivateKey(k.Raw.(*ecdsa.PrivateKey))
-		if err != nil {
-			return nil, err
-		}
-
-		return b, nil
-	default:
-		return nil, fmt.Errorf("unsupported key type: %q", k.Type)
-	}
-}

pds/auth.go

···
 
 	// setting this is a little weird,
 	// since the token isn't signed by this key, we dont have a way to validate...
-	accessTok.Set("pds", s.signingKey.DID())
+	accessTok.Set("pds", s.signingKey.Public().DID())
 
 	rval := make([]byte, 10)
 	rand.Read(rval)

pds/fedmgr.go

···
 	"time"
 
 	"github.com/bluesky-social/indigo/events"
-	"github.com/bluesky-social/indigo/key"
 
 	"github.com/gorilla/websocket"
 	cbg "github.com/whyrusleeping/cbor-gen"
+	"github.com/whyrusleeping/go-did"
 	"gorm.io/gorm"
 )
 
···
 	cb IndexCallback
 
 	db         *gorm.DB
-	signingKey *key.Key
+	signingKey *did.PrivKey
 }
 
-func NewSlurper(cb IndexCallback, db *gorm.DB, signingKey *key.Key) Slurper {
+func NewSlurper(cb IndexCallback, db *gorm.DB, signingKey *did.PrivKey) Slurper {
 	return Slurper{
 		cb:         cb,
 		db:         db,
···
 	var backoff int
 	for {
 		h := http.Header{
-			"DID": []string{s.signingKey.DID()},
+			"DID": []string{s.signingKey.Public().DID()},
 		}
 
 		con, res, err := d.Dial("ws://"+host.Host+"/events", h)

pds/handlers.go

···
 	}
 
 	if recoveryKey == "" {
-		recoveryKey = s.signingKey.DID()
+		recoveryKey = s.signingKey.Public().DID()
 	}
 
 	d, err := s.plc.CreateDID(ctx, s.signingKey, recoveryKey, input.Handle, s.serviceUrl)
···
 
 func (s *Server) handleComAtprotoHandleResolve(ctx context.Context, handle string) (*comatprototypes.HandleResolve_Output, error) {
 	if handle == "" {
-		return &comatprototypes.HandleResolve_Output{Did: s.signingKey.DID()}, nil
+		return &comatprototypes.HandleResolve_Output{Did: s.signingKey.Public().DID()}, nil
 	}
 	u, err := s.lookupUserByHandle(ctx, handle)
 	if err != nil {

pds/server.go

···
 	"github.com/bluesky-social/indigo/carstore"
 	"github.com/bluesky-social/indigo/events"
 	"github.com/bluesky-social/indigo/indexer"
-	"github.com/bluesky-social/indigo/key"
 	"github.com/bluesky-social/indigo/lex/util"
 	"github.com/bluesky-social/indigo/models"
 	"github.com/bluesky-social/indigo/notifs"
···
 	"github.com/lestrrat-go/jwx/jwa"
 	jwk "github.com/lestrrat-go/jwx/jwk"
 	jwt "github.com/lestrrat-go/jwx/jwt"
+	"github.com/whyrusleeping/go-did"
 	"gorm.io/gorm"
 )
 
···
 	indexer        *indexer.Indexer
 	events         *events.EventManager
 	slurper        *Slurper
-	signingKey     *key.Key
+	signingKey     *did.PrivKey
 	echo           *echo.Echo
 	jwtSigningKey  []byte
 	enforcePeering bool
···
 
 	evtman := events.NewEventManager()
 
-	repoman := repomgr.NewRepoManager(db, cs)
+	kmgr := indexer.NewKeyManager(didr, serkey)
+
+	repoman := repomgr.NewRepoManager(db, cs, kmgr)
 	notifman := notifs.NewNotificationManager(db, repoman.GetRecord)
 
 	ix, err := indexer.NewIndexer(db, notifman, evtman, didr, repoman, false)
···
 			u.ID = subj.Uid
 		}
 
-		return s.repoman.HandleExternalUserEvent(ctx, host.ID, u.ID, evt.RepoAppend.Prev, evt.RepoAppend.Ops, evt.RepoAppend.Car)
+		return s.repoman.HandleExternalUserEvent(ctx, host.ID, u.ID, u.Did, evt.RepoAppend.Prev, evt.RepoAppend.Ops, evt.RepoAppend.Car)
 	default:
 		return fmt.Errorf("invalid fed event")
 	}
···
 	return util.CborDecodeValue(blk.RawData())
 }
 
