Completed event and key libraries.

README.md

@@ -0,0 +1,3 @@
+# Go-Roots - Nostr Protocol Library for Golang
+
+`go-roots` is a minimal nostr protocol library for golang.

c2p

@@ -0,0 +1 @@
+code2prompt -e "go.sum" -e "README.md" -e "c2p" .

event.go

@@ -0,0 +1,155 @@
+package roots
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"regexp"
+
+	"github.com/btcsuite/btcd/btcec/v2"
+	"github.com/btcsuite/btcd/btcec/v2/schnorr"
+)
+
+type Event struct {
+	ID        string
+	PubKey    string
+	CreatedAt int
+	Kind      int
+	Tags      [][]string
+	Content   string
+	Sig       string
+}
+
+var (
+	Hex64Pattern  = regexp.MustCompile("^[a-f0-9]{64}$")
+	Hex128Pattern = regexp.MustCompile("^[a-f0-9]{128}$")
+)
+
+func (event Event) Serialize() ([]byte, error) {
+	serialized := []interface{}{
+		0,
+		event.PubKey,
+		event.CreatedAt,
+		event.Kind,
+		event.Tags,
+		event.Content,
+	}
+
+	bytes, err := json.Marshal(serialized)
+	if err != nil {
+		return []byte{}, err
+	}
+	return bytes, nil
+}
+
+func (event Event) GetID() (string, error) {
+	bytes, err := event.Serialize()
+	if err != nil {
+		return "", err
+	}
+	hash := sha256.Sum256(bytes)
+	return hex.EncodeToString(hash[:]), nil
+}
+
+func (event Event) Validate() error {
+	if err := event.ValidateStructure(); err != nil {
+		return err
+	}
+
+	if err := event.ValidateID(); err != nil {
+		return err
+	}
+
+	return ValidateSignature(event.ID, event.Sig, event.PubKey)
+}
+
+func (event Event) ValidateStructure() error {
+	if !Hex64Pattern.MatchString(event.PubKey) {
+		return fmt.Errorf("pubkey must be 64 lowercase hex characters")
+	}
+
+	if !Hex64Pattern.MatchString(event.ID) {
+		return fmt.Errorf("id must be 64 hex characters")
+	}
+
+	if !Hex128Pattern.MatchString(event.Sig) {
+		return fmt.Errorf("signature must be 128 hex characters")
+	}
+
+	for _, tag := range event.Tags {
+		if len(tag) < 2 {
+			return fmt.Errorf("tags must contain at least two elements")
+		}
+	}
+
+	return nil
+}
+
+func (event Event) ValidateID() error {
+	computedID, err := event.GetID()
+	if err != nil {
+		return fmt.Errorf("failed to compute event id")
+	}
+	if event.ID == "" {
+		return fmt.Errorf("event id is empty")
+	}
+	if computedID != event.ID {
+		return fmt.Errorf("event id %q does not match computed id %q", event.ID, computedID)
+	}
+	return nil
+}
+
+func SignEvent(eventID, privateKeyHex string) (string, error) {
+	skBytes, err := hex.DecodeString(privateKeyHex)
+	if err != nil {
+		return "", fmt.Errorf("invalid private key hex: %w", err)
+	}
+
+	idBytes, err := hex.DecodeString(eventID)
+	if err != nil {
+		return "", fmt.Errorf("invalid event id hex: %w", err)
+	}
+
+	// discard public key return value
+	sk, _ := btcec.PrivKeyFromBytes(skBytes)
+	sig, err := schnorr.Sign(sk, idBytes)
+	if err != nil {
+		return "", fmt.Errorf("schnorr signature error: %w", err)
+	}
+
+	return hex.EncodeToString(sig.Serialize()), nil
+}
+
+func ValidateSignature(eventID, eventSig, publicKeyHex string) error {
+	idBytes, err := hex.DecodeString(eventID)
+	if err != nil {
+		return fmt.Errorf("invalid event id hex: %w", err)
+	}
+
+	sigBytes, err := hex.DecodeString(eventSig)
+	if err != nil {
+		return fmt.Errorf("invalid event signature hex: %w", err)
+	}
+
+	pkBytes, err := hex.DecodeString(publicKeyHex)
+	if err != nil {
+		return fmt.Errorf("invalid public key hex: %w", err)
+	}
+
+	signature, err := schnorr.ParseSignature(sigBytes)
+	if err != nil {
+		return fmt.Errorf("malformed signature: %w", err)
+	}
+
+	publicKey, err := schnorr.ParsePubKey(pkBytes)
+	if err != nil {
+		return fmt.Errorf("malformed public key: %w", err)
+	}
+
+	if signature.Verify(idBytes, publicKey) {
+		return nil
+	} else {
+		return fmt.Errorf("event signature is invalid")
+	}
+}

