Fixes

main.go

@@ -227,6 +227,7 @@ func mustLoadRouter(config *Config, indexer Indexer) *mux.Router {
 
 func getRouter(config *Config, indexer Indexer) (*mux.Router, error) {
 	artifactsHandler := artifactsHandler(indexer, config.CacheTimeCatchAll)
+	signaturesHandler := signaturesHandler(indexer, config.CacheTimeCatchAll)
 	faviconHandleFunc, err := faviconHandler(config.CacheTimeCatchAll)
 	if err != nil {
 		return nil, err
@@ -248,6 +249,7 @@ func getRouter(config *Config, indexer Indexer) (*mux.Router, error) {
 	router.HandleFunc("/health", healthHandler)
 	router.HandleFunc("/favicon.ico", faviconHandleFunc)
 	router.HandleFunc(artifactsRouterPath, artifactsHandler)
+	router.HandleFunc(signaturesRouterPath, signaturesHandler)
 	router.HandleFunc(packageIndexRouterPath, packageIndexHandler)
 	router.HandleFunc(staticRouterPath, staticHandler)
 	router.Use(loggingMiddleware)

main_test.go

@@ -114,6 +114,31 @@ func TestArtifacts(t *testing.T) {
 	}
 }
 
+func TestSignatures(t *testing.T) {
+	indexer := packages.NewZipFileSystemIndexer("./testdata/local-storage")
+
+	err := indexer.Init(context.Background())
+	require.NoError(t, err)
+
+	signaturesHandler := signaturesHandler(indexer, testCacheTime)
+
+	tests := []struct {
+		endpoint string
+		path     string
+		file     string
+		handler  func(w http.ResponseWriter, r *http.Request)
+	}{
+		{"/epr/example/example-1.0.1.zip.sig", signaturesRouterPath, "example-1.0.1.zip.sig", signaturesHandler},
+		{"/epr/example/example-0.0.1.zip.sig", signaturesRouterPath, "missing-signature.txt", signaturesHandler},
+	}
+
+	for _, test := range tests {
+		t.Run(test.endpoint, func(t *testing.T) {
+			runEndpoint(t, test.endpoint, test.path, test.file, test.handler)
+		})
+	}
+}
+
 func TestStatics(t *testing.T) {
 	packagesBasePaths := []string{"./testdata/package"}
 	indexer := packages.NewFileSystemIndexer(packagesBasePaths...)

packages/http.go

@@ -79,3 +79,7 @@ func ServeFile(w http.ResponseWriter, r *http.Request, p *Package, name string)
 
 	http.ServeContent(w, r, name, stat.ModTime(), f)
 }
+
+func ServeSignature(w http.ResponseWriter, r *http.Request, p *Package) {
+	http.ServeFile(w, r, p.BasePath+".sig")
+}

signatures.go

@@ -0,0 +1,59 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package main
+
+import (
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/gorilla/mux"
+	"github.com/pkg/errors"
+
+	"github.com/elastic/package-registry/packages"
+)
+
+const signaturesRouterPath = "/epr/{packageName}/{packageName:[a-z0-9_]+}-{packageVersion}.zip.sig"
+
+var errSignatureFileNotFound = errors.New("signature file not found")
+
+func signaturesHandler(indexer Indexer, cacheTime time.Duration) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		vars := mux.Vars(r)
+		packageName, ok := vars["packageName"]
+		if !ok {
+			badRequest(w, "missing package name")
+			return
+		}
+
+		packageVersion, ok := vars["packageVersion"]
+		if !ok {
+			badRequest(w, "missing package version")
+			return
+		}
+
+		_, err := semver.StrictNewVersion(packageVersion)
+		if err != nil {
+			badRequest(w, "invalid package version")
+			return
+		}
+
+		opts := packages.NameVersionFilter(packageName, packageVersion)
+		packageList, err := indexer.Get(r.Context(), &opts)
+		if err != nil {
+			log.Printf("getting package path failed: %v", err)
+			http.Error(w, "internal server error", http.StatusInternalServerError)
+			return
+		}
+		if len(packageList) == 0 {
+			notFoundError(w, errSignatureFileNotFound)
+			return
+		}
+
+		cacheHeaders(w, cacheTime)
+		packages.ServeSignature(w, r, packageList[0])
+	}
+}

testdata/generated/example-1.0.1.zip.sig

@@ -0,0 +1 @@
+e16ddaf4f91df524b27bf4f2e4b1ac09

testdata/generated/missing-signature.txt

@@ -0,0 +1 @@
+signature file not found