Documentation
¶
Index ¶
- func EncodeCertificatesToPEM(certs []*pb_go_v1.X509Certificate) ([]byte, []byte)
- func GetKeypairAndToken(ctx context.Context, ko options.KeyOpts, cert, certChain string) (sign.Keypair, []byte, string, error)
- func LoadTrustedMaterialAndSigningConfig(ctx context.Context, ko *options.KeyOpts, useSigningConfig bool, ...) error
- func NewAttestationBundle(ctx context.Context, ko options.KeyOpts, cert, certChain string, ...) ([]byte, crypto.PublicKey, string, pb_go_v1.HashAlgorithm, error)
- func NewLegacyBundleFromProtoBundleComponents(bc *BundleComponents, pubKeyPem string) ([]byte, error)
- func NewSigningConfigFromKeyOpts(ko options.KeyOpts, tlogUpload bool) (*root.SigningConfig, error)
- func ParseOCIReference(ctx context.Context, refStr string, opts ...name.Option) (name.Reference, error)
- func ParseSignatureAlgorithmFlag(signingAlgorithm string) (pb_go_v1.PublicKeyDetails, error)
- func ProtoHashAlgoToHash(ha pb_go_v1.HashAlgorithm) crypto.Hash
- func RekorBundleFromProtoTlogEntry(entry *protorekor.TransparencyLogEntry) *cbundle.RekorBundle
- func ShouldUploadToTlog(ctx context.Context, ko options.KeyOpts, ref name.Reference, tlogUpload bool) (bool, error)
- type BundleComponents
- type CommonBundleOpts
- type SignerVerifier
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EncodeCertificatesToPEM ¶ added in v3.1.0
func EncodeCertificatesToPEM(certs []*pb_go_v1.X509Certificate) ([]byte, []byte)
EncodeCertificatesToPEM encodes certificates to PEM format.
func GetKeypairAndToken ¶
func GetKeypairAndToken(ctx context.Context, ko options.KeyOpts, cert, certChain string) (sign.Keypair, []byte, string, error)
GetKeypairAndToken creates a keypair object from provided key or cert flags or generates an ephemeral key. For an ephemeral key, it also uses the key to fetch an OIDC token, the pair of which are later used to get a Fulcio cert.
Ensure the returned SignerVerifier is closed via calling SignerVerifier.Close.
func LoadTrustedMaterialAndSigningConfig ¶
func LoadTrustedMaterialAndSigningConfig(ctx context.Context, ko *options.KeyOpts, useSigningConfig bool, signingConfigPath string, rekorURL, fulcioURL, oidcIssuer, tsaServerURL, trustedRootPath string, tlogUpload bool, newBundleFormat bool, bundlePath string, keyRef string, issueCertificate bool, output, outputAttestation, outputCertificate, outputPayload, outputSignature, outputTimestamp string) error
LoadTrustedMaterialAndSigningConfig loads the trusted material and signing config from the given options.
func NewAttestationBundle ¶ added in v3.1.0
func NewAttestationBundle(ctx context.Context, ko options.KeyOpts, cert, certChain string, bundleOpts CommonBundleOpts, signingConfig *root.SigningConfig, trustedMaterial root.TrustedMaterial) ([]byte, crypto.PublicKey, string, pb_go_v1.HashAlgorithm, error)
NewAttestationBundle uses signing config and trusted root to sign an attestation and create a bundle.
func NewLegacyBundleFromProtoBundleComponents ¶ added in v3.1.0
func NewLegacyBundleFromProtoBundleComponents(bc *BundleComponents, pubKeyPem string) ([]byte, error)
NewLegacyBundleFromProtoBundleComponents creates a legacy bundle from a protobuf bundle.
func NewSigningConfigFromKeyOpts ¶ added in v3.1.0
NewSigningConfigFromKeyOpts creates a signing config from key options. This only supports Rekor v1. Rekor v2 requires a user-provided signing config.
func ParseOCIReference ¶
func ParseOCIReference(ctx context.Context, refStr string, opts ...name.Option) (name.Reference, error)
ParseOCIReference parses a string reference to an OCI image into a reference, warning if the reference did not include a digest.
func ParseSignatureAlgorithmFlag ¶
func ParseSignatureAlgorithmFlag(signingAlgorithm string) (pb_go_v1.PublicKeyDetails, error)
func ProtoHashAlgoToHash ¶ added in v3.1.0
func ProtoHashAlgoToHash(ha pb_go_v1.HashAlgorithm) crypto.Hash
ProtoHashAlgoToHash converts a protobuf HashAlgorithm to a crypto.Hash.
func RekorBundleFromProtoTlogEntry ¶ added in v3.1.0
func RekorBundleFromProtoTlogEntry(entry *protorekor.TransparencyLogEntry) *cbundle.RekorBundle
RekorBundleFromProtoTlogEntry creates a RekorBundle from a protobuf TransparencyLogEntry.
Types ¶
type BundleComponents ¶ added in v3.1.0
type BundleComponents struct {
Signature []byte
Certificates []*pb_go_v1.X509Certificate
RekorEntries []*protorekor.TransparencyLogEntry
RFC3161Timestamps []*pb_go_v1.RFC3161SignedTimestamp
}
func ExtractComponentsFromProtoBundle ¶ added in v3.1.0
func ExtractComponentsFromProtoBundle(bundle *protobundle.Bundle) (*BundleComponents, error)
ExtractComponentsFromProtoBundle extracts the components from a protobuf bundle.
type CommonBundleOpts ¶
type SignerVerifier ¶
type SignerVerifier struct {
Cert []byte
Chain []byte
signature.SignerVerifier
// contains filtered or unexported fields
}
SignerVerifier contains keys or certs to sign and verify.
func (*SignerVerifier) Close ¶
func (c *SignerVerifier) Close()
Close closes the key context if there is one.
Source Files