[deltadecay]

Added methods digest_sign and digest_verify to generate and verify
digital signatures.

Tests added with both RSA and EC key signing and verification.

[codecov]

Codecov Report

❌ Patch coverage is 83.60656% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.67%. Comparing base (381615e) to head (b613323).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
src/OpenSSL.jl	83.60%	10 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #107      +/-   ##
==========================================
+ Coverage   81.91%   83.67%   +1.76%     
==========================================
  Files           2        2              
  Lines        1244     1415     +171     
==========================================
+ Hits         1019     1184     +165     
- Misses        225      231       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[quinnj-bot]

[comment generated via AI]

Thanks! Signing and verifying round-trip for RSA and P-256 here (OpenSSL_jll 3.5.4), and changed data, another key or a mismatched digest all give false. A few things before merging:

• Malformed ECDSA signatures throw instead of returning false. EVP_DigestVerifyFinal returns -1 when an ECDSA signature isn't valid DER. So a truncated or empty signature, or one with its first byte flipped, throws OpenSSLError, twice with an empty message. The same inputs give false with an RSA key. Since the signature usually comes from the other party, could digest_verify return false for any result other than 1, and throw only when init or update fails?
• A failed verify leaves its errors on OpenSSL's per-thread error queue. After one, the queue holds "bad signature" / "padding check failed" (RSA) or "provider signature failure" (EC). The next unrelated OpenSSLError() on that thread then reports them. Calling clear_errors!() before returning false avoids that.
• The tests only check the true case. A digest_verify that always returned true would pass them. Could you add checks that changed data, another key, and a modified or truncated signature give false?
• The EC_KEY_set_asn1_flag line in ec_generate_key seems unneeded. Named curves are already the default since OpenSSL 1.1.0: the P-256 public key is the same 91-byte SPKI with or without the line. Unless you saw a case that needed it, I'd drop it from this PR.
• Nit: in digest_sign_final, out_length can go to ccall as Ref{Csize_t}, without pointer_from_objref.