-- Hoogle documentation, generated by Haddock
-- See Hoogle, http://www.haskell.org/hoogle/


-- | native Haskell implementation of OpenPGP (RFC9580)
--   
--   native Haskell implementation of OpenPGP (RFC9580), with some
--   backwards compatibility
@package hOpenPGP
@version 3.0.1.1

module Codec.Encryption.OpenPGP.Types
key :: String -> Key

-- | An OpenPGP fingerprint. Length depends on key version: 16 bytes
--   (v3<i>MD5), 20 bytes (v4</i>SHA-1), or 32 bytes (v6/SHA-256).
newtype Fingerprint
Fingerprint :: ByteString -> Fingerprint
[unFingerprint] :: Fingerprint -> ByteString
data TK (k :: TKKind)
TK :: KeyPkt (TKKindToKeyPktKind k) -> [SignaturePayload] -> [(Text, [SignaturePayload])] -> [([UserAttrSubPacket], [SignaturePayload])] -> [(KeyPkt (TKKindToKeyPktKind k), [SignaturePayload])] -> TK (k :: TKKind)
[_tkPrimaryKey] :: TK (k :: TKKind) -> KeyPkt (TKKindToKeyPktKind k)
[_tkRevs] :: TK (k :: TKKind) -> [SignaturePayload]
[_tkUIDs] :: TK (k :: TKKind) -> [(Text, [SignaturePayload])]
[_tkUAts] :: TK (k :: TKKind) -> [([UserAttrSubPacket], [SignaturePayload])]
[_tkSubs] :: TK (k :: TKKind) -> [(KeyPkt (TKKindToKeyPktKind k), [SignaturePayload])]
data DataType
BinaryData :: DataType
TextData :: DataType
UTF8Data :: DataType
OtherData :: Word8 -> DataType
newtype IV
IV :: ByteString -> IV
[unIV] :: IV -> ByteString
newtype PublicKey
PublicKey :: SomePKPayload -> PublicKey
[_publicKeyPKPayload] :: PublicKey -> SomePKPayload
data SymmetricAlgorithm
Plaintext :: SymmetricAlgorithm
IDEA :: SymmetricAlgorithm
TripleDES :: SymmetricAlgorithm
CAST5 :: SymmetricAlgorithm
Blowfish :: SymmetricAlgorithm
ReservedSAFER :: SymmetricAlgorithm
ReservedDES :: SymmetricAlgorithm
AES128 :: SymmetricAlgorithm
AES192 :: SymmetricAlgorithm
AES256 :: SymmetricAlgorithm
Twofish :: SymmetricAlgorithm
Camellia128 :: SymmetricAlgorithm
Camellia192 :: SymmetricAlgorithm
Camellia256 :: SymmetricAlgorithm
OtherSA :: Word8 -> SymmetricAlgorithm
data HashAlgorithm
DeprecatedMD5 :: HashAlgorithm
SHA1 :: HashAlgorithm
RIPEMD160 :: HashAlgorithm
SHA256 :: HashAlgorithm
SHA384 :: HashAlgorithm
SHA512 :: HashAlgorithm
SHA224 :: HashAlgorithm
SHA3_256 :: HashAlgorithm
SHA3_512 :: HashAlgorithm
OtherHA :: Word8 -> HashAlgorithm
newtype Signature
Signature :: SignaturePayload -> Signature
[_signaturePayload] :: Signature -> SignaturePayload
data SecretKey
SecretKey :: SomePKPayload -> SKAddendum -> SecretKey
[_secretKeyPKPayload] :: SecretKey -> SomePKPayload
[_secretKeySKAddendum] :: SecretKey -> SKAddendum
newtype Block a
Block :: [a] -> Block a
[unBlock] :: Block a -> [a]

-- | Phantom types for tracking subpacket classification and signature
--   version These types are never instantiated; they exist purely for
--   compile-time type safety.
--   
--   Phantom marker for hashed subpackets (included in signature hash
--   computation)
data Hashed
newtype Salt
Salt :: ByteString -> Salt
[unSalt] :: Salt -> ByteString
data S2K
Simple :: HashAlgorithm -> S2K
Salted :: HashAlgorithm -> Salt8 -> S2K
IteratedSalted :: HashAlgorithm -> Salt8 -> IterationCount -> S2K
Argon2 :: Salt16 -> Word8 -> Word8 -> Word8 -> S2K
OtherS2K :: Word8 -> ByteString -> S2K
data EdSigningCurve
Ed25519 :: EdSigningCurve
Ed448 :: EdSigningCurve
data Pkt
PKESKPkt :: PKESKPayload -> Pkt
SignaturePkt :: SignaturePayload -> Pkt
SKESKPkt :: SKESKPayload -> Pkt
OnePassSignaturePkt :: OnePassSignaturePayload -> Pkt
SecretKeyPkt :: SomePKPayload -> SKAddendum -> Pkt
PublicKeyPkt :: SomePKPayload -> Pkt
SecretSubkeyPkt :: SomePKPayload -> SKAddendum -> Pkt
CompressedDataPkt :: CompressionAlgorithm -> CompressedDataPayload -> Pkt
SymEncDataPkt :: ByteString -> Pkt
MarkerPkt :: ByteString -> Pkt
LiteralDataPkt :: DataType -> FileName -> ThirtyTwoBitTimeStamp -> ByteString -> Pkt
TrustPkt :: ByteString -> Pkt
UserIdPkt :: Text -> Pkt
PublicSubkeyPkt :: SomePKPayload -> Pkt
UserAttributePkt :: [UserAttrSubPacket] -> Pkt
SymEncIntegrityProtectedDataPkt :: SEIPDPayload -> Pkt
ModificationDetectionCodePkt :: ByteString -> Pkt
OtherPacketPkt :: Word8 -> ByteString -> Pkt
BrokenPacketPkt :: String -> Word8 -> ByteString -> Pkt
data ECCCurve
NISTP256 :: ECCCurve
NISTP384 :: ECCCurve
NISTP521 :: ECCCurve
Curve25519 :: ECCCurve
Curve448 :: ECCCurve
data PubKeyAlgorithm
RSA :: PubKeyAlgorithm
DeprecatedRSAEncryptOnly :: PubKeyAlgorithm
DeprecatedRSASignOnly :: PubKeyAlgorithm
ElgamalEncryptOnly :: PubKeyAlgorithm
DSA :: PubKeyAlgorithm
ECDH :: PubKeyAlgorithm
ECDSA :: PubKeyAlgorithm
ForbiddenElgamal :: PubKeyAlgorithm
DH :: PubKeyAlgorithm
EdDSA :: PubKeyAlgorithm
X25519 :: PubKeyAlgorithm
X448 :: PubKeyAlgorithm
OtherPKA :: Word8 -> PubKeyAlgorithm

-- | Phantom marker for unhashed subpackets (not included in signature hash
--   computation)
data Unhashed

-- | Phantom marker for v4 signatures (8-octet issuer, no salt)
data V4Sig

-- | Phantom marker for v6 signatures (fingerprint issuer, requires salt)
data V6Sig
newtype EightOctetKeyId
EightOctetKeyId :: ByteString -> EightOctetKeyId
[unEOKI] :: EightOctetKeyId -> ByteString
newtype ThirtyTwoBitTimeStamp
ThirtyTwoBitTimeStamp :: Word32 -> ThirtyTwoBitTimeStamp
[unThirtyTwoBitTimeStamp] :: ThirtyTwoBitTimeStamp -> Word32
newtype MPI
MPI :: Integer -> MPI
[unMPI] :: MPI -> Integer
data SigSubPacket
SigSubPacket :: Bool -> SigSubPacketPayload -> SigSubPacket
[_sspCriticality] :: SigSubPacket -> Bool
[_sspPayload] :: SigSubPacket -> SigSubPacketPayload
data SigSubPacketPayload
SigCreationTime :: ThirtyTwoBitTimeStamp -> SigSubPacketPayload
SigExpirationTime :: ThirtyTwoBitDuration -> SigSubPacketPayload
ExportableCertification :: Exportability -> SigSubPacketPayload
TrustSignature :: TrustLevel -> TrustAmount -> SigSubPacketPayload
RegularExpression :: AlmostPublicDomainRegex -> SigSubPacketPayload
Revocable :: Revocability -> SigSubPacketPayload
KeyExpirationTime :: ThirtyTwoBitDuration -> SigSubPacketPayload
PreferredSymmetricAlgorithms :: [SymmetricAlgorithm] -> SigSubPacketPayload
RevocationKey :: Set RevocationClass -> PubKeyAlgorithm -> Fingerprint -> SigSubPacketPayload
Issuer :: EightOctetKeyId -> SigSubPacketPayload
NotationData :: Set NotationFlag -> NotationName -> NotationValue -> SigSubPacketPayload
PreferredHashAlgorithms :: [HashAlgorithm] -> SigSubPacketPayload
PreferredCompressionAlgorithms :: [CompressionAlgorithm] -> SigSubPacketPayload
KeyServerPreferences :: Set KSPFlag -> SigSubPacketPayload
PreferredKeyServer :: KeyServer -> SigSubPacketPayload
PrimaryUserId :: Bool -> SigSubPacketPayload
PolicyURL :: URL -> SigSubPacketPayload
KeyFlags :: Set KeyFlag -> SigSubPacketPayload
SignersUserId :: Text -> SigSubPacketPayload
ReasonForRevocation :: RevocationCode -> RevocationReason -> SigSubPacketPayload
Features :: Set FeatureFlag -> SigSubPacketPayload
SignatureTarget :: PubKeyAlgorithm -> HashAlgorithm -> SignatureHash -> SigSubPacketPayload
EmbeddedSignature :: SignaturePayload -> SigSubPacketPayload
IssuerFingerprint :: IssuerFingerprintVersion -> Fingerprint -> SigSubPacketPayload
UserDefinedSigSub :: Word8 -> ByteString -> SigSubPacketPayload
OtherSigSub :: Word8 -> ByteString -> SigSubPacketPayload
data SignaturePayload
SigV3 :: SigType -> ThirtyTwoBitTimeStamp -> EightOctetKeyId -> PubKeyAlgorithm -> HashAlgorithm -> Word16 -> NonEmpty MPI -> SignaturePayload
SigV4 :: SigType -> PubKeyAlgorithm -> HashAlgorithm -> [SigSubPacket] -> [SigSubPacket] -> Word16 -> NonEmpty MPI -> SignaturePayload
SigV6 :: SigType -> PubKeyAlgorithm -> HashAlgorithm -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> Word16 -> NonEmpty MPI -> SignaturePayload
SigVOther :: Word8 -> ByteString -> SignaturePayload
newtype SignatureSalt
SignatureSalt :: ByteString -> SignatureSalt
[unSignatureSalt] :: SignatureSalt -> ByteString
data SigType
BinarySig :: SigType
CanonicalTextSig :: SigType
StandaloneSig :: SigType
GenericCert :: SigType
PersonaCert :: SigType
CasualCert :: SigType
PositiveCert :: SigType
SubkeyBindingSig :: SigType
PrimaryKeyBindingSig :: SigType
SignatureDirectlyOnAKey :: SigType
KeyRevocationSig :: SigType
SubkeyRevocationSig :: SigType
CertRevocationSig :: SigType
TimestampSig :: SigType
ThirdPartyConfirmationSig :: SigType
OtherSig :: Word8 -> SigType

-- | Type-safe subpacket list with phantom types to distinguish hashed vs
--   unhashed and signature version constraints (v4 vs v6). The type
--   parameters erase at runtime; they exist purely for compile-time
--   safety.
newtype SubpacketList hashedness version
SubpacketList :: [SigSubPacket] -> SubpacketList hashedness version
data IssuerFingerprintVersion
IssuerFingerprintV4 :: IssuerFingerprintVersion
IssuerFingerprintV6 :: IssuerFingerprintVersion
newtype DSA_PublicKey
DSA_PublicKey :: PublicKey -> DSA_PublicKey
[unDSA_PublicKey] :: DSA_PublicKey -> PublicKey
newtype DSA_Params
DSA_Params :: Params -> DSA_Params
[unDSA_Params] :: DSA_Params -> Params
newtype RSA_PublicKey
RSA_PublicKey :: PublicKey -> RSA_PublicKey
[unRSA_PublicKey] :: RSA_PublicKey -> PublicKey
newtype ECDSA_PublicKey
ECDSA_PublicKey :: PublicKey -> ECDSA_PublicKey
[unECDSA_PublicKey] :: ECDSA_PublicKey -> PublicKey
compareCurve :: Curve -> Curve -> Ordering
compareECPoint :: Point -> Point -> Ordering
newtype DSA_PrivateKey
DSA_PrivateKey :: PrivateKey -> DSA_PrivateKey
[unDSA_PrivateKey] :: DSA_PrivateKey -> PrivateKey
newtype RSA_PrivateKey
RSA_PrivateKey :: PrivateKey -> RSA_PrivateKey
[unRSA_PrivateKey] :: RSA_PrivateKey -> PrivateKey
newtype ECDSA_PrivateKey
ECDSA_PrivateKey :: PrivateKey -> ECDSA_PrivateKey
[unECDSA_PrivateKey] :: ECDSA_PrivateKey -> PrivateKey
hashWithCurve :: Int -> Curve -> Int
hashWithECPoint :: Int -> Point -> Int
hashWithCurveCommon :: Int -> CurveCommon -> Int
compareCurveCommon :: CurveCommon -> CurveCommon -> Ordering
newtype ECurvePoint
ECurvePoint :: Point -> ECurvePoint
[unECurvepoint] :: ECurvePoint -> Point
type Exportability = Bool
type TrustLevel = Word8
type TrustAmount = Word8
type AlmostPublicDomainRegex = ByteString
type Revocability = Bool
type RevocationReason = Text
type KeyServer = ByteString
type SignatureHash = ByteString
type PacketVersion = Word8
type V3Expiration = Word16
type CompressedDataPayload = ByteString
type FileName = ByteString
type ImageData = ByteString
type NestedFlag = Bool
data ByteRange
ByteRange :: Int64 -> Int64 -> ByteRange
[_rangeOffset] :: ByteRange -> Int64
[_rangeLength] :: ByteRange -> Int64
newtype WireRepSourceId
WireRepSourceId :: Int64 -> WireRepSourceId
[_unWireRepSourceId] :: WireRepSourceId -> Int64
data WireRepRef
WireRepRef :: WireRepSourceId -> Int64 -> Maybe Text -> Bool -> WireRepRef
[_wireRepSourceId] :: WireRepRef -> WireRepSourceId
[_wireRepLength] :: WireRepRef -> Int64
[_wireRepName] :: WireRepRef -> Maybe Text
[_wireRepWasOriginallyArmored] :: WireRepRef -> Bool
type WireRepRefs = NonEmpty WireRepRef
wireRepRef :: ByteString -> WireRepRef
mkWireRepRefWithLength :: Maybe Text -> Bool -> Int64 -> WireRepRef
namedWireRepRef :: Text -> ByteString -> WireRepRef
freshWireRepSourceId :: Int64 -> WireRepSourceId
mkWireRepRef :: Maybe Text -> Bool -> ByteString -> WireRepRef
wireRepSourceCounter :: IORef Int64
rangeEnd :: ByteRange -> Int64
spanByteRanges :: [ByteRange] -> Maybe ByteRange
class (Eq a, Ord a) => FutureFlag a
fromFFlag :: FutureFlag a => a -> Int
toFFlag :: FutureFlag a => Int -> a
class (Eq a, Ord a) => FutureVal a
fromFVal :: FutureVal a => a -> Word8
toFVal :: FutureVal a => Word8 -> a
data NotationFlag
HumanReadable :: NotationFlag
OtherNF :: Word8 -> NotationFlag
mkNotationFlag :: Word8 -> NotationFlag
durU :: (Integral a, Show a) => a -> Maybe (String, a)
newtype ThirtyTwoBitDuration
ThirtyTwoBitDuration :: Word32 -> ThirtyTwoBitDuration
[unThirtyTwoBitDuration] :: ThirtyTwoBitDuration -> Word32
data RevocationClass
SensitiveRK :: RevocationClass
RClOther :: Word8 -> RevocationClass
mkRevocationClass :: Word8 -> RevocationClass
hexToW8s :: ReadS Word8
bsToHexUpper :: ByteString -> String
newtype SpacedFingerprint
SpacedFingerprint :: Fingerprint -> SpacedFingerprint
[unSpacedFingerprint] :: SpacedFingerprint -> Fingerprint
data KeyIdentifier
KeyIdentifierWildcard :: KeyIdentifier
KeyIdentifierEightOctet :: EightOctetKeyId -> KeyIdentifier
KeyIdentifierFingerprint :: Fingerprint -> KeyIdentifier
newtype NotationName
NotationName :: ByteString -> NotationName
[unNotationName] :: NotationName -> ByteString
newtype NotationValue
NotationValue :: ByteString -> NotationValue
[unNotationValue] :: NotationValue -> ByteString
data CompressionAlgorithm
Uncompressed :: CompressionAlgorithm
ZIP :: CompressionAlgorithm
ZLIB :: CompressionAlgorithm
BZip2 :: CompressionAlgorithm
OtherCA :: Word8 -> CompressionAlgorithm
data AEADAlgorithm
EAX :: AEADAlgorithm
OCB :: AEADAlgorithm
GCM :: AEADAlgorithm
OtherAEADAlgo :: Word8 -> AEADAlgorithm
data KSPFlag
NoModify :: KSPFlag
KSPOther :: Int -> KSPFlag
data KeyFlag
GroupKey :: KeyFlag
AuthKey :: KeyFlag
SplitKey :: KeyFlag
EncryptStorageKey :: KeyFlag
EncryptCommunicationsKey :: KeyFlag
SignDataKey :: KeyFlag
CertifyKeysKey :: KeyFlag
KFOther :: Int -> KeyFlag
data RevocationCode
NoReason :: RevocationCode
KeySuperseded :: RevocationCode
KeyMaterialCompromised :: RevocationCode
KeyRetiredAndNoLongerUsed :: RevocationCode
UserIdInfoNoLongerValid :: RevocationCode
RCoOther :: Word8 -> RevocationCode
data FeatureFlag
FeatureSEIPDv1 :: FeatureFlag
FeatureSEIPDv2 :: FeatureFlag
FeatureOther :: Int -> FeatureFlag
newtype URL
URL :: URI -> URL
[unURL] :: URL -> URI
data SignaturePayloadVersion
SigPayloadV3 :: SignaturePayloadVersion
SigPayloadV4 :: SignaturePayloadVersion
SigPayloadV6 :: SignaturePayloadVersion
SigPayloadVOther :: SignaturePayloadVersion
data SignaturePayloadV (v :: SignaturePayloadVersion)
[SigPayloadV3Data] :: SigType -> ThirtyTwoBitTimeStamp -> EightOctetKeyId -> PubKeyAlgorithm -> HashAlgorithm -> Word16 -> NonEmpty MPI -> SignaturePayloadV 'SigPayloadV3
[SigPayloadV4Data] :: SigType -> PubKeyAlgorithm -> HashAlgorithm -> [SigSubPacket] -> [SigSubPacket] -> Word16 -> NonEmpty MPI -> SignaturePayloadV 'SigPayloadV4
[SigPayloadV6Data] :: SigType -> PubKeyAlgorithm -> HashAlgorithm -> SignatureSalt -> [SigSubPacket] -> [SigSubPacket] -> Word16 -> NonEmpty MPI -> SignaturePayloadV 'SigPayloadV6
[SigPayloadOtherData] :: Word8 -> ByteString -> SignaturePayloadV 'SigPayloadVOther
data SomeSignaturePayload
[SomeSignaturePayload] :: forall (v :: SignaturePayloadVersion). SignaturePayloadV v -> SomeSignaturePayload
toSignaturePayload :: forall (v :: SignaturePayloadVersion). SignaturePayloadV v -> SignaturePayload
toSomeSignaturePayload :: SignaturePayload -> SomeSignaturePayload
signaturePayloadVersion :: SignaturePayload -> SignaturePayloadVersion
asSignaturePayloadV3 :: SignaturePayload -> Either String (SignaturePayloadV 'SigPayloadV3)
asSignaturePayloadV4 :: SignaturePayload -> Either String (SignaturePayloadV 'SigPayloadV4)
asSignaturePayloadV6 :: SignaturePayload -> Either String (SignaturePayloadV 'SigPayloadV6)
asSignaturePayloadOther :: SignaturePayload -> Either String (SignaturePayloadV 'SigPayloadVOther)
issuerFingerprintVersionToPacketVersion :: IssuerFingerprintVersion -> PacketVersion
packetVersionToIssuerFingerprintVersion :: PacketVersion -> Maybe IssuerFingerprintVersion
uc3 :: (a -> b -> c -> d) -> (a, b, c) -> d

