secboot

type ActivateConfig interface {
	ActivateConfigGetter

	// Set is used to set the value of the specified key to the specified value.
	// If value is nil, the key is erased from the config.
	Set(key, value any)
}

type ActivateConfigGetter interface {
	// Get is used to get the value of the specified key, if one exists.
	Get(key any) (value any, exists bool)
}

type ActivateContext struct {
	// contains filtered or unexported fields
}

type ActivateContextOption interface {
	ActivateOption

	// ApplyContextOptionToConfig is called to make changes to the supplied ActivateConfig.
	ApplyContextOptionToConfig(ActivateConfig)
}

type ActivateOption interface {
	// ApplyOptionToConfig is called to make changes to the supplied ActivateConfig.
	ApplyOptionToConfig(ActivateConfig)
}

type ActivateState struct {
	// PrimaryKeyID is used to allow the primary key to be shared between
	// different ActivateContexts without storing the key in the state.
	PrimaryKeyID int32 `json:"primary-key-id"`

	// Activations contains state for each StorageContainer, keyed by
	// the credential name of the container.
	Activations map[string]*ContainerActivateState `json:"activations"`
}

type ActivateVolumeOptions struct {
	// PassphraseTries specifies the maximum number of times
	// that activation with a user passphrase should be attempted
	// before failing with an error and falling back to activating
	// with the recovery key (see RecoveryKeyTries).
	//
	// Setting this to zero disables activation with a user
	// passphrase - in this case, any protected keys that require
	// a passphrase are ignored and activation will fall back to
	// requesting a recovery key.
	//
	// For each passphrase attempt, the supplied passphrase is
	// tested against every protected key that requires a passphrase.
	//
	// The actual number of available passphrase attempts may be
	// limited by the platform to a number that is lower than this
	// value (eg, in the TPM case because of the current auth fail
	// counter value which means the dictionary attack protection
	// might be triggered first).
	//
	// It is ignored by ActivateVolumeWithRecoveryKey.
	PassphraseTries int

	// RecoveryKeyTries specifies the maximum number of times that
	// activation with the fallback recovery key should be
	// attempted.
	//
	// It is used directly by ActivateVolumeWithRecoveryKey and
	// indirectly with other methods upon failure, for example
	// in the case where no other keys can be recovered.
	//
	// Setting this to zero will disable attempts to activate with
	// the fallback recovery key.
	RecoveryKeyTries int

	// KeyringPrefix is the prefix used for the description of any
	// kernel keys created during activation.
	KeyringPrefix string

	// LegacyDevicePaths are the device paths to register keys to
	// keyring. This is useful when snap-bootstrap boots to an
	// older version of snapd.
	LegacyDevicePaths []string
}

type ActivationStatus string

type Argon2CostParams struct {
	// Time corresponds to the number of iterations of the algorithm
	// that the key derivation will use.
	Time uint32

	// MemoryKiB is the amount of memory in KiB that the key derivation
	// will use.
	MemoryKiB uint32

	// Threads is the number of parallel threads that will be used
	// for the key derivation.
	Threads uint8
}

type Argon2KDF interface {
	// Derive derives a key of the specified length in bytes, from the supplied
	// passphrase and salt and using the supplied mode and cost parameters.
	Derive(passphrase string, salt []byte, mode Argon2Mode, params *Argon2CostParams, keyLen uint32) ([]byte, error)

	// Time measures the amount of time the KDF takes to execute with the
	// specified cost parameters and mode.
	Time(mode Argon2Mode, params *Argon2CostParams) (time.Duration, error)
}

type Argon2Mode = argon2.Mode

type Argon2Options struct {
	// Mode specifies the KDF mode to use.
	Mode Argon2Mode

	// MemoryKiB specifies the maximum memory cost in KiB when ForceIterations
	// is zero. In this case, it will be capped at 4GiB or half of the available
	// memory, whichever is less. If ForceIterations is not zero, then this is
	// used as the memory cost and is not limited.
	MemoryKiB uint32

	// TargetDuration specifies the target duration for the KDF which
	// is used to benchmark the time and memory cost parameters. If it
	// is zero then the default is used. If ForceIterations is not zero
	// then this field is ignored.
	TargetDuration time.Duration

