data

package
v0.0.0-...-3b700e2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 24, 2015 License: BSD-3-Clause Imports: 13 Imported by: 81

Documentation

Index

Constants

View Source
const (
	CanonicalRootRole      = "root"
	CanonicalTargetsRole   = "targets"
	CanonicalSnapshotRole  = "snapshot"
	CanonicalTimestampRole = "timestamp"
)

Canonical base role names

Variables

View Source
var TUFTypes = map[string]string{
	CanonicalRootRole:      "Root",
	CanonicalTargetsRole:   "Targets",
	CanonicalSnapshotRole:  "Snapshot",
	CanonicalTimestampRole: "Timestamp",
}

TUFTypes is the set of metadata types

ValidRoles holds an overrideable mapping of canonical role names to any custom roles names a user wants to make use of. This allows us to be internally consistent while using different roles in the public TUF files.

Functions

func CanonicalRole

func CanonicalRole(role string) string

CanonicalRole does a reverse lookup to get the canonical role name from the (possibly overridden) role name

func DefaultExpires

func DefaultExpires(role string) time.Time

DefaultExpires gets the default expiry time for the given role

func RoleName

func RoleName(canonicalRole string) string

RoleName returns the (possibly overridden) role name for the provided canonical role name

func SetDefaultExpiryTimes

func SetDefaultExpiryTimes(times map[string]int)

SetDefaultExpiryTimes allows one to change the default expiries.

func SetTUFTypes

func SetTUFTypes(ts map[string]string)

SetTUFTypes allows one to override some or all of the default type names in TUF.

func SetValidRoles

func SetValidRoles(rs map[string]string)

SetValidRoles is a utility function to override some or all of the roles

func ValidRole

func ValidRole(name string) bool

ValidRole only determines the name is semantically correct. For target delegated roles, it does NOT check the the appropriate parent roles exist.

func ValidTUFType

func ValidTUFType(typ, role string) bool

ValidTUFType checks if the given type is valid for the role

Types

type Delegations

type Delegations struct {
	Keys  map[string]PublicKey `json:"keys"`
	Roles []*Role              `json:"roles"`
}

Delegations holds a tier of targets delegations

func NewDelegations

func NewDelegations() *Delegations

NewDelegations initializes an empty Delegations object

type FileMeta

type FileMeta struct {
	Length int64           `json:"length"`
	Hashes Hashes          `json:"hashes"`
	Custom json.RawMessage `json:"custom,omitempty"`
}

FileMeta contains the size and hashes for a metadata or target file. Custom data can be optionally added.

func NewFileMeta

func NewFileMeta(r io.Reader, hashAlgorithms ...string) (FileMeta, error)

NewFileMeta generates a FileMeta object from the reader, using the hash algorithms provided

type Files

type Files map[string]FileMeta

Files is the map of paths to file meta container in targets and delegations metadata files

type Hashes

type Hashes map[string][]byte

Hashes is the map of hash type to digest created for each metadata and target file

type Key

type Key interface {
	ID() string
	Algorithm() KeyAlgorithm
	Public() []byte
}

Key is the minimal interface for a public key. It is declared independently of PublicKey for composability.

type KeyAlgorithm

type KeyAlgorithm string

KeyAlgorithm for types of keys

const (
	ED25519Key   KeyAlgorithm = "ed25519"
	RSAKey       KeyAlgorithm = "rsa"
	RSAx509Key   KeyAlgorithm = "rsa-x509"
	ECDSAKey     KeyAlgorithm = "ecdsa"
	ECDSAx509Key KeyAlgorithm = "ecdsa-x509"
)

Key types

func (KeyAlgorithm) String

func (k KeyAlgorithm) String() string

type KeyPair

type KeyPair struct {
	Public  []byte `json:"public"`
	Private []byte `json:"private"`
}

KeyPair holds the public and private key bytes

type PrivateKey

type PrivateKey interface {
	Key

	Private() []byte
}

PrivateKey adds the ability to access the private key

type PublicKey

type PublicKey interface {
	Key
}

PublicKey is the necessary interface for public keys

func NewPublicKey

func NewPublicKey(algorithm KeyAlgorithm, public []byte) PublicKey

NewPublicKey instantiates a new TUFKey where the private bytes are guaranteed to be nil

func PublicKeyFromPrivate

func PublicKeyFromPrivate(pk PrivateKey) PublicKey

PublicKeyFromPrivate returns a new TUFKey based on a private key, with the private key bytes guaranteed to be nil.

