Add PCF-SIG v1.0: cryptographic signatures profile

PCF-SIG is an application-level profile that adds digital signatures to
PCF v1.0 without changing the byte container. Two new partition types are
defined:

  - PCFSIG_KEY (0xAAAB0001): one signer's public key or X.509 cert chain,
    identified by a 32-byte SHA-256 fingerprint of the key bytes.
  - PCFSIG_SIG (0xAAAB0002): one Manifest enumerating signed partitions
    by uid + protected fields, followed by the signature over the Manifest.

A Manifest binds only the fields needed to identify a partition's contents
(uid, partition_type, label, used_bytes, data_hash_algo_id, data_hash) and
NOT physical placement (start_offset, max_length). This makes signatures
stable across PCF compaction, reservation growth, and Table Block chain
reorganisation -- the relocation-stability property.

The reference Rust crate implements Ed25519 as the MUST-support baseline.
RSA-PSS, ECDSA, and X.509 are registered in the algorithm registry and
recognised at parse time (returning Unverifiable rather than Malformed
for unsupported ids), so language ports can add full implementations
without changing the on-disk format.

Includes 68 tests across 5 integration files (roundtrip, relocation,
multi_signer, tamper, spec_compliance) plus 25 unit tests, a
gen_testvector example that produces a 966-byte canonical container, and
the full normative specification under specs/PCF-SIG-spec-v1.0.txt.

https://claude.ai/code/session_01ST4PcjqvobURus32WuyEi5

Author: claude

Cargo.toml

@@ -1,3 +1,8 @@
 [workspace]
 resolver = "2"
-members = ["reference/PCF-v1.0", "reference/PFS-MS-v1.0", "tools/pcf-debug"]
+members = [
+    "reference/PCF-v1.0",
+    "reference/PFS-MS-v1.0",
+    "reference/PCF-SIG-v1.0",
+    "tools/pcf-debug",
+]

reference/PCF-SIG-v1.0/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "pcf-sig"
+version = "0.0.1"
+edition = "2021"
+description = "Reference implementation of PCF-SIG v1.0, the PCF Cryptographic Signatures profile"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/kduma-OSS/Partitioned-Container-Format"
+homepage = "https://github.com/kduma-OSS/Partitioned-Container-Format"
+readme = "README.md"
+keywords = ["pcf", "signature", "ed25519", "cryptography", "container"]
+categories = ["cryptography", "encoding"]
+
+# This crate is a *reference* implementation of the PCF-SIG profile. Like the
+# `pcf` crate it builds on, it favours a direct, auditable mapping onto the
+# written specification (`specs/PCF-SIG-spec-v1.0.txt`) over raw performance.
+
+[dependencies]
+# The PCF-SIG profile is layered strictly above PCF v1.0; every byte container
+# operation goes through the reference PCF crate.
+pcf = { path = "../PCF-v1.0", version = "0.0.1" }
+
+# SHA-256 for key fingerprints and for the optional independent re-hash check
+# during verification. Pinned by the PCF crate already; we re-use it here.
+sha2 = "0.10"
+
+# Ed25519 is the MUST-support baseline algorithm (spec Section 8). The pure-Rust
+# `ed25519-dalek` 2.x line implements RFC 8032 verification and signing without
+# C dependencies. We disable randomized signing because PCF-SIG signs
+# deterministically over a serialised manifest.
+ed25519-dalek = { version = "=2.1.1", default-features = false, features = ["std"] }
+
+# --- MSRV pins (this environment ships rustc 1.75) -------------------------
+# The latest releases of these transitive crates require edition2024, which
+# rustc 1.75 cannot build. Constrain them to the last 1.75-compatible line.
+cpufeatures = "=0.2.12"

