feat: verify signatures

.releaserc.yml

@@ -10,4 +10,4 @@ branches:
   - name: alpha
     prerelease: true
     channel: alpha
-  - name: +([0-9])?(.{+([0-9]),x}).x
+  - name: +([0-9])?(.{+([0-9]),x}).x}

go.mod

@@ -3,22 +3,28 @@ module github.com/ekristen/distillery
 go 1.22.4
 
 require (
+	github.com/ProtonMail/gopenpgp/v2 v2.7.5
 	github.com/apex/log v1.9.0
 	github.com/dsnet/compress v0.0.1
 	github.com/gabriel-vasile/mimetype v1.4.6
 	github.com/google/go-github/v66 v66.0.0
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
 	github.com/h2non/filetype v1.1.3
 	github.com/krolaw/zipstream v0.0.0-20180621105154-0a2661891f94
+	github.com/pelletier/go-toml/v2 v2.2.3
 	github.com/rancher/wrangler v1.1.2
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.9.0
 	github.com/ulikunitz/xz v0.5.12
 	github.com/urfave/cli/v2 v2.27.5
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/fatih/color v1.7.0 // indirect
@@ -27,16 +33,15 @@ require (
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/mattn/go-colorable v0.1.2 // indirect
 	github.com/mattn/go-isatty v0.0.8 // indirect
-	github.com/nicksnyder/go-i18n v1.10.3 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	golang.org/x/crypto v0.28.0 // indirect
 	golang.org/x/net v0.30.0 // indirect
 	golang.org/x/sys v0.26.0 // indirect
+	golang.org/x/text v0.19.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,10 +1,19 @@
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
+github.com/ProtonMail/gopenpgp/v2 v2.7.5 h1:STOY3vgES59gNgoOt2w0nyHBjKViB/qSg7NjbQWPJkA=
+github.com/ProtonMail/gopenpgp/v2 v2.7.5/go.mod h1:IhkNEDaxec6NyzSI0PlxapinnwPVIESk8/76da3Ct3g=
 github.com/apex/log v1.9.0 h1:FHtw/xuaM8AgmvDDTI9fiwoAL25Sq2cxojnZICUU8l0=
 github.com/apex/log v1.9.0/go.mod h1:m82fZlWIuiWzWP04XCTXmnX0xRkYYbCdYn8jbJeLBEA=
 github.com/apex/logs v1.0.0/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo=
 github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy8kCu4PNA+aP7WUV72eXWJeP9/r3/K9aLE=
 github.com/aphistic/sweet v0.2.0/go.mod h1:fWDlIh/isSE9n6EPsRmC0det+whmX6dJid3stzu0Xys=
 github.com/aws/aws-sdk-go v1.20.6/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
 github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -60,11 +69,8 @@ github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.8 h1:HLtExJ+uU2HOZ+wI0Tt5DtUDrx8yhUqDcp7fYERX4CE=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
-github.com/nicksnyder/go-i18n v1.10.3 h1:0U60fnLBNrLBVt8vb8Q67yKNs+gykbQuLsIkiesJL+w=
-github.com/nicksnyder/go-i18n v1.10.3/go.mod h1:hvLG5HTlZ4UfSuVLSRuX7JRUomIaoKQM19hm6f+no7o=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
@@ -112,24 +118,64 @@ github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofm
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
+golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
 golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
 golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

pkg/asset/asset.go

@@ -16,6 +16,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/ProtonMail/gopenpgp/v2/crypto"
 	"github.com/gabriel-vasile/mimetype"
 	"github.com/h2non/filetype"
 	"github.com/h2non/filetype/matchers"
@@ -32,6 +33,8 @@ var (
 	apkType      = filetype.AddType("apk", "application/vnd.android.package-archive")
 	ascType      = filetype.AddType("asc", "text/plain")
 	pemType      = filetype.AddType("pem", "application/x-pem-file")
+	certType     = filetype.AddType("cert", "application/x-x509-ca-cert")
+	crtType      = filetype.AddType("crt", "application/x-x509-ca-cert")
 	sigType      = filetype.AddType("sig", "text/plain")
 	sbomJSONType = filetype.AddType("sbom.json", "application/json")
 	bomJSONType  = filetype.AddType("bom.json", "application/json")
@@ -72,6 +75,10 @@ const (
 	Key
 	SBOM
 	Data
+
+	ChecksumTypeNone  = "none"
+	ChecksumTypeFile  = "single"
+	ChecksumTypeMulti = "multi"
 )
 
 // processorFunc is a function that processes a reader
@@ -88,7 +95,14 @@ func New(name, displayName, osName, osArch, version string) *Asset {
 		Files:       make([]*File, 0),
 	}
 
-	a.Classify()
+	a.Type = a.Classify(name)
+
+	if a.Type == Key || a.Type == Signature || a.Type == Checksum {
+		parentName := strings.ReplaceAll(name, filepath.Ext(name), "")
+		parentName = strings.TrimSuffix(parentName, "-keyless")
+
+		a.ParentType = a.Classify(parentName)
+	}
 
 	return a
 }
@@ -100,9 +114,12 @@ type File struct {
 }
 
 type Asset struct {
-	Name        string
-	DisplayName string
-	Type        Type
+	Name         string
+	DisplayName  string
+	Type         Type
+	ParentType   Type
+	ChecksumType string
+	MatchedAsset IAsset
 
 	OS      string
 	Arch    string
@@ -131,6 +148,36 @@ func (a *Asset) GetDisplayName() string {
 func (a *Asset) GetType() Type {
 	return a.Type
 }
+func (a *Asset) GetParentType() Type {
+	return a.ParentType
+}
+func (a *Asset) GetChecksumType() string {
+	name := strings.ToLower(a.Name)
+	if strings.HasSuffix(name, ".sha512") ||
+		strings.HasSuffix(name, ".sha256") ||
+		strings.HasSuffix(name, ".md5") ||
+		strings.HasSuffix(name, ".sha1") {
+		return ChecksumTypeFile
+	}
+	if strings.Contains(name, "checksums") ||
+		strings.Contains(name, "checksum") {
+		return ChecksumTypeMulti
+	}
+	if strings.Contains(name, "sha") &&
+		strings.Contains(name, "sums") {
+		return ChecksumTypeMulti
+	} else if strings.Contains(name, "sums") {
+		return ChecksumTypeMulti
+	}
+	return ChecksumTypeNone
+}
+
+func (a *Asset) GetMatchedAsset() IAsset {
+	return a.MatchedAsset
+}
+func (a *Asset) SetMatchedAsset(asset IAsset) {
+	a.MatchedAsset = asset
+}
 
 func (a *Asset) GetAsset() *Asset {
 	return a
@@ -152,55 +199,61 @@ func (a *Asset) GetFilePath() string {
 }
 
 // Classify determines the type of asset based on the file extension
-func (a *Asset) Classify() { //nolint:gocyclo
-	if ext := strings.TrimPrefix(filepath.Ext(a.Name), "."); ext != "" {
+func (a *Asset) Classify(name string) Type { //nolint:gocyclo
+	aType := Unknown
+
+	if ext := strings.TrimPrefix(filepath.Ext(name), "."); ext != "" {
 		switch filetype.GetType(ext) {
 		case matchers.TypeDeb, matchers.TypeRpm, msiType, apkType:
-			a.Type = Installer
+			aType = Installer
 		case matchers.TypeGz, matchers.TypeZip, matchers.TypeXz, matchers.TypeTar, matchers.TypeBz2, tarGzType:
-			a.Type = Archive
+			aType = Archive
 		case matchers.TypeExe:
-			a.Type = Binary
+			aType = Binary
 		case sigType, ascType:
-			a.Type = Signature
-		case pemType, pubType:
-			a.Type = Key
+			aType = Signature
+		case pemType, pubType, certType, crtType:
+			aType = Key
 		case sbomJSONType, bomJSONType, sbomType, bomType:
-			a.Type = SBOM
+			aType = SBOM
 		case jsonType:
-			a.Type = Data
+			aType = Data
 