event_id_test.go

@@ -0,0 +1,203 @@
+package roots
+
+import (
+	"testing"
+)
+
+type IDTestCase struct {
+	name       string
+	event      Event
+	expectedID string
+}
+
+var idTestCases = []IDTestCase{
+	{
+		name: "minimal event",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "",
+		},
+		expectedID: "13a55672a600398894592f4cb338652d4936caffe5d3718d11597582bb030c39",
+	},
+
+	{
+		name: "alphanumeric content",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "hello world",
+		},
+		expectedID: "c7a702e6158744ca03508bbb4c90f9dbb0d6e88fefbfaa511d5ab24b4e3c48ad",
+	},
+
+	{
+		name: "unicode content",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "hello world 😀",
+		},
+		expectedID: "e42083fafbf9a39f97914fd9a27cedb38c429ac3ca8814288414eaad1f472fe8",
+	},
+
+	{
+		name: "escaped content",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "\"You say yes.\"\\n\\t\"I say no.\"",
+		},
+		expectedID: "343de133996a766bf00561945b6f2b2717d4905275976ca75c1d7096b7d1900c",
+	},
+
+	{
+		name: "json content",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "{\"field\": [\"value\",\"value\"],\"numeral\": 123}",
+		},
+		expectedID: "c6140190453ee947efb790e70541a9d37c41604d1f29e4185da4325621ed5270",
+	},
+
+	{
+		name: "empty tag",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags: [][]string{
+				{"a", ""},
+			},
+			Content: "",
+		},
+		expectedID: "7d3e394c75916362436f11c603b1a89b40b50817550cfe522a90d769655007a4",
+	},
+
+	{
+		name: "single tag",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags: [][]string{
+				{"a", "value"},
+			},
+			Content: "",
+		},
+		expectedID: "7db394e274fb893edbd9f4aa9ff189d4f3264bf1a29cef8f614e83ebf6fa19fe",
+	},
+
+	{
+		name: "optional tag values",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags: [][]string{
+				{"a", "value", "optional"},
+			},
+			Content: "",
+		},
+		expectedID: "656b47884200959e0c03054292c453cfc4beea00b592d92c0f557bff765e9d34",
+	},
+
+	{
+		name: "multiple tags",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags: [][]string{
+				{"a", "value", "optional"},
+				{"b", "another"},
+				{"c", "data"},
+			},
+			Content: "",
+		},
+		expectedID: "f7c27f2eacda7ece5123a4f82db56145ba59f7c9e6c5eeb88552763664506b06",
+	},
+
+	{
+		name: "unicode tag",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      1,
+			Tags: [][]string{
+				{"a", "😀"},
+			},
+			Content: "",
+		},
+		expectedID: "fd2798d165d9bf46acbe817735dc8cedacd4c42dfd9380792487d4902539e986",
+	},
+
+	{
+		name: "zero timestamp",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: 0,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "",
+		},
+		expectedID: "9ca742f2e2eea72ad6e0277a6287e2bb16a3e47d64b8468bc98474e266cf0ec2",
+	},
+
+	{
+		name: "negative timestamp",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: -1760740551,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "",
+		},
+		expectedID: "4740b027040bb4d0ee8e885f567a80277097da70cddd143d8a6dadf97f6faaa3",
+	},
+
+	{
+		name: "max int64 timestamp",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: 9223372036854775807,
+			Kind:      1,
+			Tags:      [][]string{},
+			Content:   "",
+		},
+		expectedID: "b28cdd44496acb49e36c25859f0f819122829a12dc57c07612d5f44cb121d2a7",
+	},
+
+	{
+		name: "different kind",
+		event: Event{
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      20021,
+			Tags:      [][]string{},
+			Content:   "",
+		},
+		expectedID: "995c4894c264e6b9558cb94b7b34008768d53801b99960b47298d4e3e23fadd3",
+	},
+}
+
+func TestEventGetId(t *testing.T) {
+	for _, tc := range idTestCases {
+		t.Run(tc.name, func(t *testing.T) {
+			computed, err := tc.event.GetID()
+			expectOk(t, err)
+			expectEqualStrings(t, computed, tc.expectedID)
+		})
+	}
+}

