data

package
v0.0.0-...-3b700e2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 24, 2015 License: BSD-3-Clause Imports: 13 Imported by: 81

Documentation

Index

Constants

View Source 
const (
	CanonicalRootRole      = "root"
	CanonicalTargetsRole   = "targets"
	CanonicalSnapshotRole  = "snapshot"
	CanonicalTimestampRole = "timestamp"
)

Canonical base role names

Variables

View Source 
var TUFTypes = map[string]string{
	CanonicalRootRole:      "Root",
	CanonicalTargetsRole:   "Targets",
	CanonicalSnapshotRole:  "Snapshot",
	CanonicalTimestampRole: "Timestamp",
}

TUFTypes is the set of metadata types

View Source 
var ValidRoles = map[string]string{
	CanonicalRootRole:      CanonicalRootRole,
	CanonicalTargetsRole:   CanonicalTargetsRole,
	CanonicalSnapshotRole:  CanonicalSnapshotRole,
	CanonicalTimestampRole: CanonicalTimestampRole,
}

ValidRoles holds an overrideable mapping of canonical role names to any custom roles names a user wants to make use of. This allows us to be internally consistent while using different roles in the public TUF files.

Functions

func CanonicalRole 

func CanonicalRole(role string) string

CanonicalRole does a reverse lookup to get the canonical role name from the (possibly overridden) role name

func DefaultExpires 

func DefaultExpires(role string) time.Time

DefaultExpires gets the default expiry time for the given role

func RoleName 

func RoleName(canonicalRole string) string

RoleName returns the (possibly overridden) role name for the provided canonical role name

func SetDefaultExpiryTimes 

func SetDefaultExpiryTimes(times map[string]int)

SetDefaultExpiryTimes allows one to change the default expiries.

func SetTUFTypes 

func SetTUFTypes(ts map[string]string)

SetTUFTypes allows one to override some or all of the default type names in TUF.

func SetValidRoles 

func SetValidRoles(rs map[string]string)

SetValidRoles is a utility function to override some or all of the roles

func ValidRole 

func ValidRole(name string) bool

ValidRole only determines the name is semantically correct. For target delegated roles, it does NOT check the the appropriate parent roles exist.

func ValidTUFType 

func ValidTUFType(typ, role string) bool

ValidTUFType checks if the given type is valid for the role

Types

type Delegations 

type Delegations struct {
	Keys  map[string]PublicKey `json:"keys"`
	Roles []*Role              `json:"roles"`
}

Delegations holds a tier of targets delegations

func NewDelegations 

func NewDelegations() *Delegations

NewDelegations initializes an empty Delegations object

type FileMeta 

type FileMeta struct {
	Length int64           `json:"length"`
	Hashes Hashes          `json:"hashes"`
	Custom json.RawMessage `json:"custom,omitempty"`
}

FileMeta contains the size and hashes for a metadata or target file. Custom data can be optionally added.

func NewFileMeta 

func NewFileMeta(r io.Reader, hashAlgorithms ...string) (FileMeta, error)

NewFileMeta generates a FileMeta object from the reader, using the hash algorithms provided

type Files 

type Files map[string]FileMeta

Files is the map of paths to file meta container in targets and delegations metadata files

type Hashes 

type Hashes map[string][]byte

Hashes is the map of hash type to digest created for each metadata and target file

type Key 

type Key interface {
	ID() string
	Algorithm() KeyAlgorithm
	Public() []byte
}

Key is the minimal interface for a public key. It is declared independently of PublicKey for composability.

type KeyAlgorithm 

type KeyAlgorithm string

KeyAlgorithm for types of keys 

const (
	ED25519Key   KeyAlgorithm = "ed25519"
	RSAKey       KeyAlgorithm = "rsa"
	RSAx509Key   KeyAlgorithm = "rsa-x509"
	ECDSAKey     KeyAlgorithm = "ecdsa"
	ECDSAx509Key KeyAlgorithm = "ecdsa-x509"
)

Key types

func (KeyAlgorithm) String 

func (k KeyAlgorithm) String() string

type KeyPair 

type KeyPair struct {
	Public  []byte `json:"public"`
	Private []byte `json:"private"`
}

KeyPair holds the public and private key bytes

type PrivateKey 

type PrivateKey interface {
	Key

	Private() []byte
}

PrivateKey adds the ability to access the private key

type PublicKey 

type PublicKey interface {
	Key
}

PublicKey is the necessary interface for public keys

func NewPublicKey 

func NewPublicKey(algorithm KeyAlgorithm, public []byte) PublicKey

NewPublicKey instantiates a new TUFKey where the private bytes are guaranteed to be nil

func PublicKeyFromPrivate 

func PublicKeyFromPrivate(pk PrivateKey) PublicKey

PublicKeyFromPrivate returns a new TUFKey based on a private key, with the private key bytes guaranteed to be nil.

