# 1. Генерируем приватный ключ (PKCS#8)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem

# 2. Извлекаем публичный ключ (в формате PKIX)
openssl rsa -pubout -in private.pem -out public.pem

echo -n "<request-body>" | openssl dgst -sha256 -sign private.pem | base64 -w 0

package main

import (
    "crypto"
    "crypto/rand"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "encoding/pem"
    "fmt"
    "os"
)

func signRequest(privateKeyPath string, requestBody []byte) (string, error) {
    // Читаем приватный ключ
    keyData, err := os.ReadFile(privateKeyPath)
    if err != nil {
        return "", err
    }

    // Декодируем PEM
    block, _ := pem.Decode(keyData)
    if block == nil {
        return "", fmt.Errorf("failed to parse PEM block")
    }

    // Парсим приватный ключ
    privateKey, err := x509.ParsePKCS8PrivateKey(block.Bytes)
    if err != nil {
        return "", err
    }

    rsaPrivateKey, ok := privateKey.(*rsa.PrivateKey)
    if !ok {
        return "", fmt.Errorf("not an RSA private key")
    }

    // Хэшируем тело запроса
    hashed := sha256.Sum256(requestBody)

    // Подписываем
    signature, err := rsa.SignPKCS1v15(rand.Reader, rsaPrivateKey, crypto.SHA256, hashed[:])
    if err != nil {
        return "", err
    }

    // Кодируем в base64
    return base64.StdEncoding.EncodeToString(signature), nil
}

func main() {
    requestBody := []byte(`{"field": "value"}`)
    signature, err := signRequest("private.pem", requestBody)
    if err != nil {
        panic(err)
    }
    fmt.Println("request-signature:", signature)
}

POST /v1/registries HTTP/1.1
Host: client-api.dev.haskaplan.net
Content-Type: multipart/form-data
client-id: your-client-id
client-secret: your-client-secret
request-signature: <base64-encoded-signature>

[request body]