reference/PCF-SIG-v1.0/README.md

@@ -0,0 +1,126 @@
+# pcf-sig — PCF Cryptographic Signatures (reference implementation)
+
+Reference reader/writer for **PCF-SIG v1.0**, an application-level profile
+that adds digital signatures to the [Partitioned Container Format](../PCF-v1.0)
+without modifying the PCF byte container.
+
+This crate mirrors the written specification (`specs/PCF-SIG-spec-v1.0.txt`)
+field-for-field and is intended as the *normative* implementation against
+which language ports are checked. It favours auditability over performance.
+
+## Model at a glance
+
+PCF-SIG defines two new PCF partition types:
+
+| Type         | Name         | Holds                                                    |
+|--------------|--------------|----------------------------------------------------------|
+| `0xAAAB0001` | `PCFSIG_KEY` | One signer's public key or X.509 cert, identified by a 32-byte SHA-256 fingerprint of the key bytes |
+| `0xAAAB0002` | `PCFSIG_SIG` | One Manifest enumerating signed partitions + the signature over the Manifest |
+
+A **Manifest** binds the *protected fields* of each covered partition:
+`uid`, `partition_type`, `label`, `used_bytes`, `data_hash_algo_id`,
+`data_hash`. It does NOT bind `start_offset` or `max_length`, so PCF
+compaction and other relocations preserve signature validity as long as
+partition bytes do not change.
+
+```
+PCFSIG_SIG partition data:
+[ Manifest (60 + 218 * N bytes) | u32 sig_len | sig_bytes | u32 trailer_len=0 ]
+```
+
+## Algorithm support
+
+| `sig_algo_id` | Algorithm           | This crate v1.0 |
+|---------------|---------------------|------------------|
+| 1             | Ed25519 (RFC 8032)  | implemented (MUST) |
+| 2, 4, 5, 7    | RSA-PSS / PKCS1v15  | registry only    |
+| 16, 18        | ECDSA P-256 / P-521 | registry only    |
+| 32            | X.509 chain         | registry only    |
+
+Algorithms in *registry only* are recognised at parse time and reported as
+`Unverifiable` rather than `Malformed`. Adding a full implementation for any
+of them is a pure addition that does not touch the on-disk format.
+
+Hash algorithm constraint: signed partitions MUST use a cryptographic
+`data_hash_algo_id` (16 SHA-256, 17 SHA-512, 18 BLAKE3). The Writer refuses
+to sign weakly-hashed partitions; the Verifier rejects them per entry.
+
+## Usage
+
+```rust
+use std::io::Cursor;
+use pcf::{Container, HashAlgo};
+use pcf_sig::{sign_partitions, verify_all_with_recheck, ManifestVerdict, SigningMaterial};
+
+let mut c = Container::create(Cursor::new(Vec::new()))?;
+let alpha = [0x11u8; 16];
+c.add_partition(0x10, alpha, "alpha", b"Hello, PCF-SIG!", 0, HashAlgo::Sha256)?;
+
+let signer = SigningMaterial::ed25519_from_seed(&[0x42u8; 32]);
+sign_partitions(
+    &mut c, &signer,
+    &[alpha],
+    [0x33u8; 16],  // PCFSIG_SIG uid
+    [0x22u8; 16],  // PCFSIG_KEY uid (reused if a key with the same fingerprint already exists)
+    0,             // signed_at_unix_seconds (0 = unspecified)
+    "pcfsig", "pcfkey",
+)?;
+
+for report in verify_all_with_recheck(&mut c)? {
+    assert!(matches!(report.verdict, ManifestVerdict::Valid));
+    for entry in &report.entries {
+        println!("covered uid {:?} verdict {:?}", entry.uid, entry.verdict);
+    }
+}
+# Ok::<(), pcf_sig::Error>(())
+```
+
+## Relocation stability
+
+The central property: a PCFSIG_SIG signature remains valid across any
+operation that touches only the unprotected fields. `tests/relocation.rs`
+exercises this end-to-end:
+
+- PCF compaction (full rewrite, every `start_offset` and `max_length`
+  changes) — signature still verifies.
+- Table Block chain growth (extra blocks inserted, chain re-linked) —
+  signature still verifies.
+- In-place update of a sibling UNSIGNED partition — signature still verifies.
+
+## Tests
+
+```
+reference/PCF-SIG-v1.0/
+├── Cargo.toml
+├── README.md
+├── src/                       # library sources
+│   ├── lib.rs
+│   ├── consts.rs              # magics, type ids, byte-layout constants
+│   ├── algo.rs                # SigAlgo + KeyFormat registries
+│   ├── error.rs
+│   ├── key.rs                 # PCFSIG_KEY record (Key Record + TLV metadata)
+│   ├── manifest.rs            # Manifest + SignedEntry layout
+│   ├── sig.rs                 # PCFSIG_SIG payload framing (manifest|sig|trailer)
+│   ├── sign.rs                # high-level Writer API
+│   └── verify.rs              # high-level Verifier API
+├── tests/
+│   ├── roundtrip.rs           # sign → write → reopen → verify
+│   ├── relocation.rs          # compaction + chain growth + sibling update
+│   ├── multi_signer.rs        # independent signatures, key deduplication
+│   ├── tamper.rs              # protected-field changes invalidate signatures
+│   └── spec_compliance.rs     # one test per normative MUST/SHALL clause
+├── examples/
+│   └── gen_testvector.rs      # produces a deterministic byte-exact vector
+└── testdata/
+    └── canonical.bin          # 966-byte canonical PCF-SIG container
+```
+
+Run from this directory:
+
+```
+cargo test
+cargo run --example gen_testvector       # writes pcfsig_testvector.bin
+```
+
+The canonical test vector is 966 bytes; its SHA-256 is printed on stderr
+when the example runs. Ports are expected to reproduce the same bytes.

