Documentation
¶
Overview ¶
Package keymaterial hosts the file-or-value key loading and DER parsing mechanism shared by the keystore module and internal/sealcli, through which the seal-payload and seal-event CLIs reach it. keystore wraps these calls with its "keystore: key %q ..." error prefixes; sealcli consumes them directly, so a key the CLIs accept is never one the middleware's keystore would reject. It also hosts the producer-role resolver sealcli assembles and the CLIs hand to jose once their keys are parsed.
Index ¶
- func LoadBytes(file, value string) ([]byte, error)
- func LoadPassword(env, file string) (string, error)
- func LoadRSAPrivateKey(file, value string) (*rsa.PrivateKey, error)
- func LoadRSAPublicKey(file, value string) (*rsa.PublicKey, error)
- func LoadSecretBytes(file, value string) ([]byte, error)
- func ParsePKCS12RSA(pfx []byte, password string) (*rsa.PrivateKey, error)
- func ParseRSAPrivateKey(der []byte) (*rsa.PrivateKey, error)
- func ParseRSAPublicKey(der []byte) (*rsa.PublicKey, error)
- type ConsumerKeys
- type ProducerKeys
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LoadBytes ¶
LoadBytes resolves file-or-value key material to raw bytes (DER for RSA). When both are set, file wins (keystore's historical behavior — callers wanting exactly-one-of must enforce it themselves). Returns (nil, nil) when neither is set.
func LoadPassword ¶ added in v0.62.0
LoadPassword resolves a PKCS#12 password from the named environment variable or from a file (trailing newlines stripped). No error echoes the variable name, the path, or the value.
func LoadRSAPrivateKey ¶ added in v0.63.0
func LoadRSAPrivateKey(file, value string) (*rsa.PrivateKey, error)
LoadRSAPrivateKey is LoadBytes followed by ParseRSAPrivateKey: the whole file-or-value-to-key hop a CLI needs for its own signing key. It adds no error prefix of its own, so callers keep whatever role wording they already use ("sign key: %w"). With neither source set LoadBytes yields nil DER and the parse rejects it — there is no silent nil key.
func LoadRSAPublicKey ¶ added in v0.63.0
LoadRSAPublicKey is LoadBytes followed by ParseRSAPublicKey, the public-key counterpart of LoadRSAPrivateKey and with the same no-prefix contract.
func LoadSecretBytes ¶
LoadSecretBytes is LoadBytes for raw symmetric secrets. Secret material has no detectable shape (no PEM/DER structure), so a mis-filed value cannot be caught by LooksLikeKeyMaterial — instead, NO error on this path ever echoes the configured file value or the underlying path. SECURITY: a transposed secret.file/secret.value must not put key material into a fatal startup log line; strip the path from wrapped OS errors.
func ParsePKCS12RSA ¶ added in v0.62.0
func ParsePKCS12RSA(pfx []byte, password string) (*rsa.PrivateKey, error)
ParsePKCS12RSA decodes a password-protected PKCS#12 bundle into its RSA private key. The leaf certificate must carry the matching RSA public key; any CA chain in the bundle is discarded.
func ParseRSAPrivateKey ¶
func ParseRSAPrivateKey(der []byte) (*rsa.PrivateKey, error)
ParseRSAPrivateKey parses PKCS#8 DER (PKCS#1 fallback) into an *rsa.PrivateKey.
Types ¶
type ConsumerKeys ¶ added in v0.65.0
type ConsumerKeys struct {
SignKid string
SignPub *rsa.PublicKey
EncryptKid string
EncPriv *rsa.PrivateKey
}
ConsumerKeys resolves the two kids a consumer holds: the producer's sign PUBLIC key and its own encrypt PRIVATE key — the exact inverse of ProducerKeys, and the shape the open-event CLI hands to jose. Any other kid is an error naming the kid and nothing else.
The method set is the same jose.KeyResolver one ProducerKeys carries, and satisfied the same structural way, without importing jose here.
func (*ConsumerKeys) PrivateKey ¶ added in v0.65.0
func (k *ConsumerKeys) PrivateKey(kid string) (*rsa.PrivateKey, error)
PrivateKey returns the decrypt key for EncryptKid; every other kid is unknown, and an unset key is unknown too — see PublicKey.
func (*ConsumerKeys) PublicKey ¶ added in v0.65.0
func (k *ConsumerKeys) PublicKey(kid string) (*rsa.PublicKey, error)
PublicKey returns the verify key for SignKid; every other kid is unknown. The nil check is the fail-closed half: a zero ConsumerKeys carries an empty kid, which an empty lookup kid would otherwise match into a (nil, nil) hand-back.
type ProducerKeys ¶ added in v0.63.0
type ProducerKeys struct {
SignKid string
SignPriv *rsa.PrivateKey
EncryptKid string
EncPub *rsa.PublicKey
}
ProducerKeys resolves the two kids a producer holds: its own sign PRIVATE key and the audience's encrypt PUBLIC key. Any other kid is an error naming the kid and nothing else.
The method set is exactly jose.KeyResolver's (and jose.KeyStoreLike's), so a *ProducerKeys satisfies both structurally — this package deliberately does not import jose: keystore imports keymaterial, and the dependency would drag go-jose into the keystore module for no gain.
func (*ProducerKeys) PrivateKey ¶ added in v0.63.0
func (k *ProducerKeys) PrivateKey(kid string) (*rsa.PrivateKey, error)
PrivateKey returns the sign key for SignKid; every other kid, and any kid when no sign key is held, is unknown.
Source Files