Documentation
¶
Overview ¶
Package profile reads lockfile's configuration (design §4) on lockkit's config base: source profiles, limits and marketplaces, from the config file of the lockfile account. It never reads a secret: credentials come from the console (ask, the OS keychain or Vault).
Index ¶
Constants ¶
const ( SourceS3 = "s3" SourceSFTP = "sftp" SourceLocal = "local" )
Source kinds.
const ( AuthKey = "key" AuthPassword = "password" )
SFTP authentication modes.
const ( DefaultMaxObjectBytes = 50 << 20 DefaultMaxObjectsPerPlan = 5 DefaultMaxPluginsPerHandle = 16 DefaultHandleTTL = 30 * time.Minute DefaultAnswerQuantum = 5 * time.Second MaxPluginsPerHandleCap = 64 DefaultSFTPPort = 22 )
Defaults of design §4 and §7b.
Variables ¶
var ErrPublicKeyRoot = errors.New("public-key trust roots need lockkit support (not in lockkit v0.1.0): use a keyless identity_regexp and oidc_issuer")
ErrPublicKeyRoot refuses a public-key trust root: lockkit's signature check is keyless only (v0.1.0).
Functions ¶
func AppendProfile ¶
AppendProfile adds [profiles.<name>] with the given keys (TOML names; string, int or bool values, written in the order of keys) at the end of the config file at path, after checking the whole file with Parse.
func RemoveMarketplace ¶
RemoveMarketplace cuts the [[marketplaces]] block named name from the config file at path.
Types ¶
type File ¶
File is a decoded, validated config file.
type PluginPin ¶
type PluginPin struct {
Name string `json:"name"` // qualified
Version string `json:"version"`
Marketplace string `json:"marketplace"`
ManifestSHA256 string `json:"manifest_sha256"`
BinarySHA256 string `json:"binary_sha256"`
Official bool `json:"official"`
}
PluginPin is an installed plugin as the policy sees it. A new pin, or a pin whose manifest changed (its question may have), loosens the policy.
type Policy ¶
type Policy struct {
P Profile `json:"profile"`
Plugins []PluginPin `json:"plugins"`
Marketplaces []Trust `json:"marketplaces"`
}
Policy is what the console enforces for one profile: the profile, the installed plugins and the trusted marketplaces. Its JSON form is the approved policy lockkit stores, so it is canonical (sorted, defaults applied).
func Load ¶
Load reads the profile name of the config file at path and the plugins installed in store.
func (*Policy) Describe ¶
Describe implements config.Policy: the lines of the console's policy review and status screen.
type Profile ¶
type Profile struct {
config.Base
Name string `json:"name"`
Source string `json:"source"`
// Prefix bounds the keys of every source kind ("" = any key).
Prefix string `json:"prefix"`
S3 source.S3Config `json:"s3"`
SFTP source.SFTPConfig `json:"sftp"`
// SFTPAuth is key or password; SFTPKey the private key path (in the
// lockfile account) for key.
SFTPAuth string `json:"sftp_auth,omitempty"`
SFTPKey string `json:"sftp_key,omitempty"`
LocalPath string `json:"local_path,omitempty"`
MaxObjectBytes int64 `json:"max_object_bytes"`
MaxObjectsPerPlan int `json:"max_objects_per_plan"`
MaxPluginsPerHandle int `json:"max_plugins_per_handle"`
HandleTTL time.Duration `json:"handle_ttl"`
AnswerQuantum time.Duration `json:"answer_quantum"`
}
Profile is a validated profile with its defaults applied.
type Raw ¶
type Raw struct {
WorkDir string `toml:"work_dir"`
MaxWorkspaceBytes string `toml:"max_workspace_bytes"`
Profiles map[string]RawProfile `toml:"profiles"`
Marketplaces []RawMarketplace `toml:"marketplaces"`
}
Raw is the config file as written.
type RawMarketplace ¶
type RawMarketplace struct {
Name string `toml:"name"`
IndexURL string `toml:"index_url"`
IdentityRegexp string `toml:"identity_regexp"`
OIDCIssuer string `toml:"oidc_issuer"`
PublicKey string `toml:"public_key"`
}
RawMarketplace is one [[marketplaces]] entry (design §9).
type RawProfile ¶
type RawProfile struct {
Source string `toml:"source"`
// s3
Bucket string `toml:"bucket"`
Region string `toml:"region"`
Endpoint string `toml:"endpoint"`
Prefix string `toml:"prefix"`
// sftp
Host string `toml:"host"`
Port int `toml:"port"`
Auth string `toml:"auth"`
Key string `toml:"key"`
KnownHosts string `toml:"known_hosts"`
BaseDir string `toml:"base_dir"`
// local
Path string `toml:"path"`
// shared with lockkit's config.Base
User string `toml:"user"`
Credentials string `toml:"credentials"`
VaultPath string `toml:"vault_path"`
CredentialsTTL string `toml:"credentials_ttl"`
Production bool `toml:"production"`
IdleTimeout string `toml:"idle_timeout"`
MaxSession string `toml:"max_session"`
// limits
MaxObjectBytes string `toml:"max_object_bytes"`
MaxObjectsPerPlan int `toml:"max_objects_per_plan"`
MaxPluginsPerHandle int `toml:"max_plugins_per_handle"`
HandleTTL string `toml:"handle_ttl"`
AnswerQuantum string `toml:"answer_quantum"`
}
RawProfile is one [profiles.NAME] table.
type Trust ¶
type Trust struct {
Name string `json:"name"`
IndexURL string `json:"index_url"`
IdentityRegexp string `json:"identity_regexp"`
OIDCIssuer string `json:"oidc_issuer"`
}
Trust is an unofficial marketplace and its keyless trust root.
func AppendMarketplace ¶
func AppendMarketplace(path string, r RawMarketplace) (Trust, error)
AppendMarketplace adds an unofficial marketplace at the end of the config file at path (created 0600 when missing).
func CheckMarketplace ¶
func CheckMarketplace(r RawMarketplace) (Trust, error)
CheckMarketplace validates an unofficial marketplace entry.
func (Trust) Marketplace ¶
func (t Trust) Marketplace() marketplace.Marketplace
Marketplace is t for the installer: never official.
Source Files