Documentation
¶
Overview ¶
Package hashivault implement the interface with hashivault kms service
Package hashivault contains utilities related to Hashivault KMS.
Index ¶
- Constants
- func ValidReference(ref string) error
- type SignerVerifier
- func (h SignerVerifier) CreateKey(_ context.Context, algorithm string) (crypto.PublicKey, error)
- func (h *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error)
- func (h *SignerVerifier) DefaultAlgorithm() string
- func (h SignerVerifier) PublicKey(_ ...signature.PublicKeyOption) (crypto.PublicKey, error)
- func (h SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error)
- func (h *SignerVerifier) SupportedAlgorithms() []string
- func (h SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signature.VerifyOption) error
Constants ¶
const ( AlgorithmECDSAP256 = "ecdsa-p256" AlgorithmECDSAP384 = "ecdsa-p384" AlgorithmECDSAP521 = "ecdsa-p521" AlgorithmED25519 = "ed25519" AlgorithmRSA2048 = "rsa-2048" AlgorithmRSA3072 = "rsa-3072" AlgorithmRSA4096 = "rsa-4096" )
Taken from https://www.vaultproject.io/api/secret/transit nolint:revive
const (
// ReferenceScheme schemes for various KMS services are copied from https://github.com/google/go-cloud/tree/master/secrets
ReferenceScheme = "hashivault://"
)
Variables ¶
This section is empty.
Functions ¶
func ValidReference ¶
ValidReference returns a non-nil error if the reference string is invalid
Types ¶
type SignerVerifier ¶
type SignerVerifier struct {
// contains filtered or unexported fields
}
SignerVerifier creates and verifies digital signatures over a message using Hashicorp Vault KMS service
func LoadSignerVerifier ¶
func LoadSignerVerifier(referenceStr string, hashFunc crypto.Hash, opts ...signature.RPCOption) (*SignerVerifier, error)
LoadSignerVerifier generates signatures using the specified key object in Vault and hash algorithm.
It also can verify signatures (via a remote vall to the Vault instance). hashFunc should be set to crypto.Hash(0) if the key referred to by referenceStr is an ED25519 signing key.
func (SignerVerifier) CreateKey ¶
CreateKey attempts to create a new key in Vault with the specified algorithm.
func (*SignerVerifier) CryptoSigner ¶
func (h *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error)
CryptoSigner returns a crypto.Signer object that uses the underlying SignerVerifier, along with a crypto.SignerOpts object that allows the KMS to be used in APIs that only accept the standard golang objects
func (*SignerVerifier) DefaultAlgorithm ¶
func (h *SignerVerifier) DefaultAlgorithm() string
DefaultAlgorithm returns the default algorithm for the Hashicorp Vault service
func (SignerVerifier) PublicKey ¶
func (h SignerVerifier) PublicKey(_ ...signature.PublicKeyOption) (crypto.PublicKey, error)
PublicKey returns the public key that can be used to verify signatures created by this signer. All options provided in arguments to this method are ignored.
func (SignerVerifier) SignMessage ¶
func (h SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error)
SignMessage signs the provided message using HashiCorp Vault KMS. If the message is provided, this method will compute the digest according to the hash function specified when the HashivaultSigner was created.
SignMessage recognizes the following Options listed in order of preference:
- WithDigest()
All other options are ignored if specified.
func (*SignerVerifier) SupportedAlgorithms ¶
func (h *SignerVerifier) SupportedAlgorithms() []string
SupportedAlgorithms returns the list of algorithms supported by the Hashicorp Vault service
func (SignerVerifier) VerifySignature ¶
func (h SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signature.VerifyOption) error
VerifySignature verifies the signature for the given message. Unless provided in an option, the digest of the message will be computed using the hash function specified when the SignerVerifier was created.
This function returns nil if the verification succeeded, and an error message otherwise.
This function recognizes the following Options listed in order of preference:
- WithDigest()
- WithCryptoSignerOpts()
All other options are ignored if specified.
Source Files