diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b9e5255..fc43246 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,9 +43,48 @@ jobs: - name: Build search index run: npx pagefind --site public - # TODO(htmltrust): re-wire signed-section verification once the signing - # pipeline is integrated with the Hugo Blox build. The previous site - # signed its own pages at the layout level; the new site does not yet. + - name: Verify placeholder signed-sections exist + # Hugo emits placeholders with data-htmltrust-placeholder + # markers on every page that opts in via `htmltrust.sign: true` front-matter. + # The signer (next step) will replace them with real content-hash / signature + # / keyid / algorithm attributes. Six content pages currently opt in: + # /spec/, /architecture/, /implementation/, /use-cases/, /faq/, + # /blog/paper-published/. + run: | + count=$(grep -rl ' placeholders" + if [ "$count" -lt 6 ]; then + echo "ERROR: Expected at least 6 pages with signed-section placeholders" + exit 1 + fi + + - name: Install htmltrust-sign + run: go install github.com/HTMLTrust/htmltrust-hugo/cmd/htmltrust-sign@latest + + - name: Sign content + env: + HTMLTRUST_SIGNING_KEY: ${{ secrets.HTMLTRUST_SIGNING_KEY }} + run: | + htmltrust-sign \ + --dir public \ + --keyid did:web:jason-grey.com \ + --domain www.htmltrust.org \ + -v + + - name: Verify signed sections are complete + run: | + if grep -rq 'data-htmltrust-placeholder' public/; then + echo "ERROR: placeholder markers remain - signer did not run on all sections" + exit 1 + fi + for f in $(grep -rl '>B: Request signature over payload B->>B: Sign with private key B-->>C: signature - C->>C: Embed + C->>C: Embed in signed-section C-->>A: Publish page C-->>D: Publish hash + keyid (optional) ``` @@ -83,7 +83,7 @@ sequenceDiagram participant K as Key resolver participant D as Directory (optional) U->>P: GET page - P-->>U: HTML with + P-->>U: HTML with signed-section U->>U: Canonicalize text → hash U->>K: Resolve keyid K-->>U: Public key diff --git a/layouts/faq/list.html b/layouts/faq/list.html new file mode 100644 index 0000000..cf3b063 --- /dev/null +++ b/layouts/faq/list.html @@ -0,0 +1,63 @@ +{{- define "main" -}} + +
+ {{ partial "components/sidebar.html" (dict "context" . "no_sidebar" false) }} +
+
+ + {{ if (.Params.show_breadcrumb | default true) }} +
+ {{ partial "components/breadcrumb.html" . }} +
+ {{ end }} + +
+

{{ .Title }}

+ {{ partial "htmltrust-signed-section.html" . }} +
+ + {{/* List all FAQ pages */}} + {{ $pages := .Pages.ByDate.Reverse }} + + + + {{ if eq (len $pages) 0 }} +
+

{{ T "no_questions_yet" | default "No FAQ pages available yet." }}

+
+ {{ end }} + + {{ partial "components/paginator" . }} +
+
+
+ +{{- end -}} +