	// ForceIterations can be used to turn off KDF benchmarking by
	// setting the time cost directly. If this is zero then the cost
	// parameters are benchmarked based on the value of TargetDuration.
	ForceIterations uint32

	// Parallel sets the maximum number of parallel threads for the KDF. If
	// it is zero, then it is set to the number of CPUs or 4, whichever is
	// less. This will always be automatically limited to 4 when ForceIterations
	// is zero.
	Parallel uint8
}

type Argon2OutOfProcessCommand string

type Argon2OutOfProcessError struct {
	ErrorType   Argon2OutOfProcessErrorType
	ErrorString string
}

type Argon2OutOfProcessErrorType string

type Argon2OutOfProcessRequest struct {
	Command           Argon2OutOfProcessCommand `json:"command"`                      // The command to run
	Timeout           time.Duration             `json:"timeout"`                      // The maximum amount of time to wait for the request to start before aborting it
	Passphrase        string                    `json:"passphrase,omitempty"`         // If the command is "derive, the passphrase
	Salt              []byte                    `json:"salt,omitempty"`               // If the command is "derive", the salt
	Keylen            uint32                    `json:"keylen,omitempty"`             // If the command is "derive", the key length in bytes
	Mode              Argon2Mode                `json:"mode"`                         // The Argon2 mode
	Time              uint32                    `json:"time"`                         // The time cost
	MemoryKiB         uint32                    `json:"memory"`                       // The memory cost in KiB
	Threads           uint8                     `json:"threads"`                      // The number of threads to use
	WatchdogChallenge []byte                    `json:"watchdog-challenge,omitempty"` // A challenge value for watchdog pings (when the command is "watchdog")
}

type Argon2OutOfProcessResponse struct {
	Command          Argon2OutOfProcessCommand   `json:"command"`                     // The input command
	Key              []byte                      `json:"key,omitempty"`               // The derived key, if the input command was "derive"
	Duration         time.Duration               `json:"duration,omitempty"`          // The duration, if the input command was "duration"
	WatchdogResponse []byte                      `json:"watchdog-response,omitempty"` // The response to a watchdog ping, if the input command was "watchdog"
	ErrorType        Argon2OutOfProcessErrorType `json:"error-type,omitempty"`        // The error type, if an error occurred
	ErrorString      string                      `json:"error-string,omitempty"`      // The error string, if an error occurred
}

type Argon2OutOfProcessResponseCommandInvalidError struct {
	Response Argon2OutOfProcessCommand
	Expected Argon2OutOfProcessCommand
}

type Argon2OutOfProcessWatchdogError struct {
	// contains filtered or unexported fields
}

type Argon2OutOfProcessWatchdogHandler func(challenge []byte) (response []byte, err error)

type Argon2OutOfProcessWatchdogMonitor func(tmb *tomb.Tomb, reqChan chan<- *Argon2OutOfProcessRequest, rspChan <-chan *Argon2OutOfProcessResponse) error

type AuthMode uint8

type AuthRequestor interface {
	// RequestUserCredential is used to request a user credential that is
	// required to unlock the container at the specified path. The optional
	// name argument permits the caller to supply a more human friendly name,
	// and can be supplied via the ActivateContext API using the
	// WithAuthRequestorUserVisibleName option. The authTypes argument is used
	// to indicate what types of credential are being requested.
	//
	// The implementation returns the requested credential and its type, which
	// may be a subset of the requested credential types. It may return
	// ErrAuthRequestorNotAvailable if the corresponding mechanism is not
	// available.
	RequestUserCredential(ctx context.Context, name, path string, authTypes UserAuthType) (string, UserAuthType, error)

	// NotifyUserAuthResult is used to inform the user about the result of an
	// authentication attempt.
	//
	// If the result is UserAuthResultSuccess, the supplied authTypes argument
	// indicates the credential type that was successfully used. The
	// exhaustedAuthTypes argument is unused.
	//
	// If the result is UserAuthResultFailed, the supplied authTypes argument
	// indicates the credential types that were attempted but failed. The
	// exhaustedAuthTypes argument indicates the credential types that
	// will no longer be available following the last attempt because there are
	// no more tries permitted.
	//
	// If the result is UserAuthResultInvalidFormat, the supplied
	// authTypes argument indicates the credential types that the user supplied
	// credential was badly formatted for. The exhaustedAuthTypes argument
	// is unused.
	//
	// It may return ErrAuthRequestorNotAvailable if the corresponding mechanism
	// is not available.
	NotifyUserAuthResult(ctx context.Context, result UserAuthResult, authTypes, exhaustedAuthTypes UserAuthType) error
}