reference/PCF-SIG-v1.0/examples/gen_testvector.rs

@@ -0,0 +1,74 @@
+//! Generates the canonical PCF-SIG v1.0 test-vector file used in spec
+//! section 19.
+//!
+//! Run with: `cargo run --example gen_testvector -- <output-path>`
+//! (defaults to ./pcfsig_testvector.bin).
+//!
+//! The Ed25519 keypair is generated deterministically from a fixed 32-byte
+//! seed of 0x00..0x1F, so independent implementations can reproduce the file
+//! byte-for-byte.
+
+use std::io::Cursor;
+
+use pcf::{Container, HashAlgo};
+use pcf_sig::{sign_partitions, verify_all, DataRecheck, ManifestVerdict, SigningMaterial};
+use sha2::{Digest, Sha256};
+
+fn main() {
+    let path = std::env::args()
+        .nth(1)
+        .unwrap_or_else(|| "pcfsig_testvector.bin".to_string());
+
+    let seed: [u8; 32] = std::array::from_fn(|i| i as u8);
+    let signer = SigningMaterial::ed25519_from_seed(&seed);
+
+    let mut c = Container::create_with(Cursor::new(Vec::new()), 8, HashAlgo::Sha256).unwrap();
+
+    // Partition "alpha": the partition to be signed.
+    c.add_partition(
+        0x0000_0010,
+        [0x11u8; 16],
+        "alpha",
+        b"Hello, PCF-SIG!",
+        0,
+        HashAlgo::Sha256,
+    )
+    .unwrap();
+
+    // Sign it. This adds a PCFSIG_KEY partition (uid = 0x22..) and a
+    // PCFSIG_SIG partition (uid = 0x33..).
+    sign_partitions(
+        &mut c,
+        &signer,
+        &[[0x11u8; 16]],
+        [0x33u8; 16], // sig partition uid
+        [0x22u8; 16], // key partition uid
+        0,            // signed_at = unspecified
+        "pcfsig",
+        "pcfkey",
+    )
+    .unwrap();
+
+    // Compact to the canonical layout and re-verify.
+    let image = c.compacted_image().unwrap();
+    std::fs::write(&path, &image).unwrap();
+
+    let mut v = Container::open(Cursor::new(image.clone())).unwrap();
+    v.verify().unwrap();
+    let reports = verify_all(&mut v, DataRecheck::Recompute).unwrap();
+    assert_eq!(reports.len(), 1);
+    assert!(matches!(reports[0].verdict, ManifestVerdict::Valid));
+
+    let digest = Sha256::digest(&image);
+    let hex: String = digest.iter().map(|b| format!("{b:02x}")).collect();
+    eprintln!("wrote {} ({} bytes)", path, image.len());
+    eprintln!("sha256 = {hex}");
+    eprintln!(
+        "signer fingerprint = {}",
+        signer
+            .fingerprint()
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect::<String>()
+    );
+}