Documentation
¶
Index ¶
- Constants
- func Contains[T comparable](list []T, val T) bool
- func ContainsAll(str string, terms []string) bool
- func ContainsAny(str string, terms []string) bool
- func FileExists(path string) (bool, error)
- func GetArchAliases() []string
- func GetFedoraGPGKeys() (io.ReadCloser, error)
- func GetLineInFileMatchingKey(filepath string, key string) (res string, err error)
- func GetLineInReader(reader io.Reader, match string) (res string, err error)
- func GetLineInReaderMatchingKey(reader io.Reader, key string) (string, error)
- func GetOSAliases() []string
- func Keys[T, U comparable](myMap map[T]U) []T
- func Md5sum(filepath string) (string, error)
- func Sha256sum(filepath string) (string, error)
- func Unarchive(source string, destination string) error
- func Unzip(source string, destination string) error
- func VerifyAndExtractSignedMessage(signedFilePath string, armoredPublicKeys ...string) ([]byte, error)
- func VerifyGPGSignature(targetFilePath, signatureFilePath string) error
- func WriteFile(from io.Reader, to string, permissions os.FileMode) error
Constants ¶
const FedoraSigningKeyURL string = "https://fedoraproject.org/fedora.gpg"
const RedHatReleaseKey2ArmoredPublicKey = `` /* 1674-byte string literal not displayed */
RedHatReleaseKey2ArmoredPublicKey is the armored OpenPGP public key for "Red Hat, Inc. (release key 2) <security@redhat.com>", pinned directly in source rather than fetched at runtime.
mirror.openshift.com serves both the tool artifacts (e.g. the 'oc' client tarball) and their checksums/signatures over the same HTTPS connection. An attacker positioned on the network path (or a compromised/malicious proxy) could tamper with the tarball and its plaintext sha256sum.txt in transit, since both are protected only by that single transport channel. Pinning this key lets us cryptographically verify the detached-signed checksum file (sha256sum.txt.gpg) against a trust anchor that does not depend on the same transport used to fetch the artifacts, so integrity no longer relies solely on TLS.
Fingerprint: 567E 347A D004 4ADE 55BA 8A5F 199E 2F91 FD43 1D51 Key ID: 199E2F91FD431D51 Source: https://access.redhat.com/security/team/key
https://security.access.redhat.com/data/fd431d51.txt
Variables ¶
This section is empty.
Functions ¶
func Contains ¶
func Contains[T comparable](list []T, val T) bool
Contains returns true if the provided list has a matching element
func ContainsAll ¶ added in v1.0.0
ContainsAll returns true if all of the provided search terms are a substring of 'str'
func ContainsAny ¶ added in v1.0.0
ContainsAny returns true if any of the provided search terms are a substring of 'str'
func FileExists ¶ added in v0.1.0
FileExists checks if a file *of any type* is present at the given path
func GetArchAliases ¶ added in v1.0.0
func GetArchAliases() []string
GetArchAliases returns all commonly used names for the system's architecture. ie - An 'amd64' system is functionally equivalent to 'x86_64' for our purposes An 'arm64' system is functionally equivalent to 'arm' for our purposes (mainly gcloud)
func GetFedoraGPGKeys ¶ added in v1.0.0
func GetFedoraGPGKeys() (io.ReadCloser, error)
func GetLineInFileMatchingKey ¶ added in v0.2.0
GetLineInFileMatchingKey searches the provided file for a line that contains the provided key. A key is a pattern that will be either at the begin/end of line and will have ::spaces:: characters around. If a match is found, the entire line is returned. Only the first result is returned. If no lines match, an error is returned
func GetLineInReader ¶ added in v0.1.0
GetLinInReader searches the provided reader for a line that contains the provided string. If a match is found, the entire line is returned. Only the first result is returned. If no lines match, an error is returned
func GetLineInReaderMatchingKey ¶ added in v1.5.0
GetLineInReaderMatchingKey searches the provided reader for a line that contains the provided key. A key is a pattern that will be either at the begin/end of line and will have ::spaces:: characters around. If a match is found, the entire line is returned. Only the first result is returned. If no lines match, an error is returned
func GetOSAliases ¶ added in v1.0.0
func GetOSAliases() []string
GetOSAliases returns all commonly used names for the system's OS. ie - A system running 'darwin' is functionally equivalent to 'mac' for our purposes
func Keys ¶
func Keys[T, U comparable](myMap map[T]U) []T
Keys returns a slice containing the keys of the provided map. Order is preserved
func Unarchive ¶
Unarchive decompresses and extracts the contents of .tar.gz bundles to the specified destination
func VerifyAndExtractSignedMessage ¶ added in v1.5.0
func VerifyAndExtractSignedMessage(signedFilePath string, armoredPublicKeys ...string) ([]byte, error)
VerifyAndExtractSignedMessage verifies an OpenPGP signed message (e.g. a file produced by `gpg --sign`/`gpg --output foo.gpg --sign foo.txt`, as opposed to a *detached* signature) against the provided armored public key(s) and returns the verified plaintext contents on success.
Callers should pass one or more pinned, embedded public keys (see e.g. RedHatReleaseKey2ArmoredPublicKey) rather than a key fetched over the network at verification time. Doing so ensures integrity does not rely solely on the transport (e.g. HTTPS to a mirror/CDN) used to fetch the signed message, protecting against a network-adjacent or proxying attacker who tampers with content in transit.
func VerifyGPGSignature ¶ added in v1.0.0
Types ¶
This section is empty.
Source Files