type Role 

type Role struct {
	RootRole
	Name             string   `json:"name"`
	Paths            []string `json:"paths,omitempty"`
	PathHashPrefixes []string `json:"path_hash_prefixes,omitempty"`
	Email            string   `json:"email,omitempty"`
}

Role is a more verbose role as they appear in targets delegations

func NewRole 

func NewRole(name string, threshold int, keyIDs, paths, pathHashPrefixes []string) (*Role, error)

NewRole creates a new Role object from the given parameters

func (Role) CheckPaths 

func (r Role) CheckPaths(path string) bool

CheckPaths checks if a given path is valid for the role

func (Role) CheckPrefixes 

func (r Role) CheckPrefixes(hash string) bool

CheckPrefixes checks if a given hash matches the prefixes for the role

func (Role) IsDelegation 

func (r Role) IsDelegation() bool

IsDelegation checks if the role is a delegation or a root role

func (Role) IsValid 

func (r Role) IsValid() bool

IsValid checks if the role has defined both paths and path hash prefixes, having both is invalid

func (Role) ValidKey 

func (r Role) ValidKey(id string) bool

ValidKey checks if the given id is a recognized signing key for the role

type Root 

type Root struct {
	Type    string    `json:"_type"`
	Version int       `json:"version"`
	Expires time.Time `json:"expires"`
	// These keys are public keys. We use TUFKey instead of PublicKey to
	// support direct JSON unmarshaling.
	Keys               map[string]*TUFKey   `json:"keys"`
	Roles              map[string]*RootRole `json:"roles"`
	ConsistentSnapshot bool                 `json:"consistent_snapshot"`
}

Root is the Signed component of a root.json

type RootRole 

type RootRole struct {
	KeyIDs    []string `json:"keyids"`
	Threshold int      `json:"threshold"`
}

RootRole is a cut down role as it appears in the root.json

type SigAlgorithm 

type SigAlgorithm string

SigAlgorithm for types of signatures 

const (
	EDDSASignature       SigAlgorithm = "eddsa"
	RSAPSSSignature      SigAlgorithm = "rsapss"
	RSAPKCS1v15Signature SigAlgorithm = "rsapkcs1v15"
	ECDSASignature       SigAlgorithm = "ecdsa"
	PyCryptoSignature    SigAlgorithm = "pycrypto-pkcs#1 pss"
)

Signature types

func (SigAlgorithm) String 

func (k SigAlgorithm) String() string

type Signature 

type Signature struct {
	KeyID     string       `json:"keyid"`
	Method    SigAlgorithm `json:"method"`
	Signature []byte       `json:"sig"`
}

Signature is a signature on a piece of metadata

func (*Signature) UnmarshalJSON 

func (s *Signature) UnmarshalJSON(data []byte) error

UnmarshalJSON does a custom unmarshalling of the signature JSON

type Signed 

type Signed struct {
	Signed     json.RawMessage `json:"signed"`
	Signatures []Signature     `json:"signatures"`
}

Signed is the high level, partially deserialized metadata object used to verify signatures before fully unpacking, or to add signatures before fully packing

type SignedCommon 

type SignedCommon struct {
	Type    string    `json:"_type"`
	Expires time.Time `json:"expires"`
	Version int       `json:"version"`
}

SignedCommon contains the fields common to the Signed component of all TUF metadata files

type SignedMeta 

type SignedMeta struct {
	Signed     SignedCommon `json:"signed"`
	Signatures []Signature  `json:"signatures"`
}

SignedMeta is used in server validation where we only need signatures and common fields

type SignedRoot 

type SignedRoot struct {
	Signatures []Signature
	Signed     Root
	Dirty      bool
}

SignedRoot is a fully unpacked root.json

func NewRoot 

func NewRoot(keys map[string]PublicKey, roles map[string]*RootRole, consistent bool) (*SignedRoot, error)

NewRoot initializes a new SignedRoot with a set of keys, roles, and the consistent flag

func RootFromSigned 

func RootFromSigned(s *Signed) (*SignedRoot, error)

RootFromSigned fully unpacks a Signed object into a SignedRoot

func (SignedRoot) ToSigned 

func (r SignedRoot) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedRoot for further signing

type SignedSnapshot 

type SignedSnapshot struct {
	Signatures []Signature
	Signed     Snapshot
	Dirty      bool
}

SignedSnapshot is a fully unpacked snapshot.json

func NewSnapshot 

func NewSnapshot(root *Signed, targets *Signed) (*SignedSnapshot, error)

