Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ( // ErrTSAResponseInvalid indicates the RFC3161 timestamp response could not // be verified against the TSA certificate chain. ErrTSAResponseInvalid = errors.New("TSA response verification failed") // ErrTimestampOutsideTSAValidity indicates the timestamp's time falls // outside the TSA certificate's NotBefore/NotAfter window. ErrTimestampOutsideTSAValidity = errors.New("timestamp outside TSA certificate validity window") // ErrSigningCertNotValidAtTimestamp indicates the signing certificate // was not valid at the timestamp's time. ErrSigningCertNotValidAtTimestamp = errors.New("signing certificate not valid at timestamp time") // ErrNoTSARootsConfigured indicates the bundle contains signed timestamps // but no TSA trust roots are configured on the server. ErrNoTSARootsConfigured = errors.New("no TSA trust roots configured") )
View Source
var ErrInvalidBundle = errors.New("invalid bundle")
View Source
var ErrMissingVerificationMaterial = errors.New("missing material")
View Source
var ErrUnsupportedVerificationMaterial = errors.New("unsupported verification material")
ErrUnsupportedVerificationMaterial indicates the bundle carries verification material we cannot verify a signature against (e.g. a bare public key with no trusted key set). It is treated as a verification failure, never ignored.
Functions ¶
func VerifyBundle ¶
func VerifyBundle(ctx context.Context, bundleBytes []byte, tr *TrustedRoot) error
func VerifyTimestamps ¶ added in v0.170.0
func VerifyTimestamps(sb *bundle.Bundle, tr *TrustedRoot) error
Types ¶
type TrustedRoot ¶
type TrustedRoot struct {
// map key identifiers to a chain of certificates
Keys map[string][]*x509.Certificate
TimestampAuthorities map[string][]*x509.Certificate
}
Source Files
Click to show internal directories.
Click to hide internal directories.