Key Management Service：簽名驗簽樣本

package main

import (
	"fmt"
	"github.com/alibabacloud-go/tea/tea"
	dedicatedkmsopenapi "github.com/aliyun/alibabacloud-dkms-gcs-go-sdk/openapi"
	dedicatedkmsopenapiutil "github.com/aliyun/alibabacloud-dkms-gcs-go-sdk/openapi-util"
	dedicatedkmssdk "github.com/aliyun/alibabacloud-dkms-gcs-go-sdk/sdk"
	"io/ioutil"
)

// The signature context may be stored
type SignatureContext struct {
	KeyId     string
	Signature []byte
	// Use default algorithm value,if the value is not set
	Algorithm   string
	MessageType string
}

func main() {
	// KMS執行個體簽名密鑰的ID或別名（Alias）
	keyId := "yourKeyId"
	// 待簽名資料摘要或預先處理資料
	//digest := sha256.Sum256([]byte("message"))
	message := "message"
	// 簽名資料類型，RAW-待簽名未經處理資料 DIGEST-簽名資料的摘要
	//messageType := "DIGEST"
	messageType := "RAW"

	// 建立DKMS Client對象
	client := getDkmsClientByClientKeyContent()
	//client := getDkmsClientByClientKeyFile()

	signatureCtx := signSample(client, keyId, []byte(message), messageType)
	verifyResult := verifySample(client, []byte(message), signatureCtx)
	fmt.Println(verifyResult)
}

// 簽名樣本
func signSample(client *dedicatedkmssdk.Client, keyId string, message []byte, messageType string) *SignatureContext {
	signRequest := &dedicatedkmssdk.SignRequest{
		KeyId:       tea.String(keyId),
		Message:     message,
		MessageType: tea.String(messageType),
	}
	// 驗證服務端認證
	ca, err := ioutil.ReadFile("path/to/caCert.pem")
	if err != nil {
		panic(err)
	}
	runtimeOptions := &dedicatedkmsopenapiutil.RuntimeOptions{
		Verify: tea.String(string(ca)),
	}
	// 或，忽略認證
	//runtimeOptions := &dedicatedkmsopenapiutil.RuntimeOptions{
	//	IgnoreSSL: tea.Bool(true),
	//}
	// 呼叫簽章介面進行簽名
	signResponse, err := client.SignWithOptions(signRequest, runtimeOptions)
	if err != nil {
		panic(err)
	}

	// 密鑰ID
	_keyId := tea.StringValue(signResponse.KeyId)
	// 簽名值
	_signature := signResponse.Signature
	// 訊息類型
	_messageType := tea.StringValue(signResponse.MessageType)
	// 簽名演算法
	_algorithm := tea.StringValue(signResponse.Algorithm)

	fmt.Println("KeyId:", _keyId)
	fmt.Println("Signature:", _signature)
	fmt.Println("MessageType:", _messageType)
	fmt.Println("RequestId:", tea.StringValue(signResponse.RequestId))

	return &SignatureContext{
		KeyId:       _keyId,
		Signature:   _signature,
		MessageType: messageType,
		Algorithm:   _algorithm,
	}
}

// 驗簽樣本
func verifySample(client *dedicatedkmssdk.Client, message []byte, ctx *SignatureContext) (_value bool) {
	verifyRequest := &dedicatedkmssdk.VerifyRequest{
		KeyId:       tea.String(ctx.KeyId),
		Message:     message,
		MessageType: tea.String(ctx.MessageType),
		Signature:   ctx.Signature,
		Algorithm:   tea.String(ctx.Algorithm),
	}
	// 驗證服務端認證
	ca, err := ioutil.ReadFile("path/to/caCert.pem")
	if err != nil {
		panic(err)
	}
	runtimeOptions := &dedicatedkmsopenapiutil.RuntimeOptions{
		Verify: tea.String(string(ca)),
	}
	// 或，忽略認證
	//runtimeOptions := &dedicatedkmsopenapiutil.RuntimeOptions{
	//	IgnoreSSL: tea.Bool(true),
	//}
	// 調用驗簽介面進行驗簽
	verifyResponse, err := client.VerifyWithOptions(verifyRequest, runtimeOptions)
	if err != nil {
		panic(err)
	}

	// 驗簽結果
	_value = tea.BoolValue(verifyResponse.Value)
	// 訊息類型
	_messageType := verifyResponse.MessageType

	fmt.Println("KeyId:", tea.StringValue(verifyResponse.KeyId))
	fmt.Println("Value:", _value)
	fmt.Println("MessageType:", tea.StringValue(_messageType))
	fmt.Println("RequestId:", tea.StringValue(verifyResponse.RequestId))

	return tea.BoolValue(verifyResponse.Value)
}

// 使用ClientKey內容建立KMS執行個體SDK Client對象
func getDkmsClientByClientKeyContent() *dedicatedkmssdk.Client {
	// 建立KMS執行個體SDK Client配置
	config := &dedicatedkmsopenapi.Config{
	        // 連線協定請設定為"https"。KMS執行個體服務僅允許通過HTTPS協議訪問。
		Protocol: tea.String("https"),
		// 請替換為ClientKey檔案的內容
		ClientKeyContent: tea.String("yourClientKeyContent"),
		// 請替換為建立ClientKey時輸入的加密口令
		Password: tea.String("yourClientKeyPassword"),
		// 設定endpoint為<your KMS Instance Id>.cryptoservice.kms.aliyuncs.com。
		Endpoint: tea.String("yourEndpoint"),
	}
	// 建立KMS執行個體SDK Client對象
	client, err := dedicatedkmssdk.NewClient(config)
	if err != nil {
		// 異常處理
		panic(err)
	}
	return client
}

// 使用ClientKey檔案路徑建立KSM執行個體SDK Client對象
func getDkmsClientByClientKeyFile() *dedicatedkmssdk.Client {
	// 建立DKMS Client配置
	config := &dedicatedkmsopenapi.Config{
		// 連線協定請設定為"https"。KMS執行個體服務僅允許通過HTTPS協議訪問。
		Protocol: tea.String("https"),
		// 請替換為ClientKey檔案的路徑
		ClientKeyFile: tea.String("yourClientKeyFile"),
		// 請替換為建立ClientKey時輸入的加密口令
		Password: tea.String("yourClientKeyPassword"),
                 // 設定endpoint為<your KMS Instance Id>.cryptoservice.kms.aliyuncs.com。
		Endpoint: tea.String("yourEndpoint"),
	}
	// 建立KMS執行個體SDK Client對象
	client, err := dedicatedkmssdk.NewClient(config)
	if err != nil {
		// 異常處理
		panic(err)
	}
	return client
}