Documentation
¶
Overview ¶
Package inventory implements the certificate and key inventory use cases on top of the encrypted database: import with de-duplication and automatic linking (issuer ↔ subject, certificate ↔ private key), chains, search and expiry.
Index ¶
- func CertRow(c *x509.Certificate) *database.Certificate
- type CertResult
- type Counts
- type ImportOptions
- type KeyResult
- type ListFilter
- type SearchResult
- type Service
- func (s *Service) Certificate(ctx context.Context, ref string) (*database.Certificate, *x509.Certificate, error)
- func (s *Service) Chain(ctx context.Context, row *database.Certificate) ([]*database.Certificate, error)
- func (s *Service) Children(ctx context.Context, row *database.Certificate) ([]*database.Certificate, error)
- func (s *Service) Expiring(ctx context.Context, d time.Duration, includeExpired bool) ([]*database.Certificate, error)
- func (s *Service) ImportCertificate(ctx context.Context, c *x509.Certificate, opts ImportOptions) (CertResult, error)
- func (s *Service) ImportCertificates(ctx context.Context, certs []*x509.Certificate, opts ImportOptions) ([]CertResult, error)
- func (s *Service) ImportPrivateKey(ctx context.Context, priv crypto.PrivateKey, opts ImportOptions) (KeyResult, error)
- func (s *Service) ImportPublicKey(ctx context.Context, pub crypto.PublicKey, opts ImportOptions) (KeyResult, error)
- func (s *Service) ImportSSHKey(ctx context.Context, it sshkeys.Item, opts ImportOptions, withPrivate bool) (*database.SSHKey, bool, error)
- func (s *Service) ListCertificates(ctx context.Context, f ListFilter) ([]*database.Certificate, error)
- func (s *Service) PrivateKey(ctx context.Context, k *database.Key) (crypto.PrivateKey, error)
- func (s *Service) PublicKey(k *database.Key) (crypto.PublicKey, error)
- func (s *Service) Search(ctx context.Context, query string) (*SearchResult, error)
- func (s *Service) Stats(ctx context.Context, warnDays int) (Counts, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CertRow ¶
func CertRow(c *x509.Certificate) *database.Certificate
CertRow converts a parsed certificate into a database row (without ID).
Types ¶
type CertResult ¶
type CertResult struct {
Cert *database.Certificate
Created bool // false when the certificate was already stored
}
CertResult reports what happened to one imported certificate.
type Counts ¶
type Counts struct {
Certificates int `json:"certificates"`
PrivateKeys int `json:"private_keys"`
PublicKeys int `json:"public_keys"`
SSHKeys int `json:"ssh_keys"`
Expiring int `json:"expiring"`
Expired int `json:"expired"`
TLSEndpoints int `json:"tls_endpoints"`
CTWatches int `json:"ct_watches"`
}
Counts summarises the inventory.
type ImportOptions ¶
ImportOptions apply to imported objects.
type KeyResult ¶
type KeyResult struct {
Key *database.Key
Created bool
// Upgraded is set when private material was added to a stored public key.
Upgraded bool
// LinkedCerts counts certificates newly linked to this key.
LinkedCerts int
}
KeyResult reports what happened to an imported key.
type ListFilter ¶
type ListFilter struct {
Query string // search language, may be empty
}
ListFilter narrows certificate listings.
type SearchResult ¶
type SearchResult struct {
Certificates []*database.Certificate
Keys []*database.Key
SSHKeys []*database.SSHKey
}
SearchResult holds matches of each kind.
type Service ¶
Service is the inventory API used by the CLI and the server.
func (*Service) Certificate ¶
func (s *Service) Certificate(ctx context.Context, ref string) (*database.Certificate, *x509.Certificate, error)
Certificate loads a stored certificate and parses its DER.
func (*Service) Chain ¶
func (s *Service) Chain(ctx context.Context, row *database.Certificate) ([]*database.Certificate, error)
Chain follows issuer links from row up to the top-most stored issuer.
func (*Service) Children ¶
func (s *Service) Children(ctx context.Context, row *database.Certificate) ([]*database.Certificate, error)
Children returns certificates directly issued by row.
func (*Service) Expiring ¶
func (s *Service) Expiring(ctx context.Context, d time.Duration, includeExpired bool) ([]*database.Certificate, error)
Expiring returns certificates that expire within d (and have not yet expired unless includeExpired is set).
func (*Service) ImportCertificate ¶
func (s *Service) ImportCertificate(ctx context.Context, c *x509.Certificate, opts ImportOptions) (CertResult, error)
ImportCertificate stores one certificate, or returns the existing row (adding any new tags) when it is already present.
func (*Service) ImportCertificates ¶
func (s *Service) ImportCertificates(ctx context.Context, certs []*x509.Certificate, opts ImportOptions) ([]CertResult, error)
ImportCertificates stores certs. The name applies to the first new certificate only (names are unique). Tags apply to all.
func (*Service) ImportPrivateKey ¶
func (s *Service) ImportPrivateKey(ctx context.Context, priv crypto.PrivateKey, opts ImportOptions) (KeyResult, error)
ImportPrivateKey seals priv (as PKCS#8) into the vault.
func (*Service) ImportPublicKey ¶
func (s *Service) ImportPublicKey(ctx context.Context, pub crypto.PublicKey, opts ImportOptions) (KeyResult, error)
ImportPublicKey stores a public key without private material.
func (*Service) ImportSSHKey ¶
func (s *Service) ImportSSHKey(ctx context.Context, it sshkeys.Item, opts ImportOptions, withPrivate bool) (*database.SSHKey, bool, error)
ImportSSHKey stores an SSH key. The private key file is stored exactly as given (so a passphrase-protected key stays protected) when withPrivate is set and the item carries one.
func (*Service) ListCertificates ¶
func (s *Service) ListCertificates(ctx context.Context, f ListFilter) ([]*database.Certificate, error)
ListCertificates returns certificates matching the filter, soonest expiry first.
func (*Service) PrivateKey ¶
PrivateKey decrypts a stored private key.