-			if strings.Contains(a.Name, ".sbom") || strings.Contains(a.Name, ".bom") {
-				a.Type = SBOM
+			if strings.Contains(name, ".sbom") || strings.Contains(name, ".bom") {
+				aType = SBOM
 			}
 		default:
-			a.Type = Unknown
+			aType = Unknown
 		}
 	}
 
-	if a.Type == Unknown {
-		logrus.Tracef("classifying asset based on name: %s", a.Name)
-		name := strings.ToLower(a.Name)
-		if strings.Contains(name, ".sha256") || strings.Contains(name, ".md5") {
-			a.Type = Checksum
+	if aType == Unknown {
+		logrus.Tracef("classifying asset based on name: %s", name)
+		name = strings.ToLower(name)
+		if strings.HasSuffix(name, ".sha256") || strings.HasSuffix(name, ".md5") || strings.HasSuffix(name, ".sha1") {
+			aType = Checksum
 		}
 		if strings.Contains(name, "checksums") {
-			a.Type = Checksum
+			aType = Checksum
 		}
-		if strings.Contains(a.Name, "SHA") && strings.Contains(a.Name, "SUMS") {
-			a.Type = Checksum
-		} else if strings.Contains(a.Name, "SUMS") {
-			a.Type = Checksum
+		if strings.Contains(name, "sha") && strings.Contains(name, "sums") {
+			aType = Checksum
+		} else if strings.Contains(name, "sums") {
+			aType = Checksum
 		}
+	}
 
-		if strings.Contains(a.Name, "-pivkey-") {
-			a.Type = Key
-		} else if strings.Contains(a.Name, "pkcs") && strings.Contains(a.Name, "key") {
-			a.Type = Key
+	if aType == Unknown {
+		if strings.Contains(name, "-pivkey-") {
+			aType = Key
+		} else if strings.Contains(name, "pkcs") && strings.Contains(name, "key") {
+			aType = Key
 		}
 	}
 
-	logrus.Tracef("classified: %s (%d)", a.Name, a.Type)
+	logrus.Tracef("classified: %s - %s (type: %d)", name, aType, aType)
+
+	return aType
 }
 
 func (a *Asset) copyFile(srcFile, dstFile string) error {
@@ -573,6 +626,30 @@ func (a *Asset) processBz2(in io.Reader) (io.Reader, error) {
 	return br, nil
 }
 
+func (a *Asset) GetGPGKeyID() (uint64, error) {
+	if a.Type != Signature {
+		return 0, fmt.Errorf("asset is not a signature: %s", a.GetName())
+	}
+
+	signatureContent, err := os.ReadFile(a.GetFilePath())
+	if err != nil {
+		return 0, fmt.Errorf("failed to read signature: %w", err)
+	}
+
+	// Parse the armored signature
+	signature, err := crypto.NewPGPSignatureFromArmored(string(signatureContent))
+	if err != nil {
+		return 0, fmt.Errorf("failed to parse signature: %w", err)
+	}
+
+	ids, ok := signature.GetSignatureKeyIDs()
+	if !ok {
+		return 0, errors.New("signature does not contain a key ID")
+	}
+
+	return ids[0], nil
+}
+
 func int64ToUint32(value int64) (uint32, error) {
 	if value < 0 || value > math.MaxUint32 {
 		return 0, errors.New("value out of range for uint32")

pkg/asset/interface.go

@@ -6,6 +6,7 @@ type IAsset interface {
 	GetName() string
 	GetDisplayName() string
 	GetType() Type
+	GetParentType() Type
 	GetAsset() *Asset
 	GetFiles() []*File
 	GetTempPath() string
@@ -16,4 +17,8 @@ type IAsset interface {
 	Cleanup() error
 	ID() string
 	Path() string
+	GetChecksumType() string
+	GetMatchedAsset() IAsset
+	SetMatchedAsset(IAsset)
+	GetGPGKeyID() (uint64, error)
 }