notation

Documentation

Index

• Constants
• func CacheCRL(ctx context.Context, certs []*x509.Certificate, fetcher corecrl.Fetcher)
• func CreateCRLFetcher(httpClient *http.Client, cacheRoot string) (corecrl.Fetcher, error)
• func SupportCRL(cert *x509.Certificate) bool
• type CRLHandler
  • func (h *CRLHandler) NewFetcher() (corecrl.Fetcher, error)
  • func (h *CRLHandler) NewValidator(opts revocation.Options) (revocation.Validator, error)
• type NotationPluginVerifierConfig
• type RatifyPluginManager
  • func NewRatifyPluginManager(directory string) *RatifyPluginManager
  • func (m *RatifyPluginManager) Get(ctx context.Context, name string) (pl.Plugin, error)
  • func (m *RatifyPluginManager) List(_ context.Context) ([]string, error)
• type RevocationFactory
  • func CreateCRLHandlerFromConfig() RevocationFactory

Constants

const (
	CA               certStoreType = "ca"
	SigningAuthority certStoreType = "signingAuthority"
	TSA              certStoreType = "tsa"
)

Functions

func CacheCRL

func CacheCRL(ctx context.Context, certs []*x509.Certificate, fetcher corecrl.Fetcher)

cacheCRL caches the Certificate Revocation Lists (CRLs) for the given certificates using the provided CRL fetcher. It logs a warning if fetching the CRL fails but does not return an error to ensure the process is not blocked.

func CreateCRLFetcher

func CreateCRLFetcher(httpClient *http.Client, cacheRoot string) (corecrl.Fetcher, error)

CreateCRLFetcher returns a new fetcher instance

func SupportCRL

func SupportCRL(cert *x509.Certificate) bool

SupportCRL checks if the certificate supports CRL

Types

type CRLHandler

type CRLHandler struct {
	CacheEnabled bool
	// contains filtered or unexported fields
}

func (*CRLHandler) NewFetcher

func (h *CRLHandler) NewFetcher() (corecrl.Fetcher, error)

NewFetcher creates a new instance of a Fetcher if it doesn't already exist. If a Fetcher instance is already present, it returns the existing instance. The method also configures the cache for the Fetcher. Returns an instance of corecrl.Fetcher or an error if the Fetcher creation fails.

func (*CRLHandler) NewValidator

func (h *CRLHandler) NewValidator(opts revocation.Options) (revocation.Validator, error)

NewValidator returns a new validator instance

type NotationPluginVerifierConfig

type NotationPluginVerifierConfig struct {
	Name          string `json:"name"`
	ArtifactTypes string `json:"artifactTypes"`

	// VerificationCerts is array of directories containing certificates.
	VerificationCerts []string `json:"verificationCerts"`
	// VerificationCertStores defines a collection of Notary Project Trust Stores.
	// VerificationCertStores accepts new format map[string]map[string][]string
	// {
	//   "ca": {
	//     "certs": {"kv1", "kv2"},
	//   },
	//   "signingauthority": {
	//     "certs": {"kv3"}
	//   },
	// }
	// VerificationCertStores accepts legacy format map[string][]string as well.
	// {
	//   "certs": {"kv1", "kv2"},
	// },
	VerificationCertStores verificationCertStores `json:"verificationCertStores"`
	// TrustPolicyDoc represents a trustpolicy.json document. Reference: https://pkg.go.dev/github.com/notaryproject/notation-go@v0.12.0-beta.1.0.20221125022016-ab113ebd2a6c/verifier/trustpolicy#Document
	TrustPolicyDoc trustpolicy.Document `json:"trustPolicyDoc"`
}

NotationPluginVerifierConfig describes the configuration of notation verifier

type RatifyPluginManager

type RatifyPluginManager struct {
	// contains filtered or unexported fields
}

Implements interface defined in https://github.com/notaryproject/notation-go/blob/main/plugin/manager.go#L20

func NewRatifyPluginManager

func NewRatifyPluginManager(directory string) *RatifyPluginManager

func (*RatifyPluginManager) Get

func (m *RatifyPluginManager) Get(ctx context.Context, name string) (pl.Plugin, error)

Returns a notation Plugin for the given name if present in the target directory

func (*RatifyPluginManager) List

func (m *RatifyPluginManager) List(_ context.Context) ([]string, error)

Lists available notation plugins in the target directory

type RevocationFactory

type RevocationFactory interface {
	// NewFetcher returns a new fetcher instance
	NewFetcher() (corecrl.Fetcher, error)

	// NewValidator returns a new validator instance
	NewValidator(revocation.Options) (revocation.Validator, error)
}

RevocationFactory is an interface that defines methods for creating instances related to revocation. It provides methods to create a new fetcher and a new validator.

func CreateCRLHandlerFromConfig

func CreateCRLHandlerFromConfig() RevocationFactory

CreateCRLHandlerFromConfig creates a new instance of CRLHandler using the configuration provided in config.CRLConf. It returns a RevocationFactory interface. The CRLHandler will have its CacheDisabled field set based on the configuration, and it will use a default HTTP client.