Documentation
¶
Index ¶
- func DefaultStorePath() string
- func Verify(publicKey ed25519.PublicKey, sig *Signature) error
- type KeyPair
- type Signature
- type Store
- func (s *Store) GenerateAndSave() (*KeyPair, error)
- func (s *Store) HasKeyPair() bool
- func (s *Store) ImportPublicKey(pemData []byte) error
- func (s *Store) LoadKeyPair() (*KeyPair, error)
- func (s *Store) LoadSignature(imageDir string) (*Signature, error)
- func (s *Store) PublicKeyPEM() ([]byte, error)
- func (s *Store) SaveKeyPair(kp *KeyPair) error
- func (s *Store) SaveSignature(imageDir string, sig *Signature) error
- func (s *Store) SignDigest(digest string) (*Signature, error)
- func (s *Store) SignManifest(digest, imageDir string) (*Signature, error)
- func (s *Store) VerifyDigest(digest string) (*Signature, error)
- func (s *Store) VerifyManifest(imageDir string) (*Signature, error)
- type VerifyPolicy
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultStorePath ¶
func DefaultStorePath() string
DefaultStorePath returns the default store path (~/.jerboa).
Types ¶
type KeyPair ¶
type KeyPair struct {
PrivateKey ed25519.PrivateKey
PublicKey ed25519.PublicKey
KeyID string
}
KeyPair holds an Ed25519 key pair and its key ID.
func GenerateKeyPair ¶
GenerateKeyPair creates a new Ed25519 key pair.
type Signature ¶
type Signature struct {
Type string `json:"type"`
KeyID string `json:"keyId"`
Digest string `json:"digest"`
Signature string `json:"signature"`
}
Signature represents an Ed25519 signature over a manifest digest.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store persists Ed25519 key pairs and signatures on disk.
func (*Store) GenerateAndSave ¶
GenerateAndSave creates a new key pair and saves it to disk.
func (*Store) HasKeyPair ¶
HasKeyPair reports whether a key pair exists on disk.
func (*Store) ImportPublicKey ¶
ImportPublicKey imports a PEM-encoded public key for verification. The key is stored as a separate verification key file.
func (*Store) LoadKeyPair ¶
LoadKeyPair loads the key pair from disk. Returns error if no key pair exists.
func (*Store) LoadSignature ¶
LoadSignature reads a signature file from the image store directory.
func (*Store) PublicKeyPEM ¶
PublicKeyPEM exports the public key as PEM-encoded bytes.
func (*Store) SaveKeyPair ¶
SaveKeyPair persists a key pair to disk.
func (*Store) SaveSignature ¶
SaveSignature writes a signature file next to the image manifest in the image store. The signature file is stored at <imageDir>/manifest.json.sig.
func (*Store) SignDigest ¶
SignDigest signs a content digest (e.g. an image's disk digest) with the stored key pair and saves the signature keyed by that digest.
func (*Store) SignManifest ¶
SignManifest signs the manifest digest using the stored key pair and saves the signature. imageDir is the directory containing the manifest (typically <store>/images/<hex-digest>). If no key pair exists, it generates one first.
func (*Store) VerifyDigest ¶
VerifyDigest verifies the signature stored for a content digest. It returns (nil, nil) when no signature exists, the signature on success, and an error when a signature exists but is invalid.
type VerifyPolicy ¶
type VerifyPolicy int
VerifyPolicy controls signature verification behavior.
const ( // VerifyOff skips signature verification. VerifyOff VerifyPolicy = iota // VerifyWarn logs a warning if signature is missing or invalid but does not fail. VerifyWarn // VerifyEnforce requires a valid signature; fails if missing or invalid. VerifyEnforce )
func ParseVerifyPolicy ¶
func ParseVerifyPolicy(s string) (VerifyPolicy, error)
ParseVerifyPolicy parses a verification policy string.
Source Files