Documentation
¶
Overview ¶
Package rcstore implements the TUF metadata signing used by fakeintake's Remote Config endpoints.
Index ¶
- Constants
- func BuildRootJSON(key ed25519.PrivateKey, keyID, publicKeyHex string) ([]byte, error)
- func CanonicalJSON(v any) ([]byte, error)
- func ComputeKeyID(publicKeyHex string) (string, error)
- func DefaultKeyPath() (string, error)
- func KeyFromHexSeed(hexSeed string) (ed25519.PrivateKey, error)
- func LoadOrCreateSigningKey(path string) (ed25519.PrivateKey, bool, error)
- func PublicKeyHex(key ed25519.PrivateKey) string
- func SignEnvelope(key ed25519.PrivateKey, keyID string, signedValue any) ([]byte, error)
- func VerifyEnvelope(pub ed25519.PublicKey, envelope []byte) error
- type Config
- type RepoMetas
Constants ¶
const TUFExpires = "2030-01-01T00:00:00Z"
TUFExpires is hardcoded for fakeintake; long horizon so test setups don't hit expiry.
Variables ¶
This section is empty.
Functions ¶
func BuildRootJSON ¶
func BuildRootJSON(key ed25519.PrivateKey, keyID, publicKeyHex string) ([]byte, error)
BuildRootJSON returns a signed root.json containing a single ed25519 key trusted for all four TUF roles.
func CanonicalJSON ¶
CanonicalJSON encodes v in TUF canonical form: object keys sorted lexicographically, no whitespace, and no HTML escaping.
Only used for hashing (the key ID and digest inputs). The signed payloads themselves are signed-then-embedded verbatim, so byte-identical re-serialisation is not required there.
func ComputeKeyID ¶
ComputeKeyID returns hex(sha256(canonical_json(key_object))) for an ed25519 key, matching go-tuf's keyid computation when keyid_hash_algorithms is omitted.
func DefaultKeyPath ¶
DefaultKeyPath is the on-disk location of the persistent signing key seed when the caller does not specify one.
func KeyFromHexSeed ¶ added in v0.81.0
func KeyFromHexSeed(hexSeed string) (ed25519.PrivateKey, error)
KeyFromHexSeed derives an ed25519 private key from a 64-character hex-encoded 32-byte seed. Returns an error when hexSeed is malformed.
func LoadOrCreateSigningKey ¶
func LoadOrCreateSigningKey(path string) (ed25519.PrivateKey, bool, error)
LoadOrCreateSigningKey reads a 32-byte ed25519 seed from path. If path is empty, falls back to DefaultKeyPath. If the file does not exist, a fresh key is generated and written. The returned bool reports whether a new key was generated this call (callers may want to log a hint about flushing remote-config.db).
func PublicKeyHex ¶
func PublicKeyHex(key ed25519.PrivateKey) string
PublicKeyHex is a convenience accessor for tests/handlers that need to surface the verifying key.
func SignEnvelope ¶
SignEnvelope marshals signedValue once, signs those bytes with key, and returns a TUF envelope embedding the same bytes verbatim.
Types ¶
type RepoMetas ¶
RepoMetas bundles the four TUF metadata documents that make up a repo.
func GenerateTUFMetas ¶
func GenerateTUFMetas(cfgs []Config, key ed25519.PrivateKey, keyID string, root []byte, version uint64) (RepoMetas, error)
GenerateTUFMetas builds targets/snapshot/timestamp at the given version from the supplied configs, alongside the cached root bytes.
Source Files