-func loadKey(kfile string) (*key.Key, error) {
+func loadKey(kfile string) (*did.PrivKey, error) {
 	kb, err := os.ReadFile(kfile)
 	if err != nil {
 		return nil, err
···
 		return nil, fmt.Errorf("need a curve set")
 	}
 
-	return &key.Key{
+	var out string
+	kts := string(curve.(jwa.EllipticCurveAlgorithm))
+	switch kts {
+	case "P-256":
+		out = did.KeyTypeP256
+	default:
+		return nil, fmt.Errorf("unrecognized key type: %s", kts)
+	}
+
+	return &did.PrivKey{
 		Raw:  &spk,
-		Type: string(curve.(jwa.EllipticCurveAlgorithm)),
+		Type: out,
 	}, nil
 }
 

plc/fakedid.go

···
 	"crypto/rand"
 	"encoding/hex"
 
-	"github.com/bluesky-social/indigo/key"
 	"github.com/whyrusleeping/go-did"
 	"gorm.io/gorm"
 )
 
 type FakeDidMapping struct {
 	gorm.Model
-	Handle  string
-	Did     string `gorm:"index"`
-	Service string
+	Handle      string
+	Did         string `gorm:"index"`
+	Service     string
+	KeyType     string
+	PubKeyMbase string
 }
 
 type FakeDid struct {
···
 
 		//Authentication []interface{} `json:"authentication"`
 
-		//VerificationMethod []VerificationMethod `json:"verificationMethod"`
+		VerificationMethod: []did.VerificationMethod{
+			did.VerificationMethod{
+				ID:                 "#signingKey",
+				Type:               rec.KeyType,
+				PublicKeyMultibase: &rec.PubKeyMbase,
+				Controller:         rec.Did,
+			},
+		},
 
 		Service: []did.Service{
 			did.Service{
···
 	}, nil
 }
 
-func (fd *FakeDid) CreateDID(ctx context.Context, sigkey *key.Key, recovery string, handle string, service string) (string, error) {
+func (fd *FakeDid) CreateDID(ctx context.Context, sigkey *did.PrivKey, recovery string, handle string, service string) (string, error) {
 	buf := make([]byte, 8)
 	rand.Read(buf)
 	d := "did:plc:" + hex.EncodeToString(buf)
 
 	if err := fd.db.Create(&FakeDidMapping{
-		Handle:  handle,
-		Did:     d,
-		Service: service,
+		Handle:      handle,
+		Did:         d,
+		Service:     service,
+		PubKeyMbase: sigkey.Public().MultibaseString(),
+		KeyType:     sigkey.KeyType(),
 	}).Error; err != nil {
 		return "", err
 	}

plc/plc.go

···
 import (
 	"context"
 
-	"github.com/bluesky-social/indigo/key"
 	"github.com/whyrusleeping/go-did"
 )
 
 type PLCClient interface {
 	GetDocument(ctx context.Context, didstr string) (*did.Document, error)
-	CreateDID(ctx context.Context, sigkey *key.Key, recovery string, handle string, service string) (string, error)
+	CreateDID(ctx context.Context, sigkey *did.PrivKey, recovery string, handle string, service string) (string, error)
 }

repo/repo.go

···
 	return OpenRepo(ctx, bs, root)
 }
 
-func NewRepo(ctx context.Context, bs blockstore.Blockstore) *Repo {
+func NewRepo(ctx context.Context, did string, bs blockstore.Blockstore) *Repo {
 	cst := util.CborStore(bs)
 
 	t := mst.NewMST(cst, 32, cid.Undef, []mst.NodeEntry{}, 0)
 
+	meta := Meta{
+		Datastore: "TODO",
+		Did:       did,
+		Version:   1,
+	}
+
 	return &Repo{
+		meta:  meta,
 		cst:   cst,
 		bs:    bs,
 		mst:   t,
···
 		return nil, fmt.Errorf("loading root from blockstore: %w", err)
 	}
 
+	var rt Root
+	if err := cst.Get(ctx, sr.Root, &rt); err != nil {
+		return nil, fmt.Errorf("loading root: %w", err)
+	}
+
+	var meta Meta
+	if err := cst.Get(ctx, rt.Meta, &meta); err != nil {
+		return nil, fmt.Errorf("loading meta: %w", err)
+	}
+
 	return &Repo{
 		sr:      sr,
 		bs:      bs,
 		cst:     cst,
 		repoCid: root,
+		meta:    meta,
 	}, nil
 }
 
···
 	MarshalCBOR(w io.Writer) error
 }
 
+func (r *Repo) MetaCid(ctx context.Context) (cid.Cid, error) {
+	var root Root
+	if err := r.cst.Get(ctx, r.sr.Root, &root); err != nil {
+		return cid.Undef, err
+	}
+
+	return root.Meta, nil
+}
+
+func (r *Repo) RepoDid() string {
+	if r.meta.Did == "" {
+		panic("repo has unset did")
+	}
+
+	return r.meta.Did
+}
+
 func (r *Repo) PrevCommit(ctx context.Context) (*cid.Cid, error) {
-
 	var c Root
 	if err := r.cst.Get(ctx, r.sr.Root, &c); err != nil {
 		return nil, fmt.Errorf("loading previous commit: %w", err)
···
 
 func (r *Repo) CommitRoot() cid.Cid {
 	return r.sr.Root
+}
+
+func (r *Repo) SignedCommit() SignedCommit {
+	return r.sr
 }
 
 func (r *Repo) Blockstore() blockstore.Blockstore {
···
 	return nil
 }
 
-func (r *Repo) Commit(ctx context.Context) (cid.Cid, error) {
+func (r *Repo) Commit(ctx context.Context, signer func(context.Context, string, []byte) ([]byte, error)) (cid.Cid, error) {
 	ctx, span := otel.Tracer("repo").Start(ctx, "Commit")
 	defer span.End()
 
···
 		if err != nil {
 			return cid.Undef, err
 		}
+		fmt.Println("PUT NEW META: ", mcid)
 		nroot.Meta = mcid
 	}
 
···
 		return cid.Undef, err
 	}
 
+	did := r.RepoDid()
+
+	sig, err := signer(ctx, did, ncomcid.Bytes())
+	if err != nil {
+		return cid.Undef, fmt.Errorf("failed to sign root: %w", err)
+	}
+
 	nsroot := SignedCommit{
 		Root: ncomcid,
+		Sig:  sig,
 	}
 
 	nsrootcid, err := r.cst.Put(ctx, &nsroot)

repomgr/ingest_test.go

···
 	"testing"
 
 	"github.com/bluesky-social/indigo/carstore"
+	"github.com/bluesky-social/indigo/util"
 	"github.com/ipfs/go-cid"
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
···
 		t.Fatal(err)
 	}
 
-	repoman := NewRepoManager(maindb, cs)
+	repoman := NewRepoManager(maindb, cs, &util.FakeKeyManager{})
 
 	fi, err := os.Open("testrepo.car")
 	if err != nil {

repomgr/repomgr.go

···
 
 var log = logging.Logger("repomgr")
 
-func NewRepoManager(db *gorm.DB, cs *carstore.CarStore) *RepoManager {
+func NewRepoManager(db *gorm.DB, cs *carstore.CarStore, kmgr KeyManager) *RepoManager {
 	db.AutoMigrate(RepoHead{})
 
 	return &RepoManager{
 		db:        db,
 		cs:        cs,
 		userLocks: make(map[uint]*userLock),
+		kmgr:      kmgr,
 	}
 }
 
+type KeyManager interface {
+	VerifyUserSignature(context.Context, string, []byte, []byte) error
+	SignForUser(context.Context, string, []byte) ([]byte, error)
+}
+
 func (rm *RepoManager) SetEventHandler(cb func(context.Context, *RepoEvent)) {
 	rm.events = cb
 }
 
 type RepoManager struct {
-	cs *carstore.CarStore
-	db *gorm.DB
+	cs   *carstore.CarStore
+	db   *gorm.DB
+	kmgr KeyManager
 
 	lklk      sync.Mutex
 	userLocks map[uint]*userLock
···
 		return "", cid.Undef, err
 	}
 
-	nroot, err := r.Commit(ctx)
+	nroot, err := r.Commit(ctx, rm.kmgr.SignForUser)
 	if err != nil {
 		return "", cid.Undef, err
 	}
···
 		return cid.Undef, err
 	}
 