-- | Extract the underlying list from a phantom-typed SubpacketList This is
--   typically used internally during serialization/deserialization
fromSubpacketList :: SubpacketList h v -> [SigSubPacket]

-- | Wrap a plain list into a phantom-typed SubpacketList Warning: This
--   circumvents type safety; use only for trusted sources (e.g., parsing)
toSubpacketList :: [SigSubPacket] -> SubpacketList h v

-- | Create an empty hashed subpacket list for a given signature version
emptyHashedSubpackets :: SubpacketList Hashed v

-- | Create an empty unhashed subpacket list for a given signature version
emptyUnhashedSubpackets :: SubpacketList Unhashed v

-- | Append a subpacket to a hashed list, preserving phantom type
consHashedSubpacket :: SigSubPacket -> SubpacketList Hashed v -> SubpacketList Hashed v

-- | Append a subpacket to an unhashed list, preserving phantom type
consUnhashedSubpacket :: SigSubPacket -> SubpacketList Unhashed v -> SubpacketList Unhashed v
data KeyVersion
DeprecatedV3 :: KeyVersion
V4 :: KeyVersion
V6 :: KeyVersion
newtype SessionKey
SessionKey :: ByteString -> SessionKey
[unSessionKey] :: SessionKey -> ByteString
newtype Salt8
Salt8 :: ByteString -> Salt8
[unSalt8] :: Salt8 -> ByteString
newtype Salt16
Salt16 :: ByteString -> Salt16
[unSalt16] :: Salt16 -> ByteString
salt8FromSalt :: Salt -> Maybe Salt8
salt16FromSalt :: Salt -> Maybe Salt16
saltFromSalt8 :: Salt8 -> Salt
saltFromSalt16 :: Salt16 -> Salt
newtype IterationCount
IterationCount :: Int -> IterationCount
[unIterationCount] :: IterationCount -> Int
data ImageFormat
JPEG :: ImageFormat
OtherImage :: Word8 -> ImageFormat
newtype ImageHeader
ImageHV1 :: ImageFormat -> ImageHeader
data UserAttrSubPacket
ImageAttribute :: ImageHeader -> ImageData -> UserAttrSubPacket
OtherUASub :: Word8 -> ByteString -> UserAttrSubPacket
rangeLength :: Lens' ByteRange Int64
rangeOffset :: Lens' ByteRange Int64
wireRepLength :: Lens' WireRepRef Int64
wireRepName :: Lens' WireRepRef (Maybe Text)
wireRepSourceId :: Lens' WireRepRef WireRepSourceId
wireRepWasOriginallyArmored :: Lens' WireRepRef Bool
sspCriticality :: Lens' SigSubPacket Bool
sspPayload :: Lens' SigSubPacket SigSubPacketPayload
newtype EPoint
EPoint :: Integer -> EPoint
[unEPoint] :: EPoint -> Integer
data EdPoint
PrefixedNativeEPoint :: EPoint -> EdPoint
NativeEPoint :: EPoint -> EdPoint
data PKey
RSAPubKey :: RSA_PublicKey -> PKey
DSAPubKey :: DSA_PublicKey -> PKey
ElGamalPubKey :: Integer -> Integer -> Integer -> PKey
ECDHPubKey :: PKey -> HashAlgorithm -> SymmetricAlgorithm -> PKey
ECDSAPubKey :: ECDSA_PublicKey -> PKey
EdDSAPubKey :: EdSigningCurve -> EdPoint -> PKey
UnknownPKey :: ByteString -> PKey
data SKey
RSAPrivateKey :: RSA_PrivateKey -> SKey
DSAPrivateKey :: DSA_PrivateKey -> SKey
ElGamalPrivateKey :: Integer -> SKey
ECDHPrivateKey :: ECDSA_PrivateKey -> SKey
ECDSAPrivateKey :: ECDSA_PrivateKey -> SKey
EdDSAPrivateKey :: EdSigningCurve -> ByteString -> SKey
X25519PrivateKey :: ByteString -> SKey
X448PrivateKey :: ByteString -> SKey
UnknownSKey :: ByteString -> SKey
data PKPayload (v :: KeyVersion)
[PKPayloadV3] :: ThirtyTwoBitTimeStamp -> V3Expiration -> PubKeyAlgorithm -> PKey -> PKPayload 'DeprecatedV3
[PKPayloadV4] :: ThirtyTwoBitTimeStamp -> PubKeyAlgorithm -> PKey -> PKPayload 'V4
[PKPayloadV6] :: ThirtyTwoBitTimeStamp -> PubKeyAlgorithm -> PKey -> PKPayload 'V6
pattern PKPayload :: KeyVersion -> ThirtyTwoBitTimeStamp -> V3Expiration -> PubKeyAlgorithm -> PKey -> SomePKPayload
pkPayloadFields :: forall (v :: KeyVersion). PKPayload v -> (KeyVersion, ThirtyTwoBitTimeStamp, V3Expiration, PubKeyAlgorithm, PKey)
data SomePKPayload
[SomePKPayload] :: forall (v :: KeyVersion). PKPayload v -> SomePKPayload
pkPayloadDataType :: DataType
pkPayloadConstr :: Constr
somePKPayloadFields :: SomePKPayload -> (KeyVersion, ThirtyTwoBitTimeStamp, V3Expiration, PubKeyAlgorithm, PKey)
_keyVersion :: SomePKPayload -> KeyVersion
_timestamp :: SomePKPayload -> ThirtyTwoBitTimeStamp
_v3exp :: SomePKPayload -> V3Expiration
_pkalgo :: SomePKPayload -> PubKeyAlgorithm
_pubkey :: SomePKPayload -> PKey
data SKAddendum
SUS16bit :: SymmetricAlgorithm -> S2K -> IV -> ByteString -> SKAddendum
SUSSHA1 :: SymmetricAlgorithm -> S2K -> IV -> ByteString -> SKAddendum
SUSAEAD :: SymmetricAlgorithm -> AEADAlgorithm -> S2K -> IV -> ByteString -> SKAddendum
SUSym :: SymmetricAlgorithm -> IV -> ByteString -> SKAddendum
SUUnencrypted :: SKey -> Word16 -> SKAddendum
class LegacyKeyVersion (v :: KeyVersion)
data SKAddendumV (v :: KeyVersion)
[SKA16bit] :: forall (v :: KeyVersion). LegacyKeyVersion v => SymmetricAlgorithm -> S2K -> IV -> ByteString -> SKAddendumV v
[SKASHA1Legacy] :: forall (v :: KeyVersion). LegacyKeyVersion v => SymmetricAlgorithm -> S2K -> IV -> ByteString -> SKAddendumV v
[SKASHA1V6] :: SymmetricAlgorithm -> S2K -> IV -> ByteString -> SKAddendumV 'V6
[SKAAEADV6] :: SymmetricAlgorithm -> AEADAlgorithm -> S2K -> IV -> ByteString -> SKAddendumV 'V6
[SKAAEADLegacy] :: forall (v :: KeyVersion). LegacyKeyVersion v => SymmetricAlgorithm -> AEADAlgorithm -> S2K -> IV -> ByteString -> SKAddendumV v
[SKASymLegacy] :: forall (v :: KeyVersion). LegacyKeyVersion v => SymmetricAlgorithm -> IV -> ByteString -> SKAddendumV v
[SKASymV6] :: SymmetricAlgorithm -> IV -> ByteString -> SKAddendumV 'V6
[SKAUnencryptedLegacy] :: forall (v :: KeyVersion). LegacyKeyVersion v => SKey -> Word16 -> SKAddendumV v
[SKAUnencryptedV6] :: SKey -> SKAddendumV 'V6
data SomeSKAddendumV
[SomeSKAddendumV] :: forall (v :: KeyVersion). SKAddendumV v -> SomeSKAddendumV
toSKAddendum :: forall (v :: KeyVersion). SKAddendumV v -> SKAddendum
fromSKAddendumForKeyVersion :: KeyVersion -> SKAddendum -> Either String SomeSKAddendumV
fromSKAddendumForPKPayload :: SomePKPayload -> SKAddendum -> Either String SomeSKAddendumV
data PKESKPayloadVersion
PKESKV3 :: PKESKPayloadVersion
PKESKV6 :: PKESKPayloadVersion
data PKESKPayloadV3
PKESKPayloadV3 :: PacketVersion -> EightOctetKeyId -> PubKeyAlgorithm -> NonEmpty MPI -> PKESKPayloadV3
data PKESKPayloadV6
PKESKPayloadV6 :: ByteString -> PubKeyAlgorithm -> ByteString -> PKESKPayloadV6
data PKESKPayload
PKESKPayloadV3Packet :: PKESKPayloadV3 -> PKESKPayload
PKESKPayloadV6Packet :: PKESKPayloadV6 -> PKESKPayload
data SKESKPayloadVersion
SKESKV4 :: SKESKPayloadVersion
SKESKV6 :: SKESKPayloadVersion
data SKESKPayloadV4
SKESKPayloadV4 :: SymmetricAlgorithm -> S2K -> Maybe ByteString -> SKESKPayloadV4
data SKESKPayloadV6
SKESKPayloadV6 :: SymmetricAlgorithm -> AEADAlgorithm -> S2K -> ByteString -> ByteString -> ByteString -> SKESKPayloadV6
data SKESKPayload
SKESKPayloadV4Packet :: SKESKPayloadV4 -> SKESKPayload
SKESKPayloadV6Packet :: SKESKPayloadV6 -> SKESKPayload
data OnePassSignatureVersion
OPSV3 :: OnePassSignatureVersion
OPSV6 :: OnePassSignatureVersion
data OPSPayloadV3
OPSPayloadV3 :: PacketVersion -> SigType -> HashAlgorithm -> PubKeyAlgorithm -> EightOctetKeyId -> NestedFlag -> OPSPayloadV3
data OPSPayloadV6
OPSPayloadV6 :: SigType -> HashAlgorithm -> PubKeyAlgorithm -> SignatureSalt -> ByteString -> NestedFlag -> OPSPayloadV6
data OnePassSignaturePayload
OPSPayloadV3Packet :: OPSPayloadV3 -> OnePassSignaturePayload
OPSPayloadV6Packet :: OPSPayloadV6 -> OnePassSignaturePayload
data SEIPDPayload
SEIPD1 :: PacketVersion -> ByteString -> SEIPDPayload
SEIPD2 :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> ByteString -> SEIPDPayload
data KeyPktKind
PublicPkt :: KeyPktKind
SecretPkt :: KeyPktKind
data KeyPktRole
KeyPktPrimary :: KeyPktRole
KeyPktSubkey :: KeyPktRole
data KeyPkt (k :: KeyPktKind)
[KeyPktPublicPrimary] :: SomePKPayload -> KeyPkt 'PublicPkt
[KeyPktPublicSubkey] :: SomePKPayload -> KeyPkt 'PublicPkt
[KeyPktSecretPrimary] :: SomePKPayload -> SKAddendum -> KeyPkt 'SecretPkt
[KeyPktSecretSubkey] :: SomePKPayload -> SKAddendum -> KeyPkt 'SecretPkt
keyPktToPkt :: forall (k :: KeyPktKind). KeyPkt k -> Pkt
conKeyPktPublicPrimary :: Constr
conKeyPktPublicSubkey :: Constr
conKeyPktSecretPrimary :: Constr
conKeyPktSecretSubkey :: Constr
tyKeyPkt :: DataType
data SomeKeyPkt
[SomeKeyPkt] :: forall (k :: KeyPktKind). KeyPkt k -> SomeKeyPkt
someKeyPktToPkt :: SomeKeyPkt -> Pkt
data KeyPktCoercionError
NotAKeyPacket :: Pkt -> KeyPktCoercionError
ExpectedPublicKeyPacket :: Pkt -> KeyPktCoercionError
ExpectedSecretKeyPacket :: Pkt -> KeyPktCoercionError
data PktWithWireRep
PktWithWireRep :: WireRepRef -> ByteRange -> ByteString -> Int -> Pkt -> PktWithWireRep
[_pktWireRepRef] :: PktWithWireRep -> WireRepRef
[_pktRange] :: PktWithWireRep -> ByteRange
[_pktRaw] :: PktWithWireRep -> ByteString
[_pktIndex] :: PktWithWireRep -> Int
[_pktValue] :: PktWithWireRep -> Pkt
pktTag :: Pkt -> Word8
wireRepOfPkt :: PktWithWireRep -> WireRepRef
packetsFromWireRep :: WireRepRef -> [PktWithWireRep] -> [PktWithWireRep]
renderKeyPktCoercionError :: KeyPktCoercionError -> String
keyPktRole :: forall (k :: KeyPktKind). KeyPkt k -> KeyPktRole
keyPktPKPayload :: forall (k :: KeyPktKind). KeyPkt k -> SomePKPayload
keyPktMaybeSKAddendum :: forall (k :: KeyPktKind). KeyPkt k -> Maybe SKAddendum
keyPktTKKey :: forall (k :: KeyPktKind). KeyPkt k -> (SomePKPayload, Maybe SKAddendum)
secretKeyPktSKAddendum :: KeyPkt 'SecretPkt -> SKAddendum
mkPrimaryKeyPkt :: SomePKPayload -> Maybe SKAddendum -> SomeKeyPkt
mkSubkeyKeyPkt :: SomePKPayload -> Maybe SKAddendum -> SomeKeyPkt
keyPktToPublicView :: KeyPkt 'SecretPkt -> KeyPkt 'PublicPkt
pktToSomeKeyPktEither :: Pkt -> Either KeyPktCoercionError SomeKeyPkt
pktToSomeKeyPkt :: Pkt -> Maybe SomeKeyPkt
pktToPublicKeyPktEither :: Pkt -> Either KeyPktCoercionError (KeyPkt 'PublicPkt)
pktToPublicKeyPkt :: Pkt -> Maybe (KeyPkt 'PublicPkt)
pktToSecretKeyPktEither :: Pkt -> Either KeyPktCoercionError (KeyPkt 'SecretPkt)
pktToSecretKeyPkt :: Pkt -> Maybe (KeyPkt 'SecretPkt)

-- | Convert secret key/subkey packets to their public-key packet forms.
--   Non-secret packets are returned unchanged.
publicKeyPacketOf :: Pkt -> Pkt
data Verification
Verification :: SomePKPayload -> SignaturePayload -> [VerificationWarning] -> Verification
[_verificationSigner] :: Verification -> SomePKPayload
[_verificationSignature] :: Verification -> SignaturePayload
[_verificationWarnings] :: Verification -> [VerificationWarning]
data VerificationWarning
MissingSubkeyBackSignatureWarning :: VerificationWarning
data SOPVVerification
SOPVVerification :: UTCTime -> Fingerprint -> Fingerprint -> String -> String -> SOPVVerification
[_sopvvDateStamp] :: SOPVVerification -> UTCTime
[_sopvvFingerprint] :: SOPVVerification -> Fingerprint
[_sopvvPrimaryFingerprint] :: SOPVVerification -> Fingerprint
[_sopvvMode] :: SOPVVerification -> String
[_sopvvDescription] :: SOPVVerification -> String
verificationSignature :: Lens' Verification SignaturePayload
verificationSigner :: Lens' Verification SomePKPayload
verificationWarnings :: Lens' Verification [VerificationWarning]
sopvvDateStamp :: Lens' SOPVVerification UTCTime
sopvvDescription :: Lens' SOPVVerification String
sopvvFingerprint :: Lens' SOPVVerification Fingerprint
sopvvMode :: Lens' SOPVVerification String
sopvvPrimaryFingerprint :: Lens' SOPVVerification Fingerprint
pktIndex :: Lens' PktWithWireRep Int
pktRange :: Lens' PktWithWireRep ByteRange
pktRaw :: Lens' PktWithWireRep ByteString
pktValue :: Lens' PktWithWireRep Pkt
pktWireRepRef :: Lens' PktWithWireRep WireRepRef
class Packet a where {
    data PacketType a;
}
packetType :: Packet a => a -> PacketType a
packetCode :: Packet a => PacketType a -> Word8
dynamicPacketCode :: Packet a => a -> Word8
toPkt :: Packet a => a -> Pkt
fromPktMaybe :: Packet a => Pkt -> Maybe a
fromPktEither :: Packet a => Pkt -> Either String a
data family PacketType a
coercionError :: String -> Pkt -> Either String a
data PKESK (v :: PKESKPayloadVersion)
[PKESK3Packet] :: PacketVersion -> EightOctetKeyId -> PubKeyAlgorithm -> NonEmpty MPI -> PKESK 'PKESKV3
[PKESK6Packet] :: ByteString -> PubKeyAlgorithm -> ByteString -> PKESK 'PKESKV6
data SignatureV (v :: SignaturePayloadVersion)
[SignatureV3Packet] :: SignaturePayloadV 'SigPayloadV3 -> SignatureV 'SigPayloadV3
[SignatureV4Packet] :: SignaturePayloadV 'SigPayloadV4 -> SignatureV 'SigPayloadV4
[SignatureV6Packet] :: SignaturePayloadV 'SigPayloadV6 -> SignatureV 'SigPayloadV6
[SignatureVOtherPacket] :: SignaturePayloadV 'SigPayloadVOther -> SignatureV 'SigPayloadVOther
data SomeSignatureV
[SomeSignatureV] :: forall (v :: SignaturePayloadVersion). SignatureV v -> SomeSignatureV
signaturePayloadFromSignatureV :: forall (v :: SignaturePayloadVersion). SignatureV v -> SignaturePayload
fromPktEitherSomeSignatureV :: Pkt -> Either String SomeSignatureV
someSignatureVFromPayload :: SignaturePayload -> SomeSignatureV
data SKESK (v :: SKESKPayloadVersion)
[SKESK4Packet] :: SymmetricAlgorithm -> S2K -> Maybe ByteString -> SKESK 'SKESKV4
[SKESK6Packet] :: SymmetricAlgorithm -> AEADAlgorithm -> S2K -> ByteString -> ByteString -> ByteString -> SKESK 'SKESKV6
data OnePassSignature (v :: OnePassSignatureVersion)
[OnePassSignatureV3Packet] :: PacketVersion -> SigType -> HashAlgorithm -> PubKeyAlgorithm -> EightOctetKeyId -> NestedFlag -> OnePassSignature 'OPSV3
[OnePassSignatureV6Packet] :: SigType -> HashAlgorithm -> PubKeyAlgorithm -> SignatureSalt -> ByteString -> NestedFlag -> OnePassSignature 'OPSV6
data SecretSubkey
SecretSubkey :: SomePKPayload -> SKAddendum -> SecretSubkey
[_secretSubkeyPKPayload] :: SecretSubkey -> SomePKPayload
[_secretSubkeySKAddendum] :: SecretSubkey -> SKAddendum
data CompressedData
CompressedData :: CompressionAlgorithm -> CompressedDataPayload -> CompressedData
[_compressedDataCompressionAlgorithm] :: CompressedData -> CompressionAlgorithm
[_compressedDataPayload] :: CompressedData -> CompressedDataPayload
newtype SymEncData
SymEncData :: ByteString -> SymEncData
[_symEncDataPayload] :: SymEncData -> ByteString
newtype Marker
Marker :: ByteString -> Marker
[_markerPayload] :: Marker -> ByteString
data LiteralData
LiteralData :: DataType -> FileName -> ThirtyTwoBitTimeStamp -> ByteString -> LiteralData
[_literalDataDataType] :: LiteralData -> DataType
[_literalDataFileName] :: LiteralData -> FileName
[_literalDataTimeStamp] :: LiteralData -> ThirtyTwoBitTimeStamp
[_literalDataPayload] :: LiteralData -> ByteString
newtype Trust
Trust :: ByteString -> Trust
[_trustPayload] :: Trust -> ByteString
newtype UserId
UserId :: Text -> UserId
[_userIdPayload] :: UserId -> Text
newtype PublicSubkey
PublicSubkey :: SomePKPayload -> PublicSubkey
[_publicSubkeyPKPayload] :: PublicSubkey -> SomePKPayload
newtype UserAttribute
UserAttribute :: [UserAttrSubPacket] -> UserAttribute
[_userAttributeSubPackets] :: UserAttribute -> [UserAttrSubPacket]
data SymEncIntegrityProtectedData
SymEncIntegrityProtectedData :: PacketVersion -> ByteString -> SymEncIntegrityProtectedData
[_symEncIntegrityProtectedDataPacketVersion] :: SymEncIntegrityProtectedData -> PacketVersion
[_symEncIntegrityProtectedDataPayload] :: SymEncIntegrityProtectedData -> ByteString
SymEncIntegrityProtectedDataV2 :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> ByteString -> SymEncIntegrityProtectedData
newtype ModificationDetectionCode
ModificationDetectionCode :: ByteString -> ModificationDetectionCode
[_modificationDetectionCodePayload] :: ModificationDetectionCode -> ByteString
data OtherPacket
OtherPacket :: Word8 -> ByteString -> OtherPacket
[_otherPacketType] :: OtherPacket -> Word8
[_otherPacketPayload] :: OtherPacket -> ByteString
data BrokenPacket
BrokenPacket :: String -> Word8 -> ByteString -> BrokenPacket
[_brokenPacketParseError] :: BrokenPacket -> String
[_brokenPacketType] :: BrokenPacket -> Word8
[_brokenPacketPayload] :: BrokenPacket -> ByteString
signaturePayload :: Iso' Signature SignaturePayload
secretKeyPKPayload :: Lens' SecretKey SomePKPayload
secretKeySKAddendum :: Lens' SecretKey SKAddendum
publicKeyPKPayload :: Iso' PublicKey SomePKPayload
secretSubkeyPKPayload :: Lens' SecretSubkey SomePKPayload
secretSubkeySKAddendum :: Lens' SecretSubkey SKAddendum
compressedDataCompressionAlgorithm :: Lens' CompressedData CompressionAlgorithm
compressedDataPayload :: Lens' CompressedData CompressedDataPayload
symEncDataPayload :: Iso' SymEncData ByteString
markerPayload :: Iso' Marker ByteString
literalDataDataType :: Lens' LiteralData DataType
literalDataFileName :: Lens' LiteralData FileName
literalDataPayload :: Lens' LiteralData ByteString
literalDataTimeStamp :: Lens' LiteralData ThirtyTwoBitTimeStamp
trustPayload :: Iso' Trust ByteString
userIdPayload :: Iso' UserId Text
publicSubkeyPKPayload :: Iso' PublicSubkey SomePKPayload
userAttributeSubPackets :: Iso' UserAttribute [UserAttrSubPacket]
symEncIntegrityProtectedDataPacketVersion :: Traversal' SymEncIntegrityProtectedData PacketVersion
symEncIntegrityProtectedDataPayload :: Traversal' SymEncIntegrityProtectedData ByteString
modificationDetectionCodePayload :: Iso' ModificationDetectionCode ByteString
otherPacketPayload :: Lens' OtherPacket ByteString
otherPacketType :: Lens' OtherPacket Word8
brokenPacketParseError :: Lens' BrokenPacket String
brokenPacketPayload :: Lens' BrokenPacket ByteString
brokenPacketType :: Lens' BrokenPacket Word8