event_test.go

@@ -0,0 +1,48 @@
+package roots
+
+import (
+	"testing"
+)
+
+const testSK = "f43a0435f69529f310bbd1d6263d2fbf0977f54bfe2310cc37ae5904b83bb167"
+const testPK = "cfa87f35acbde29ba1ab3ee42de527b2cad33ac487e80cf2d6405ea0042c8fef"
+
+var testEvent = Event{
+	ID:        "c7a702e6158744ca03508bbb4c90f9dbb0d6e88fefbfaa511d5ab24b4e3c48ad",
+	PubKey:    testPK,
+	CreatedAt: 1760740551,
+	Kind:      1,
+	Tags:      [][]string{},
+	Content:   "hello world",
+	Sig:       "83b71e15649c9e9da362c175f988c36404cabf357a976d869102a74451cfb8af486f6088b5631033b4927bd46cad7a0d90d7f624aefc0ac260364aa65c36071a",
+}
+
+func TestSignEvent(t *testing.T) {
+	eventID := testEvent.ID
+	expectedSig := testEvent.Sig
+	computedSig, err := SignEvent(eventID, testSK)
+
+	expectOk(t, err)
+	expectEqualStrings(t, computedSig, expectedSig)
+}
+
+func TestSignInvalidEventID(t *testing.T) {
+	badEventID := "thisisabadeventid"
+	expectedError := "invalid event id hex"
+
+	_, err := SignEvent(badEventID, testSK)
+
+	expectError(t, err)
+	expectErrorSubstring(t, err, expectedError)
+}
+
+func TestSignInvalidPrivateKey(t *testing.T) {
+	eventID := testEvent.ID
+	badSK := "thisisabadsecretkey"
+	expectedError := "invalid private key hex"
+
+	_, err := SignEvent(eventID, badSK)
+
+	expectError(t, err)
+	expectErrorSubstring(t, err, expectedError)
+}

