Documentation
¶
Overview ¶
Package macaroon decodes macaroon authorization credentials from their libmacaroons binary serialization (v1 packet format and v2 binary format).
It is a read-only parser: it recovers the location, identifier, caveats, and signature so a caller can inspect a captured macaroon — for example a leaked PyPI API token (see internal/pypitoken) — without the issuing HMAC secret. It deliberately does NOT verify the macaroon's signature chain: that requires the root key, which loot never carries, and a decoder that claimed verification from the token alone would be confidently wrong.
Wrap-vs-native: native — both layouts are a short run of length-prefixed fields, decoded with the stdlib (encoding/binary varint) and no new go.mod dep. The format is rescrv/libmacaroons doc/format.txt; the parser is anchored to the cross-implementation vectors in pymacaroons' tests/functional_tests/serialization_tests.py (see macaroon_test.go).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Caveat ¶
Caveat is one macaroon caveat. A first-party caveat (VID empty) carries only an ID — for PyPI that ID is a JSON-encoded restriction. A third-party caveat additionally carries a Location and a verification key ID (VID).
func (Caveat) FirstParty ¶
FirstParty reports whether c is a first-party caveat (no verification key ID).
type Macaroon ¶
type Macaroon struct {
Version int
Location string
Identifier []byte
Caveats []Caveat
Signature []byte
}
Macaroon is a decoded macaroon. Signature is the raw HMAC bytes; the parser does not verify it (the root key is not present in a captured token).
func Decode ¶
Decode parses a macaroon from its raw (already base64-decoded) binary form, auto-detecting v1 vs v2 the same way libmacaroons does: a leading byte of 0x02 is the v2 binary format; a leading ASCII hex digit is the v1 packet format. Use DecodeBase64 for the base64-wrapped form tokens ship in.
func DecodeBase64 ¶
DecodeBase64 decodes the base64-wrapped form a macaroon ships in (e.g. the part of a PyPI token after the "pypi-" prefix) and parses it. pymacaroons emits URL-safe, unpadded base64; cross-implementation tooling may emit standard base64; so DecodeBase64 trims surrounding whitespace and padding and tries the URL-safe and standard alphabets in turn, returning the first that both decodes and yields a valid macaroon.
Source Files