tuf

Documentation

Index

• Constants
• Variables
• func DefaultExpires(role string) time.Time
• func GcsRemoteStore(ctx context.Context, bucket string, opts *GcsRemoteOptions, ...) (client.RemoteStore, error)
• func Initialize(ctx context.Context, mirror string, root []byte) error
• func NewSigstoreTufRepo(t *testing.T, root TestSigstoreRoot) (tuf.LocalStore, *tuf.Repo)
• type FulcioKeyVal
  • func GetFulcioKeyVal(key *Key) (*FulcioKeyVal, error)
• type GcsRemoteOptions
• type Key
  • func FulcioVerificationKey(email string, issuer string) *Key
  • func (k *Key) ContainsID(id string) bool
  • func (k *Key) ID() string
• type MetadataStatus
• type Role
  • func (r *Role) AddKeysWithThreshold(keys []*Key, threshold int) bool
• type Root
  • func NewRoot() *Root
  • func (r *Root) AddKey(key *Key) bool
  • func (r *Root) Marshal() (*Signed, error)
  • func (r *Root) ValidKey(key *Key, role string) (string, error)
• type RootStatus
  • func GetRootStatus(ctx context.Context) (*RootStatus, error)
• type Signature
• type Signed
  • func (s *Signed) AddOrUpdateSignature(key *Key, signature Signature) error
  • func (s *Signed) JSONMarshal(prefix, indent string) ([]byte, error)
• type StatusKind
  • func (s StatusKind) MarshalText() ([]byte, error)
  • func (s StatusKind) String() string
  • func (s *StatusKind) UnmarshalText(text []byte) error
• type TUF
  • func NewFromEnv(ctx context.Context) (*TUF, error)
  • func (t *TUF) Close() error
  • func (t *TUF) GetTarget(name string) ([]byte, error)
  • func (t *TUF) GetTargetsByMeta(usage UsageKind, fallbacks []string) ([]TargetFile, error)
• type TargetFile
• type TestSigstoreRoot
• type UsageKind
  • func (u UsageKind) MarshalText() ([]byte, error)
  • func (u UsageKind) String() string
  • func (u *UsageKind) UnmarshalText(text []byte) error

Constants

const (
	DefaultRemoteRoot = "sigstore-tuf-root"
	TufRootEnv        = "TUF_ROOT"
	SigstoreNoCache   = "SIGSTORE_NO_CACHE"
)

const (
	KeyTypeFulcio   = "sigstore-oidc"
	KeySchemeFulcio = "https://fulcio.sigstore.dev"
)

Variables

var (
	KeyAlgorithms = []string{"sha256", "sha512"}
)

Functions

func DefaultExpires

func DefaultExpires(role string) time.Time

func GcsRemoteStore

func GcsRemoteStore(ctx context.Context, bucket string, opts *GcsRemoteOptions, client *storage.Client) (client.RemoteStore, error)

A remote store for TUF metadata on GCS.

func Initialize

func Initialize(ctx context.Context, mirror string, root []byte) error

func NewSigstoreTufRepo

func NewSigstoreTufRepo(t *testing.T, root TestSigstoreRoot) (tuf.LocalStore, *tuf.Repo)

This creates a new sigstore TUF repo whose signers can be used to create dynamic signed Rekor entries.

Types

type FulcioKeyVal

type FulcioKeyVal struct {
	Identity string `json:"identity"`
	Issuer   string `json:"issuer,omitempty"`
}

func GetFulcioKeyVal

func GetFulcioKeyVal(key *Key) (*FulcioKeyVal, error)

type GcsRemoteOptions

type GcsRemoteOptions struct {
	MetadataPath string
	TargetsPath  string
}

type Key

type Key struct {
	Type       string          `json:"keytype"`
	Scheme     string          `json:"scheme"`
	Algorithms []string        `json:"keyid_hash_algorithms,omitempty"`
	Value      json.RawMessage `json:"keyval"`
	// contains filtered or unexported fields
}

func FulcioVerificationKey

func FulcioVerificationKey(email string, issuer string) *Key

func (*Key) ContainsID

func (k *Key) ContainsID(id string) bool

func (*Key) ID

func (k *Key) ID() string

type MetadataStatus

type MetadataStatus struct {
	Version    int    `json:"version"`
	Size       int    `json:"len"`
	Expiration string `json:"expiration"`
	Error      string `json:"error"`
}

type Role

type Role struct {
	KeyIDs    []string `json:"keyids"`
	Threshold int      `json:"threshold"`
}

func (*Role) AddKeysWithThreshold

func (r *Role) AddKeysWithThreshold(keys []*Key, threshold int) bool

type Root

type Root struct {
	Type        string           `json:"_type"`
	SpecVersion string           `json:"spec_version"`
	Version     int              `json:"version"`
	Expires     time.Time        `json:"expires"`
	Keys        map[string]*Key  `json:"keys"`
	Roles       map[string]*Role `json:"roles"`
	Namespace   string           `json:"namespace"`

	ConsistentSnapshot bool `json:"consistent_snapshot"`
}

func NewRoot

func NewRoot() *Root

func (*Root) AddKey

func (r *Root) AddKey(key *Key) bool

func (*Root) Marshal

func (r *Root) Marshal() (*Signed, error)

func (*Root) ValidKey

func (r *Root) ValidKey(key *Key, role string) (string, error)

type RootStatus

type RootStatus struct {
	Local    string                    `json:"local"`
	Remote   string                    `json:"remote"`
	Metadata map[string]MetadataStatus `json:"metadata"`
	Targets  []string                  `json:"targets"`
}

JSON output representing the configured root status

func GetRootStatus

func GetRootStatus(ctx context.Context) (*RootStatus, error)

GetRootStatus gets the current root status for info logging

type Signature

type Signature struct {
	KeyID     string `json:"keyid"`
	Signature string `json:"sig"`
	Cert      string `json:"cert,omitempty"`
}

type Signed

type Signed struct {
	Signed     json.RawMessage `json:"signed"`
	Signatures []Signature     `json:"signatures"`
}

func (*Signed) AddOrUpdateSignature

func (s *Signed) AddOrUpdateSignature(key *Key, signature Signature) error

func (*Signed) JSONMarshal

func (s *Signed) JSONMarshal(prefix, indent string) ([]byte, error)

type StatusKind

type StatusKind int

const (
	UnknownStatus StatusKind = iota
	Active
	Expired
)

func (StatusKind) MarshalText

func (s StatusKind) MarshalText() ([]byte, error)

func (StatusKind) String

func (s StatusKind) String() string

func (*StatusKind) UnmarshalText

func (s *StatusKind) UnmarshalText(text []byte) error

type TUF

type TUF struct {
	// contains filtered or unexported fields
}

func NewFromEnv

func NewFromEnv(ctx context.Context) (*TUF, error)

func (*TUF) Close

func (t *TUF) Close() error

Close closes the local TUF store. Should only be called once per client.

func (*TUF) GetTarget

func (t *TUF) GetTarget(name string) ([]byte, error)

func (*TUF) GetTargetsByMeta

func (t *TUF) GetTargetsByMeta(usage UsageKind, fallbacks []string) ([]TargetFile, error)

Get target files by a custom usage metadata tag. If there are no files found, use the fallback target names to fetch the targets by name.

type TargetFile

type TargetFile struct {
	Target []byte
	Status StatusKind
}

type TestSigstoreRoot

type TestSigstoreRoot struct {
	Rekor             signature.Verifier
	FulcioCertificate *x509.Certificate
}

type UsageKind

type UsageKind int

const (
	UnknownUsage UsageKind = iota
	Fulcio
	Rekor
	CTFE
)

func (UsageKind) MarshalText

func (u UsageKind) MarshalText() ([]byte, error)

func (UsageKind) String

func (u UsageKind) String() string

func (*UsageKind) UnmarshalText

func (u *UsageKind) UnmarshalText(text []byte) error