···33use cid::Cid;
44use jacquard::types::{integer::LimitedU32, string::Tid};
55use jacquard_repo::storage::BlockStore;
66-use k256::ecdsa::{Signature, SigningKey, signature::Signer};
66+use k256::ecdsa::{signature::Signer, Signature, SigningKey};
77use serde::Serialize;
88use serde_json::json;
99use uuid::Uuid;
1010+1011/*
1111- * Why am I making custom commit objects instead of jacquard's Commit::sign(), you ask?
1212+ * Why custom commit signing instead of jacquard's Commit::sign()?
1213 *
1313- * At time of writing, jacquard has a bug in how it creates unsigned bytes for signing.
1414- * Jacquard sets sig to empty bytes and serializes (6-field CBOR map)
1515- * Indigo/ATProto creates a struct *without* the sig field (5-field CBOR map)
1616- *
1717- * These produce different CBOR bytes, so signatures created with jacquard
1818- * don't verify with the relay's algorithm. The relay silently rejects commits
1919- * with invalid signatures.
1414+ * Jacquard previously had a bug in how it created unsigned bytes for signing:
1515+ * it set sig to empty bytes and serialized (6-field CBOR map), while the
1616+ * ATProto spec creates a struct *without* the sig field (5-field CBOR map).
1717+ * These produce different CBOR bytes, so signatures didn't verify with relays.
2018 *
2121- * If you have it downloaded, see: reference-relay-indigo/atproto/repo/commit.go UnsignedBytes()
1919+ * The bug has been fixed in jacquard, but the fix is untested here.
2020+ * TODO: Switch back to jacquard's Commit::sign() and verify it works.
2221 */
2222+2323#[derive(Serialize)]
2424struct UnsignedCommit<'a> {
2525 data: Cid,
···2929 version: i64,
3030}
31313232-fn create_signed_commit(
3232+pub fn create_signed_commit(
3333 did: &str,
3434 data: Cid,
3535 rev: &str,