Help us shape the future of Go! Take the 2026 Go Developer Survey

inventory

package
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 4, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package inventory implements the certificate and key inventory use cases on top of the encrypted database: import with de-duplication and automatic linking (issuer ↔ subject, certificate ↔ private key), chains, search and expiry.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CertRow

func CertRow(c *x509.Certificate) *database.Certificate

CertRow converts a parsed certificate into a database row (without ID).

Types

type CertResult

type CertResult struct {
	Cert    *database.Certificate
	Created bool // false when the certificate was already stored
}

CertResult reports what happened to one imported certificate.

type Counts

type Counts struct {
	Certificates int `json:"certificates"`
	PrivateKeys  int `json:"private_keys"`
	PublicKeys   int `json:"public_keys"`
	SSHKeys      int `json:"ssh_keys"`
	Expiring     int `json:"expiring"`
	Expired      int `json:"expired"`
	TLSEndpoints int `json:"tls_endpoints"`
	CTWatches    int `json:"ct_watches"`
}

Counts summarises the inventory.

type ImportOptions

type ImportOptions struct {
	Name    string
	Tags    []string
	Source  string
	Comment string
}

ImportOptions apply to imported objects.

type KeyResult

type KeyResult struct {
	Key     *database.Key
	Created bool
	// Upgraded is set when private material was added to a stored public key.
	Upgraded bool
	// LinkedCerts counts certificates newly linked to this key.
	LinkedCerts int
}

KeyResult reports what happened to an imported key.

type ListFilter

type ListFilter struct {
	Query string // search language, may be empty
}

ListFilter narrows certificate listings.

type SearchResult

type SearchResult struct {
	Certificates []*database.Certificate
	Keys         []*database.Key
	SSHKeys      []*database.SSHKey
}

SearchResult holds matches of each kind.

type Service

type Service struct {
	DB  *database.DB
	Now func() time.Time
}

Service is the inventory API used by the CLI and the server.

func New

func New(db *database.DB) *Service

New creates a service.

func (*Service) Certificate

func (s *Service) Certificate(ctx context.Context, ref string) (*database.Certificate, *x509.Certificate, error)

Certificate loads a stored certificate and parses its DER.

func (*Service) Chain

Chain follows issuer links from row up to the top-most stored issuer.

func (*Service) Children

func (s *Service) Children(ctx context.Context, row *database.Certificate) ([]*database.Certificate, error)

Children returns certificates directly issued by row.

func (*Service) Expiring

func (s *Service) Expiring(ctx context.Context, d time.Duration, includeExpired bool) ([]*database.Certificate, error)

Expiring returns certificates that expire within d (and have not yet expired unless includeExpired is set).

func (*Service) ImportCertificate

func (s *Service) ImportCertificate(ctx context.Context, c *x509.Certificate, opts ImportOptions) (CertResult, error)

ImportCertificate stores one certificate, or returns the existing row (adding any new tags) when it is already present.

func (*Service) ImportCertificates

func (s *Service) ImportCertificates(ctx context.Context, certs []*x509.Certificate, opts ImportOptions) ([]CertResult, error)

ImportCertificates stores certs. The name applies to the first new certificate only (names are unique). Tags apply to all.

func (*Service) ImportPrivateKey

func (s *Service) ImportPrivateKey(ctx context.Context, priv crypto.PrivateKey, opts ImportOptions) (KeyResult, error)

ImportPrivateKey seals priv (as PKCS#8) into the vault.

func (*Service) ImportPublicKey

func (s *Service) ImportPublicKey(ctx context.Context, pub crypto.PublicKey, opts ImportOptions) (KeyResult, error)

ImportPublicKey stores a public key without private material.

func (*Service) ImportSSHKey

func (s *Service) ImportSSHKey(ctx context.Context, it sshkeys.Item, opts ImportOptions, withPrivate bool) (*database.SSHKey, bool, error)

ImportSSHKey stores an SSH key. The private key file is stored exactly as given (so a passphrase-protected key stays protected) when withPrivate is set and the item carries one.

func (*Service) ListCertificates

func (s *Service) ListCertificates(ctx context.Context, f ListFilter) ([]*database.Certificate, error)

ListCertificates returns certificates matching the filter, soonest expiry first.

func (*Service) PrivateKey

func (s *Service) PrivateKey(ctx context.Context, k *database.Key) (crypto.PrivateKey, error)

PrivateKey decrypts a stored private key.

func (*Service) PublicKey

func (s *Service) PublicKey(k *database.Key) (crypto.PublicKey, error)

PublicKey parses a stored key's public half.

func (*Service) Search

func (s *Service) Search(ctx context.Context, query string) (*SearchResult, error)

Search runs a query against all object kinds.

func (*Service) Stats

func (s *Service) Stats(ctx context.Context, warnDays int) (Counts, error)

Stats counts stored objects; expiring uses warnDays.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL