dsse

type AcceptedKey ¶ added in v0.3.0

type AcceptedKey struct {
	Public crypto.PublicKey
	KeyID  string
	Sig    Signature
}

type Envelope ¶

type Envelope struct {
	PayloadType string      `json:"payloadType"`
	Payload     string      `json:"payload"`
	Signatures  []Signature `json:"signatures"`
}

Envelope captures an envelope as described by the DSSE specification. See here: https://github.com/secure-systems-lab/dsse/blob/master/envelope.md

func (e *Envelope) DecodeB64Payload() ([]byte, error)

type EnvelopeSigner ¶

type EnvelopeSigner struct {
	// contains filtered or unexported fields
}

EnvelopeSigner creates signed Envelopes.

func NewEnvelopeSigner(p ...Signer) (*EnvelopeSigner, error)

func NewMultiEnvelopeSigner(threshold int, p ...Signer) (*EnvelopeSigner, error)

func (es *EnvelopeSigner) SignPayload(ctx context.Context, payloadType string, body []byte) (*Envelope, error)

type EnvelopeVerifier ¶

type EnvelopeVerifier struct {
	// contains filtered or unexported fields
}

func NewEnvelopeVerifier(v ...Verifier) (*EnvelopeVerifier, error)

func NewMultiEnvelopeVerifier(threshold int, p ...Verifier) (*EnvelopeVerifier, error)

func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]AcceptedKey, error)

type Signature ¶

type Signature struct {
	KeyID string `json:"keyid"`
	Sig   string `json:"sig"`
}

Signature represents a generic in-toto signature that contains the identifier of the key which was used to create the signature. The used signature scheme has to be agreed upon by the signer and verifer out of band. The signature is a base64 encoding of the raw bytes from the signature algorithm.

type Signer ¶

type Signer interface {
	Sign(ctx context.Context, data []byte) ([]byte, error)
	KeyID() (string, error)
}

Signer defines the interface for an abstract signing algorithm. The Signer interface is used to inject signature algorithm implementations into the EnvelopeSigner. This decoupling allows for any signing algorithm and key management system can be used. The full message is provided as the parameter. If the signature algorithm depends on hashing of the message prior to signature calculation, the implementor of this interface must perform such hashing. The function must return raw bytes representing the calculated signature using the current algorithm, and the key used (if applicable).

type SignerVerifier ¶ added in v0.6.0

type SignerVerifier interface {
	Signer
	Verifier
}

SignerVerifier provides both the signing and verification interface.

type Verifier ¶

type Verifier interface {
	Verify(ctx context.Context, data, sig []byte) error
	KeyID() (string, error)
	Public() crypto.PublicKey
}

Verifier verifies a complete message against a signature and key. If the message was hashed prior to signature generation, the verifier must perform the same steps. If KeyID returns successfully, only signature matching the key ID will be verified.