integrity

type IntegrityCtx struct {
	// Repository is a repository used to check integrity of files.
	Repository Repository
	// contains filtered or unexported fields
}

type Provider interface {
	// RegisterWithIntegrityFlag adds the flag naming the private key used
	// to sign published data.
	RegisterWithIntegrityFlag(flags *pflag.FlagSet, dst *string)
	// RegisterIntegrityCheckFlag adds the root flag naming the public key
	// that enables integrity checks.
	RegisterIntegrityCheckFlag(flags *pflag.FlagSet, dst *string)
	// RegisterIntegrityCheckPeriodFlag adds the flag setting how often the
	// watchdog re-checks integrity.
	RegisterIntegrityCheckPeriodFlag(flags *pflag.FlagSet, dst *int)
	// HashesFileName is the name of the file with the hashes of an
	// application's files.
	HashesFileName() string
	// InitializeIntegrityCheck sets up integrity checking of the files the
	// signed hashes files in the directories roots list, with the public
	// key at publicKeyPath; a root without hashes files lists nothing. tt
	// passes the directory of the application it works on - the project,
	// or an installed version - and the directories of the runtimes it
	// runs, tarantool, tt and tcm. An empty publicKeyPath disables the
	// checks.
	InitializeIntegrityCheck(publicKeyPath string, roots ...string) (IntegrityCtx, error)
	// VerifyTree checks the tree rooted at dir with the public key at
	// publicKeyPath: it must be signed, every file its hashes files list
	// must match, and every file of the tree must be listed. A symbolic
	// link to a directory, or one that leads nowhere, holds no file and is
	// passed over. It is the check of what is about to be installed.
	VerifyTree(publicKeyPath, dir string) error
	// NewSigner creates a Signer for the private key at privateKeyPath.
	NewSigner(privateKeyPath string) (Signer, error)
	// GetCheckFunction returns a function that checks a map of hashes and
	// a signature of a data.
	GetCheckFunction(ctx IntegrityCtx) (
		func(data []byte, hashes map[string][]byte, sign []byte) error, error,
	)
	// GetSignFunction returns a function that creates a map of hashes and a
	// signature for a data for the private key at privateKeyPath.
	GetSignFunction(privateKeyPath string) (
		func(data []byte) (map[string][]byte, []byte, error), error,
	)
	// GetStorageVerifiers returns integrity primitives for storage-backed
	// readers.
	GetStorageVerifiers(ctx IntegrityCtx) ([]ghasher.Hasher, []gcrypto.Verifier, error)
	// GetStorageSigners returns integrity primitives for storage-backed
	// writers for the private key at privateKeyPath.
	GetStorageSigners(
		privateKeyPath string,
	) ([]ghasher.Hasher, []gcrypto.SignerVerifier, error)
}

type Repository interface {
	// Read checks the file at path and returns it opened for reading.
	//
	// The content of the file matched its digest when Read opened it. The
	// returned file is the live file: a write to it after Read returns
	// reaches the reader undetected, and only a later ValidateAll reports
	// it. Meant for large files and for callers that need a file rather
	// than bytes.
	Read(path string) (io.ReadCloser, error)
	// ReadFile checks the file at path and returns its content.
	//
	// The file is read into memory once and those bytes are checked, so
	// the returned bytes are exactly the ones that matched the digest,
	// whatever happens to the file afterwards. The cost is memory
	// proportional to the file. Meant for configuration and script files.
	ReadFile(path string) ([]byte, error)
	// ValidateAll checks that all the files stored in the repository
	// were not modified.
	ValidateAll() error
}

type SignOptions struct {
	// Skip are directories of the tree, as slash-separated paths relative
	// to its root, that are not listed: what is installed apart from the
	// package, such as the runtime it bundles.
	Skip []string
	// Loaded are files of the tree, as slash-separated paths relative to its
	// root, that Tarantool loads whatever their names, such as the scripts
	// the instance records run. Each must be a file of the tree.
	Loaded []string
}

type SignedFile struct {
	// Path is the path the file is listed under: relative to the directory
	// of the hashes file, slash-separated, without "." or "..".
	Path string
	// Source is the file whose content is listed.
	Source string
}

type Signer interface {
	// Sign signs the tree of a package rooted at dir. It writes two hashes
	// files in dir, each with its signature: hashes.json lists the files
	// Tarantool loads - Lua sources, shared libraries, cluster configs, the
	// files opts.Loaded names - and is what tt hands Tarantool to check
	// them; env_hashes.json lists every other file of the tree, the ones tt
	// reads and runs itself. Every file of the tree is listed exactly once,
	// but for the directories opts.Skip names and the hashes files and
	// signatures themselves, wherever they are.
	Sign(dir string, opts SignOptions) error
	// SignFiles writes the environment hashes file of dir, env_hashes.json,
	// listing files under the paths they are to have there, and its
	// signature. It signs a tree that is laid out after it is signed, such
	// as the runtime a package bundles, which is installed apart from it.
	SignFiles(dir string, files []SignedFile) error
}