inventory

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 29, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package inventory implements the certificate and key inventory use cases on top of the encrypted database: import with de-duplication and automatic linking (issuer ↔ subject, certificate ↔ private key), chains, search and expiry.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CertRow

func CertRow(c *x509.Certificate) *database.Certificate

CertRow converts a parsed certificate into a database row (without ID).

Types

type CertResult

type CertResult struct {
	Cert    *database.Certificate
	Created bool // false when the certificate was already stored
}

CertResult reports what happened to one imported certificate.

type Counts

type Counts struct {
	Certificates int `json:"certificates"`
	PrivateKeys  int `json:"private_keys"`
	PublicKeys   int `json:"public_keys"`
	SSHKeys      int `json:"ssh_keys"`
	Expiring     int `json:"expiring"`
	Expired      int `json:"expired"`
	TLSEndpoints int `json:"tls_endpoints"`
	CTWatches    int `json:"ct_watches"`
}

Counts summarises the inventory.

type ImportOptions

type ImportOptions struct {
	Name    string
	Tags    []string
	Source  string
	Comment string
}

ImportOptions apply to imported objects.

type KeyResult

type KeyResult struct {
	Key     *database.Key
	Created bool
	// Upgraded is set when private material was added to a stored public key.
	Upgraded bool
	// LinkedCerts counts certificates newly linked to this key.
	LinkedCerts int
}

KeyResult reports what happened to an imported key.

type ListFilter

type ListFilter struct {
	Query string // search language, may be empty
}

ListFilter narrows certificate listings.

type SearchResult

type SearchResult struct {
	Certificates []*database.Certificate
	Keys         []*database.Key
	SSHKeys      []*database.SSHKey
}

SearchResult holds matches of each kind.

type Service

type Service struct {
	DB  *database.DB
	Now func() time.Time
}

Service is the inventory API used by the CLI and the server.

func New

func New(db *database.DB) *Service

New creates a service.

func (*Service) Certificate

func (s *Service) Certificate(ctx context.Context, ref string) (*database.Certificate, *x509.Certificate, error)

Certificate loads a stored certificate and parses its DER.

func (*Service) Chain

Chain follows issuer links from row up to the top-most stored issuer.

func (*Service) Children

func (s *Service) Children(ctx context.Context, row *database.Certificate) ([]*database.Certificate, error)

Children returns certificates directly issued by row.

func (*Service) Expiring

func (s *Service) Expiring(ctx context.Context, d time.Duration, includeExpired bool) ([]*database.Certificate, error)

Expiring returns certificates that expire within d (and have not yet expired unless includeExpired is set).

func (*Service) ImportCertificate

func (s *Service) ImportCertificate(ctx context.Context, c *x509.Certificate, opts ImportOptions) (CertResult, error)

ImportCertificate stores one certificate, or returns the existing row (adding any new tags) when it is already present.

func (*Service) ImportCertificates

func (s *Service) ImportCertificates(ctx context.Context, certs []*x509.Certificate, opts ImportOptions) ([]CertResult, error)

ImportCertificates stores certs. The name applies to the first new certificate only (names are unique). Tags apply to all.

func (*Service) ImportPrivateKey

func (s *Service) ImportPrivateKey(ctx context.Context, priv crypto.PrivateKey, opts ImportOptions) (KeyResult, error)

ImportPrivateKey seals priv (as PKCS#8) into the vault.

func (*Service) ImportPublicKey

func (s *Service) ImportPublicKey(ctx context.Context, pub crypto.PublicKey, opts ImportOptions) (KeyResult, error)

ImportPublicKey stores a public key without private material.

func (*Service) ImportSSHKey

func (s *Service) ImportSSHKey(ctx context.Context, it sshkeys.Item, opts ImportOptions, withPrivate bool) (*database.SSHKey, bool, error)

ImportSSHKey stores an SSH key. The private key file is stored exactly as given (so a passphrase-protected key stays protected) when withPrivate is set and the item carries one.

func (*Service) ListCertificates

func (s *Service) ListCertificates(ctx context.Context, f ListFilter) ([]*database.Certificate, error)

ListCertificates returns certificates matching the filter, soonest expiry first.

func (*Service) PrivateKey

func (s *Service) PrivateKey(ctx context.Context, k *database.Key) (crypto.PrivateKey, error)

PrivateKey decrypts a stored private key.

func (*Service) PublicKey

func (s *Service) PublicKey(k *database.Key) (crypto.PublicKey, error)

PublicKey parses a stored key's public half.

func (*Service) Search

func (s *Service) Search(ctx context.Context, query string) (*SearchResult, error)

Search runs a query against all object kinds.

func (*Service) Stats

func (s *Service) Stats(ctx context.Context, warnDays int) (Counts, error)

Stats counts stored objects; expiring uses warnDays.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL