challenges

Documentation

Index

• func CheckSignature(pub crypto.PublicKey, proof []byte, subject string) error
• func ParseCSR(csr []byte) (*x509.CertificateRequest, error)
• func ParsePublicKey(encodedPubKey string, csr *x509.CertificateRequest) (crypto.PublicKey, error)
• type AdditionalInfo
• type ChallengeResult
  • func ExtractSubject(ctx context.Context, tok *oidc.IDToken, publicKey crypto.PublicKey, ...) (*ChallengeResult, error)
• type ChallengeType

Functions

func CheckSignature

func CheckSignature(pub crypto.PublicKey, proof []byte, subject string) error

CheckSignature verifies a challenge, a signature over the subject or email of an OIDC token

func ParseCSR

func ParseCSR(csr []byte) (*x509.CertificateRequest, error)

TODO: Move to sigstore/sigstore

func ParsePublicKey

func ParsePublicKey(encodedPubKey string, csr *x509.CertificateRequest) (crypto.PublicKey, error)

ParsePublicKey parses a PEM or DER encoded public key, or extracts the public key from the provided CSR. Returns an error if decoding fails or if no public key is found.

Types

type AdditionalInfo

type AdditionalInfo int

const (
	GithubWorkflowTrigger AdditionalInfo = iota
	GithubWorkflowSha
	GithubWorkflowName
	GithubWorkflowRepository
	GithubWorkflowRef
)

Additional information that can be added as a cert extension.

type ChallengeResult

type ChallengeResult struct {
	Issuer    string
	TypeVal   ChallengeType
	PublicKey crypto.PublicKey
	Value     string
	// Extra information from the token that can be added to extensions.
	AdditionalInfo map[AdditionalInfo]string
}

func ExtractSubject

func ExtractSubject(ctx context.Context, tok *oidc.IDToken, publicKey crypto.PublicKey, csr *x509.CertificateRequest, challenge []byte) (*ChallengeResult, error)

type ChallengeType

type ChallengeType int

const (
	EmailValue ChallengeType = iota
	SpiffeValue
	GithubWorkflowValue
	KubernetesValue
	URIValue
	UsernameValue
)