keychain

Documentation

Overview

Package keychain contains functions for retrieving certificates from the Darwin Keychain.

Index

• type Key
  • func Cred(issuerCN string) (*Key, error)
  • func (k *Key) CertificateChain() [][]byte
  • func (k *Key) Close() error
  • func (k *Key) Decrypt(ciphertext []byte, opts crypto.DecrypterOpts) ([]byte, error)
  • func (k *Key) Encrypt(plaintext []byte, opts any) ([]byte, error)
  • func (k *Key) Public() crypto.PublicKey
  • func (k *Key) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error)

Types

type Key

type Key struct {
	// contains filtered or unexported fields
}

Key is a wrapper around the Keychain reference that uses it to implement signing-related methods with Keychain functionality.

func Cred

func Cred(issuerCN string) (*Key, error)

Cred gets the first Credential (filtering on issuer) corresponding to available certificate and private key pairs (i.e. identities) available in the Keychain. This includes both the current login keychain for the user, and the system keychain.

func (*Key) CertificateChain

func (k *Key) CertificateChain() [][]byte

CertificateChain returns the credential as a raw X509 cert chain. This contains the public key.

func (*Key) Close

func (k *Key) Close() error

Close releases resources held by the credential.

func (*Key) Decrypt

func (k *Key) Decrypt(ciphertext []byte, opts crypto.DecrypterOpts) ([]byte, error)

Decrypt decrypts a ciphertext message digest using the private key. Here, we pass off the decryption to Keychain library. Currently, only *rsa.OAEPOptions is supported for opts.

func (*Key) Encrypt

func (k *Key) Encrypt(plaintext []byte, opts any) ([]byte, error)

Encrypt encrypts a plaintext message digest using the public key. Here, we pass off the encryption to Keychain library.

func (*Key) Public

func (k *Key) Public() crypto.PublicKey

Public returns the corresponding public key for this Key. Good thing we extracted it when we created it.

func (*Key) Sign

func (k *Key) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error)

Sign signs a message digest. Here, we pass off the signing to Keychain library.