Documentation
¶
Index ¶
Constants ¶
const LocalScope = "local"
LocalScope authorises filesystem installs. A distinct token rather than a URL, so no URL scope can grant it by accident.
Variables ¶
var ( ErrNoTrustedKey = errors.New("no trusted key for this origin") ErrUntrusted = errors.New("signature does not match any trusted key") )
var ( ErrUnsigned = errors.New("package is not signed") ErrNameMismatch = errors.New("signature covers a different file") ErrDigestMismatch = errors.New("package contents do not match the signed checksum") ErrNoChecksum = errors.New("signature carries no checksum") ErrBadChecksum = errors.New("unusable signed checksum") )
var ErrInvalidScope = errors.New("invalid scope")
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Key *TrustedKey
Filename string
Digest string
}
type Scope ¶
Scope bounds where a trusted key may have signed. A key trusted for one registry must not vouch for another.
func ParseScope ¶
ParseScope parses "local" or a registry base URL.
type TrustStore ¶
type TrustStore struct {
// contains filtered or unexported fields
}
func LoadTrustStore ¶
func LoadTrustStore(configDir string) (*TrustStore, error)
LoadTrustStore builds this run's trust store: the compiled-in keys plus any the user added under configDir.
func NewTrustStore ¶
func NewTrustStore(keys ...*TrustedKey) *TrustStore
func (*TrustStore) Add ¶
func (t *TrustStore) Add(key *TrustedKey)
func (*TrustStore) For ¶
func (t *TrustStore) For(origin string) []*TrustedKey
For returns the keys authorised for origin. Empty means nothing may be installed from it.
func (*TrustStore) Keys ¶
func (t *TrustStore) Keys() []*TrustedKey
func (*TrustStore) Verify ¶
func (t *TrustStore) Verify(origin string, msg []byte, sig *gosignify.Signature) (*TrustedKey, error)
Verify checks a signature against the keys authorised for origin. Selection is by key number: a signature names its own key.
type TrustedKey ¶
type TrustedKey struct {
Name string // the trust-store basename, or a fixed name for builtin keys
Key *gosignify.PublicKey
Scopes []*Scope // a key with no scopes is authorised for nothing
Builtin bool // compiled in, so not removable
}
func BuiltinKeys ¶
func BuiltinKeys() []*TrustedKey
BuiltinKeys returns the keys compiled into this binary. Embedded rather than read from disk: a key fetched from where a package could also reach would verify nothing.
func LoadTrustDir ¶
func LoadTrustDir(dir string) ([]*TrustedKey, error)
LoadTrustDir reads every *.pub in dir, with scopes from a <key>.scope sidecar. A key with no sidecar is authorised for nothing: scoping is not optional, and its absence is more likely a mistake than intent.
func (*TrustedKey) Authorises ¶
func (k *TrustedKey) Authorises(origin string) bool
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
func NewVerifier ¶
func NewVerifier(store *TrustStore) *Verifier
func (*Verifier) SetAllowUnsigned ¶
Opt-in per run only. A signed artifact is still verified, and a bad signature is still fatal.
func (*Verifier) Signer ¶
Signer names the key that produced sig, by key number, so a key that has since been rotated out is still named. This says who signed, not that the signature is good.
func (*Verifier) Verify ¶
Verify implements pkg.Verifier. Errors wrap pkg.ErrUnverified so callers can tell a rejection from a transport failure.
func (*Verifier) VerifyArtifact ¶
func (v *Verifier) VerifyArtifact(origin, filename string, sig []byte, content io.Reader) (*Result, error)
VerifyArtifact checks that content is the file named by filename, signed by a key trusted for origin.
The order is deliberate: verify the signature, then compare the signed filename against the one requested, then hash. The filename comparison is what binds a signature to a package — without it, substituting an artifact and its signature together passes every other check. The standalone .sum is never consulted: it is unsigned, and the signature carries the copy that matters.
Source Files