event_validate_test.go

@@ -0,0 +1,305 @@
+package roots
+
+import (
+	"testing"
+)
+
+type ValidateEventTestCase struct {
+	name          string
+	event         Event
+	expectedError string
+}
+
+var structureTestCases = []ValidateEventTestCase{
+	{
+		name: "empty pubkey",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    "",
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "pubkey must be 64 lowercase hex characters",
+	},
+
+	{
+		name: "short pubkey",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    "abc123",
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "pubkey must be 64 lowercase hex characters",
+	},
+
+	{
+		name: "long pubkey",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    "c7a702e6158744ca03508bbb4c90f9dbb0d6e88fefbfaa511d5ab24b4e3c48adabc",
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "pubkey must be 64 lowercase hex characters",
+	},
+
+	{
+		name: "non-hex pubkey",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    "zyx-!2e6158744ca03508bbb4c90f9dbb0d6e88fefbfaa511d5ab24b4e3c48ad",
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "pubkey must be 64 lowercase hex characters",
+	},
+
+	{
+		name: "uppercase pubkey",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    "C7A702E6158744CA03508BBB4C90F9DBB0D6E88FEFBFAA511D5AB24B4E3C48AD",
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "pubkey must be 64 lowercase hex characters",
+	},
+
+	{
+		name: "empty id",
+		event: Event{
+			ID:        "",
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "id must be 64 hex characters",
+	},
+
+	{
+		name: "short id",
+		event: Event{
+			ID:        "abc123",
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "id must be 64 hex characters",
+	},
+
+	{
+		name: "empty signature",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       "",
+		},
+		expectedError: "signature must be 128 hex characters",
+	},
+
+	{
+		name: "short signature",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      testEvent.Tags,
+			Content:   testEvent.Content,
+			Sig:       "abc123",
+		},
+		expectedError: "signature must be 128 hex characters",
+	},
+
+	{
+		name: "empty tag",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      [][]string{{}},
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "tags must contain at least two elements",
+	},
+
+	{
+		name: "single element tag",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      [][]string{{"a"}},
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "tags must contain at least two elements",
+	},
+
+	{
+		name: "one good tag, one single element tag",
+		event: Event{
+			ID:        testEvent.ID,
+			PubKey:    testEvent.PubKey,
+			CreatedAt: testEvent.CreatedAt,
+			Kind:      testEvent.Kind,
+			Tags:      [][]string{{"a", "value"}, {"b"}},
+			Content:   testEvent.Content,
+			Sig:       testEvent.Sig,
+		},
+		expectedError: "tags must contain at least two elements",
+	},
+}
+
+func TestValidateEventStructure(t *testing.T) {
+	for _, tc := range structureTestCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.event.ValidateStructure()
+			if err == nil {
+				t.Error("expected invalid event structure")
+			}
+			expectErrorSubstring(t, err, tc.expectedError)
+		})
+	}
+}
+
+func TestValidateEventIDFailure(t *testing.T) {
+	event := Event{
+		ID:        "7f661c2a3c1ed67dc959d6cd968d743d5e6e334313df44724bca939e2aa42c9e",
+		PubKey:    testEvent.PubKey,
+		CreatedAt: testEvent.CreatedAt,
+		Kind:      testEvent.Kind,
+		Tags:      testEvent.Tags,
+		Content:   testEvent.Content,
+		Sig:       testEvent.Sig,
+	}
+
+	err := event.ValidateID()
+	expectErrorSubstring(t, err, "does not match computed id")
+}
+
+func TestValidateSignature(t *testing.T) {
+	eventID := testEvent.ID
+	eventSig := testEvent.Sig
+	publicKey := testEvent.PubKey
+	err := ValidateSignature(eventID, eventSig, publicKey)
+
+	expectOk(t, err)
+}
+
+func TestValidateInvalidSignature(t *testing.T) {
+	eventID := testEvent.ID
+	eventSig := "9e43cbcf7e828a21c53fa35371ee79bffbfd7a3063ae46fc05ec623dd3186667c57e3d006488015e19247df35eb41c61013e051aa87860e23fa5ffbd44120482"
+	publicKey := testEvent.PubKey
+	err := ValidateSignature(eventID, eventSig, publicKey)
+
+	expectErrorSubstring(t, err, "event signature is invalid")
+}
+
+type ValidateSignatureTestCase struct {
+	name          string
+	id            string
+	sig           string
+	pubkey        string
+	expectedError string
+}
+
+var validateSignatureTestCases = []ValidateSignatureTestCase{
+	{
+		name:          "bad event id",
+		id:            "badeventid",
+		sig:           testEvent.Sig,
+		pubkey:        testEvent.PubKey,
+		expectedError: "invalid event id hex",
+	},
+
+	{
+		name:          "bad event signature",
+		id:            testEvent.ID,
+		sig:           "badeventsignature",
+		pubkey:        testEvent.PubKey,
+		expectedError: "invalid event signature hex",
+	},
+
+	{
+		name:          "bad public key",
+		id:            testEvent.ID,
+		sig:           testEvent.Sig,
+		pubkey:        "badpublickey",
+		expectedError: "invalid public key hex",
+	},
+
+	{
+		name:          "malformed event signature",
+		id:            testEvent.ID,
+		sig:           "abc123",
+		pubkey:        testEvent.PubKey,
+		expectedError: "malformed signature",
+	},
+
+	{
+		name:          "malformed public key",
+		id:            testEvent.ID,
+		sig:           testEvent.Sig,
+		pubkey:        "abc123",
+		expectedError: "malformed public key",
+	},
+}
+
+func TestValidateSignatureInvalidEventSignature(t *testing.T) {
+	for _, tc := range validateSignatureTestCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := ValidateSignature(tc.id, tc.sig, tc.pubkey)
+
+			expectError(t, err)
+			expectErrorSubstring(t, err, tc.expectedError)
+		})
+	}
+}
+
+func TestValidateEvent(t *testing.T) {
+	event := Event{
+		ID:        "c9a0f84fcaa889654da8992105eb122eb210c8cbd58210609a5ef7e170b51400",
+		PubKey:    testEvent.PubKey,
+		CreatedAt: testEvent.CreatedAt,
+		Kind:      testEvent.Kind,
+		Tags: [][]string{
+			{"a", "value"},
+			{"b", "value", "optional"},
+		},
+		Content: "valid event",
+		Sig:     "668a715f1eb983172acf230d17bd283daedb2598adf8de4290bcc7eb0b802fdb60669d1e7d1104ac70393f4dbccd07e8abf897152af6ce6c0a75499874e27f14",
+	}
+
+	err := event.Validate()
+	expectOk(t, err)
+}