type Role

type Role struct {
	RootRole
	Name             string   `json:"name"`
	Paths            []string `json:"paths,omitempty"`
	PathHashPrefixes []string `json:"path_hash_prefixes,omitempty"`
	Email            string   `json:"email,omitempty"`
}

Role is a more verbose role as they appear in targets delegations

func NewRole

func NewRole(name string, threshold int, keyIDs, paths, pathHashPrefixes []string) (*Role, error)

NewRole creates a new Role object from the given parameters

func (Role) CheckPaths

func (r Role) CheckPaths(path string) bool

CheckPaths checks if a given path is valid for the role

func (Role) CheckPrefixes

func (r Role) CheckPrefixes(hash string) bool

CheckPrefixes checks if a given hash matches the prefixes for the role

func (Role) IsDelegation

func (r Role) IsDelegation() bool

IsDelegation checks if the role is a delegation or a root role

func (Role) IsValid

func (r Role) IsValid() bool

IsValid checks if the role has defined both paths and path hash prefixes, having both is invalid

func (Role) ValidKey

func (r Role) ValidKey(id string) bool

ValidKey checks if the given id is a recognized signing key for the role

type Root

type Root struct {
	Type    string    `json:"_type"`
	Version int       `json:"version"`
	Expires time.Time `json:"expires"`
	// These keys are public keys. We use TUFKey instead of PublicKey to
	// support direct JSON unmarshaling.
	Keys               map[string]*TUFKey   `json:"keys"`
	Roles              map[string]*RootRole `json:"roles"`
	ConsistentSnapshot bool                 `json:"consistent_snapshot"`
}

Root is the Signed component of a root.json

type RootRole

type RootRole struct {
	KeyIDs    []string `json:"keyids"`
	Threshold int      `json:"threshold"`
}

RootRole is a cut down role as it appears in the root.json

type SigAlgorithm

type SigAlgorithm string

SigAlgorithm for types of signatures

const (
	EDDSASignature       SigAlgorithm = "eddsa"
	RSAPSSSignature      SigAlgorithm = "rsapss"
	RSAPKCS1v15Signature SigAlgorithm = "rsapkcs1v15"
	ECDSASignature       SigAlgorithm = "ecdsa"
	PyCryptoSignature    SigAlgorithm = "pycrypto-pkcs#1 pss"
)

Signature types

func (SigAlgorithm) String

func (k SigAlgorithm) String() string

type Signature

type Signature struct {
	KeyID     string       `json:"keyid"`
	Method    SigAlgorithm `json:"method"`
	Signature []byte       `json:"sig"`
}

Signature is a signature on a piece of metadata

func (*Signature) UnmarshalJSON

func (s *Signature) UnmarshalJSON(data []byte) error

UnmarshalJSON does a custom unmarshalling of the signature JSON

type Signed

type Signed struct {
	Signed     json.RawMessage `json:"signed"`
	Signatures []Signature     `json:"signatures"`
}

Signed is the high level, partially deserialized metadata object used to verify signatures before fully unpacking, or to add signatures before fully packing

type SignedCommon

type SignedCommon struct {
	Type    string    `json:"_type"`
	Expires time.Time `json:"expires"`
	Version int       `json:"version"`
}

SignedCommon contains the fields common to the Signed component of all TUF metadata files

type SignedMeta

type SignedMeta struct {
	Signed     SignedCommon `json:"signed"`
	Signatures []Signature  `json:"signatures"`
}

SignedMeta is used in server validation where we only need signatures and common fields

type SignedRoot

type SignedRoot struct {
	Signatures []Signature
	Signed     Root
	Dirty      bool
}

SignedRoot is a fully unpacked root.json

func NewRoot

func NewRoot(keys map[string]PublicKey, roles map[string]*RootRole, consistent bool) (*SignedRoot, error)

NewRoot initializes a new SignedRoot with a set of keys, roles, and the consistent flag

func RootFromSigned

func RootFromSigned(s *Signed) (*SignedRoot, error)

RootFromSigned fully unpacks a Signed object into a SignedRoot

func (SignedRoot) ToSigned

func (r SignedRoot) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedRoot for further signing

type SignedSnapshot

type SignedSnapshot struct {
	Signatures []Signature
	Signed     Snapshot
	Dirty      bool
}

SignedSnapshot is a fully unpacked snapshot.json

func NewSnapshot

func NewSnapshot(root *Signed, targets *Signed) (*SignedSnapshot, error)