-	nroot, err := r.Commit(ctx)
+	nroot, err := r.Commit(ctx, rm.kmgr.SignForUser)
 	if err != nil {
 		return cid.Undef, err
 	}
···
 		return err
 	}
 
-	nroot, err := r.Commit(ctx)
+	nroot, err := r.Commit(ctx, rm.kmgr.SignForUser)
 	if err != nil {
 		return err
 	}
···
 		return err
 	}
 
-	r := repo.NewRepo(ctx, ds)
+	r := repo.NewRepo(ctx, did, ds)
 
 	profile := &bsky.ActorProfile{
 		DisplayName: displayname,
···
 
 	// TODO: set declaration?
 
-	root, err := r.Commit(ctx)
+	root, err := r.Commit(ctx, rm.kmgr.SignForUser)
 	if err != nil {
-		return err
+		return fmt.Errorf("committing repo for actor init: %w", err)
 	}
 
 	rslice, err := ds.CloseWithRoot(ctx, root)
···
 	return ap, nil
 }
 
-func (rm *RepoManager) HandleExternalUserEvent(ctx context.Context, pdsid uint, uid uint, prev *cid.Cid, ops []*events.RepoOp, carslice []byte) error {
+func (rm *RepoManager) HandleExternalUserEvent(ctx context.Context, pdsid uint, uid uint, did string, prev *cid.Cid, ops []*events.RepoOp, carslice []byte) error {
 	ctx, span := otel.Tracer("repoman").Start(ctx, "HandleExternalUserEvent")
 	defer span.End()
 
···
 		return fmt.Errorf("opening external user repo: %w", err)
 	}
 
+	repoDid := r.RepoDid()
+
+	if did != repoDid {
+		return fmt.Errorf("DID in repo did not match (%q != %q)", did, repoDid)
+	}
+
+	scom := r.SignedCommit()
+
+	if err := rm.kmgr.VerifyUserSignature(ctx, repoDid, scom.Sig, scom.Root.Bytes()); err != nil {
+		return fmt.Errorf("signature check failed: %w", err)
+	}
+
 	log.Infow("external event", "uid", uid, "ops", ops)
 
 	var evtops []RepoOp
···
 		}
 	}
 
-	nroot, err := r.Commit(ctx)
+	nroot, err := r.Commit(ctx, rm.kmgr.SignForUser)
 	if err != nil {
 		return err
 	}
···
 	}
 
 	membs := blockstore.NewBlockstore(datastore.NewMapDatastore())
+
+	// mild hack: without access to the 'meta' object, we cant properly verify each new repo slice has the right DID in the case of a gap fill procedure
+	if until.Defined() {
+		robs, err := rm.cs.ReadOnlySession(user)
+		if err != nil {
+			return err
+		}
+
+		old, err := repo.OpenRepo(ctx, robs, until)
+		if err != nil {
+			return err
+		}
+
+		mcid, err := old.MetaCid(ctx)
+		if err != nil {
+			return err
+		}
+
+		blk, err := robs.Get(ctx, mcid)
+		if err != nil {
+			return err
+		}
+
+		if err := membs.Put(ctx, blk); err != nil {
+			return err
+		}
+	}
 
 	for {
 		blk, err := carr.Next()

testing/utils.go

···
 		return nil, err
 	}
 
-	repoman := repomgr.NewRepoManager(maindb, cs)
+	kmgr := indexer.NewKeyManager(didr, nil)
+
+	repoman := repomgr.NewRepoManager(maindb, cs, kmgr)
 
 	notifman := notifs.NewNotificationManager(maindb, repoman.GetRecord)
 
···
 			}
 		}
 
-		nroot, err := r.Commit(ctx)
+		kmgr := &bsutil.FakeKeyManager{}
+
+		nroot, err := r.Commit(ctx, kmgr.SignForUser)
 		if err != nil {
 			return cid.Undef, err
 		}

util/fakekey.go

···
+package util
+
+import "context"
+
+type FakeKeyManager struct {
+}
+
+func (km *FakeKeyManager) VerifyUserSignature(context.Context, string, []byte, []byte) error {
+	return nil
+}
+
+func (km *FakeKeyManager) SignForUser(ctx context.Context, did string, msg []byte) ([]byte, error) {
+	return []byte("signature"), nil
+}