go.mod

@@ -1,3 +1,13 @@
 module git.wisehodl.dev/jay/go-roots
 
 go 1.23.5
+
+require (
+	github.com/btcsuite/btcd/btcec/v2 v2.3.5
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0
+)
+
+require (
+	github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1 // indirect
+	github.com/decred/dcrd/crypto/blake256 v1.1.0 // indirect
+)

go.sum

@@ -0,0 +1,10 @@
+github.com/btcsuite/btcd/btcec/v2 v2.3.5 h1:dpAlnAwmT1yIBm3exhT1/8iUSD98RDJM5vqJVQDQLiU=
+github.com/btcsuite/btcd/btcec/v2 v2.3.5/go.mod h1:m22FrOAiuxl/tht9wIqAoGHcbnCCaPWyauO8y2LGGtQ=
+github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1 h1:q0rUy8C/TYNBQS1+CGKw68tLOFYSNEs0TFnxxnS9+4U=
+github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1/go.mod h1:7SFka0XMvUgj3hfZtydOrQY2mwhPclbT2snogU7SQQc=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/crypto/blake256 v1.1.0 h1:zPMNGQCm0g4QTY27fOCorQW7EryeQ/U0x++OzVrdms8=
+github.com/decred/dcrd/crypto/blake256 v1.1.0/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=

keys.go

@@ -0,0 +1,30 @@
+package roots
+
+import (
+	"encoding/hex"
+	"fmt"
+	"github.com/decred/dcrd/dcrec/secp256k1/v4"
+)
+
+func GeneratePrivateKey() (string, error) {
+	sk, err := secp256k1.GeneratePrivateKey()
+	if err != nil {
+		return "", err
+	}
+	skBytes := sk.Serialize()
+	return hex.EncodeToString(skBytes), nil
+}
+
+func GetPublicKey(privateKeyHex string) (string, error) {
+	if len(privateKeyHex) != 64 {
+		return "", fmt.Errorf("private key must be 64 hex characters")
+	}
+	skBytes, err := hex.DecodeString(privateKeyHex)
+	if err != nil {
+		return "", fmt.Errorf("invalid private key hex: %w", err)
+	}
+
+	pk := secp256k1.PrivKeyFromBytes(skBytes).PubKey()
+	pkBytes := pk.SerializeCompressed()[1:]
+	return hex.EncodeToString(pkBytes), nil
+}

keys_test.go

@@ -0,0 +1,29 @@
+package roots
+
+import (
+	"regexp"
+	"testing"
+)
+
+var hexPattern = regexp.MustCompile("^[a-f0-9]{64}$")
+
+func TestGeneratePrivateKey(t *testing.T) {
+	sk, err := GeneratePrivateKey()
+
+	expectOk(t, err)
+	if !hexPattern.MatchString(sk) {
+		t.Errorf("invalid private key format: %s", sk)
+	}
+}
+
+func TestGetPublicKey(t *testing.T) {
+	pk, err := GetPublicKey(testSK)
+
+	expectOk(t, err)
+	expectEqualStrings(t, pk, testPK)
+}
+
+func TestGetPublicKeyInvalidPrivateKey(t *testing.T) {
+	_, err := GetPublicKey("abc123")
+	expectErrorSubstring(t, err, "private key must be 64 hex characters")
+}

util_test.go

@@ -0,0 +1,30 @@
+package roots
+
+import (
+	"strings"
+	"testing"
+)
+
+func expectOk(t *testing.T, err error) {
+	if err != nil {
+		t.Errorf("got error: %s", err.Error())
+	}
+}
+
+func expectError(t *testing.T, err error) {
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+}
+
+func expectErrorSubstring(t *testing.T, err error, expected string) {
+	if !strings.Contains(err.Error(), expected) {
+		t.Errorf("error = %q, want substring %q", err.Error(), expected)
+	}
+}
+
+func expectEqualStrings(t *testing.T, got, want string) {
+	if got != want {
+		t.Errorf("got %s, want %s", got, want)
+	}
+}