package selfupdate

import (
	"bytes"
	"fmt"

	"golang.org/x/crypto/openpgp"
)

var key = []byte(`
-----BEGIN PGP PUBLIC KEY BLOCK-----

[encoded data, 9945 characters]
CwGc
=AV20
-----END PGP PUBLIC KEY BLOCK-----
`)

// GPGVerify checks the authenticity of data by verifying the signature sig,
// which must be ASCII armored (base64). When the signature matches, GPGVerify
// returns true and a nil error.
func GPGVerify(data, sig []byte) (ok bool, err error) {
	keyring, err := openpgp.ReadArmoredKeyRing(bytes.NewReader(key))
	if err != nil {
		return false, fmt.Errorf("reading keyring failed: %w", err)
	}

	_, err = openpgp.CheckArmoredDetachedSignature(keyring, bytes.NewReader(data), bytes.NewReader(sig))
	if err != nil {
		return false, err
	}

	return true, nil
}
