Documentation ¶
Index ¶
- Constants
- func CertToPem(c *x509.Certificate) []byte
- func Descriptors(ref name.Reference) ([]v1.Descriptor, error)
- func DestinationRef(ref name.Reference, img *remote.Descriptor) (name.Reference, error)
- func Experimental() bool
- func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (string, error)
- func GeneratePrivateKey() (*ecdsa.PrivateKey, error)
- func KeyToPem(pub crypto.PublicKey) ([]byte, error)
- func LoadCerts(pemStr string) ([]*x509.Certificate, error)
- func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)
- func Munge(desc v1.Descriptor) string
- func PublicKeyPem(ctx context.Context, key signature.PublicKeyProvider) ([]byte, error)
- func TlogServer() string
- func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error
- func Upload(signature, payload []byte, dstTag name.Reference, cert, chain string) error
- func UploadTLog(signature, payload []byte, pemBytes []byte) (string, error)
- type CheckOpts
- type Keys
- type PassFunc
- type PublicKey
- type PublicKeyProvider
- type SignedPayload
- func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)
- func FetchSignaturesYaml(ctx context.Context, payloadPath string) ([]SignedPayload, error)
- func Verify(ctx context.Context, ref name.Reference, co CheckOpts, payloadPath string) ([]SignedPayload, error)
- func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error
- func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *payload.Simple) error
- func (sp *SignedPayload) VerifyKey(ctx context.Context, pubKey PublicKey) error
- func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (string, error)
Constants ¶
View Source
const ( ExperimentalEnv = "COSIGN_EXPERIMENTAL" ServerEnv = "REKOR_SERVER" )
Variables ¶
This section is empty.
Functions ¶
func CertToPem ¶
func CertToPem(c *x509.Certificate) []byte
func Descriptors ¶
func Descriptors(ref name.Reference) ([]v1.Descriptor, error)
func DestinationRef ¶
func Experimental ¶
func Experimental() bool
func FindTlogEntry ¶
func GeneratePrivateKey ¶
func GeneratePrivateKey() (*ecdsa.PrivateKey, error)
func LoadECDSAPrivateKey ¶
func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)
func Munge ¶
func Munge(desc v1.Descriptor) string
func PublicKeyPem ¶
func TlogServer ¶
func TlogServer() string
tlogServer returns the name of the tlog server, can be overwritten via env var
func TrustedCert ¶
func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error
Types ¶
type CheckOpts ¶
type CheckOpts struct { Annotations map[string]interface{} Claims bool Tlog bool PubKey PublicKey Roots *x509.CertPool }
There are only payloads. Some have certs, some don't.
type Keys ¶
func GenerateKeyPair ¶
type PublicKeyProvider ¶
type SignedPayload ¶
type SignedPayload struct { Base64Signature string Payload []byte Cert *x509.Certificate Chain []*x509.Certificate }
func FetchSignatures ¶
func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)
func FetchSignaturesYaml ¶
func FetchSignaturesYaml(ctx context.Context, payloadPath string) ([]SignedPayload, error)
func Verify ¶
func Verify(ctx context.Context, ref name.Reference, co CheckOpts, payloadPath string) ([]SignedPayload, error)
Verify does all the main cosign checks in a loop, returning validated payloads. If there were no payloads, we return an error.
func (*SignedPayload) TrustedCert ¶
func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error
func (*SignedPayload) VerifyClaims ¶
func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *payload.Simple) error
func (*SignedPayload) VerifyKey ¶
func (sp *SignedPayload) VerifyKey(ctx context.Context, pubKey PublicKey) error
func (*SignedPayload) VerifyTlog ¶
Click to show internal directories.
Click to hide internal directories.