tuf

Documentation

Index

• Constants
• Variables
• func DefaultExpires(role string) time.Time
• func GcsRemoteStore(ctx context.Context, bucket string, opts *GcsRemoteOptions, ...) (client.RemoteStore, error)
• func Initialize(ctx context.Context, mirror string, root []byte) error
• type FulcioKeyVal
  • func GetFulcioKeyVal(key *Key) (*FulcioKeyVal, error)
• type GcsRemoteOptions
• type Key
  • func FulcioVerificationKey(email string, issuer string) *Key
  • func (k *Key) ContainsID(id string) bool
  • func (k *Key) ID() string
• type Role
  • func (r *Role) AddKeysWithThreshold(keys []*Key, threshold int) bool
• type Root
  • func NewRoot() *Root
  • func (r *Root) AddKey(key *Key) bool
  • func (r *Root) Marshal() (*Signed, error)
  • func (r *Root) ValidKey(key *Key, role string) (string, error)
• type Signature
• type Signed
  • func (s *Signed) AddOrUpdateSignature(key *Key, signature Signature) error
  • func (s *Signed) JSONMarshal(prefix, indent string) ([]byte, error)
• type TUF
  • func NewFromEnv(ctx context.Context) (*TUF, error)
  • func (t *TUF) Close() error
  • func (t *TUF) GetTarget(name string) ([]byte, error)
  • func (t *TUF) GetTimestamp() ([]byte, error)
• type Timestamp
  • func GetTimestamp(ctx context.Context) (*Timestamp, error)

Constants

const (
	DefaultRemoteRoot = "sigstore-tuf-root"
	TufRootEnv        = "TUF_ROOT"
	SigstoreNoCache   = "SIGSTORE_NO_CACHE"
)

const (
	KeyTypeFulcio   = "sigstore-oidc"
	KeySchemeFulcio = "https://fulcio.sigstore.dev"
)

Variables

var (
	KeyAlgorithms = []string{"sha256", "sha512"}
)

Functions

func DefaultExpires

func DefaultExpires(role string) time.Time

func GcsRemoteStore

func GcsRemoteStore(ctx context.Context, bucket string, opts *GcsRemoteOptions, client *storage.Client) (client.RemoteStore, error)

A remote store for TUF metadata on GCS.

func Initialize

func Initialize(ctx context.Context, mirror string, root []byte) error

Types

type FulcioKeyVal

type FulcioKeyVal struct {
	Identity string `json:"identity"`
	Issuer   string `json:"issuer,omitempty"`
}

func GetFulcioKeyVal

func GetFulcioKeyVal(key *Key) (*FulcioKeyVal, error)

type GcsRemoteOptions

type GcsRemoteOptions struct {
	MetadataPath string
	TargetsPath  string
}

type Key

type Key struct {
	Type       string          `json:"keytype"`
	Scheme     string          `json:"scheme"`
	Algorithms []string        `json:"keyid_hash_algorithms,omitempty"`
	Value      json.RawMessage `json:"keyval"`
	// contains filtered or unexported fields
}

func FulcioVerificationKey

func FulcioVerificationKey(email string, issuer string) *Key

func (*Key) ContainsID

func (k *Key) ContainsID(id string) bool

func (*Key) ID

func (k *Key) ID() string

type Role

type Role struct {
	KeyIDs    []string `json:"keyids"`
	Threshold int      `json:"threshold"`
}

func (*Role) AddKeysWithThreshold

func (r *Role) AddKeysWithThreshold(keys []*Key, threshold int) bool

type Root

type Root struct {
	Type        string           `json:"_type"`
	SpecVersion string           `json:"spec_version"`
	Version     int              `json:"version"`
	Expires     time.Time        `json:"expires"`
	Keys        map[string]*Key  `json:"keys"`
	Roles       map[string]*Role `json:"roles"`
	Namespace   string           `json:"namespace"`

	ConsistentSnapshot bool `json:"consistent_snapshot"`
}

func NewRoot

func NewRoot() *Root

func (*Root) AddKey

func (r *Root) AddKey(key *Key) bool

func (*Root) Marshal

func (r *Root) Marshal() (*Signed, error)

func (*Root) ValidKey

func (r *Root) ValidKey(key *Key, role string) (string, error)

type Signature

type Signature struct {
	KeyID     string `json:"keyid"`
	Signature string `json:"sig"`
	Cert      string `json:"cert,omitempty"`
}

type Signed

type Signed struct {
	Signed     json.RawMessage `json:"signed"`
	Signatures []Signature     `json:"signatures"`
}

func (*Signed) AddOrUpdateSignature

func (s *Signed) AddOrUpdateSignature(key *Key, signature Signature) error

func (*Signed) JSONMarshal

func (s *Signed) JSONMarshal(prefix, indent string) ([]byte, error)

type TUF

type TUF struct {
	// contains filtered or unexported fields
}

func NewFromEnv

func NewFromEnv(ctx context.Context) (*TUF, error)

func (*TUF) Close

func (t *TUF) Close() error

Close closes the local TUF store. Should only be called once per client.

func (*TUF) GetTarget

func (t *TUF) GetTarget(name string) ([]byte, error)

func (*TUF) GetTimestamp

func (t *TUF) GetTimestamp() ([]byte, error)

type Timestamp

type Timestamp struct {
	Signatures []data.Signature `json:"signatures"`
	Signed     data.Timestamp   `json:"signed"`
}

func GetTimestamp

func GetTimestamp(ctx context.Context) (*Timestamp, error)

GetTimestamp fetches the TUF timestamp metadata to be bundled with the OCI signature.