NewSnapshot initilizes a SignedSnapshot with a given top level root and targets objects

func SnapshotFromSigned 

func SnapshotFromSigned(s *Signed) (*SignedSnapshot, error)

SnapshotFromSigned fully unpacks a Signed object into a SignedSnapshot

func (*SignedSnapshot) AddMeta 

func (sp *SignedSnapshot) AddMeta(role string, meta FileMeta)

AddMeta updates a role in the snapshot with new meta

func (SignedSnapshot) ToSigned 

func (sp SignedSnapshot) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedSnapshot for further signing

type SignedTargets 

type SignedTargets struct {
	Signatures []Signature
	Signed     Targets
	Dirty      bool
}

SignedTargets is a fully unpacked targets.json, or target delegation json file

func NewTargets 

func NewTargets() *SignedTargets

NewTargets intiializes a new empty SignedTargets object

func TargetsFromSigned 

func TargetsFromSigned(s *Signed) (*SignedTargets, error)

TargetsFromSigned fully unpacks a Signed object into a SignedTargets

func (*SignedTargets) AddDelegation 

func (t *SignedTargets) AddDelegation(role *Role, keys []*PublicKey) error

AddDelegation will add a new delegated role with the given keys, ensuring the keys either already exist, or are added to the map of delegation keys

func (*SignedTargets) AddTarget 

func (t *SignedTargets) AddTarget(path string, meta FileMeta)

AddTarget adds or updates the meta for the given path

func (SignedTargets) GetDelegations 

func (t SignedTargets) GetDelegations(path string) []*Role

GetDelegations filters the roles and associated keys that may be the signers for the given target path. If no appropriate roles can be found, it will simply return nil for the return values. The returned slice of Role will have order maintained relative to the role slice on Delegations per TUF spec proposal on using order to determine priority.

func (SignedTargets) GetMeta 

func (t SignedTargets) GetMeta(path string) *FileMeta

GetMeta attempts to find the targets entry for the path. It will return nil in the case of the target not being found.

func (SignedTargets) ToSigned 

func (t SignedTargets) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedTargets for further signing

type SignedTimestamp 

type SignedTimestamp struct {
	Signatures []Signature
	Signed     Timestamp
	Dirty      bool
}

SignedTimestamp is a fully unpacked timestamp.json

func NewTimestamp 

func NewTimestamp(snapshot *Signed) (*SignedTimestamp, error)

NewTimestamp initializes a timestamp with an existing snapshot

func TimestampFromSigned 

func TimestampFromSigned(s *Signed) (*SignedTimestamp, error)

TimestampFromSigned parsed a Signed object into a fully unpacked SignedTimestamp

func (SignedTimestamp) ToSigned 

func (ts SignedTimestamp) ToSigned() (*Signed, error)

ToSigned partially serializes a SignedTimestamp such that it can be signed

type Snapshot 

type Snapshot struct {
	Type    string    `json:"_type"`
	Version int       `json:"version"`
	Expires time.Time `json:"expires"`
	Meta    Files     `json:"meta"`
}

Snapshot is the Signed component of a snapshot.json

type TUFKey 

type TUFKey struct {
	Type  KeyAlgorithm `json:"keytype"`
	Value KeyPair      `json:"keyval"`
	// contains filtered or unexported fields
}

TUFKey is the structure used for both public and private keys in TUF. Normally it would make sense to use a different structures for public and private keys, but that would change the key ID algorithm (since the canonical JSON would be different). This structure should normally be accessed through the PublicKey or PrivateKey interfaces.

func NewPrivateKey 

func NewPrivateKey(algorithm KeyAlgorithm, public, private []byte) *TUFKey

NewPrivateKey instantiates a new TUFKey with the private key component populated

func (TUFKey) Algorithm 

func (k TUFKey) Algorithm() KeyAlgorithm

Algorithm returns the algorithm of the key

func (*TUFKey) ID 

func (k *TUFKey) ID() string

ID efficiently generates if necessary, and caches the ID of the key

func (TUFKey) Private 

func (k TUFKey) Private() []byte

Private returns the private bytes

func (TUFKey) Public 

func (k TUFKey) Public() []byte

Public returns the public bytes

type Targets 

type Targets struct {
	SignedCommon
	Targets     Files       `json:"targets"`
	Delegations Delegations `json:"delegations,omitempty"`
}

Targets is the Signed components of a targets.json or delegation json file

type Timestamp 

type Timestamp struct {
	Type    string    `json:"_type"`
	Version int       `json:"version"`
	Expires time.Time `json:"expires"`
	Meta    Files     `json:"meta"`
}

Timestamp is the Signed component of a timestamp.json

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.