type AuthRequestorStringer interface {
	// RequestUserCredentialString returns messages used by RequestUserCredential. The
	// name is a string supplied via the WithAuthRequestorUserVisibleName option, and the
	// path is the storage container path.
	RequestUserCredentialString(name, path string, authTypes UserAuthType) (string, error)

	// NotifyUserAuthResultString returns messages used by NotifyUserAuthResult.
	NotifyUserAuthResultString(name, path string, result UserAuthResult, authTypes, exhaustedAuthTypes UserAuthType) (string, error)
}

type ContainerActivateState struct {
	Status             ActivationStatus            `json:"status"`                      // The overall activation status for this storage container.
	Keyslot            string                      `json:"keyslot,omitempty"`           // If the container was activated, the name of the keyslot used.
	DeactivateReason   DeactivationReason          `json:"deactivate-reason,omitempty"` // An argument supplied to ActivateContext.DeactivateContainer.
	KeyslotErrors      map[string]KeyslotErrorType `json:"keyslot-errors"`              // A map of errors for tried keyslots, keyed by name.
	KeyslotErrorsOrder []string                    `json:"keyslot-errors-order"`        // A list of keyslot names in order of failure.

	// CustomData provides a way for the user of the ActivateContext API
	// to save arbitrary custom JSON data, using the
	// WithCustomActivateStateData option.
	CustomData json.RawMessage `json:"custom-data,omitempty"`
}

type DeactivationReason string

type DiskUnlockKey []byte

type ExternalUnlockKeySource int

type FileKeyDataReader struct {
	*bytes.Reader
	// contains filtered or unexported fields
}

type FileKeyDataWriter struct {
	*bytes.Buffer
	// contains filtered or unexported fields
}

type HashAlg crypto.Hash

type IncompatibleKeyDataRoleParamsError struct {
	// contains filtered or unexported fields
}

type InitializeLUKS2ContainerOptions struct {
	// MetadataKiBSize sets the size of the metadata area in KiB. This
	//
	// MetadataKiBSize sets the size of the metadata area in KiB. 4KiB of
	// this is used for the fixed-size binary header, with the remaining
	// space being used for the JSON area. Setting this to zero causes
	// the container to be initialized with the default metadata area size.
	// If set to a non zero value, it must be a power of 2 between 16KiB
	// and 4MiB.
	MetadataKiBSize uint32

	// KeyslotsAreaKiBSize sets the size of the binary keyslot area in KiB.
	// Setting this to zero causes the container to be initialized with
	// the default keyslots area size. If set to a non-zero value, the
	// value must be a multiple of 4KiB up to a maximum of 128MiB.
	KeyslotsAreaKiBSize uint32

	// InitialKeyslotName sets the name that will be used to identify
	// the initial keyslot. If this is empty, then the name will be
	// set to "default".
	InitialKeyslotName string

	// InlineCryptoEngine set flag if to use Inline Crypto Engine
	InlineCryptoEngine bool
}

type InvalidKeyDataError struct {
	// contains filtered or unexported fields
}

type InvalidKeyDataRoleParamsError struct {
	// contains filtered or unexported fields
}

type KDFOptions interface {
	// contains filtered or unexported methods
}

type KeyData struct {
	// contains filtered or unexported fields
}

type KeyDataReader interface {
	io.Reader
	ReadableName() string
}

type KeyDataWriter interface {
	io.Writer
	Commit() error
}

type KeyID []byte

type KeyParams struct {
	// Handle contains metadata required by the platform in order to recover
	// this key. It is opaque to this go package. It should be a value that can
	// be encoded to JSON using go's encoding/json package, which could be
	// something as simple as binary data stored in a byte slice or a more complex
	// JSON object, depending on the requirements of the implementation. A handle
	// already encoded to JSON can be supplied using the json.RawMessage type.
	Handle interface{}

	Role string

	// EncryptedPayload contains the encrypted and authenticated payload. The
	// plaintext payload should be created with [MakeDiskUnlockKey].
	EncryptedPayload []byte

	PlatformName string // Name of the platform that produced this data

	// KDFAlg is the digest algorithm used to derive additional keys during
	// the use of the created KeyData. It must match the algorithm passed to
	// [MakeDiskUnlockKey]. The zero value here has a special meaning which
	// is reserved to support legacy TPM2 key data files, and tells the
	// KeyData to use the unique key as the unlock key rather than using it
	// to derive the unlock key.
	KDFAlg crypto.Hash
}

type KeyWithPINParams struct {
	KeyParams
	KDFOptions *PBKDF2Options // The PIN KDF options

	// AuthKeySize is the size of key to derive from the PIN for
	// use by the platform implementation.
	AuthKeySize int

	// ChangeAuthKeyContext can be set to the caller to any arbitrary value
	// that should be passed to the initial call to
	// [PlatformKeyDataHandler.ChangeAuthKey]. The main use for this is to
	// permit the tpm2 package to supply an open TPM connection.
	ChangeAuthKeyContext any
}

type KeyWithPassphraseParams struct {
	KeyParams
	KDFOptions KDFOptions // The passphrase KDF options

	// AuthKeySize is the size of key to derive from the passphrase for
	// use by the platform implementation.
	AuthKeySize int

	// ChangeAuthKeyContext can be set to the caller to any arbitrary value
	// that should be passed to the initial call to
	// [PlatformKeyDataHandler.ChangeAuthKey]. The main use for this is to
	// permit the tpm2 package to supply an open TPM connection.
	ChangeAuthKeyContext any
}

type KeyringKeyPurpose string

type Keyslot interface {
	Type() KeyslotType
	Name() string
	Priority() int
	Data() KeyDataReader // TODO: This will eventually just be a io.Reader.
}

type KeyslotErrorType string

type KeyslotType string

type LUKS2KeyDataReader struct {
	*bytes.Reader
	// contains filtered or unexported fields
}

type LUKS2KeyDataWriter struct {
	*bytes.Buffer
	// contains filtered or unexported fields
}

type PBKDF2Options struct {
	TargetDuration time.Duration

	ForceIterations uint32

	HashAlg crypto.Hash
}

type PIN struct {
	// contains filtered or unexported fields
}

type PassphraseEntropyStats struct {
	SymbolPoolSize  uint32
	NumberOfSymbols uint32
	EntropyBits     uint32
}

type PlatformDeviceUnavailableError struct {
	// contains filtered or unexported fields
}

type PlatformHandlerError struct {
	Type PlatformHandlerErrorType // type of the error
	Err  error                    // underlying error
}

type PlatformHandlerErrorType int

type PlatformKeyData struct {
	Generation    int
	EncodedHandle []byte // The JSON encoded platform handle
	Role          string
	KDFAlg        crypto.Hash

	AuthMode AuthMode
}

type PlatformKeyDataHandler interface {
	// RecoverKeys attempts to recover the cleartext keys from the supplied encrypted
	// payload using this platform's secure device.
	RecoverKeys(data *PlatformKeyData, encryptedPayload []byte) ([]byte, error)

	// RecoverKeysWithAuthKey attempts to recover the cleartext keys from the
	// encrypted payload using this platform's secure device. The key parameter
	// is a passphrase derived key to enable passphrase support to be integrated
	// with the secure device. The platform implementation doesn't provide the primary
	// mechanism of protecting keys with a passphrase - this is done in the platform
	// agnostic API. Some devices (such as TPMs) support this integration natively. For
	// other devices, the integration should provide a way of validating the key in
	// a way that requires the use of the secure device (eg, such as computing a HMAC of
	// it using a hardware backed key).
	RecoverKeysWithAuthKey(data *PlatformKeyData, encryptedPayload, key []byte) ([]byte, error)

	// ChangeAuthKey is called to notify the platform implementation that the
	// passphrase is being changed. The old and new parameters are passphrase derived
	// keys. Either value can be nil if passphrase authentication is being enabled (
	// where old will be nil) or disabled (where new will be nil).
	//
	// The use of the context argument isn't defined here - it's passed during
	// key construction and the platform is free to use it however it likes.
	//
	// On success, it should return an updated handle.
	ChangeAuthKey(data *PlatformKeyData, old, new []byte, context any) ([]byte, error)
}

type PlatformKeyDataHandlerFlags uint64

type PlatformUninitializedError struct {
	// contains filtered or unexported fields
}

type PrimaryKey []byte

type RecoveryKey [16]byte

type SnapModel interface {
	Series() string
	BrandID() string
	Model() string
	Classic() bool
	Grade() asserts.ModelGrade
	SignKeyID() string
}

type StorageContainer interface {
	Path() string // The path of this storage container.

