Documentation
¶
Index ¶
- Constants
- Variables
- func AddDigestsToComponentDescriptor(ctx context.Context, cd *cdv2.ComponentDescriptor, ...) error
- func GetSignatureByName(cd *cdv2.ComponentDescriptor, signatureName string) (*cdv2.Signature, error)
- func GetSignaturePEMBlocks(pemData []byte) ([]*pem.Block, error)
- func HashForComponentDescriptor(cd cdv2.ComponentDescriptor, hash Hasher) (*cdv2.DigestSpec, error)
- func SignComponentDescriptor(cd *cdv2.ComponentDescriptor, signer Signer, hasher Hasher, ...) error
- func VerifySignedComponentDescriptor(cd *cdv2.ComponentDescriptor, verifier Verifier, signatureName string) error
- type Entry
- type Hasher
- type RSASigner
- type RSAVerifier
- type ResourceDigester
- type Signer
- type Verifier
Constants ¶
const (
SHA256 = "sha256"
)
Variables ¶
Functions ¶
func AddDigestsToComponentDescriptor ¶
func AddDigestsToComponentDescriptor(ctx context.Context, cd *cdv2.ComponentDescriptor, compRefResolver func(context.Context, cdv2.ComponentDescriptor, cdv2.ComponentReference) (*cdv2.DigestSpec, error), resResolver func(context.Context, cdv2.ComponentDescriptor, cdv2.Resource) (*cdv2.DigestSpec, error)) error
AddDigestsToComponentDescriptor adds digest to componentReferences and resources as returned in the resolver functions. If a digest already exists, a mismatch against the resolved digest will return an error.
func GetSignatureByName ¶
func GetSignatureByName(cd *cdv2.ComponentDescriptor, signatureName string) (*cdv2.Signature, error)
GetSignatureByName returns the Signature (Digest and SigantureSpec) matching the given name
func GetSignaturePEMBlocks ¶
GetSignaturePEMBlocks returns all signature pem blocks from a list of pem blocks
func HashForComponentDescriptor ¶
func HashForComponentDescriptor(cd cdv2.ComponentDescriptor, hash Hasher) (*cdv2.DigestSpec, error)
HashForComponentDescriptor return the hash for the component-descriptor, if it is normaliseable (= componentReferences and resources contain digest field)
func SignComponentDescriptor ¶
func SignComponentDescriptor(cd *cdv2.ComponentDescriptor, signer Signer, hasher Hasher, signatureName string) error
SignComponentDescriptor signs the given component-descriptor with the signer. The component-descriptor has to contain digests for componentReferences and resources.
func VerifySignedComponentDescriptor ¶
func VerifySignedComponentDescriptor(cd *cdv2.ComponentDescriptor, verifier Verifier, signatureName string) error
VerifySignedComponentDescriptor verifies the signature (selected by signatureName) and hash of the component-descriptor (as specified in the signature). Does NOT resolve resources or referenced component-descriptors. Returns error if verification fails.
Types ¶
type Entry ¶
type Entry map[string]interface{}
Entry is used for normalisation and has to contain one key
type Hasher ¶
Hasher encapsulates a hash.Hash interface with an algorithm name.
func HasherForName ¶
HasherForName creates a Hasher instance for the algorithmName.
type RSASigner ¶
type RSASigner struct {
// contains filtered or unexported fields
}
RSASigner is a signatures.Signer compatible struct to sign with RSASSA-PKCS1-V1_5.
func CreateRSASignerFromKeyFile ¶
CreateRSASignerFromKeyFile creates an Instance of RSASigner with the given private key. The private key has to be in the PKCS #1, ASN.1 DER form, see x509.ParsePKCS1PrivateKey. mediaType defines the format of the signature that is saved to the component descriptor.
func (RSASigner) Sign ¶
func (s RSASigner) Sign(componentDescriptor cdv2.ComponentDescriptor, digest cdv2.DigestSpec) (*cdv2.SignatureSpec, error)
Sign returns the signature for the data for the component descriptor.
type RSAVerifier ¶
type RSAVerifier struct {
// contains filtered or unexported fields
}
RSAVerifier is a signatures.Verifier compatible struct to verify RSASSA-PKCS1-V1_5 signatures.
func CreateRSAVerifier ¶
func CreateRSAVerifier(publicKey *rsa.PublicKey) (*RSAVerifier, error)
CreateRSAVerifier creates an instance of RsaVerifier from a given rsa public key.
func CreateRSAVerifierFromKeyFile ¶
func CreateRSAVerifierFromKeyFile(pathToPublicKey string) (*RSAVerifier, error)
CreateRSAVerifierFromKeyFile creates an instance of RsaVerifier from a rsa public key file. The private key has to be in the PKIX, ASN.1 DER form, see x509.ParsePKIXPublicKey.
func (RSAVerifier) Verify ¶
func (v RSAVerifier) Verify(componentDescriptor cdv2.ComponentDescriptor, signature cdv2.Signature) error
Verify checks the signature, returns an error on verification failure
type ResourceDigester ¶
type ResourceDigester interface {
DigestForResource(ctx context.Context, componentDescriptor cdv2.ComponentDescriptor, resource cdv2.Resource, hasher Hasher) (*cdv2.DigestSpec, error)
}
type Signer ¶
type Signer interface {
// Sign returns the signature for the data for the component-descriptor
Sign(componentDescriptor cdv2.ComponentDescriptor, digest cdv2.DigestSpec) (*cdv2.SignatureSpec, error)
}
Signer interface is used to implement different signing algorithms. Each Signer should have a matching Verifier.
type Verifier ¶
type Verifier interface {
// Verify checks the signature, returns an error on verification failure
Verify(componentDescriptor cdv2.ComponentDescriptor, signature cdv2.Signature) error
}
Verifier interface is used to implement different verification algorithms. Each Verifier should have a matching Signer.
Source Files