-- | Zipper for navigating a list of packets with position context
data PacketZipper
PacketZipper :: [PktWithWireRep] -> PktWithWireRep -> [PktWithWireRep] -> PacketZipper
[_zpBefore] :: PacketZipper -> [PktWithWireRep]
[_zpCurrent] :: PacketZipper -> PktWithWireRep
[_zpAfter] :: PacketZipper -> [PktWithWireRep]

-- | Create a zipper from a list, starting at the first element
zFromList :: [PktWithWireRep] -> Maybe PacketZipper

-- | Extract position in packet sequence
zPosition :: PacketZipper -> Int

-- | Move to the next packet in the sequence
zMoveNext :: PacketZipper -> Maybe PacketZipper

-- | Get the remaining packets (current + after)
zRemaining :: PacketZipper -> [PktWithWireRep]

-- | Reconstruct the full list from a zipper
zToList :: PacketZipper -> [PktWithWireRep]
data TKUnknown
TKUnknown :: (SomePKPayload, Maybe SKAddendum) -> [SignaturePayload] -> [(Text, [SignaturePayload])] -> [([UserAttrSubPacket], [SignaturePayload])] -> [(Pkt, [SignaturePayload])] -> TKUnknown
[_tkuKey] :: TKUnknown -> (SomePKPayload, Maybe SKAddendum)
[_tkuRevs] :: TKUnknown -> [SignaturePayload]
[_tkuUIDs] :: TKUnknown -> [(Text, [SignaturePayload])]
[_tkuUAts] :: TKUnknown -> [([UserAttrSubPacket], [SignaturePayload])]
[_tkuSubs] :: TKUnknown -> [(Pkt, [SignaturePayload])]
data TKKind
PublicTK :: TKKind
SecretTK :: TKKind
type family TKKindToKeyPktKind (k :: TKKind) :: KeyPktKind
data SomeTK
[SomePublicTK] :: TK 'PublicTK -> SomeTK
[SomeSecretTK] :: TK 'SecretTK -> SomeTK
someTKToUnknown :: SomeTK -> TKUnknown
data TKConversionError
PublicSubkeyHasPrimaryRole :: TKConversionError
SecretSubkeyHasPrimaryRole :: TKConversionError
ExpectedPublicSubkeyPacket :: Word8 -> TKConversionError
ExpectedSecretSubkeyPacket :: Word8 -> TKConversionError
renderTKConversionError :: TKConversionError -> String
tkToUnknown :: forall (k :: TKKind). TK k -> TKUnknown
mkTKUnknown :: SomePKPayload -> Maybe SKAddendum -> TKUnknown
fromPrimaryKeyPktToTKUnknown :: Pkt -> Either String TKUnknown
someTKToPublicTK :: SomeTK -> Maybe (TK 'PublicTK)
someTKToSecretTK :: SomeTK -> Maybe (TK 'SecretTK)
someTKToPublicViewTK :: SomeTK -> TK 'PublicTK
publicViewTK :: TK 'SecretTK -> TK 'PublicTK
fromUnknownToTKEither :: TKUnknown -> Either TKConversionError SomeTK
fromUnknownToTK :: TKUnknown -> Either String SomeTK
data TKWithWireRep
TKWithWireRep :: WireRepRefs -> Maybe ByteRange -> [PktWithWireRep] -> TKUnknown -> TKWithWireRep
[_tkWireRepRefs] :: TKWithWireRep -> WireRepRefs
[_tkWireRepRange] :: TKWithWireRep -> Maybe ByteRange
[_tkPackets] :: TKWithWireRep -> [PktWithWireRep]
[_tkValue] :: TKWithWireRep -> TKUnknown
data PacketRefId
PacketRefId :: WireRepRef -> Int -> PacketRefId
[_packetRefWireRepRef] :: PacketRefId -> WireRepRef
[_packetRefIndex] :: PacketRefId -> Int
data SignatureWithWireRef
SignatureWithWireRef :: SignaturePayload -> PacketRefId -> SignatureWithWireRef
[_signatureWithWireRefValue] :: SignatureWithWireRef -> SignaturePayload
[_signatureWithWireRefRef] :: SignatureWithWireRef -> PacketRefId
data UIDWithWireRefs
UIDWithWireRefs :: Text -> PacketRefId -> [SignatureWithWireRef] -> UIDWithWireRefs
[_uidWithWireRefsValue] :: UIDWithWireRefs -> Text
[_uidWithWireRefsRef] :: UIDWithWireRefs -> PacketRefId
[_uidWithWireRefsSignatures] :: UIDWithWireRefs -> [SignatureWithWireRef]
data UATWithWireRefs
UATWithWireRefs :: [UserAttrSubPacket] -> PacketRefId -> [SignatureWithWireRef] -> UATWithWireRefs
[_uatWithWireRefsValue] :: UATWithWireRefs -> [UserAttrSubPacket]
[_uatWithWireRefsRef] :: UATWithWireRefs -> PacketRefId
[_uatWithWireRefsSignatures] :: UATWithWireRefs -> [SignatureWithWireRef]
data SubkeyWithWireRefs
SubkeyWithWireRefs :: Pkt -> PacketRefId -> [SignatureWithWireRef] -> SubkeyWithWireRefs
[_subkeyWithWireRefsValue] :: SubkeyWithWireRefs -> Pkt
[_subkeyWithWireRefsRef] :: SubkeyWithWireRefs -> PacketRefId
[_subkeyWithWireRefsSignatures] :: SubkeyWithWireRefs -> [SignatureWithWireRef]
data TKStructuredWithWireRep
TKStructuredWithWireRep :: WireRepRefs -> Maybe ByteRange -> (SomePKPayload, Maybe SKAddendum) -> PacketRefId -> [SignatureWithWireRef] -> [UIDWithWireRefs] -> [UATWithWireRefs] -> [SubkeyWithWireRefs] -> [PktWithWireRep] -> TKStructuredWithWireRep
[_tkStructuredWireRepRefs] :: TKStructuredWithWireRep -> WireRepRefs
[_tkStructuredWireRepRange] :: TKStructuredWithWireRep -> Maybe ByteRange
[_tkStructuredPrimaryKey] :: TKStructuredWithWireRep -> (SomePKPayload, Maybe SKAddendum)
[_tkStructuredPrimaryKeyRef] :: TKStructuredWithWireRep -> PacketRefId
[_tkStructuredDirectSignatures] :: TKStructuredWithWireRep -> [SignatureWithWireRef]
[_tkStructuredUIDs] :: TKStructuredWithWireRep -> [UIDWithWireRefs]
[_tkStructuredUAts] :: TKStructuredWithWireRep -> [UATWithWireRefs]
[_tkStructuredSubkeys] :: TKStructuredWithWireRep -> [SubkeyWithWireRefs]
[_tkStructuredPacketRefs] :: TKStructuredWithWireRep -> [PktWithWireRep]
data CanonicalizeTKWithWireRepError
CanonicalizeStructuringError :: String -> CanonicalizeTKWithWireRepError
CanonicalizeMissingPacketRef :: PacketRefId -> CanonicalizeTKWithWireRepError
wireRepOfTK :: TKWithWireRep -> WireRepRef
wireRepsOfTK :: TKWithWireRep -> WireRepRefs
packetRefsOfTK :: TKWithWireRep -> [PktWithWireRep]
packetRefIdOf :: PktWithWireRep -> PacketRefId
lookupPacketRef :: TKStructuredWithWireRep -> PacketRefId -> Maybe PktWithWireRep
packetWireBytesForRef :: TKStructuredWithWireRep -> PacketRefId -> Either CanonicalizeTKWithWireRepError ByteString
signatureWireSortKey :: TKStructuredWithWireRep -> SignatureWithWireRef -> Either CanonicalizeTKWithWireRepError (ByteString, PacketRefId)
uidWireSortKey :: TKStructuredWithWireRep -> UIDWithWireRefs -> Either CanonicalizeTKWithWireRepError (ByteString, PacketRefId)
uatWireSortKey :: TKStructuredWithWireRep -> UATWithWireRefs -> Either CanonicalizeTKWithWireRepError (ByteString, PacketRefId)
subkeyWireSortKey :: TKStructuredWithWireRep -> SubkeyWithWireRefs -> Either CanonicalizeTKWithWireRepError (ByteString, PacketRefId)
compareSignatureWithWireRefCanonical :: TKStructuredWithWireRep -> SignatureWithWireRef -> SignatureWithWireRef -> Either CanonicalizeTKWithWireRepError Ordering
compareUIDWithWireRefsCanonical :: TKStructuredWithWireRep -> UIDWithWireRefs -> UIDWithWireRefs -> Either CanonicalizeTKWithWireRepError Ordering
compareUATWithWireRefsCanonical :: TKStructuredWithWireRep -> UATWithWireRefs -> UATWithWireRefs -> Either CanonicalizeTKWithWireRepError Ordering
compareSubkeyWithWireRefsCanonical :: TKStructuredWithWireRep -> SubkeyWithWireRefs -> SubkeyWithWireRefs -> Either CanonicalizeTKWithWireRepError Ordering
sortCanonicalByKey :: Ord key => (a -> Either CanonicalizeTKWithWireRepError key) -> [a] -> Either CanonicalizeTKWithWireRepError [a]
sortSignatureWithWireRefsCanonical :: TKStructuredWithWireRep -> [SignatureWithWireRef] -> Either CanonicalizeTKWithWireRepError [SignatureWithWireRef]
sortUIDWithWireRefsCanonical :: TKStructuredWithWireRep -> [UIDWithWireRefs] -> Either CanonicalizeTKWithWireRepError [UIDWithWireRefs]
sortUATWithWireRefsCanonical :: TKStructuredWithWireRep -> [UATWithWireRefs] -> Either CanonicalizeTKWithWireRepError [UATWithWireRefs]
sortSubkeyWithWireRefsCanonical :: TKStructuredWithWireRep -> [SubkeyWithWireRefs] -> Either CanonicalizeTKWithWireRepError [SubkeyWithWireRefs]
canonicalizeTKStructuredWithWireRep :: TKStructuredWithWireRep -> Either CanonicalizeTKWithWireRepError TKUnknown
canonicalizeTKWithWireRep :: TKWithWireRep -> Either CanonicalizeTKWithWireRepError TKUnknown
toStructuredTKWithWireRep :: TKWithWireRep -> Either String TKStructuredWithWireRep
tksFromWireRep :: WireRepRef -> [TKWithWireRep] -> [TKWithWireRep]
tksContainingPacket :: PktWithWireRep -> [TKWithWireRep] -> [TKWithWireRep]
type KeyringIxs = '[EightOctetKeyId, Fingerprint, Text]

-- | Kinded keyrings: homogeneous collections of public or secret TKs
type PublicKeyring = IxSet KeyringIxs TK 'PublicTK
type SecretKeyring = IxSet KeyringIxs TK 'SecretTK

-- | Parameterized kinded keyring for generic operations
type family KeyringOf (k :: TKKind)
tkuKey :: Lens' TKUnknown (SomePKPayload, Maybe SKAddendum)
tkuRevs :: Lens' TKUnknown [SignaturePayload]
tkuSubs :: Lens' TKUnknown [(Pkt, [SignaturePayload])]
tkuUAts :: Lens' TKUnknown [([UserAttrSubPacket], [SignaturePayload])]
tkuUIDs :: Lens' TKUnknown [(Text, [SignaturePayload])]
tkPrimaryKey :: forall (k :: TKKind) f. Functor f => (KeyPkt (TKKindToKeyPktKind k) -> f (KeyPkt (TKKindToKeyPktKind k))) -> TK k -> f (TK k)
tkRevs :: forall (k :: TKKind) f. Functor f => ([SignaturePayload] -> f [SignaturePayload]) -> TK k -> f (TK k)
tkSubs :: forall (k :: TKKind) f. Functor f => ([(KeyPkt (TKKindToKeyPktKind k), [SignaturePayload])] -> f [(KeyPkt (TKKindToKeyPktKind k), [SignaturePayload])]) -> TK k -> f (TK k)
tkUAts :: forall (k :: TKKind) f. Functor f => ([([UserAttrSubPacket], [SignaturePayload])] -> f [([UserAttrSubPacket], [SignaturePayload])]) -> TK k -> f (TK k)
tkUIDs :: forall (k :: TKKind) f. Functor f => ([(Text, [SignaturePayload])] -> f [(Text, [SignaturePayload])]) -> TK k -> f (TK k)
tkPackets :: Lens' TKWithWireRep [PktWithWireRep]
tkValue :: Lens' TKWithWireRep TKUnknown
tkWireRepRange :: Lens' TKWithWireRep (Maybe ByteRange)
tkWireRepRefs :: Lens' TKWithWireRep WireRepRefs
packetRefIndex :: Lens' PacketRefId Int
packetRefWireRepRef :: Lens' PacketRefId WireRepRef
zpAfter :: Lens' PacketZipper [PktWithWireRep]
zpBefore :: Lens' PacketZipper [PktWithWireRep]
zpCurrent :: Lens' PacketZipper PktWithWireRep
signatureWithWireRefRef :: Lens' SignatureWithWireRef PacketRefId
signatureWithWireRefValue :: Lens' SignatureWithWireRef SignaturePayload
uidWithWireRefsRef :: Lens' UIDWithWireRefs PacketRefId
uidWithWireRefsSignatures :: Lens' UIDWithWireRefs [SignatureWithWireRef]
uidWithWireRefsValue :: Lens' UIDWithWireRefs Text
uatWithWireRefsRef :: Lens' UATWithWireRefs PacketRefId
uatWithWireRefsSignatures :: Lens' UATWithWireRefs [SignatureWithWireRef]
uatWithWireRefsValue :: Lens' UATWithWireRefs [UserAttrSubPacket]
subkeyWithWireRefsRef :: Lens' SubkeyWithWireRefs PacketRefId
subkeyWithWireRefsSignatures :: Lens' SubkeyWithWireRefs [SignatureWithWireRef]
subkeyWithWireRefsValue :: Lens' SubkeyWithWireRefs Pkt
tkStructuredDirectSignatures :: Lens' TKStructuredWithWireRep [SignatureWithWireRef]
tkStructuredPacketRefs :: Lens' TKStructuredWithWireRep [PktWithWireRep]
tkStructuredPrimaryKey :: Lens' TKStructuredWithWireRep (SomePKPayload, Maybe SKAddendum)
tkStructuredPrimaryKeyRef :: Lens' TKStructuredWithWireRep PacketRefId
tkStructuredSubkeys :: Lens' TKStructuredWithWireRep [SubkeyWithWireRefs]
tkStructuredUAts :: Lens' TKStructuredWithWireRep [UATWithWireRefs]
tkStructuredUIDs :: Lens' TKStructuredWithWireRep [UIDWithWireRefs]
tkStructuredWireRepRange :: Lens' TKStructuredWithWireRep (Maybe ByteRange)
tkStructuredWireRepRefs :: Lens' TKStructuredWithWireRep WireRepRefs

module Codec.Encryption.OpenPGP.Ontology
isCertRevocationSig :: SignaturePayload -> Bool
isRevokerP :: SignaturePayload -> Bool
isPKBindingSig :: SignaturePayload -> Bool
isSKBindingSig :: SignaturePayload -> Bool
isSubkeyBindingSig :: SignaturePayload -> Bool
isSubkeyRevocation :: SignaturePayload -> Bool
isTrustPkt :: Pkt -> Bool
isCT :: SigSubPacket -> Bool
isIssuerSSP :: SigSubPacket -> Bool
isIssuerFPSSP :: SigSubPacket -> Bool
isKET :: SigSubPacket -> Bool
isKUF :: SigSubPacket -> Bool
isPHA :: SigSubPacket -> Bool
isRevocationKeySSP :: SigSubPacket -> Bool
isSigCreationTime :: SigSubPacket -> Bool

module Codec.Encryption.OpenPGP.SignatureQualities
sigType :: SignaturePayload -> Maybe SigType
sigPKA :: SignaturePayload -> Maybe PubKeyAlgorithm
sigHA :: SignaturePayload -> Maybe HashAlgorithm
sigCT :: SignaturePayload -> Maybe ThirtyTwoBitTimeStamp
signatureSubpacketListsKnown :: SignaturePayload -> Maybe ([SigSubPacket], [SigSubPacket])
signatureHashedSubpacketsKnown :: SignaturePayload -> Maybe [SigSubPacket]

module Codec.Encryption.OpenPGP.Policy
data OpenPGPRFC
RFC2440 :: OpenPGPRFC
RFC4880 :: OpenPGPRFC
RFC9580 :: OpenPGPRFC
data OpenPGPRFCW (rfc :: OpenPGPRFC)
[RFC2440W] :: OpenPGPRFCW 'RFC2440
[RFC4880W] :: OpenPGPRFCW 'RFC4880
[RFC9580W] :: OpenPGPRFCW 'RFC9580
data SomeOpenPGPRFCW
[SomeOpenPGPRFCW] :: forall (rfc :: OpenPGPRFC). OpenPGPRFCW rfc -> SomeOpenPGPRFCW
promoteOpenPGPRFC :: OpenPGPRFC -> SomeOpenPGPRFCW
demoteOpenPGPRFCW :: forall (rfc :: OpenPGPRFC). OpenPGPRFCW rfc -> OpenPGPRFC
data HashAlgorithmW (h :: HashAlgorithm)
[DeprecatedMD5W] :: HashAlgorithmW 'DeprecatedMD5
[SHA1W] :: HashAlgorithmW 'SHA1
[RIPEMD160W] :: HashAlgorithmW 'RIPEMD160
[SHA256W] :: HashAlgorithmW 'SHA256
[SHA384W] :: HashAlgorithmW 'SHA384
[SHA512W] :: HashAlgorithmW 'SHA512
[SHA224W] :: HashAlgorithmW 'SHA224
[SHA3_256W] :: HashAlgorithmW 'SHA3_256
[SHA3_512W] :: HashAlgorithmW 'SHA3_512
data SomeHashAlgorithmW
[SomeHashAlgorithmW] :: forall (h :: HashAlgorithm). HashAlgorithmW h -> SomeHashAlgorithmW
promoteHashAlgorithm :: HashAlgorithm -> Maybe SomeHashAlgorithmW
demoteHashAlgorithmW :: forall (h :: HashAlgorithm). HashAlgorithmW h -> HashAlgorithm
data HashAlgoStatus
HashAllowed :: HashAlgoStatus
HashShouldNot :: HashAlgoStatus
HashMustNot :: HashAlgoStatus
type family HashAlgoStatusFor (rfc :: OpenPGPRFC) (h :: HashAlgorithm) :: HashAlgoStatus
type HashAlgoAllowedFor (rfc :: OpenPGPRFC) (h :: HashAlgorithm) = AssertHashAllowed HashAlgoStatusFor rfc h
type HashAlgoVerifiableFor (rfc :: OpenPGPRFC) (h :: HashAlgorithm) = AssertHashVerifiable HashAlgoStatusFor rfc h
data PKESKVersionPolicy
PreferV6 :: PKESKVersionPolicy
ForceV3Interop :: PKESKVersionPolicy
data MessageEncryptionPolicy
MessageEncryptionPolicy :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Int -> Int -> (Salt -> S2K) -> [SymmetricAlgorithm] -> MessageEncryptionPolicy
[messageDefaultSymmetricAlgorithm] :: MessageEncryptionPolicy -> SymmetricAlgorithm
[messageDefaultAEADAlgorithm] :: MessageEncryptionPolicy -> AEADAlgorithm
[messageDefaultChunkSize] :: MessageEncryptionPolicy -> Word8
[messageS2KSaltOctets] :: MessageEncryptionPolicy -> Int
[messageSEIPDv2SaltOctets] :: MessageEncryptionPolicy -> Int
[messageDefaultS2KForSalt] :: MessageEncryptionPolicy -> Salt -> S2K
[messageSEIPDv2SymmetricAlgorithms] :: MessageEncryptionPolicy -> [SymmetricAlgorithm]
data SecretKeyProtectionPolicy
SecretKeyProtectionPolicy :: SymmetricAlgorithm -> AEADAlgorithm -> (Salt -> S2K) -> Int -> Int -> SecretKeyProtectionPolicy
[secretKeyDefaultSymmetricAlgorithm] :: SecretKeyProtectionPolicy -> SymmetricAlgorithm
[secretKeyDefaultAEADAlgorithm] :: SecretKeyProtectionPolicy -> AEADAlgorithm
[secretKeyDefaultS2KForSalt] :: SecretKeyProtectionPolicy -> Salt -> S2K
[secretKeyS2KSaltOctets] :: SecretKeyProtectionPolicy -> Int
[secretKeyAEADNonceOctets] :: SecretKeyProtectionPolicy -> Int
data GenerationDeprecationPolicy
GenerationDeprecationPolicy :: [HashAlgorithm] -> [SymmetricAlgorithm] -> GenerationDeprecationPolicy
[deprecatedHashAlgorithms] :: GenerationDeprecationPolicy -> [HashAlgorithm]
[deprecatedSymmetricAlgorithms] :: GenerationDeprecationPolicy -> [SymmetricAlgorithm]
data VerificationDefaults
VerificationDefaults :: Bool -> Bool -> VerificationDefaults
[verificationDefaultStrict] :: VerificationDefaults -> Bool
[verificationDefaultStreaming] :: VerificationDefaults -> Bool

-- | Per-message decrypt-side enforcement policy.
--   
--   <a>defaultDecryptPolicy</a> applies RFC9580-strict rules: no
--   unauthenticated (SED) ciphertext, modern symmetric algorithms only,
--   and rejection of deprecated S2K specifiers in SKESK. Use
--   <a>lenientDecryptPolicy</a> when interoperating with older RFC4880 or
--   RFC2440 messages.
data DecryptPolicy
DecryptPolicy :: Bool -> Bool -> Maybe [SymmetricAlgorithm] -> Maybe [AEADAlgorithm] -> Bool -> Bool -> Bool -> DecryptPolicy

-- | When <a>False</a> (RFC9580 default), receiving a Symmetrically
--   Encrypted Data packet (SED, tag 9) is a hard error. RFC9580 §5.9 says
--   implementations SHOULD reject unauthenticated ciphertext.
[decryptAllowSEDNoIntegrity] :: DecryptPolicy -> Bool

-- | When <a>False</a>, receiving a SEIPDv1 (MDC-protected) packet is
--   rejected. Defaults to <a>True</a> for interoperability with RFC4880
--   senders.
[decryptAllowSEIPDv1] :: DecryptPolicy -> Bool

-- | Allowed symmetric algorithms for session keys. <a>Nothing</a> means
--   unrestricted. The RFC9580 default restricts to AES-128<i>192</i>256.
[decryptAllowedSymmetricAlgos] :: DecryptPolicy -> Maybe [SymmetricAlgorithm]

-- | Allowed AEAD algorithms for SEIPDv2 payloads. <a>Nothing</a> means
--   unrestricted. The RFC9580 default allows EAX, OCB, and GCM.
[decryptAllowedAEADAlgos] :: DecryptPolicy -> Maybe [AEADAlgorithm]

-- | When <a>True</a> (RFC9580 default), reject SKESK packets that use
--   Simple or Salted S2K specifiers (both deprecated since RFC9580).
[decryptRejectDeprecatedSKESK] :: DecryptPolicy -> Bool

-- | When <a>True</a> (RFC9580 default), any packet received after the
--   message-integrity boundary (MDC for SEIPDv1, final AEAD tag for
--   SEIPDv2, or the outer encrypted-data packet for SED) is a hard error.
--   RFC9580 §5.13.2 requires that implementations detect and reject data
--   appended after the authenticated payload. Set to <a>False</a> only
--   when interoperating with legacy implementations that emit trailing
--   garbage (implies <a>lenientDecryptPolicy</a>).
[decryptRejectTrailingData] :: DecryptPolicy -> Bool

-- | When <a>True</a> (RFC9580 default), a payload with no version-aligned
--   ESK is a hard error even when misaligned ESKs are present. This is a
--   distinct concern from trailing-data rejection: a message could have
--   correct framing yet still carry only v6 PKESKs before a SEIPDv1
--   payload (or only v4 SKESKs before a SEIPDv2 payload), which indicates
--   a mis-assembled message rather than an integrity violation. Set to
--   <a>False</a> only when salvaging malformed legacy messages.
[decryptRejectESKVersionMismatch] :: DecryptPolicy -> Bool
data OpenPGPPolicy
OpenPGPPolicy :: OpenPGPRFC -> MessageEncryptionPolicy -> Maybe SecretKeyProtectionPolicy -> GenerationDeprecationPolicy -> DecryptPolicy -> OpenPGPPolicy
[policyRFC] :: OpenPGPPolicy -> OpenPGPRFC
[policyMessageEncryption] :: OpenPGPPolicy -> MessageEncryptionPolicy
[policySecretKeyProtection] :: OpenPGPPolicy -> Maybe SecretKeyProtectionPolicy
[policyGenerationDeprecations] :: OpenPGPPolicy -> GenerationDeprecationPolicy
[policyDecrypt] :: OpenPGPPolicy -> DecryptPolicy
policyForRFC :: OpenPGPRFC -> OpenPGPPolicy
defaultPolicy :: OpenPGPPolicy
defaultPKESKVersionPolicy :: PKESKVersionPolicy
defaultVerificationDefaults :: VerificationDefaults

-- | RFC9580-strict decrypt policy. Rejects unauthenticated SED ciphertext,
--   restricts session-key symmetric algorithms to AES-128<i>192</i>256 and
--   AEAD to EAX<i>OCB</i>GCM, and rejects SKESK packets carrying
--   deprecated Simple or Salted S2K specifiers. SEIPDv1 (MDC-protected) is
--   still accepted for interoperability with RFC4880 senders.
defaultDecryptPolicy :: DecryptPolicy

-- | Permissive decrypt policy for interoperability with RFC4880 and
--   RFC2440 messages. No algorithm or integrity restrictions are applied.
lenientDecryptPolicy :: DecryptPolicy
supportsSEIPDv2Symmetric :: OpenPGPPolicy -> SymmetricAlgorithm -> Bool
secretKeyProtectionPolicyForKeyVersion :: OpenPGPPolicy -> KeyVersion -> Maybe SecretKeyProtectionPolicy
signatureV6SaltSizeForHashAlgorithm :: HashAlgorithm -> Maybe Word8
ecdhKdfHashDigest :: HashAlgorithm -> ByteString -> Either String ByteString
validateTable30PolicyForRecipient :: SomePKPayload -> HashAlgorithm -> SymmetricAlgorithm -> Either String ()
legacySecretKeyProtectionErrorMessage :: String

-- | RFC9580 §3.2: Primary key can only have KeyRevocationSig or
--   SignatureDirectlyOnAKey
isAllowedPrimaryKeySig :: SignaturePayload -> Bool

-- | RFC9580 §3.3: Subkey can only have SubkeyBindingSig or
--   SubkeyRevocationSig
isAllowedSubkeySig :: SignaturePayload -> Bool

-- | RFC9580 §3.4: User ID can only have various certification types or
--   CertRevocationSig
isAllowedUIDSig :: SignaturePayload -> Bool

-- | Test if a SigType is allowed on a primary key
isAllowedPrimaryKeySigType :: SigType -> Bool

-- | Test if a SigType is allowed on a subkey
isAllowedSubkeySigType :: SigType -> Bool

-- | Test if a SigType is allowed on a User ID
isAllowedUIDSigType :: SigType -> Bool
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Policy.DecryptPolicy
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Policy.OpenPGPRFC
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Policy.PKESKVersionPolicy
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Policy.DecryptPolicy
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Policy.OpenPGPRFC
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Policy.PKESKVersionPolicy

module Codec.Encryption.OpenPGP.Subpackets

-- | A subpacket that has passed basic safety checks (does not guarantee
--   it's critical-safe; use CriticalSubpacket for that)
data SafeSubpacket

-- | Create a safe subpacket from a payload and criticality flag Basic
--   validation that the payload is well-formed
mkSafeSubpacket :: Bool -> SigSubPacketPayload -> Either String SafeSubpacket

-- | Extract the payload from a safe subpacket
safePayload :: SafeSubpacket -> SigSubPacketPayload

-- | Extract the underlying SigSubPacket from a safe subpacket
safeSubpacket :: SafeSubpacket -> SigSubPacket

-- | A subpacket that is guaranteed to be both well-formed AND can be
--   safely marked critical Used to prevent accidentally marking
--   non-critical-safe types as critical
data CriticalSubpacket

-- | Create a critical subpacket only if the payload type allows it RFC9580
--   section 5.2.3.5: only certain subpacket types can be marked critical
mkCritical :: SigSubPacketPayload -> Either String CriticalSubpacket

-- | RFC9580 §5.2.3.5 lists which subpacket types can be marked critical
canBeCritical :: SigSubPacketPayload -> Bool

-- | Controls how text payload is normalized for CanonicalTextSig.
--   
--   RFC 9580 §5.2.1.2 requires only CRLF normalization for type 0x01
--   signatures. Trailing-whitespace stripping is only mandated by §7
--   (Cleartext Signature Framework). Use <a>CleartextCompat</a> for
--   GnuPG-compatible behaviour when producing cleartext-armored
--   signatures; use <a>RFC9580Strict</a> for inline text signatures.
data TextNormalizationMode

-- | CRLF normalization only; no trailing-whitespace stripping. Correct for
--   inline type 0x01 document signatures.
RFC9580Strict :: TextNormalizationMode

-- | CRLF normalization *plus* per-line trailing-whitespace stripping.
--   Required by the Cleartext Signature Framework (RFC 9580 §7).
CleartextCompat :: TextNormalizationMode

-- | Staged signature builder that enforces completion order
--   
--   Usage pattern: builder &lt;- sigBuilderInit SigTypeBinary RSA SHA256
--   builder' &lt;- addHashedSubs hashedList builder finalPayload &lt;-
--   buildSigV4 sigMPIs (addUnhashedSubs unhashedList builder')
data SigBuilder hashedness v (algo :: PubKeyAlgorithm)

-- | Legal subpackets encoded by placement and signature-version
--   constraints. This expands compile-time legality beyond bare
--   hashed/unhashed staging.
data LegalSubpacket h v
[LegalSigCreationTime] :: forall v. ThirtyTwoBitTimeStamp -> LegalSubpacket Hashed v
[LegalIssuerFingerprintV4] :: Fingerprint -> LegalSubpacket Hashed V4Sig
[LegalIssuerFingerprintV6] :: Fingerprint -> LegalSubpacket Hashed V6Sig
[LegalIssuerV4] :: EightOctetKeyId -> LegalSubpacket Unhashed V4Sig
legalSubpacket :: LegalSubpacket h v -> SigSubPacket
singleLegalSub :: LegalSubpacket h v -> SubpacketList h v
consLegalSub :: LegalSubpacket h v -> SubpacketList h v -> SubpacketList h v
listToLegalSubs :: [LegalSubpacket h v] -> SubpacketList h v
sbSigType :: SigBuilder hashedness v algo -> SigType
sbPubKeyAlgo :: forall hashedness v (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => SigBuilder hashedness v algo -> PubKeyAlgorithm
sbHashAlgo :: SigBuilder hashedness v algo -> HashAlgorithm
sbHashedSubs :: SigBuilder hashedness v algo -> [SigSubPacket]
sbUnhashedSubs :: SigBuilder hashedness v algo -> [SigSubPacket]
sbSalt :: SigBuilder hashedness v algo -> BuilderSalt v

-- | Normalization mode for CanonicalTextSig payloads. Defaults to
--   <a>CleartextCompat</a> for backward compatibility.
sbTextNormMode :: SigBuilder hashedness v algo -> TextNormalizationMode

-- | Build a v4 signature from a completed builder and MPI values
buildSigV4 :: forall (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => SigBuilder Unhashed V4Sig algo -> Word16 -> NonEmpty MPI -> SignaturePayload

-- | Build a v6 signature from a completed builder and MPI values
buildSigV6 :: forall (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => SigBuilder Unhashed V6Sig algo -> Word16 -> NonEmpty MPI -> SignaturePayload

-- | Initialize a builder for a v4 signature Starts with no subpackets and
--   must call addHashedSubs and addUnhashedSubs
sigBuilderInit :: forall (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => SigType -> HashAlgorithm -> SigBuilder Hashed V4Sig algo

-- | Initialize a builder for a v4 signature with compile-time RFC/hash
--   policy enforcement.
sigBuilderInitTyped :: forall (algo :: PubKeyAlgorithm) (rfc :: OpenPGPRFC) (h :: HashAlgorithm). (KnownPubKeyAlgorithm algo, HashAlgoAllowedFor rfc h) => OpenPGPRFCW rfc -> SigType -> HashAlgorithmW h -> SigBuilder Hashed V4Sig algo

-- | Initialize a v4 builder from runtime RFC/hash inputs with policy
--   validation and witness promotion at the API boundary.
sigBuilderInitRuntime :: forall (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => OpenPGPRFC -> SigType -> HashAlgorithm -> Either String (SigBuilder Hashed V4Sig algo)

-- | Initialize a builder for a v6 signature
sigBuilderInitV6 :: forall (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => SigType -> HashAlgorithm -> SignatureSalt -> SigBuilder Hashed V6Sig algo

-- | Initialize a builder for a v6 signature with compile-time RFC/hash
--   policy enforcement.
sigBuilderInitV6Typed :: forall (algo :: PubKeyAlgorithm) (rfc :: OpenPGPRFC) (h :: HashAlgorithm). (KnownPubKeyAlgorithm algo, HashAlgoAllowedFor rfc h) => OpenPGPRFCW rfc -> SigType -> HashAlgorithmW h -> SignatureSalt -> SigBuilder Hashed V6Sig algo

-- | Initialize a v6 builder from runtime RFC/hash inputs with policy
--   validation and witness promotion at the API boundary.
sigBuilderInitV6Runtime :: forall (algo :: PubKeyAlgorithm). KnownPubKeyAlgorithm algo => OpenPGPRFC -> SigType -> HashAlgorithm -> SignatureSalt -> Either String (SigBuilder Hashed V6Sig algo)

-- | Add hashed subpackets to a builder Must be called before
--   addUnhashedSubs
addHashedSubs :: forall v (algo :: PubKeyAlgorithm). HashedSubpackets v -> SigBuilder Hashed v algo -> SigBuilder Unhashed v algo

-- | Add unhashed subpackets to a builder Must be called after
--   addHashedSubs
addUnhashedSubs :: forall v (algo :: PubKeyAlgorithm). UnhashedSubpackets v -> SigBuilder Unhashed v algo -> SigBuilder Unhashed v algo
class KnownPubKeyAlgorithm (algo :: PubKeyAlgorithm)
demotePubKeyAlgorithmT :: KnownPubKeyAlgorithm algo => Proxy algo -> PubKeyAlgorithm

-- | Wrapper GADT for algorithm-specific private keys Encodes the algorithm
--   at the type level to ensure type-safe key/builder matching
data PrivateKeyFor (algo :: PubKeyAlgorithm)
[RSAPrivateKey] :: PrivateKey -> PrivateKeyFor 'RSA
[Ed25519PrivateKey] :: SecretKey -> PrivateKeyFor 'Ed25519
[Ed448PrivateKey] :: SecretKey -> PrivateKeyFor 'Ed448
[DSAPrivateKey] :: PrivateKey -> PrivateKeyFor 'DSA
[ECDSAPrivateKey] :: PrivateKey -> PrivateKeyFor 'ECDSA

-- | Type alias for readability: hashed subpacket list
type HashedSubpackets v = SubpacketList Hashed v

-- | Type alias for readability: unhashed subpacket list
type UnhashedSubpackets v = SubpacketList Unhashed v

-- | Prepend a subpacket to a hashed subpacket list
consHashedSub :: SigSubPacket -> HashedSubpackets v -> HashedSubpackets v

-- | Construct a single hashed subpacket into a hashed subpacket list
singleHashedSub :: SigSubPacket -> HashedSubpackets v

-- | Construct a single unhashed subpacket into an unhashed subpacket list
singleUnhashedSub :: SigSubPacket -> UnhashedSubpackets v

-- | Convert a list to a hashed subpacket list Used to bridge between
--   list-based and phantom-typed APIs
listToHashedSubs :: [SigSubPacket] -> HashedSubpackets v

-- | Convert a list to an unhashed subpacket list Used to bridge between
--   list-based and phantom-typed APIs
listToUnhashedSubs :: [SigSubPacket] -> UnhashedSubpackets v
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Subpackets.CriticalSubpacket
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Subpackets.SafeSubpacket
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Subpackets.TextNormalizationMode
instance Codec.Encryption.OpenPGP.Subpackets.KnownPubKeyAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.DSA
instance Codec.Encryption.OpenPGP.Subpackets.KnownPubKeyAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.ECDSA
instance Codec.Encryption.OpenPGP.Subpackets.KnownPubKeyAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.Ed25519
instance Codec.Encryption.OpenPGP.Subpackets.KnownPubKeyAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.Ed448
instance Codec.Encryption.OpenPGP.Subpackets.KnownPubKeyAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.EdDSA
instance Codec.Encryption.OpenPGP.Subpackets.KnownPubKeyAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.RSA
instance GHC.Classes.Ord Codec.Encryption.OpenPGP.Subpackets.CriticalSubpacket
instance GHC.Classes.Ord Codec.Encryption.OpenPGP.Subpackets.SafeSubpacket
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Subpackets.CriticalSubpacket
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Subpackets.SafeSubpacket
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Subpackets.TextNormalizationMode

module Codec.Encryption.OpenPGP.KeySelection
parseEightOctetKeyId :: Text -> Either String EightOctetKeyId
parseFingerprint :: Text -> Either String Fingerprint

module Codec.Encryption.OpenPGP.KeyInfo
pubkeySize :: PKey -> Either String Int
pkalgoAbbrev :: PubKeyAlgorithm -> String

module Codec.Encryption.OpenPGP.Serialize
putPkt :: Pkt -> Put

-- | Serialize a packet with explicit validation and error handling.
--   Validates constraints before calling putPkt to ensure errors are
--   caught early.
putPktEither :: Pkt -> Either String Put
putSKAddendum :: SKAddendum -> Either String Put
getSecretKey :: SomePKPayload -> Get SKey
putSKeyForPKPayload :: SomePKPayload -> SKey -> Either String Put
dearmorIfAsciiArmored :: ByteString -> Either String (Bool, ByteString)
dearmorIfAsciiArmoredLenient :: ByteString -> Either String (Bool, ByteString)
looksLikeAsciiArmor :: ByteString -> Bool
armorPayloadsOfType :: ArmorType -> [Armor] -> [ByteString]
singleArmorPayloadOfType :: ArmorType -> [Armor] -> Either String ByteString
singleClearSignedBlock :: [Armor] -> Either String ([(String, String)], ByteString, ByteString)
recommendedArmorType :: [Pkt] -> Maybe ArmorType
data WireRepInput
WireRepInput :: WireRepRef -> ByteString -> WireRepInput
[wireRepInputRef] :: WireRepInput -> WireRepRef
[wireRepInputPayload] :: WireRepInput -> ByteString
wireRepRefFromInput :: Maybe Text -> ByteString -> Either String WireRepInput
data PktParseError
PktParseError :: Int64 -> String -> PktParseError
[pktParseErrorOffset] :: PktParseError -> Int64
[pktParseErrorMessage] :: PktParseError -> String

-- | Parse the packets from a ByteString, with no error reporting
parsePkts :: ByteString -> [Pkt]

-- | Parse packets from a ByteString and report the first parse failure.
parsePktsEither :: ByteString -> Either PktParseError [Pkt]

-- | Parse packets from a source bytestream, preserving packet provenance.
parsePktsWithWireRep :: WireRepRef -> ByteString -> [PktWithWireRep]
conduitParsePktsWithWireRep :: forall (m :: Type -> Type). Monad m => Maybe Text -> ConduitT ByteString PktWithWireRep m ()
instance Data.Binary.Class.Binary a => Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.Base.Block a)
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.CompressedData
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.CompressionAlgorithm
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.HashAlgorithm
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.LiteralData
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.MPI
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.Marker
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.ModificationDetectionCode
instance Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.PacketClass.OnePassSignature 'Codec.Encryption.OpenPGP.Types.Internal.Pkt.OPSV3)
instance Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.PacketClass.OnePassSignature 'Codec.Encryption.OpenPGP.Types.Internal.Pkt.OPSV6)
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.OtherPacket
instance Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.PacketClass.PKESK 'Codec.Encryption.OpenPGP.Types.Internal.Pkt.PKESKV3)
instance Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.PacketClass.PKESK 'Codec.Encryption.OpenPGP.Types.Internal.Pkt.PKESKV6)
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Pkt.Pkt
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.PubKeyAlgorithm
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.PublicKey
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.PublicSubkey
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.S2K
instance Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.PacketClass.SKESK 'Codec.Encryption.OpenPGP.Types.Internal.Pkt.SKESKV4)
instance Data.Binary.Class.Binary (Codec.Encryption.OpenPGP.Types.Internal.PacketClass.SKESK 'Codec.Encryption.OpenPGP.Types.Internal.Pkt.SKESKV6)
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.SecretKey
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.SecretSubkey
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.SigSubPacket
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.SigType
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.Signature
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.SignaturePayload
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PKITypes.SomePKPayload
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.SymEncData
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.SymEncIntegrityProtectedData
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.SymmetricAlgorithm
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.TK.TKUnknown
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.Trust
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.Base.UserAttrSubPacket
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.UserAttribute
instance Data.Binary.Class.Binary Codec.Encryption.OpenPGP.Types.Internal.PacketClass.UserId
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Serialize.PktParseError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Serialize.PktParseError

module Codec.Encryption.OpenPGP.Fingerprint
eightOctetKeyID :: SomePKPayload -> Either String EightOctetKeyId
fingerprint :: SomePKPayload -> Fingerprint

module Codec.Encryption.OpenPGP.Expirations
data KeyState
KeyState :: Bool -> Bool -> Bool -> Maybe UTCTime -> KeyState
[keyStateValid] :: KeyState -> Bool
[keyStateSelfSignaturesKnown] :: KeyState -> Bool
[keyStateHasEffectiveSelfSignature] :: KeyState -> Bool
[keyStateExpirationTime] :: KeyState -> Maybe UTCTime
keyStateAt :: UTCTime -> TKUnknown -> KeyState
effectiveKeyPreferencesAt :: UTCTime -> TKUnknown -> Maybe [SigSubPacketPayload]
effectiveUIDPreferencesAt :: UTCTime -> Text -> TKUnknown -> Maybe [SigSubPacketPayload]
effectiveKeyPreferencesAtTimestamp :: ThirtyTwoBitTimeStamp -> TKUnknown -> Maybe [SigSubPacketPayload]
effectiveUIDPreferencesAtTimestamp :: ThirtyTwoBitTimeStamp -> Text -> TKUnknown -> Maybe [SigSubPacketPayload]
isTKTimeValid :: UTCTime -> TKUnknown -> Bool
isPKTimeValidWithSelfSignatures :: UTCTime -> SomePKPayload -> [SignaturePayload] -> Bool
getKeyExpirationTimesFromSignature :: SignaturePayload -> [ThirtyTwoBitDuration]
isCertificationSig :: SignaturePayload -> Bool
signatureCreationTime :: SignaturePayload -> Maybe UTCTime
signatureExpirationTime :: SignaturePayload -> Maybe UTCTime
signatureExpirationDuration :: SignaturePayload -> Maybe ThirtyTwoBitDuration
firstSignatureExpirationDuration :: [SigSubPacket] -> Maybe ThirtyTwoBitDuration
signatureEffectiveAt :: UTCTime -> SignaturePayload -> Bool
addDurationToTime :: UTCTime -> ThirtyTwoBitDuration -> UTCTime
newestByCreationTime :: [(UTCTime, a)] -> Maybe (UTCTime, a)
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Expirations.KeyState
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Expirations.KeyState

module Codec.Encryption.OpenPGP.Compression

-- | Errors that can arise during decompression of an OpenPGP Compressed
--   Data packet. Note that corrupt stream exceptions from the underlying
--   zlib/bzip2 library are not captured here; they propagate as
--   <tt>IOException</tt> through the call stack.
data CompressionError

-- | The compressed payload bytes are empty; nothing to decompress.
EmptyCompressedPayload :: CompressionAlgorithm -> CompressionError

-- | Decompression succeeded but the binary parse of the inner packet
--   sequence failed.
InnerPacketParseFailed :: CompressionAlgorithm -> String -> CompressionError

-- | Decompression and parse succeeded but produced no packets at all
--   (zero-length uncompressed payload).
ZeroLengthDecompressedPayload :: CompressionAlgorithm -> CompressionError

-- | The decompressed content contains only Marker packets (RFC4880 §5.8
--   marker packets carry no semantic content).
MarkerOnlyPayload :: CompressionAlgorithm -> CompressionError
renderCompressionError :: CompressionError -> String

-- | Decompress an OpenPGP Compressed Data packet, classifying structural
--   failures as <a>CompressionError</a>. Non-Compressed-Data packets are
--   returned unchanged in <tt>Right [p]</tt>. Corrupt compressed streams
--   may still throw <tt>IOException</tt> from the underlying decompression
--   library.
decompressPkt :: Pkt -> Either CompressionError [Pkt]
compressPkts :: CompressionAlgorithm -> [Pkt] -> Pkt
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Compression.CompressionError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Compression.CompressionError

module Codec.Encryption.OpenPGP.S2K
data EncodedSessionKeyError
EncodedSessionKeyTooShort :: EncodedSessionKeyError
EncodedSessionKeyUnsupportedAlgorithm :: SymmetricAlgorithm -> EncodedSessionKeyError
EncodedSessionKeyLengthMismatch :: SymmetricAlgorithm -> Int -> Int -> EncodedSessionKeyError
EncodedSessionKeyChecksumMismatch :: EncodedSessionKeyError
renderEncodedSessionKeyError :: EncodedSessionKeyError -> String

-- | Errors that can arise during string-to-key derivation.
data S2KError

-- | The symmetric algorithm used in the SKESK is not supported.
S2KUnsupportedAlgorithm :: CipherError -> S2KError

-- | An unsupported or unknown S2K specifier type was encountered.
S2KUnsupportedSpecifier :: Word8 -> S2KError

-- | An unsupported SKESK shape (e.g. non-zero ESK).
S2KUnsupportedSKESKShape :: String -> S2KError

-- | A required hash algorithm is not supported for S2K.
S2KUnsupportedHashAlgorithm :: HashAlgorithm -> S2KError

-- | The Argon2 S2K parameters are invalid.
S2KArgon2ParamError :: String -> S2KError

-- | The Argon2 KDF itself failed.
S2KArgon2Failed :: String -> S2KError

-- | Decrypting an embedded encrypted session key failed.
S2KEncryptedSessionKeyCipherError :: CipherError -> S2KError

-- | Embedded encrypted session key material was malformed.
S2KEncryptedSessionKeyDecodeError :: EncodedSessionKeyError -> S2KError
renderS2KError :: S2KError -> String
decodeOpenPGPEncodedSessionKey :: ByteString -> Either EncodedSessionKeyError (SymmetricAlgorithm, ByteString)
string2Key :: S2K -> Int -> ByteString -> Either S2KError ByteString
skesk2Key :: SKESK 'SKESKV4 -> ByteString -> Either S2KError ByteString
skesk2SessionKey :: SKESK 'SKESKV4 -> ByteString -> Either S2KError (SymmetricAlgorithm, ByteString)
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.S2K.EncodedSessionKeyError
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.S2K.S2KError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.S2K.EncodedSessionKeyError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.S2K.S2KError

module Codec.Encryption.OpenPGP.CFB
decrypt :: SymmetricAlgorithm -> ByteString -> ByteString -> Either CipherError ByteString
decryptPreservingNonce :: SymmetricAlgorithm -> ByteString -> ByteString -> Either CipherError (ByteString, ByteString)
decryptNoNonce :: SymmetricAlgorithm -> IV -> ByteString -> ByteString -> Either CipherError ByteString
decryptOpenPGPCfb :: SymmetricAlgorithm -> ByteString -> ByteString -> Either CipherError ByteString
decryptOpenPGPCfbWithNonce :: SymmetricAlgorithm -> ByteString -> ByteString -> Either CipherError (ByteString, ByteString)
data OpenPGPCFBMode
OpenPGPCFBResync :: OpenPGPCFBMode
OpenPGPCFBNoResync :: OpenPGPCFBMode
data OpenPGPCFBModeW (mode :: OpenPGPCFBMode)
[OpenPGPCFBResyncW] :: OpenPGPCFBModeW 'OpenPGPCFBResync
[OpenPGPCFBNoResyncW] :: OpenPGPCFBModeW 'OpenPGPCFBNoResync
encryptNoNonce :: SymmetricAlgorithm -> S2K -> IV -> ByteString -> ByteString -> Either CipherError ByteString
encryptOpenPGPCfbRaw :: forall (mode :: OpenPGPCFBMode). OpenPGPCFBModeW mode -> SymmetricAlgorithm -> IV -> ByteString -> ByteString -> Either CipherError ByteString

-- | Compute the MDC trailer appended to SEIPDv1 plaintext before
--   encryption. The trailer is: <tt>0xd3 0x14 SHA1(nonce || plaintext ||
--   0xd3 0x14)</tt>.
mdcTrailerForSEIPDv1 :: IV -> ByteString -> ByteString

-- | The SEIPDv1 nonce: the IV bytes followed by its last two bytes (resync
--   prefix).
seipdv1NonceFromIV :: IV -> ByteString

-- | Verify the MDC trailer of a decrypted SEIPDv1 payload. Takes the CFB
--   nonce (blockSize+2 prefix bytes retained from decryption) and the full
--   decrypted bytes (payload + MDC packet), and returns the payload
--   without the MDC trailer on success.
validateSEIPD1MDC :: ByteString -> ByteString -> Either String ByteString
calculateMDC :: ByteString -> ByteString -> Maybe ByteString
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.CFB.OpenPGPCFBMode
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.CFB.OpenPGPCFBMode

module Codec.Encryption.OpenPGP.SecretKey
decryptPrivateKey :: (SomePKPayload, SKAddendum) -> ByteString -> Either String SKAddendum
reinterpretUnknownSKeyForPKPayload :: SomePKPayload -> SKey -> Either String SKey
mkUnencryptedSKAddendum :: SomePKPayload -> SKey -> Either String SKAddendum
encryptPrivateKeyWithPolicyAndSaltAndIV :: OpenPGPPolicy -> SomePKPayload -> Salt -> IV -> SKAddendum -> ByteString -> Either String SKAddendum

-- | generates pseudo-random salt and IV
encryptPrivateKey :: MonadRandom m => OpenPGPPolicy -> SomePKPayload -> SKAddendum -> ByteString -> m (Either String SKAddendum)
changePrivateKeyPassphrase :: (SomePKPayload, SKAddendum) -> ByteString -> Salt -> IV -> ByteString -> Either String SKAddendum
changePrivateKeyPassphraseRandom :: MonadRandom m => (SomePKPayload, SKAddendum) -> ByteString -> ByteString -> m (Either String SKAddendum)
changeSecretKeyPassphrase :: SecretKey -> ByteString -> Salt -> IV -> ByteString -> Either String SecretKey
changeSecretKeyPassphraseRandom :: MonadRandom m => SecretKey -> ByteString -> ByteString -> m (Either String SecretKey)
reencryptSecretKeyRandomEither :: MonadRandom m => SecretKey -> ByteString -> m (Either String SecretKey)

-- | Version-preserving re-encryption of a typed secret-key addendum.
--   
--   Each constructor family is re-encrypted in kind: * V6 variants (AEAD,
--   SHA1, Sym, Unencrypted) → SKAAEADV6 (default v6 policy) * SKA16bit /
--   SKASHA1Legacy → same S2K family with updated salt * SKAAEADLegacy →
--   re-protected as SKASHA1Legacy (standard v3/v4 S2K) * SKASymLegacy →
--   legacy CFB re-encryption as SKASymLegacy * SKAUnencryptedLegacy → Left
--   (cannot re-encrypt unencrypted legacy keys)
reencryptPrivateKeyTyped :: forall (v :: KeyVersion). SomePKPayload -> SKAddendumV v -> Salt -> IV -> SKey -> ByteString -> Either String (SKAddendumV v)

module Codec.Encryption.OpenPGP.Encrypt

-- | Typed failures surfaced by encrypt-side PKESK and SEIPD-v2 helpers.
data PKESKEncryptError
UnsupportedSessionKeyAlgorithm :: SymmetricAlgorithm -> String -> PKESKEncryptError
InvalidSessionKeyLength :: SymmetricAlgorithm -> Int -> Int -> PKESKEncryptError
InvalidRecipientIdentifier :: String -> PKESKEncryptError
UnsupportedRecipientAlgorithm :: PubKeyAlgorithm -> PKESKEncryptError
InvalidRecipientKeyMaterial :: PubKeyAlgorithm -> String -> PKESKEncryptError
RecipientKdfFailure :: PubKeyAlgorithm -> String -> PKESKEncryptError
RecipientKeyWrapFailure :: PubKeyAlgorithm -> String -> PKESKEncryptError
RecipientCapabilitySelectionFailure :: RecipientCapabilityError -> PKESKEncryptError
PayloadBuildFailure :: String -> PKESKEncryptError
NoRecipientsProvided :: PKESKEncryptError
data RecipientCapabilityNegotiationMode
RecipientCapabilityNegotiationOff :: RecipientCapabilityNegotiationMode
RecipientCapabilityNegotiationOn :: RecipientCapabilityNegotiationMode
data RecipientCapabilityError
RecipientCapabilityMissingEncryptionFlags :: SomePKPayload -> Set KeyFlag -> RecipientCapabilityError
RecipientCapabilityNoEncryptableKeyMaterialInTK :: RecipientCapabilityError
RecipientCapabilityMissingSEIPDv1Support :: [SomePKPayload] -> RecipientCapabilityError
RecipientCapabilityMissingSEIPDv2Support :: [SomePKPayload] -> RecipientCapabilityError
RecipientCapabilityNoCommonSymmetricAlgorithms :: [SymmetricAlgorithm] -> RecipientCapabilityError
RecipientCapabilityNoCommonAEADAlgorithms :: [AEADAlgorithm] -> RecipientCapabilityError
renderRecipientCapabilityError :: RecipientCapabilityError -> String
data RecipientCapabilities
RecipientCapabilities :: KeyVersion -> PubKeyAlgorithm -> Set KeyFlag -> Set FeatureFlag -> [SymmetricAlgorithm] -> [AEADAlgorithm] -> RecipientCapabilities
[recipientCapabilityKeyVersion] :: RecipientCapabilities -> KeyVersion
[recipientCapabilityPublicKeyAlgorithm] :: RecipientCapabilities -> PubKeyAlgorithm
[recipientCapabilityKeyFlags] :: RecipientCapabilities -> Set KeyFlag
[recipientCapabilityFeatures] :: RecipientCapabilities -> Set FeatureFlag
[recipientCapabilityPreferredSymmetricAlgorithms] :: RecipientCapabilities -> [SymmetricAlgorithm]
[recipientCapabilityPreferredAEADAlgorithms] :: RecipientCapabilities -> [AEADAlgorithm]

-- | Extract encrypt-relevant recipient capabilities from effective
--   self-signature subpackets.
--   
--   RFC 9580 preferred AEAD ciphersuites are currently carried through
--   <a>OtherSigSub</a> type 39 and decoded into AEAD preferences here.
recipientCapabilitiesFromSubpacketPayloads :: SomePKPayload -> [SigSubPacketPayload] -> RecipientCapabilities
recipientCapabilitySupportsEncryption :: RecipientCapabilities -> Bool
data RecipientTargetRejectionReason
RecipientTargetUnsupportedAlgorithm :: PubKeyAlgorithm -> RecipientTargetRejectionReason
RecipientTargetMissingEncryptionFlags :: SomePKPayload -> Set KeyFlag -> RecipientTargetRejectionReason
RecipientTargetRevoked :: SomePKPayload -> RecipientTargetRejectionReason
RecipientTargetNotValidAtTimestamp :: SomePKPayload -> ThirtyTwoBitTimeStamp -> RecipientTargetRejectionReason
data RecipientEncryptionTargetRejected
RecipientEncryptionTargetRejected :: SomePKPayload -> Maybe RecipientCapabilities -> RecipientTargetRejectionReason -> RecipientEncryptionTargetRejected
[recipientEncryptionTargetRejectedKey] :: RecipientEncryptionTargetRejected -> SomePKPayload
[recipientEncryptionTargetRejectedCapabilities] :: RecipientEncryptionTargetRejected -> Maybe RecipientCapabilities
[recipientEncryptionTargetRejectedReason] :: RecipientEncryptionTargetRejected -> RecipientTargetRejectionReason
data RecipientEncryptionTargetsReport
RecipientEncryptionTargetsReport :: [RecipientEncryptionTarget] -> [RecipientEncryptionTargetRejected] -> RecipientEncryptionTargetsReport
[recipientEncryptionTargetsAccepted] :: RecipientEncryptionTargetsReport -> [RecipientEncryptionTarget]
[recipientEncryptionTargetsRejected] :: RecipientEncryptionTargetsReport -> [RecipientEncryptionTargetRejected]
recipientEncryptionTargetsReportFromTKAtTimestamp :: ThirtyTwoBitTimeStamp -> TKUnknown -> RecipientEncryptionTargetsReport
recipientEncryptionTargetsReportFromTK :: TK 'PublicTK -> RecipientEncryptionTargetsReport
recipientEncryptionTargetFromTKAtTimestamp :: ThirtyTwoBitTimeStamp -> TKUnknown -> Either RecipientCapabilityError RecipientEncryptionTarget
recipientEncryptionTargetFromTKAtTimestampWithPolicy :: RecipientTargetSelectionPolicy -> ThirtyTwoBitTimeStamp -> TKUnknown -> Either RecipientCapabilityError RecipientEncryptionTarget
recipientEncryptionTargetsFromTKAtTimestamp :: ThirtyTwoBitTimeStamp -> TKUnknown -> [RecipientEncryptionTarget]
recipientEncryptionTargetFromTK :: TK 'PublicTK -> Either RecipientCapabilityError RecipientEncryptionTarget
recipientEncryptionTargetFromTKWithPolicy :: RecipientTargetSelectionPolicy -> TK 'PublicTK -> Either RecipientCapabilityError RecipientEncryptionTarget
recipientEncryptionTargetsFromTK :: TK 'PublicTK -> [RecipientEncryptionTarget]
data RecipientTargetSelectionPolicy
RecipientTargetSelectionFirstValid :: RecipientTargetSelectionPolicy
RecipientTargetSelectionPreferPrimary :: RecipientTargetSelectionPolicy
RecipientTargetSelectionPreferSubkey :: RecipientTargetSelectionPolicy
RecipientTargetSelectionPreferNewestCreationTime :: RecipientTargetSelectionPolicy
data PassphraseSKESKVersionPolicy
PassphraseSKESKPreferV6 :: PassphraseSKESKVersionPolicy
PassphraseSKESKForceV4Interop :: PassphraseSKESKVersionPolicy
data PassphraseEncryptRequest
PassphraseEncryptRequest :: PassphraseSKESKVersionPolicy -> SymmetricAlgorithm -> S2K -> ByteString -> ByteString -> Maybe IV -> Maybe AEADAlgorithm -> Maybe Word8 -> Maybe Salt -> PassphraseEncryptRequest
[passphraseEncryptVersionPolicy] :: PassphraseEncryptRequest -> PassphraseSKESKVersionPolicy
[passphraseEncryptSymmetricAlgorithm] :: PassphraseEncryptRequest -> SymmetricAlgorithm
[passphraseEncryptS2K] :: PassphraseEncryptRequest -> S2K
[passphraseEncryptPassphrase] :: PassphraseEncryptRequest -> ByteString
[passphraseEncryptPayload] :: PassphraseEncryptRequest -> ByteString
[passphraseEncryptSEIPDv1IVOverride] :: PassphraseEncryptRequest -> Maybe IV
[passphraseEncryptSEIPDv2AEADOverride] :: PassphraseEncryptRequest -> Maybe AEADAlgorithm
[passphraseEncryptSEIPDv2ChunkSizeOverride] :: PassphraseEncryptRequest -> Maybe Word8
[passphraseEncryptSEIPDv2SaltOverride] :: PassphraseEncryptRequest -> Maybe Salt
encryptPassphraseWithPolicy :: MonadRandom m => PassphraseEncryptRequest -> m (Either String [Pkt])
data PKESKVersionPolicy
PreferV6 :: PKESKVersionPolicy
ForceV3Interop :: PKESKVersionPolicy
data RecipientPKESKVersionStrategy
RecipientPreferV6 :: RecipientPKESKVersionStrategy
RecipientForceV3Interop :: RecipientPKESKVersionStrategy
data RecipientPKESKVersionStrategyW (strategy :: RecipientPKESKVersionStrategy)
[RecipientPreferV6W] :: RecipientPKESKVersionStrategyW 'RecipientPreferV6
[RecipientForceV3InteropW] :: RecipientPKESKVersionStrategyW 'RecipientForceV3Interop
data SomeRecipientPKESKVersionStrategyW
[SomeRecipientPKESKVersionStrategyW] :: forall (strategy :: RecipientPKESKVersionStrategy). RecipientPKESKVersionStrategyW strategy -> SomeRecipientPKESKVersionStrategyW
type RecipientPKESKVersionSelector = SomePKPayload -> Either PKESKEncryptError RecipientPKESKVersionStrategy
type RecipientPKESKVersionSelectorTyped = SomePKPayload -> Either PKESKEncryptError SomeRecipientPKESKVersionStrategyW
data EncryptCompatibilityProfile
EncryptStrictDefault :: EncryptCompatibilityProfile
EncryptInteropLegacy :: EncryptCompatibilityProfile
data EncryptCompatibilityProfileW (profile :: EncryptCompatibilityProfile)
[EncryptStrictDefaultW] :: EncryptCompatibilityProfileW 'EncryptStrictDefault
[EncryptInteropLegacyW] :: EncryptCompatibilityProfileW 'EncryptInteropLegacy
data SomeEncryptCompatibilityProfileW
[SomeEncryptCompatibilityProfileW] :: forall (profile :: EncryptCompatibilityProfile). EncryptCompatibilityProfileW profile -> SomeEncryptCompatibilityProfileW
data RecipientEncryptionTarget
RecipientEncryptionTarget :: SomePKPayload -> Maybe RecipientPKESKVersionStrategy -> Maybe RecipientCapabilities -> RecipientEncryptionTarget