	// BackendName is the name of the backend that created this
	// StorageContainer instance.
	//
	// XXX: See the comment for RegisterStorageContainerBackend about
	// using something other than a string for identifying the storage
	// backend.
	BackendName() string

	// CredentialName returns a string that can be used to identify
	// a credential associated with this container that is passed from
	// the early boot environment
	CredentialName() string

	// Activate unlocks this container with the specified key.
	// The caller can choose to supply the Keyslot instance
	// related to the keyslot from which the supplied key is
	// associated with (obtained from StorageContainerReader.ReadKeyslot).
	// If supplied, the backend can use this to target the supplied
	// key at a specific keyslot. If keyslotInfo nil is supplied, the
	// backend will have to test all keyslots with the supplied key.
	// The caller can specify a configuration, which is a map of keys
	// or arbitrary types to values of arbitrary types.
	Activate(ctx context.Context, ks Keyslot, key []byte, cfg ActivateConfigGetter) error

	// Deactivate locks this storage container.
	Deactivate(ctx context.Context) error

	// OpenRead opens this storage container in order to perform
	// operations to keyslots that only require read access. The backend
	// should permit as many of these to be opened as is requested, but
	// must not allow a combination of StorageContainerReader and
	// StorageContainerReadWriter (when it exists) to be open at the same
	// time (and the backend should only permit one StorageContainerReadWriter
	// to be open at a time).
	OpenRead(ctx context.Context) (StorageContainerReader, error)
}

type StorageContainerBackend interface {
	// Probe returns a StorageContainer instance for the supplied
	// path to a storage container source if it can be handled by this
	// backend, else it returns (nil, nil).
	//
	// Implementations should always return the same StorageContainer
	// instance for the same container referenced by the supplied path -
	// the implementation should at least handle the cases of symbolic
	// links. It should also be the same instance as the one returned
	// via the ProbeActivated method with a path to the corresponding
	// activate storage container.
	//
	// Implementations of this must be safe to call from any goroutine.
	//
	// The supplied path may or may not be a path to a block device,
	// depending on how the backend works - there may be backends in the
	// future that don't use block devices for storage containers.
	Probe(ctx context.Context, path string) (StorageContainer, error)

	// ProbeActivated returns a StorageContainer instance for the
	// supplied path to an activated storage container if it can be
	// handled by this backend, else it returns (nil, nil). An activated
	// storage container is one that is backed by some source that can
	// be returned via the Probe method using the path to the source
	// instead.
	//
	// Implementations should always return the same StorageContainer
	// instance for the same container referenced by the supplied path -
	// the implementation should at least handle the cases of symbolic
	// links. It should also be the same instance as the one returned
	// via the Probe method with the corresponding source path.
	//
	// Implementations of this must be safe to call from any goroutine.
	//
	// The supplied path may or may not be a path to a block device,
	// depending on how the backend works - there may be backends in the
	// future that don't use block devices for storage containers.
	ProbeActivated(ctx context.Context, path string) (StorageContainer, error)
}

type StorageContainerReader interface {
	// Container returns the StorageContainer that this reader
	// was opened from. It can return nil once Close is called.
	Container() StorageContainer

	// io.Closer is used to close this reader.
	io.Closer

	// ListKeyslotNames returns a sorted list of keyslot names.
	ListKeyslotNames(ctx context.Context) ([]string, error)

	// ReadKeyslot returns information about the keyslot with
	// the specified name.
	ReadKeyslot(ctx context.Context, name string) (Keyslot, error)
}

type SystemdAuthRequestorStringFn func(name, path string, authTypes UserAuthType) (string, error)

type UserAuthResult int

type UserAuthType int

type UserAuthUnavailableError struct {
	// contains filtered or unexported fields
}