Documentation
¶
Overview ¶
Package registrytoken — ES256 client_assertion crypto for the Docker Registry v2 auth-server (`/iam/token`) shim.
The shim does NOT mint the registry token itself: it signs a short-lived RFC 7523 client_assertion (JWS ES256) from the presented SA-key private half and exchanges it with Ory Hydra (`client_credentials` + `private_key_jwt`); Hydra is the issuer. This package assembles that assertion with pure stdlib crypto (RFC 7519 JWT + RFC 7515 JWS, ECDSA P-256 / SHA-256), so no external JWT dependency is pulled in.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SignClientAssertionES256 ¶
func SignClientAssertionES256(kid, privateKeyPEM string, claims AssertionClaims) (string, error)
SignClientAssertionES256 assembles and signs a compact JWS (JWT) with ES256 over the given claims, using kid in the protected header so Hydra selects the registered verification key. privateKeyPEM is the presented PKCS#8 EC private key (the SA-key secret). The ECDSA signature is the JWS raw form: R||S, each left-padded to 32 bytes (RFC 7518 §3.4).
Types ¶
type AssertionClaims ¶
type AssertionClaims struct {
Issuer string // iss — the Hydra client_id.
Subject string // sub — the Hydra client_id (== iss).
Audience string // aud — the Hydra token endpoint URL.
IssuedAt int64 // iat — unix seconds.
ExpiresAt int64 // exp — unix seconds (short TTL, ≤60s).
JTI string // jti — unique assertion id (replay protection).
}
AssertionClaims — the client_assertion payload (RFC 7523 registered claims). For `private_key_jwt` the issuer and subject are both the OAuth2 client_id.
Source Files