-- | Recipient key packet selected for PKESK wrapping.
[recipientEncryptionTargetKey] :: RecipientEncryptionTarget -> SomePKPayload

-- | Optional explicit PKESK version strategy hint. When absent, profile
--   defaults and auto-detection apply.
[recipientEncryptionTargetStrategy] :: RecipientEncryptionTarget -> Maybe RecipientPKESKVersionStrategy

-- | Optional recipient capability hints used by negotiation-enabled
--   encryption to choose common symmetric/AEAD algorithms.
[recipientEncryptionTargetCapabilities] :: RecipientEncryptionTarget -> Maybe RecipientCapabilities
recipientEncryptionTarget :: SomePKPayload -> RecipientEncryptionTarget
recipientEncryptionTargetWithStrategy :: SomePKPayload -> RecipientPKESKVersionStrategy -> RecipientEncryptionTarget
recipientEncryptionTargetWithCapabilities :: SomePKPayload -> RecipientCapabilities -> RecipientEncryptionTarget
recipientEncryptionTargetWithStrategyTyped :: forall (strategy :: RecipientPKESKVersionStrategy). SomePKPayload -> RecipientPKESKVersionStrategyW strategy -> RecipientEncryptionTarget
recipientVersionStrategyForProfile :: EncryptCompatibilityProfile -> RecipientEncryptionTarget -> Either PKESKEncryptError RecipientPKESKVersionStrategy
recipientVersionStrategyForProfileTyped :: forall (profile :: EncryptCompatibilityProfile). EncryptCompatibilityProfileW profile -> RecipientEncryptionTarget -> Either PKESKEncryptError SomeRecipientPKESKVersionStrategyW
data RecipientPayloadShape
RecipientPayloadShape :: DataType -> FileName -> ThirtyTwoBitTimeStamp -> Bool -> [SignaturePayload] -> RecipientPayloadShape
[recipientPayloadDataType] :: RecipientPayloadShape -> DataType
[recipientPayloadFileName] :: RecipientPayloadShape -> FileName
[recipientPayloadTimestamp] :: RecipientPayloadShape -> ThirtyTwoBitTimeStamp
[recipientPayloadUseOnePassSignatures] :: RecipientPayloadShape -> Bool
[recipientPayloadSignatures] :: RecipientPayloadShape -> [SignaturePayload]
defaultRecipientPayloadShape :: RecipientPayloadShape
data SEIPDVersion
SEIPDv1 :: SEIPDVersion
SEIPDv2 :: SEIPDVersion
data RecipientEncryptResult
RecipientEncryptResult :: [Pkt] -> PKESKSessionMaterial -> RecipientEncryptResult
[recipientEncryptPackets] :: RecipientEncryptResult -> [Pkt]
[recipientEncryptSessionMaterial] :: RecipientEncryptResult -> PKESKSessionMaterial
data RecipientEncryptRequest (v :: SEIPDVersion)
RecipientEncryptRequest :: [RecipientEncryptionTarget] -> RecipientPayloadShape -> ByteString -> Maybe SymmetricAlgorithm -> RecipientEncryptRequestOverrides v -> RecipientEncryptRequest (v :: SEIPDVersion)

-- | Recipient encryption targets. At least one target is required.
[recipientEncryptRequestTargets] :: RecipientEncryptRequest (v :: SEIPDVersion) -> [RecipientEncryptionTarget]
[recipientEncryptRequestPayloadShape] :: RecipientEncryptRequest (v :: SEIPDVersion) -> RecipientPayloadShape
[recipientEncryptRequestPayload] :: RecipientEncryptRequest (v :: SEIPDVersion) -> ByteString

-- | Explicit symmetric algorithm override. When <a>Nothing</a>, the
--   selected mode (negotiated or legacy) determines algorithm selection.
[recipientEncryptRequestSymmetricOverride] :: RecipientEncryptRequest (v :: SEIPDVersion) -> Maybe SymmetricAlgorithm
[recipientEncryptRequestOverrides] :: RecipientEncryptRequest (v :: SEIPDVersion) -> RecipientEncryptRequestOverrides v
data RecipientEncryptRequestOverrides (v :: SEIPDVersion)
[RecipientEncryptRequestSEIPDv1Overrides] :: Maybe IV -> RecipientEncryptRequestOverrides 'SEIPDv1

-- | For SEIPDv2 requests: - when AEAD override is <a>Nothing</a>,
--   encrypt-side capability negotiation selects a common
--   recipient-supported AEAD algorithm (if enabled). - when AEAD override
--   is <a>Just</a>, the explicit AEAD wins.
[RecipientEncryptRequestSEIPDv2Overrides] :: Maybe AEADAlgorithm -> Maybe Word8 -> Maybe Salt -> RecipientEncryptRequestOverrides 'SEIPDv2

-- | Encrypt for recipient targets with capability negotiation enabled.
--   
--   By default this negotiates a common symmetric and (for SEIPDv2) AEAD
--   algorithm from recipient capabilities when available. Explicit request
--   overrides still take precedence.
encryptForRecipients :: forall m (v :: SEIPDVersion). MonadRandom m => RecipientEncryptRequest v -> m (Either PKESKEncryptError RecipientEncryptResult)

-- | Encrypt for recipient targets without recipient capability
--   negotiation.
--   
--   This preserves legacy behavior by using policy defaults unless request
--   overrides are provided.
encryptForRecipientsLegacy :: forall m (v :: SEIPDVersion). MonadRandom m => RecipientEncryptRequest v -> m (Either PKESKEncryptError RecipientEncryptResult)

-- | Encrypt for recipient targets with an explicit capability-negotiation
--   mode.
--   
--   When negotiation is on, symmetric and AEAD selection use the common
--   intersection of recipient preferences constrained by the active
--   policy. When off, policy defaults are used.
encryptForRecipientsWithCapabilityNegotiation :: forall m (v :: SEIPDVersion). MonadRandom m => RecipientCapabilityNegotiationMode -> RecipientEncryptRequest v -> m (Either PKESKEncryptError RecipientEncryptResult)

-- | Session-key bundle for PKESK/SKESK packet construction.
data PKESKV3SessionMaterial
data PKESKV6RawSessionMaterial
data PKESKSessionMaterial
pkeskSessionAlgorithm :: PKESKSessionMaterial -> SymmetricAlgorithm
pkeskSessionKey :: PKESKSessionMaterial -> SessionKey
mkPKESKSessionMaterial :: SymmetricAlgorithm -> SessionKey -> Either PKESKEncryptError PKESKSessionMaterial
mkPKESKV3SessionMaterial :: SymmetricAlgorithm -> SessionKey -> Either PKESKEncryptError PKESKV3SessionMaterial
mkPKESKV6RawSessionMaterial :: SymmetricAlgorithm -> SessionKey -> Either PKESKEncryptError PKESKV6RawSessionMaterial
pkeskV3SessionMaterial :: PKESKSessionMaterial -> PKESKV3SessionMaterial
pkeskV6RawSessionMaterial :: PKESKSessionMaterial -> PKESKV6RawSessionMaterial

-- | Encode the RFC 9580 PKESK/SKESK session-key material: one-octet
--   algorithm ID, raw session key, then 16-bit checksum.
encodeOpenPGPSessionMaterial :: SymmetricAlgorithm -> SessionKey -> Either PKESKEncryptError ByteString

-- | Generate a fresh session key and return both raw and encoded forms.
generateSessionKeyMaterial :: MonadRandom m => SymmetricAlgorithm -> m (Either PKESKEncryptError PKESKSessionMaterial)
canonicalizePKESKRecipientId :: PKESKPayload -> Either PKESKEncryptError PKESKPayload
canonicalizePKESKPacketRecipientIds :: [Pkt] -> Either PKESKEncryptError [Pkt]

-- | Build a legacy PKESKv3 payload for v4/v3 RSA recipient interop.
buildPKESKv3PayloadForRecipient :: MonadRandom m => SomePKPayload -> PKESKV3SessionMaterial -> m (Either PKESKEncryptError PKESKPayload)

-- | Build a legacy PKESKv3 packet for v4/v3 RSA recipient interop.
buildPKESKv3PktForRecipient :: MonadRandom m => SomePKPayload -> PKESKV3SessionMaterial -> m (Either PKESKEncryptError Pkt)

-- | Build a v6 PKESK payload for one recipient key according to the
--   selected version policy.
buildPKESKPayloadForRecipient :: MonadRandom m => PKESKVersionPolicy -> SomePKPayload -> PKESKSessionMaterial -> m (Either PKESKEncryptError PKESKPayload)

-- | Build a PKESK packet for one recipient key according to the selected
--   version policy.
buildPKESKPktForRecipient :: MonadRandom m => PKESKVersionPolicy -> SomePKPayload -> PKESKSessionMaterial -> m (Either PKESKEncryptError Pkt)

-- | Build PKESK packets for all recipients with a single shared session
--   key.
buildPKESKPktsForRecipientTargetsWithSelector :: MonadRandom m => (RecipientEncryptionTarget -> Either PKESKEncryptError RecipientPKESKVersionStrategy) -> [RecipientEncryptionTarget] -> PKESKSessionMaterial -> m (Either PKESKEncryptError [Pkt])
buildPKESKPktsForRecipientTargetsWithSelectorTyped :: MonadRandom m => (RecipientEncryptionTarget -> Either PKESKEncryptError SomeRecipientPKESKVersionStrategyW) -> [RecipientEncryptionTarget] -> PKESKSessionMaterial -> m (Either PKESKEncryptError [Pkt])
encryptSEIPDv2Payload :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> SessionKey -> ByteString -> Either String ByteString

-- | Encrypt a plaintext block with OpenPGP CFB + MDC to produce a SEIPDv1
--   ciphertext.
encryptSEIPDv1Payload :: SymmetricAlgorithm -> IV -> SessionKey -> ByteString -> Either String ByteString
encryptSEIPDv2WithSKESK :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> S2K -> ByteString -> ByteString -> Either String [Pkt]
encryptSEIPDv2WithSKESKBlock :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> S2K -> ByteString -> Block Pkt -> Either String [Pkt]
encryptSEIPDv2LiteralDataWithSKESK :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> S2K -> ByteString -> ByteString -> Either String [Pkt]

-- | Compose a complete AEAD-encrypted message with optional literal data
--   and signature. Returns a packet list (SKESK, SEIPD v2, optional
--   signature) ready for serialization.
--   
--   Example: <tt>composeMessageWithSEIPDv2 AES256 OCB 6 (Salt 32 bytes)
--   (SimpleS2K SHA256) passphrase payload Nothing</tt> returns <tt>[SKESK
--   v6, SEIPD v2, <a>ciphertext</a>]</tt>
--   
--   If the signature is provided, it will be included in the encrypted
--   payload.
composeMessageWithSEIPDv2 :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> S2K -> ByteString -> ByteString -> Maybe [Pkt] -> Either String [Pkt]
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.EncryptCompatibilityProfile
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.OPSBuildError
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.PKESKEncryptError
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.PKESKSessionMaterial
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.PKESKV3SessionMaterial
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.PKESKV6RawSessionMaterial
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.PassphraseEncryptRequest
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.PassphraseSKESKVersionPolicy
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientCapabilities
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientCapabilityError
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientCapabilityNegotiationMode
instance GHC.Classes.Eq (Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptRequest v)
instance GHC.Classes.Eq (Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptRequestOverrides v)
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptResult
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptionTarget
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptionTargetRejected
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptionTargetsReport
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientPKESKVersionStrategy
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientPayloadShape
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientTargetRejectionReason
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.RecipientTargetSelectionPolicy
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Encrypt.SEIPDVersion
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.EncryptCompatibilityProfile
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.OPSBuildError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.PKESKEncryptError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.PKESKSessionMaterial
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.PKESKV3SessionMaterial
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.PKESKV6RawSessionMaterial
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.PassphraseEncryptRequest
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.PassphraseSKESKVersionPolicy
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientCapabilities
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientCapabilityError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientCapabilityNegotiationMode
instance GHC.Internal.Show.Show (Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptRequest v)
instance GHC.Internal.Show.Show (Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptRequestOverrides v)
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptResult
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptionTarget
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptionTargetRejected
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientEncryptionTargetsReport
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientPKESKVersionStrategy
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientPayloadShape
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientTargetRejectionReason
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.RecipientTargetSelectionPolicy
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Encrypt.SEIPDVersion

module Data.Conduit.OpenPGP.Compression
conduitCompress :: forall (m :: Type -> Type). MonadThrow m => CompressionAlgorithm -> ConduitT Pkt Pkt m ()

-- | Decompress OpenPGP Compressed Data packets. Decompression failures,
--   empty payloads, zero-length results, and marker-only payloads are
--   reported via <a>MonadThrow</a> rather than silently dropped.
conduitDecompress :: forall (m :: Type -> Type). MonadThrow m => ConduitT Pkt Pkt m ()

module Data.Conduit.OpenPGP.Filter
conduitPktFilter :: forall (m :: Type -> Type). Monad m => FilterPredicates Void Pkt -> ConduitT Pkt Pkt m ()
conduitPktWithExtraFilter :: forall (m :: Type -> Type) r. Monad m => r -> FilterPredicates r Pkt -> ConduitT Pkt Pkt m ()
conduitTKFilter :: forall (m :: Type -> Type). Monad m => FilterPredicates Void TKUnknown -> ConduitT TKUnknown TKUnknown m ()
data FilterPredicates r a

-- | fp for transferable keys
RTKFilterPredicate :: Reader TKUnknown Bool -> FilterPredicates r a

-- | fp for context-less packets
RPFilterPredicate :: Reader Pkt Bool -> FilterPredicates r a

-- | generic filter predicate
RFilterPredicate :: Reader a Bool -> FilterPredicates r a

-- | generic filter predicate with additional context
RPairFilterPredicate :: Reader (r, a) Bool -> FilterPredicates r a

module Data.Conduit.OpenPGP.Keyring.Instances
instance Data.IxSet.Typed.Indexable Codec.Encryption.OpenPGP.Types.Internal.TK.KeyringIxs (Codec.Encryption.OpenPGP.Types.Internal.TK.TK 'Codec.Encryption.OpenPGP.Types.Internal.TK.PublicTK)
instance Data.IxSet.Typed.Indexable Codec.Encryption.OpenPGP.Types.Internal.TK.KeyringIxs (Codec.Encryption.OpenPGP.Types.Internal.TK.TK 'Codec.Encryption.OpenPGP.Types.Internal.TK.SecretTK)
instance Data.IxSet.Typed.Indexable Codec.Encryption.OpenPGP.Types.Internal.TK.KeyringIxs Codec.Encryption.OpenPGP.Types.Internal.TK.TKUnknown
instance GHC.Internal.Base.Semigroup (Codec.Encryption.OpenPGP.Types.Internal.TK.TK k)
instance GHC.Internal.Base.Semigroup Codec.Encryption.OpenPGP.Types.Internal.TK.TKUnknown
instance GHC.Internal.Base.Semigroup Codec.Encryption.OpenPGP.Types.Internal.TK.TKWithWireRep

module Data.Conduit.OpenPGP.Decrypt
conduitDecrypt :: forall (m :: Type -> Type). (MonadFail m, MonadUnliftIO m, MonadResource m, MonadThrow m) => DecryptOptions -> ConduitT Pkt Pkt m DecryptOutcome
conduitDecryptWithReport :: forall (m :: Type -> Type). (MonadFail m, MonadUnliftIO m, MonadResource m, MonadThrow m) => DecryptOptions -> ConduitT Pkt Pkt m DecryptReport

-- | Canonical decrypt configuration.
--   
--   Most callers should prefer <a>conduitDecrypt</a> and set:
--   
--   <ul>
--   <li><a>decryptOptionsKeyResolution</a> to <a>DecryptWithKeyring</a> or
--   <a>DecryptWithKeyringAndPassphrase</a></li>
--   <li><a>decryptOptionsPolicy</a> to strict
--   (<a>defaultDecryptPolicy</a>) or lenient</li>
--   <li><a>decryptOptionsPassphraseCallback</a> for SKESK passphrase
--   lookup</li>
--   </ul>
data DecryptOptions
DecryptOptions :: DecryptKeyResolution -> DecryptPolicy -> InputCallback IO -> DecryptOptions
[decryptOptionsKeyResolution] :: DecryptOptions -> DecryptKeyResolution
[decryptOptionsPolicy] :: DecryptOptions -> DecryptPolicy
[decryptOptionsPassphraseCallback] :: DecryptOptions -> InputCallback IO

-- | Build a stateful <a>PKESKResolver</a> that iterates over a
--   pre-populated candidate list. The returned resolver yields candidates
--   in order and returns <a>ResolveExhausted</a> once the list is
--   depleted. | How to resolve secret keys for PKESK-encrypted messages.
data DecryptKeyResolution

-- | Do not attempt PKESK decryption; fall through to manual session-key
--   input via the passphrase callback instead.
DecryptWithoutPKESK :: DecryptKeyResolution

-- | Resolve secret keys from a <a>SecretKeyring</a>. Only unencrypted
--   secret keys (not passphrase-protected) are used. For
--   passphrase-protected keys, use <a>DecryptWithKeyringAndPassphrase</a>.
DecryptWithKeyring :: SecretKeyring -> DecryptKeyResolution

-- | Resolve secret keys from a <a>SecretKeyring</a>, unlocking passphrase-
--   protected keys using the provided callback. The callback receives the
--   public key payload and returns the passphrase, or <a>Nothing</a> to
--   skip.
DecryptWithKeyringAndPassphrase :: SecretKeyring -> (SomePKPayload -> IO (Maybe ByteString)) -> DecryptKeyResolution

-- | Preferred callback form for non-keyring key material. The callback
--   receives a typed key identifier (8-octet key ID, fingerprint, or
--   wildcard) plus the packet public-key algorithm, then returns all
--   matching candidates in priority order. hOpenPGP iterates candidates
--   deterministically without re-calling the callback for each retry.
DecryptWithUnwrapCandidatesCallback :: (KeyIdentifier -> PubKeyAlgorithm -> IO [PKESKRecipientKey]) -> DecryptKeyResolution
data PKESKRecipientKey
PKESKRecipientKey :: Maybe SomePKPayload -> SKey -> PKESKRecipientKey

-- | Public key payload for the recipient. Required for X25519, X448, and
--   ECDH unwrap paths; may be <a>Nothing</a> for RSA.
[pkeskRecipientPKPayload] :: PKESKRecipientKey -> Maybe SomePKPayload

-- | Corresponding secret key.
[pkeskRecipientSKey] :: PKESKRecipientKey -> SKey
data PKESKAttemptFailureKind
PKESKAttemptUnwrapFailed :: PKESKAttemptFailureKind
PKESKAttemptSessionMaterialDecodeFailed :: PKESKAttemptFailureKind
data PKESKAttemptFailure
PKESKAttemptFailure :: Maybe (KeyVersion, PubKeyAlgorithm) -> PKESKAttemptFailureKind -> String -> PKESKAttemptFailure
[pkeskAttemptFailureKeyContext] :: PKESKAttemptFailure -> Maybe (KeyVersion, PubKeyAlgorithm)
[pkeskAttemptFailureKind] :: PKESKAttemptFailure -> PKESKAttemptFailureKind
[pkeskAttemptFailureReason] :: PKESKAttemptFailure -> String

-- | Outcome of a checked decrypt conduit run.
--   
--   Use <a>conduitDecrypt</a> to obtain this value. Because <a>.|</a>
--   preserves the <i>rightmost</i> conduit's return value, callers who
--   also need the decrypted packet stream should use <a>fuseBoth</a>:
--   
--   <pre>
--   (outcome, pkts) &lt;- runConduit $ source .| fuseBoth (conduitDecrypt opts) CL.consume
--   </pre>
data DecryptOutcome

-- | The integrity-terminating marker (MDC or SEIPD v2 final AEAD tag) was
--   seen and no further packets arrived. The message was well-formed
--   end-to-end.
DecryptClean :: DecryptOutcome

-- | The input stream ended before any integrity-terminating marker was
--   seen. The ciphertext was incomplete.
DecryptTruncated :: DecryptOutcome

-- | An integrity-terminating marker was seen, but additional packets
--   followed it. Only possible with <tt>lenientDecryptPolicy</tt> (strict
--   policy reports <a>DecryptMalformedStructure</a> instead). The trailing
--   packets were forwarded downstream unchanged.
DecryptTrailingData :: DecryptOutcome

-- | A structural packet-sequencing violation was detected. The
--   <a>String</a> describes the specific violation:
--   
--   <ul>
--   <li>PKESK version does not match the SEIPD version (e.g. a v6 PKESK
--   preceding a SEIPDv1 payload, or a v4 SKESK preceding a SEIPDv2
--   payload).</li>
--   <li>ESK packets arrived in the wrong order relative to the encrypted
--   data packet (e.g. a literal-data packet appeared between a PKESK and
--   the SEIPD it was intended to protect).</li>
--   <li>A packet arrived after the message integrity boundary (trailing
--   data). Under <a>defaultDecryptPolicy</a> this is reported here; under
--   <tt>lenientDecryptPolicy</tt> it is reported as
--   <a>DecryptTrailingData</a> instead.</li>
--   </ul>
DecryptMalformedStructure :: String -> DecryptOutcome
data DecryptReport
DecryptReport :: DecryptOutcome -> [DecryptSessionKeyResolutionReport] -> DecryptReport
[decryptReportOutcome] :: DecryptReport -> DecryptOutcome
[decryptReportSessionKeyResolutions] :: DecryptReport -> [DecryptSessionKeyResolutionReport]
data DecryptSessionKeyResolutionReport
DecryptSessionKeyResolutionReport :: DecryptSessionKeyResolutionPath -> [String] -> [String] -> [PKESKResolverAttempt] -> DecryptSessionKeyResolutionReport
[decryptSessionResolutionPath] :: DecryptSessionKeyResolutionReport -> DecryptSessionKeyResolutionPath
[decryptSessionResolutionSKESKErrors] :: DecryptSessionKeyResolutionReport -> [String]
[decryptSessionResolutionPKESKErrors] :: DecryptSessionKeyResolutionReport -> [String]
[decryptSessionResolutionResolverAttempts] :: DecryptSessionKeyResolutionReport -> [PKESKResolverAttempt]
data DecryptSessionKeyResolutionPath
DecryptResolvedViaSKESK :: DecryptSessionKeyResolutionPath
DecryptResolvedViaPKESK :: DecryptSessionKeyResolutionPath
DecryptResolvedViaManualPKESKInput :: DecryptSessionKeyResolutionPath
data PKESKResolverAttempt
PKESKResolverAttempt :: [PKESKAttemptFailure] -> PKESKResolverAttemptAction -> PKESKResolverAttempt

-- | Failures from earlier attempts on the same PKESK packet.
[pkeskResolverAttemptPreviousFailures] :: PKESKResolverAttempt -> [PKESKAttemptFailure]
[pkeskResolverAttemptAction] :: PKESKResolverAttempt -> PKESKResolverAttemptAction
data PKESKResolverAttemptAction
ResolverAttemptResolveWith :: Maybe (KeyVersion, PubKeyAlgorithm) -> PKESKResolverAttemptAction
ResolverAttemptSkip :: PKESKResolverAttemptAction
ResolverAttemptExhausted :: PKESKResolverAttemptAction
ResolverAttemptFail :: PKESKResolverError -> PKESKResolverAttemptAction
decryptSEIPDv2Payload :: SymmetricAlgorithm -> AEADAlgorithm -> Word8 -> Salt -> ByteString -> SessionKey -> Either String ByteString
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.DecryptOutcome
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.DecryptReport
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.DecryptSessionKeyResolutionPath
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.DecryptSessionKeyResolutionReport
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.LegacyECDHWrappedRFC3394Ciphertext
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PKESKAttemptFailure
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PKESKAttemptFailureKind
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PKESKResolveRequest
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PKESKResolverAttempt
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PKESKResolverAttemptAction
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PKESKResolverError
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.PendingESK
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.RecursorState
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Decrypt.SKESKSessionKeyResolutionError
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.DecryptOutcome
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.DecryptReport
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.DecryptSessionKeyResolutionPath
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.DecryptSessionKeyResolutionReport
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PKESKAttemptFailure
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PKESKAttemptFailureKind
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PKESKResolveRequest
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PKESKResolverAttempt
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PKESKResolverAttemptAction
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PKESKResolverError
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.PendingESK
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.RecursorState
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Decrypt.SKESKSessionKeyResolutionError

module Codec.Encryption.OpenPGP.Signatures
data SignError
SignBackendError :: String -> SignError
SignUnsupportedCertificationType :: SigType -> SignError
SignUnsupportedKeySignatureType :: SigType -> SignError
SignV6SaltSizeMismatch :: HashAlgorithm -> Word8 -> Int -> SignError
SignProducedWrongLength :: String -> Int -> Int -> SignError
renderSignError :: SignError -> String
data CertificationState
CertificationNotYetKnown :: CertificationState
CertificationActive :: CertificationState
CertificationRevoked :: CertificationState
certificationStateAt :: Maybe UTCTime -> [(SignaturePayload, Verification)] -> (SignaturePayload, Verification) -> CertificationState
data VerificationError
IssuerSubpacketMismatch :: VerificationError
IssuerSubpacketUncheckable :: String -> VerificationError
IssuerKeyIdProhibitedInV6Signature :: VerificationError
IssuerFingerprintSubpacketMismatch :: VerificationError
UnsupportedCriticalSubpacket :: SigType -> VerificationError
UnknownCriticalPacketInStream :: Word8 -> VerificationError
BrokenCriticalPacketInStream :: Word8 -> String -> VerificationError
ExternalVerificationError :: String -> VerificationError
NonSignaturePacket :: VerificationError
UnexpectedSignaturePayloadShape :: VerificationError
MissingHashAlgorithm :: VerificationError
HashComputationFailed :: String -> VerificationError
UnexpectedKeyVersion :: VerificationError
SignatureHashUnsupportedByAlgorithm :: HashAlgorithm -> PubKeyAlgorithm -> VerificationError
KeyRevoked :: VerificationError
SigningKeyUnavailableAtSignatureTime :: VerificationError
MissingIssuer :: VerificationError
SigningKeyNotFound :: Maybe EightOctetKeyId -> Maybe Fingerprint -> VerificationError
MultipleVerificationSuccesses :: Int -> VerificationError
UnsupportedKeyType :: PubKeyAlgorithm -> VerificationError
SignatureMismatch :: PubKeyAlgorithm -> Fingerprint -> VerificationError
SignatureShapeMismatch :: PubKeyAlgorithm -> VerificationError
SignatureEncodingInvalid :: PubKeyAlgorithm -> String -> VerificationError
SignaturePolicyHashUnsupported :: HashAlgorithm -> VerificationError
SignaturePolicyPKAMismatch :: PubKeyAlgorithm -> PubKeyAlgorithm -> VerificationError
SignatureExpired :: VerificationError
CandidateKeyFailures :: [VerificationError] -> VerificationError

-- | An embedded primary-key back-signature (type 0x19) in a subkey binding
--   signature failed to verify.
InvalidSubkeyBackSignature :: VerificationError -> VerificationError
renderVerificationError :: VerificationError -> String
verifySigWith :: (Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification) -> Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification
verifyAgainstKeyring :: PublicKeyring -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
verifyAgainstKeys :: [TKUnknown] -> Pkt -> Maybe UTCTime -> ByteString -> Either VerificationError Verification
verifyTKWith :: forall (k :: TKKind). (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TK k -> Either VerificationError (TK k)
verifyUnknownTKWith :: (Pkt -> PktStreamContext -> Maybe UTCTime -> Either VerificationError Verification) -> Maybe UTCTime -> TKUnknown -> Either VerificationError TKUnknown
signCertificationWithRSA :: SigType -> SomePKPayload -> UserId -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signDirectKeyWithRSA :: SigType -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signKeyRevocationWithRSA :: SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signSubkeyRevocationWithRSA :: SomePKPayload -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signCertRevocationWithRSA :: SomePKPayload -> UserId -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
signUserIDwithRSA :: SomePKPayload -> UserId -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> Either SignError SignaturePayload
crossSignSubkeyWithRSA :: SomePKPayload -> SomePKPayload -> [SigSubPacket] -> [SigSubPacket] -> [SigSubPacket] -> [SigSubPacket] -> PrivateKey -> PrivateKey -> Either SignError SignaturePayload
signDataWithEd25519 :: SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithEd25519V6 :: SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithEd448 :: SigType -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithEd448V6 :: SigType -> SignatureSalt -> SecretKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithRSA :: SigType -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload
signDataWithRSAV6 :: SigType -> SignatureSalt -> PrivateKey -> [SigSubPacket] -> [SigSubPacket] -> ByteString -> Either SignError SignaturePayload

-- | Builder-based signature creation for RSA
--   
--   Example usage: builder &lt;- sigBuilderInit BinarySig RSA SHA512
--   builder' &lt;- addHashedSubs hashedSubpackets builder builder'' &lt;-
--   addUnhashedSubs unhashedSubpackets builder' sig &lt;-
--   signDataWithRSABuilder builder'' rsaPrivateKey payload
signDataWithRSABuilder :: SigBuilder Unhashed V4Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload

-- | Builder-based signature creation for RSA (v6)
signDataWithRSAV6Builder :: SigBuilder Unhashed V6Sig 'RSA -> PrivateKey -> ByteString -> Either SignError SignaturePayload

-- | Builder-based signature creation for Ed25519 (v4)
--   
--   Example usage: builder &lt;- sigBuilderInit BinarySig Ed25519 SHA512
--   builder' &lt;- addHashedSubs hashedSubpackets builder builder'' &lt;-
--   addUnhashedSubs unhashedSubpackets builder' sig &lt;-
--   signDataWithEd25519Builder builder'' ed25519PrivateKey payload
signDataWithEd25519Builder :: SigBuilder Unhashed V4Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload

-- | Builder-based signature creation for Ed25519 (v6)
--   
--   Example usage: builder &lt;- sigBuilderInitV6 BinarySig Ed25519 SHA512
--   salt builder' &lt;- addHashedSubs hashedSubpackets builder builder''
--   &lt;- addUnhashedSubs unhashedSubpackets builder' sig &lt;-
--   signDataWithEd25519V6Builder builder'' ed25519PrivateKey payload
signDataWithEd25519V6Builder :: SigBuilder Unhashed V6Sig 'Ed25519 -> SecretKey -> ByteString -> Either SignError SignaturePayload

-- | Builder-based signature creation for Ed448 (v4)
--   
--   Example usage: builder &lt;- sigBuilderInit BinarySig Ed448 SHA512
--   builder' &lt;- addHashedSubs hashedSubpackets builder builder'' &lt;-
--   addUnhashedSubs unhashedSubpackets builder' sig &lt;-
--   signDataWithEd448Builder builder'' ed448PrivateKey payload
signDataWithEd448Builder :: SigBuilder Unhashed V4Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload

-- | Builder-based signature creation for Ed448 (v6)
signDataWithEd448V6Builder :: SigBuilder Unhashed V6Sig 'Ed448 -> SecretKey -> ByteString -> Either SignError SignaturePayload
signDataWithAlgorithmicBuilder :: forall (algo :: PubKeyAlgorithm). BuilderSigningAlgorithm algo => SigBuilder Unhashed V4Sig algo -> PrivateKeyFor algo -> ByteString -> Either SignError SignaturePayload

-- | Controls how text payload is normalized for CanonicalTextSig.
--   
--   RFC 9580 §5.2.1.2 requires only CRLF normalization for type 0x01
--   signatures. Trailing-whitespace stripping is only mandated by §7
--   (Cleartext Signature Framework). Use <a>CleartextCompat</a> for
--   GnuPG-compatible behaviour when producing cleartext-armored
--   signatures; use <a>RFC9580Strict</a> for inline text signatures.
data TextNormalizationMode

-- | CRLF normalization only; no trailing-whitespace stripping. Correct for
--   inline type 0x01 document signatures.
RFC9580Strict :: TextNormalizationMode

-- | CRLF normalization *plus* per-line trailing-whitespace stripping.
--   Required by the Cleartext Signature Framework (RFC 9580 §7).
CleartextCompat :: TextNormalizationMode
instance Codec.Encryption.OpenPGP.Signatures.BuilderSigningAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.Ed25519
instance Codec.Encryption.OpenPGP.Signatures.BuilderSigningAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.Ed448
instance Codec.Encryption.OpenPGP.Signatures.BuilderSigningAlgorithm 'Codec.Encryption.OpenPGP.Types.Internal.Base.RSA
instance (TypeError ...) => Codec.Encryption.OpenPGP.Signatures.BuilderSigningAlgorithm algo
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Signatures.CertificationState
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Signatures.SignError
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Signatures.VerificationError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Signatures.CertificationState
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Signatures.SignError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Signatures.VerificationError

module Codec.Encryption.OpenPGP.KeyringParser
parseAChunk :: (Monoid s, Show s) => Parser s r -> s -> ([(r, s)], Maybe (Maybe (r -> r), Parser s r)) -> (([(r, s)], Maybe (Maybe (r -> r), Parser s r)), [r])
parseAChunkEither :: (Monoid s, Show s) => Parser s r -> s -> ([(r, s)], Maybe (Maybe (r -> r), Parser s r)) -> Either KeyringChunkParseError (([(r, s)], Maybe (Maybe (r -> r), Parser s r)), [r])
finalizeParsing :: Monoid s => ([(r, s)], Maybe (Maybe (r -> r), Parser s r)) -> (([(r, s)], Maybe (Maybe (r -> r), Parser s r)), [r])
finalizeParsingEither :: Monoid s => ([(r, s)], Maybe (Maybe (r -> r), Parser s r)) -> Either KeyringChunkParseError (([(r, s)], Maybe (Maybe (r -> r), Parser s r)), [r])
data KeyringChunkParseError
ChunkFailureBeforeInput :: String -> KeyringChunkParseError
ChunkUnexpectedFinalizationFailure :: KeyringChunkParseError
ChunkParserFailure :: String -> KeyringChunkParseError
anyTK :: Bool -> Parser [Pkt] (Maybe TKUnknown)
anyTKWithWireRep :: Bool -> Parser [PktWithWireRep] (Maybe TKWithWireRep)
data UidOrUat
I :: Text -> UidOrUat
A :: [UserAttrSubPacket] -> UidOrUat
splitUs :: [(UidOrUat, [SignaturePayload])] -> ([(Text, [SignaturePayload])], [([UserAttrSubPacket], [SignaturePayload])])
publicTK :: Bool -> Parser [Pkt] (Maybe TKUnknown)
publicTKWithWireRep :: Bool -> Parser [PktWithWireRep] (Maybe TKWithWireRep)
secretTK :: Bool -> Parser [Pkt] (Maybe TKUnknown)
secretTKWithWireRep :: Bool -> Parser [PktWithWireRep] (Maybe TKWithWireRep)
brokenTK :: Int -> Parser [Pkt] (Maybe TKUnknown)
brokenTKWithWireRep :: Int -> Parser [PktWithWireRep] (Maybe TKWithWireRep)
pkPayload :: Parser [Pkt] (SomePKPayload, Maybe SKAddendum)
pkPayloadWithWireRep :: Parser [PktWithWireRep] ((SomePKPayload, Maybe SKAddendum), [PktWithWireRep])
signature :: Bool -> [SigType] -> Parser [Pkt] [SignaturePayload]
signatureWithWireRep :: Bool -> [SigType] -> Parser [PktWithWireRep] ([SignaturePayload], [PktWithWireRep])
signedUID :: Bool -> Parser [Pkt] (UidOrUat, [SignaturePayload])
signedUIDWithWireRep :: Bool -> Parser [PktWithWireRep] ((UidOrUat, [SignaturePayload]), [PktWithWireRep])
signedUAt :: Bool -> Parser [Pkt] (UidOrUat, [SignaturePayload])
signedUAtWithWireRep :: Bool -> Parser [PktWithWireRep] ((UidOrUat, [SignaturePayload]), [PktWithWireRep])
signedOrRevokedPubSubkey :: Bool -> Parser [Pkt] [(Pkt, [SignaturePayload])]
signedOrRevokedPubSubkeyWithWireRep :: Bool -> Parser [PktWithWireRep] [((Pkt, [SignaturePayload]), [PktWithWireRep])]
brokenPubSubkey :: Parser [Pkt] [(Pkt, [SignaturePayload])]
brokenPubSubkeyWithWireRep :: Parser [PktWithWireRep] [((Pkt, [SignaturePayload]), [PktWithWireRep])]
rawOrSignedOrRevokedSecSubkey :: Bool -> Parser [Pkt] [(Pkt, [SignaturePayload])]
rawOrSignedOrRevokedSecSubkeyWithWireRep :: Bool -> Parser [PktWithWireRep] [((Pkt, [SignaturePayload]), [PktWithWireRep])]
brokenSecSubkey :: Parser [Pkt] [(Pkt, [SignaturePayload])]
brokenSecSubkeyWithWireRep :: Parser [PktWithWireRep] [((Pkt, [SignaturePayload]), [PktWithWireRep])]
skPayload :: Parser [Pkt] (SomePKPayload, Maybe SKAddendum)
skPayloadWithWireRep :: Parser [PktWithWireRep] ((SomePKPayload, Maybe SKAddendum), [PktWithWireRep])
broken :: Int -> Parser [Pkt] Pkt
brokenWithWireRep :: Int -> Parser [PktWithWireRep] PktWithWireRep

-- | parse TKs from packets
parseUnknownTKs :: Bool -> [Pkt] -> [TKUnknown]
parseTKsEither :: Bool -> [Pkt] -> [Either TKConversionError SomeTK]
parseTKs :: Bool -> [Pkt] -> [SomeTK]
parsePublicTKs :: Bool -> [Pkt] -> [TK 'PublicTK]
parseSecretTKs :: Bool -> [Pkt] -> [TK 'SecretTK]
parseTKsWithWireRep :: Bool -> [PktWithWireRep] -> [TKWithWireRep]
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.KeyringParser.KeyringChunkParseError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.KeyringParser.KeyringChunkParseError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.KeyringParser.UidOrUat

module Data.Conduit.OpenPGP.Keyring

-- | Deprecated: this conduit silently drops parse failures and parse-time
--   omissions. Prefer <a>conduitToTKsEither</a> and handle errors
--   explicitly.

-- | <i>Deprecated: Use conduitToTKsEither and handle Left/Maybe
--   explicitly.</i>
conduitToUnknownTKs :: forall (m :: Type -> Type). Monad m => ConduitT Pkt TKUnknown m ()
data TypedTKConduitError
TypedTKParseError :: KeyringChunkParseError -> TypedTKConduitError
TypedTKConversionError :: TKConversionError -> TypedTKConduitError

-- | Canonical strict typed conduit with explicit parse+conversion error
--   channel.
conduitToSomeTKsEither :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (Either TypedTKConduitError (Maybe SomeTK)) m ()

-- | Deprecated: this conduit silently drops parse+conversion failures.
--   Prefer <a>conduitToSomeTKsEither</a> and handle errors explicitly.

-- | <i>Deprecated: Use conduitToSomeTKsEither and handle Left/Maybe
--   explicitly.</i>
conduitToSomeTKsDropping :: forall (m :: Type -> Type). Monad m => ConduitT Pkt SomeTK m ()

-- | Tolerant typed conduit (broken transferable-key chunks may be
--   omitted), while still surfacing parse+conversion failures.
conduitToSomeTKsDroppingEither :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (Either TypedTKConduitError (Maybe SomeTK)) m ()

-- | Deprecated: this conduit silently drops parse+conversion failures.
--   Prefer <a>conduitToSomeTKsEither</a> and handle errors explicitly.

-- | <i>Deprecated: Use conduitToSomeTKsEither and handle Left/Maybe
--   explicitly.</i>
conduitToTKs :: forall (m :: Type -> Type). Monad m => ConduitT Pkt SomeTK m ()

-- | <i>Deprecated: Use conduitToSomeTKsEither and perform explicit
--   projection/filtering.</i>
conduitToPublicTKs :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (TK 'PublicTK) m ()

-- | Yield public TKs from any input: native public TKs pass through,
--   secret TKs are stripped to their public view

-- | <i>Deprecated: Use conduitToSomeTKsEither and perform explicit
--   projection.</i>
conduitToPublicViewTKs :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (TK 'PublicTK) m ()

-- | <i>Deprecated: Use conduitToSomeTKsEither and perform explicit
--   projection/filtering.</i>
conduitToSecretTKs :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (TK 'SecretTK) m ()
data AuthSecretSubkeyUID
AuthSecretSubkeyUID :: Text -> Bool -> AuthSecretSubkeyUID
[authSecretSubkeyUIDValue] :: AuthSecretSubkeyUID -> Text
[authSecretSubkeyUIDIsPrimary] :: AuthSecretSubkeyUID -> Bool
data AuthSecretSubkeyAtTime
AuthSecretSubkeyAtTime :: KeyPkt 'SecretPkt -> KeyPkt 'SecretPkt -> [AuthSecretSubkeyUID] -> Maybe Text -> AuthSecretSubkeyAtTime
[authSecretSubkeyPrimaryKey] :: AuthSecretSubkeyAtTime -> KeyPkt 'SecretPkt
[authSecretSubkeyValue] :: AuthSecretSubkeyAtTime -> KeyPkt 'SecretPkt
[authSecretSubkeyUIDs] :: AuthSecretSubkeyAtTime -> [AuthSecretSubkeyUID]
[authSecretSubkeyPrimaryUID] :: AuthSecretSubkeyAtTime -> Maybe Text
data AuthSecretSubkeyRejectionReason
AuthSecretSubkeyTKVerificationFailed :: AuthSecretSubkeyRejectionReason
AuthSecretSubkeyPrimaryKeyInvalidAtTime :: AuthSecretSubkeyRejectionReason
AuthSecretSubkeyNotSecretSubkeyPacket :: AuthSecretSubkeyRejectionReason
AuthSecretSubkeyNotSubkeyPacket :: AuthSecretSubkeyRejectionReason
AuthSecretSubkeySubkeyInvalidAtTime :: AuthSecretSubkeyRejectionReason
AuthSecretSubkeyMissingAuthCapability :: AuthSecretSubkeyRejectionReason
data AuthSecretSubkeyRejectedAtTime
AuthSecretSubkeyRejectedAtTime :: KeyPkt 'SecretPkt -> Maybe (KeyPkt 'SecretPkt) -> [AuthSecretSubkeyUID] -> Maybe Text -> AuthSecretSubkeyRejectionReason -> AuthSecretSubkeyRejectedAtTime
[authSecretSubkeyRejectedPrimaryKey] :: AuthSecretSubkeyRejectedAtTime -> KeyPkt 'SecretPkt
[authSecretSubkeyRejectedValue] :: AuthSecretSubkeyRejectedAtTime -> Maybe (KeyPkt 'SecretPkt)
[authSecretSubkeyRejectedUIDs] :: AuthSecretSubkeyRejectedAtTime -> [AuthSecretSubkeyUID]
[authSecretSubkeyRejectedPrimaryUID] :: AuthSecretSubkeyRejectedAtTime -> Maybe Text
[authSecretSubkeyRejectedReason] :: AuthSecretSubkeyRejectedAtTime -> AuthSecretSubkeyRejectionReason
data AuthSecretSubkeysAtReport
AuthSecretSubkeysAtReport :: [AuthSecretSubkeyAtTime] -> [AuthSecretSubkeyRejectedAtTime] -> AuthSecretSubkeysAtReport
[authSecretSubkeysAccepted] :: AuthSecretSubkeysAtReport -> [AuthSecretSubkeyAtTime]
[authSecretSubkeysRejected] :: AuthSecretSubkeysAtReport -> [AuthSecretSubkeyRejectedAtTime]
authSecretSubkeysAt :: UTCTime -> TK 'SecretTK -> [AuthSecretSubkeyAtTime]
authSecretSubkeysAtReport :: UTCTime -> TK 'SecretTK -> AuthSecretSubkeysAtReport
conduitToAuthSecretSubkeysAt :: forall (m :: Type -> Type). Monad m => UTCTime -> ConduitT (TK 'SecretTK) AuthSecretSubkeyAtTime m ()
conduitToAuthSecretSubkeysAtReport :: forall (m :: Type -> Type). Monad m => UTCTime -> ConduitT (TK 'SecretTK) AuthSecretSubkeysAtReport m ()

-- | Deprecated: this conduit silently drops parse failures and parse-time
--   omissions. Prefer <a>conduitToTKsDroppingEither</a> when tolerant
--   parsing is needed, or <a>conduitToTKsEither</a> for strict parsing.

-- | <i>Deprecated: Use conduitToTKsDroppingEither or conduitToTKsEither
--   and handle Left/Maybe explicitly.</i>
conduitToTKsDropping :: forall (m :: Type -> Type). Monad m => ConduitT Pkt TKUnknown m ()
conduitToTKsEither :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (Either KeyringChunkParseError (Maybe TKUnknown)) m ()
conduitToTKsDroppingEither :: forall (m :: Type -> Type). Monad m => ConduitT Pkt (Either KeyringChunkParseError (Maybe TKUnknown)) m ()

-- | <i>Deprecated: Use conduitToTKsWithWireRepEither and handle Left/Maybe
--   explicitly.</i>
conduitToTKsWithWireRep :: forall (m :: Type -> Type). Monad m => ConduitT PktWithWireRep TKWithWireRep m ()

-- | <i>Deprecated: Use conduitToTKsDroppingWithWireRepEither or
--   conduitToTKsWithWireRepEither and handle Left/Maybe explicitly.</i>
conduitToTKsDroppingWithWireRep :: forall (m :: Type -> Type). Monad m => ConduitT PktWithWireRep TKWithWireRep m ()
conduitToTKsWithWireRepEither :: forall (m :: Type -> Type). Monad m => ConduitT PktWithWireRep (Either KeyringChunkParseError (Maybe TKWithWireRep)) m ()
conduitToTKsDroppingWithWireRepEither :: forall (m :: Type -> Type). Monad m => ConduitT PktWithWireRep (Either KeyringChunkParseError (Maybe TKWithWireRep)) m ()
data KeyringChunkParseError
ChunkFailureBeforeInput :: String -> KeyringChunkParseError
ChunkUnexpectedFinalizationFailure :: KeyringChunkParseError
ChunkParserFailure :: String -> KeyringChunkParseError
sinkPublicKeyringMap :: forall (m :: Type -> Type). Monad m => ConduitT (TK 'PublicTK) Void m PublicKeyring
sinkSecretKeyringMap :: forall (m :: Type -> Type). Monad m => ConduitT (TK 'SecretTK) Void m SecretKeyring

-- | Lift a single typed TK into its kinded keyring
publicTKToKeyring :: TK 'PublicTK -> PublicKeyring
secretTKToKeyring :: TK 'SecretTK -> SecretKeyring

-- | Partition a list of SomeTK into homogeneous public and secret keyrings
partitionSomeTKs :: [SomeTK] -> (PublicKeyring, SecretKeyring)
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyAtTime
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyRejectedAtTime
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyRejectionReason
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyUID
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeysAtReport
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.Phase
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Keyring.TypedTKConduitError
instance GHC.Classes.Ord Data.Conduit.OpenPGP.Keyring.Phase
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyAtTime
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyRejectedAtTime
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyRejectionReason
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeyUID
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.AuthSecretSubkeysAtReport
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.Phase
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Keyring.TypedTKConduitError

module Data.Conduit.OpenPGP.Verify
data VerificationMode
VerificationStreaming :: VerificationMode
VerificationBatch :: VerificationMode
data VerificationModeW (mode :: VerificationMode)
[VerificationStreamingW] :: VerificationModeW 'VerificationStreaming
[VerificationBatchW] :: VerificationModeW 'VerificationBatch
conduitVerify :: forall (m :: Type -> Type). Monad m => PublicKeyring -> Maybe UTCTime -> ConduitT Pkt (Either VerificationError Verification) m ()
verifyPacketsBatch :: PublicKeyring -> Maybe UTCTime -> [Pkt] -> [Either VerificationError Verification]
verifyPacketsWithModeTyped :: forall (m :: Type -> Type) (mode :: VerificationMode). Monad m => VerificationModeW mode -> PublicKeyring -> Maybe UTCTime -> ConduitT Pkt (Either VerificationError Verification) m ()
verifyPacketsWithMode :: forall (m :: Type -> Type). Monad m => VerificationMode -> PublicKeyring -> Maybe UTCTime -> ConduitT Pkt (Either VerificationError Verification) m ()
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Verify.VerificationMode
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Verify.VerificationMode

module Data.Conduit.OpenPGP.Message
data VerificationPolicy
VerifyInformational :: VerificationPolicy
VerifyStrict :: VerificationPolicy
data VerificationOptions
VerificationOptions :: VerificationPolicy -> VerificationMode -> Maybe UTCTime -> VerificationOptions
[verificationPolicy] :: VerificationOptions -> VerificationPolicy
[verificationMode] :: VerificationOptions -> VerificationMode
[verificationTime] :: VerificationOptions -> Maybe UTCTime
defaultVerificationOptions :: VerificationOptions
verifyMessagePackets :: VerificationOptions -> PublicKeyring -> [Pkt] -> [Either VerificationError Verification]
verifyMessage :: VerificationOptions -> PublicKeyring -> ByteString -> [Either VerificationError Verification]
data VerificationMode
VerificationStreaming :: VerificationMode
VerificationBatch :: VerificationMode
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Message.VerificationOptions
instance GHC.Classes.Eq Data.Conduit.OpenPGP.Message.VerificationPolicy
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Message.VerificationOptions
instance GHC.Internal.Show.Show Data.Conduit.OpenPGP.Message.VerificationPolicy

module Codec.Encryption.OpenPGP.Message
data Passphrase
mkPassphrase :: ByteString -> Passphrase
passphraseBytes :: Passphrase -> ByteString
data EncryptedPayload
mkEncryptedPayload :: ByteString -> EncryptedPayload
encryptedPayloadBytes :: EncryptedPayload -> ByteString
data ClearPayload
mkClearPayload :: ByteString -> ClearPayload
clearPayloadBytes :: ClearPayload -> ByteString
data WrappedSessionMaterial
data SigningAlgorithm
AlgoRSA :: SigningAlgorithm
AlgoEd25519 :: SigningAlgorithm
AlgoEd448 :: SigningAlgorithm
type family SecretKeyFor (alg :: SigningAlgorithm)
data VersionedPKPayload (v :: KeyVersion)
asV4PKPayload :: SomePKPayload -> Either String (VersionedPKPayload 'V4)
asV6PKPayload :: SomePKPayload -> Either String (VersionedPKPayload 'V6)
data Signer (alg :: SigningAlgorithm) v
class SigningCapability (alg :: SigningAlgorithm) v
mkRSASignerV4 :: VersionedPKPayload 'V4 -> SecretKeyFor 'AlgoRSA -> Signer 'AlgoRSA V4Sig
mkRSASignerV6 :: VersionedPKPayload 'V6 -> SecretKeyFor 'AlgoRSA -> Signer 'AlgoRSA V6Sig
mkEd25519SignerV4 :: VersionedPKPayload 'V4 -> SecretKeyFor 'AlgoEd25519 -> Signer 'AlgoEd25519 V4Sig
mkEd25519SignerV6 :: VersionedPKPayload 'V6 -> SecretKeyFor 'AlgoEd25519 -> Signer 'AlgoEd25519 V6Sig
mkEd448SignerV4 :: VersionedPKPayload 'V4 -> SecretKeyFor 'AlgoEd448 -> Signer 'AlgoEd448 V4Sig
mkEd448SignerV6 :: VersionedPKPayload 'V6 -> SecretKeyFor 'AlgoEd448 -> Signer 'AlgoEd448 V6Sig
data MessageParseFailure
MissingEncryptedMessage :: MessageParseFailure
ExpectedSKESKThenEncryptedData :: MessageParseFailure
SKESKSEIPDAlgorithmMismatch :: MessageParseFailure
UnsupportedEncryptedSKESK :: MessageParseFailure
MissingLiteralDataPacket :: MessageParseFailure
UnknownCriticalPacketType :: Word8 -> MessageParseFailure
BrokenCriticalPacketType :: Word8 -> String -> MessageParseFailure
data MessageDecryptFailure
SessionMaterialDerivationFailed :: S2KError -> MessageDecryptFailure
PayloadDecryptFailed :: String -> MessageDecryptFailure
data MessageError
MessageEncryptError :: String -> MessageError
MessageDecryptError :: String -> MessageError
MessageSignError :: SignError -> MessageError
MessageParseError :: String -> MessageError
MessageParseFailureError :: MessageParseFailure -> MessageError
MessageDecryptFailureError :: MessageDecryptFailure -> MessageError
data SessionMaterialExposure
DoNotExposeSessionMaterial :: SessionMaterialExposure
ExposeSessionMaterial :: SessionMaterialExposure
data EncryptMessageProfile
data EncryptMessageOptions (p :: EncryptMessageProfile)
[RFC4880EncryptMessageOptions] :: SessionMaterialExposure -> SymmetricAlgorithm -> S2K -> IV -> EncryptMessageOptions 'RFC4880Message
[RFC9580EncryptMessageOptions] :: SessionMaterialExposure -> SymmetricAlgorithm -> S2K -> IV -> EncryptMessageOptions 'RFC9580Message
data RecoveredSessionMaterial
RecoveredSessionMaterial :: SymmetricAlgorithm -> SessionKey -> RecoveredSessionMaterial
[recoveredSessionAlgorithm] :: RecoveredSessionMaterial -> SymmetricAlgorithm
[recoveredSessionKey] :: RecoveredSessionMaterial -> SessionKey
encryptMessage :: forall (p :: EncryptMessageProfile). EncryptMessageOptions p -> Passphrase -> ClearPayload -> Either MessageError (EncryptedPayload, Maybe RecoveredSessionMaterial)
decryptMessage :: Passphrase -> EncryptedPayload -> Either MessageError ClearPayload
signMessage :: forall m (alg :: SigningAlgorithm) v. (MonadRandom m, SigningCapability alg v) => Signer alg v -> ByteString -> m (Either MessageError ByteString)
signMessageWith :: forall m (alg :: SigningAlgorithm) v. (MonadRandom m, SigningCapability alg v) => Signer alg v -> ClearPayload -> m (Either MessageError ByteString)
data VerificationPolicy
VerifyInformational :: VerificationPolicy
VerifyStrict :: VerificationPolicy
data VerificationOptions
VerificationOptions :: VerificationPolicy -> VerificationMode -> Maybe UTCTime -> VerificationOptions
[verificationPolicy] :: VerificationOptions -> VerificationPolicy
[verificationMode] :: VerificationOptions -> VerificationMode
[verificationTime] :: VerificationOptions -> Maybe UTCTime
defaultVerificationOptions :: VerificationOptions
verifySignedMessage :: VerificationOptions -> PublicKeyring -> ByteString -> [Either VerificationError Verification]
instance GHC.Internal.Base.Applicative Codec.Encryption.OpenPGP.Message.MessageFlow
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.ClearPayload
instance GHC.Classes.Eq (Codec.Encryption.OpenPGP.Message.EncryptMessageOptions p)
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.EncryptedPayload
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.MessageDecryptFailure
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.MessageError
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.MessageParseFailure
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.Passphrase
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.RecoveredSessionMaterial
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.SessionMaterialExposure
instance GHC.Classes.Eq Codec.Encryption.OpenPGP.Message.WrappedSessionMaterial
instance GHC.Internal.Base.Functor Codec.Encryption.OpenPGP.Message.MessageFlow
instance GHC.Internal.Base.Monad Codec.Encryption.OpenPGP.Message.MessageFlow
instance GHC.Classes.Ord Codec.Encryption.OpenPGP.Message.ClearPayload
instance GHC.Classes.Ord Codec.Encryption.OpenPGP.Message.EncryptedPayload
instance GHC.Classes.Ord Codec.Encryption.OpenPGP.Message.Passphrase
instance GHC.Classes.Ord Codec.Encryption.OpenPGP.Message.WrappedSessionMaterial
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.ClearPayload
instance GHC.Internal.Show.Show (Codec.Encryption.OpenPGP.Message.EncryptMessageOptions p)
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.EncryptedPayload
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.MessageDecryptFailure
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.MessageError
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.MessageParseFailure
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.Passphrase
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.RecoveredSessionMaterial
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.SessionMaterialExposure
instance GHC.Internal.Show.Show Codec.Encryption.OpenPGP.Message.WrappedSessionMaterial
instance Codec.Encryption.OpenPGP.Message.SigningCapability 'Codec.Encryption.OpenPGP.Message.AlgoEd25519 Codec.Encryption.OpenPGP.Types.Internal.Base.V4Sig
instance Codec.Encryption.OpenPGP.Message.SigningCapability 'Codec.Encryption.OpenPGP.Message.AlgoEd25519 Codec.Encryption.OpenPGP.Types.Internal.Base.V6Sig
instance Codec.Encryption.OpenPGP.Message.SigningCapability 'Codec.Encryption.OpenPGP.Message.AlgoEd448 Codec.Encryption.OpenPGP.Types.Internal.Base.V4Sig
instance Codec.Encryption.OpenPGP.Message.SigningCapability 'Codec.Encryption.OpenPGP.Message.AlgoEd448 Codec.Encryption.OpenPGP.Types.Internal.Base.V6Sig
instance Codec.Encryption.OpenPGP.Message.SigningCapability 'Codec.Encryption.OpenPGP.Message.AlgoRSA Codec.Encryption.OpenPGP.Types.Internal.Base.V4Sig
instance Codec.Encryption.OpenPGP.Message.SigningCapability 'Codec.Encryption.OpenPGP.Message.AlgoRSA Codec.Encryption.OpenPGP.Types.Internal.Base.V6Sig

module Codec.Encryption.OpenPGP.Version
version :: String