NewSnapshot initilizes a SignedSnapshot with a given top level root and targets objects

func SnapshotFromSigned

func SnapshotFromSigned(s *Signed) (*SignedSnapshot, error)

SnapshotFromSigned fully unpacks a Signed object into a SignedSnapshot

func (*SignedSnapshot) AddMeta

func (sp *SignedSnapshot) AddMeta(role string, meta FileMeta)

AddMeta updates a role in the snapshot with new meta

func (SignedSnapshot) ToSigned

func (sp SignedSnapshot) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedSnapshot for further signing

type SignedTargets

type SignedTargets struct {
	Signatures []Signature
	Signed     Targets
	Dirty      bool
}

SignedTargets is a fully unpacked targets.json, or target delegation json file

func NewTargets

func NewTargets() *SignedTargets

NewTargets intiializes a new empty SignedTargets object

func TargetsFromSigned

func TargetsFromSigned(s *Signed) (*SignedTargets, error)

TargetsFromSigned fully unpacks a Signed object into a SignedTargets

func (*SignedTargets) AddDelegation

func (t *SignedTargets) AddDelegation(role *Role, keys []*PublicKey) error

AddDelegation will add a new delegated role with the given keys, ensuring the keys either already exist, or are added to the map of delegation keys

func (*SignedTargets) AddTarget

func (t *SignedTargets) AddTarget(path string, meta FileMeta)

AddTarget adds or updates the meta for the given path

func (SignedTargets) GetDelegations

func (t SignedTargets) GetDelegations(path string) []*Role

GetDelegations filters the roles and associated keys that may be the signers for the given target path. If no appropriate roles can be found, it will simply return nil for the return values. The returned slice of Role will have order maintained relative to the role slice on Delegations per TUF spec proposal on using order to determine priority.

func (SignedTargets) GetMeta

func (t SignedTargets) GetMeta(path string) *FileMeta

GetMeta attempts to find the targets entry for the path. It will return nil in the case of the target not being found.

func (SignedTargets) ToSigned

func (t SignedTargets) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedTargets for further signing

type SignedTimestamp

type SignedTimestamp struct {
	Signatures []Signature
	Signed     Timestamp
	Dirty      bool
}

SignedTimestamp is a fully unpacked timestamp.json

func NewTimestamp

func NewTimestamp(snapshot *Signed) (*SignedTimestamp, error)

NewTimestamp initializes a timestamp with an existing snapshot

func TimestampFromSigned

func TimestampFromSigned(s *Signed) (*SignedTimestamp, error)

TimestampFromSigned parsed a Signed object into a fully unpacked SignedTimestamp

func (SignedTimestamp) ToSigned

func (ts SignedTimestamp) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedTimestamp such that it can be signed

type Snapshot

type Snapshot struct {
	Type    string    `json:"_type"`
	Version int       `json:"version"`
	Expires time.Time `json:"expires"`
	Meta    Files     `json:"meta"`
}

Snapshot is the Signed component of a snapshot.json

type TUFKey

type TUFKey struct {
	Type  KeyAlgorithm `json:"keytype"`
	Value KeyPair      `json:"keyval"`
	// contains filtered or unexported fields
}

TUFKey is the structure used for both public and private keys in TUF. Normally it would make sense to use a different structures for public and private keys, but that would change the key ID algorithm (since the canonical JSON would be different). This structure should normally be accessed through the PublicKey or PrivateKey interfaces.

func NewPrivateKey

func NewPrivateKey(algorithm KeyAlgorithm, public, private []byte) *TUFKey

NewPrivateKey instantiates a new TUFKey with the private key component populated

func (TUFKey) Algorithm

func (k TUFKey) Algorithm() KeyAlgorithm

Algorithm returns the algorithm of the key

func (*TUFKey) ID

func (k *TUFKey) ID() string

ID efficiently generates if necessary, and caches the ID of the key

func (TUFKey) Private

func (k TUFKey) Private() []byte

Private returns the private bytes

func (TUFKey) Public

func (k TUFKey) Public() []byte

Public returns the public bytes

type Targets

type Targets struct {
	SignedCommon
	Targets     Files       `json:"targets"`
	Delegations Delegations `json:"delegations,omitempty"`
}

Targets is the Signed components of a targets.json or delegation json file

type Timestamp

type Timestamp struct {
	Type    string    `json:"_type"`
	Version int       `json:"version"`
	Expires time.Time `json:"expires"`
	Meta    Files     `json:"meta"`
}

Timestamp is the Signed component of a timestamp.json

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL