fix: add NOSONAR markers for RSA signature false positives

SonarCloud rule S5542 incorrectly flags rsa.SignPKCS1v15 as insecure
encryption when it's actually a signature scheme (not encryption).
RSA-PKCS1v15 signatures are standard and secure, used in JWT RS256/384/512.

- Added NOSONAR inline comments to both SignDigest implementations
- Added file-level exclusions in sonar-project.properties for PKI signers

Author: leifj

pkg/pki/keymaterial_signer.go

@@ -73,7 +73,7 @@ func (s *KeyMaterialSigner) SignDigest(ctx context.Context, digest []byte) ([]by
 		// widely used in JWT RS256/RS384/RS512. It's distinct from RSA-PKCS1v15 encryption
 		// which has known vulnerabilities. The signature scheme is secure.
 		hash := getHashForAlgorithm(s.km.SigningMethod.Alg())
-		return rsa.SignPKCS1v15(rand.Reader, key, hash, digest) //nolint:gosec // This is signature, not encryption
+		return rsa.SignPKCS1v15(rand.Reader, key, hash, digest) //nolint:gosec // NOSONAR go:S5542 - This is signature, not encryption
 	default:
 		return nil, fmt.Errorf("unsupported key type: %T", s.km.PrivateKey)
 	}

pkg/pki/software.go

@@ -79,7 +79,7 @@ func (s *SoftwareSigner) SignDigest(ctx context.Context, digest []byte) ([]byte,
 		// widely used in JWT RS256/RS384/RS512. It's distinct from RSA-PKCS1v15 encryption
 		// which has known vulnerabilities. The signature scheme is secure.
 		hash := getHashForAlgorithm(s.algorithm)
-		return rsa.SignPKCS1v15(rand.Reader, key, hash, digest) //nolint:gosec // This is signature, not encryption
+		return rsa.SignPKCS1v15(rand.Reader, key, hash, digest) //nolint:gosec // NOSONAR go:S5542 - This is signature, not encryption
 	case *ecdsa.PrivateKey:
 		// Sign the digest directly using ECDSA
 		r, sigS, err := ecdsa.Sign(rand.Reader, key, digest)

sonar-project.properties

@@ -29,7 +29,7 @@ sonar.go.coverage.reportPaths=coverage.out,didcomm_coverage.out
 #    - This is a key-wrapping primitive, not general-purpose encryption
 #
 # These patterns are required for standards compliance and interoperability.
-sonar.issue.ignore.multicriteria=e1,e2
+sonar.issue.ignore.multicriteria=e1,e2,e3,e4
 
 # Exclude S5542 from JWE crypto implementation (AES-CBC for content encryption, AES Key Wrap)
 sonar.issue.ignore.multicriteria.e1.ruleKey=go:S5542
@@ -38,3 +38,11 @@ sonar.issue.ignore.multicriteria.e1.resourceKey=pkg/didcomm/crypto/jwe.go
 # Exclude from test files (test code uses same crypto primitives)
 sonar.issue.ignore.multicriteria.e2.ruleKey=go:S5542
 sonar.issue.ignore.multicriteria.e2.resourceKey=**/*_test.go
+
+# Exclude S5542 from PKI signers (RSA-PKCS1v15 SIGNATURE, not encryption)
+# SonarCloud incorrectly flags rsa.SignPKCS1v15 as encryption when it's a signature scheme
+sonar.issue.ignore.multicriteria.e3.ruleKey=go:S5542
+sonar.issue.ignore.multicriteria.e3.resourceKey=pkg/pki/keymaterial_signer.go
+
+sonar.issue.ignore.multicriteria.e4.ruleKey=go:S5542
+sonar.issue.ignore.multicriteria.e4.resourceKey=pkg/pki/software.go