2 files changed, 45 insertions, 3 deletions
diff --git a/cmd/sigsum-debug/cosign/cosign.go b/cmd/sigsum-debug/cosign/cosign.go
new file mode 100644
index 0000000..8597cc6
--- /dev/null
+++ b/cmd/sigsum-debug/cosign/cosign.go
@@ -0,0 +1,41 @@
+package cosign
+
+import (
+	"bytes"
+	"fmt"
+
+	"git.sigsum.org/sigsum-go/pkg/hex"
+	"git.sigsum.org/sigsum-go/pkg/types"
+	"git.sigsum.org/sigsum-tools-go/internal/util"
+)
+
+func Main(_ []string, optPriv, optPub string) error {
+	priv, err := util.SignerFromHex(optPriv)
+	if err != nil {
+		return fmt.Errorf("cosign: %v", err)
+	}
+	b, err := hex.Deserialize(optPub)
+	if err != nil {
+		return fmt.Errorf("cosign: %v", err)
+	}
+	if len(b) != types.PublicKeySize {
+		return fmt.Errorf("cosign: invalid public key length %d", len(b))
+	}
+	var pub types.PublicKey
+	copy(pub[:], b)
+	data, err := util.BytesFromStdin()
+	if err != nil {
+		return fmt.Errorf("cosign: %v", err)
+	}
+	var sth types.SignedTreeHead
+	if err := sth.FromASCII(bytes.NewBuffer(data)); err != nil {
+		return fmt.Errorf("cosign: %v", err)
+	}
+	witSTH, err := sth.TreeHead.Sign(priv, types.HashFn(pub[:]))
+	if err != nil {
+		return fmt.Errorf("cosign: %v", err)
+	}
+
+	fmt.Printf("%s\n", hex.Serialize(witSTH.Signature[:]))
+	return nil
+}
diff --git a/cmd/sigsum-debug/main.go b/cmd/sigsum-debug/main.go
index 2bc05de..fe13cfd 100644
--- a/cmd/sigsum-debug/main.go
+++ b/cmd/sigsum-debug/main.go
@@ -17,6 +17,7 @@ import (
 	"log"
 	"os"
 
+	"git.sigsum.org/sigsum-tools-go/cmd/sigsum-debug/cosign"
 	"git.sigsum.org/sigsum-tools-go/cmd/sigsum-debug/genkey"
 	"git.sigsum.org/sigsum-tools-go/cmd/sigsum-debug/hashkey"
 	"git.sigsum.org/sigsum-tools-go/cmd/sigsum-debug/hashleaf"
@@ -83,7 +84,7 @@ func main() {
 	case "sign":
 		err = sign.Main(cmd.Args(), optPriv, optShardHint)
 	case "cosign":
-		err = fmt.Errorf("TODO")
+		err = cosign.Main(cmd.Args(), optPriv, optPub)
 	default:
 		err = fmt.Errorf("invalid command %q, try %q", cmd.Name(), "sigsum help")
 	}
@@ -107,7 +108,7 @@ func setOptions(fs *flag.FlagSet) {
 		options.AddString(fs, &optPriv, "k", "key", "")
 		options.AddUint64(fs, &optShardHint, "s", "shard-hint", 0)
 	case "cosign":
-		options.AddString(fs, &optPriv, "w", "--witness-priv", "")
-		options.AddString(fs, &optPub, "l", "--log-pub", "")
+		options.AddString(fs, &optPriv, "w", "witness-priv", "")
+		options.AddString(fs, &optPub, "l", "log-pub", "")
 	}
 }