Documentation
¶
Index ¶
- func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, ...) (io.Reader, digest.Digest, error)
- func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, ...) (io.Reader, map[string]string, error)
- func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, ...) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error)
- func GetKeyWrapper(scheme string) keywrap.KeyWrapper
- func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string
- func ReaderFromReaderAt(r io.ReaderAt) io.Reader
- func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper)
- type GPGClient
- type GPGVault
- type GPGVersion
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DecryptLayer ¶
func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error)
DecryptLayer decrypts a layer trying one keywrap.KeyWrapper after the other to see whether it can apply the provided private key If unwrapOnly is set we will only try to decrypt the layer encryption key and return
func EncryptLayer ¶
func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, map[string]string, error)
EncryptLayer encrypts the layer by running one encryptor after the other
func GPGGetPrivateKey ¶
func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, mustFindKey bool) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error)
GPGGetPrivateKey walks the list of layerInfos and tries to decrypt the wrapped symmetric keys. For this it determines whether a private key is in the GPGVault or on this system and prompts for the passwords for those that are available. If we do not find a private key on the system for getting to the symmetric key of a layer then an error is generated.
func GetKeyWrapper ¶
func GetKeyWrapper(scheme string) keywrap.KeyWrapper
GetKeyWrapper looks up the encryptor interface given an encryption scheme (gpg, jwe)
func GetWrappedKeysMap ¶
func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string
GetWrappedKeysMap returns a map of wrappedKeys as values in a map with the encryption scheme(s) as the key(s)
func ReaderFromReaderAt ¶
ReaderFromReaderAt takes an io.ReaderAt and returns an io.Reader
func RegisterKeyWrapper ¶
func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper)
RegisterKeyWrapper allows to register key wrappers by their encryption scheme
Types ¶
type GPGClient ¶
type GPGClient interface {
// ReadGPGPubRingFile gets the byte sequence of the gpg public keyring
ReadGPGPubRingFile() ([]byte, error)
// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error)
// GetSecretKeyDetails gets the details of a secret key
GetSecretKeyDetails(keyid uint64) ([]byte, bool, error)
// GetKeyDetails gets the details of a public key
GetKeyDetails(keyid uint64) ([]byte, bool, error)
// ResolveRecipients resolves PGP key ids to user names
ResolveRecipients([]string) []string
}
GPGClient defines an interface for wrapping the gpg command line tools
func NewGPGClient ¶
NewGPGClient creates a new GPGClient object representing the given version and using the given home directory
type GPGVault ¶
type GPGVault interface {
// AddSecretKeyRingData adds a secret keyring via its raw byte array
AddSecretKeyRingData(gpgSecretKeyRingData []byte) error
// AddSecretKeyRingDataArray adds secret keyring via its raw byte arrays
AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error
// AddSecretKeyRingFiles adds secret keyrings given their filenames
AddSecretKeyRingFiles(filenames []string) error
// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte)
}
GPGVault defines an interface for wrapping multiple secret key rings
type GPGVersion ¶
type GPGVersion int
GPGVersion enum representing the GPG client version to use.
const ( // GPGv2 signifies gpgv2+ GPGv2 GPGVersion = iota // GPGv1 signifies gpgv1+ GPGv1 // GPGVersionUndetermined signifies gpg client version undetermined GPGVersionUndetermined )
func GuessGPGVersion ¶
func GuessGPGVersion() GPGVersion
GuessGPGVersion guesses the version of gpg. Defaults to gpg2 if exists, if not defaults to regular gpg.
Source Files
Directories