docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-29 20:39:05 +03:00
Code Activity

Updates to notary for gotuf's split of PublicKey and PrivateKey interfaces

Browse Source 
Functions should now take data.PublicKey or data.PrivateKey instead of
data.Key.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
This commit is contained in:
Aaron Lehmann
2015-07-17 11:09:56 -07:00
parent 88e7346782
commit d2ea9cc0d5
28 changed files with 190 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Godeps/Godeps.json generated
View File

@@ -58,7 +58,7 @@
},
{
"ImportPath": "github.com/endophage/gotuf",
"Rev": "f81a3471fd94ba58e004ef9cd9bbbf81bfc565ed"
"Rev": "44944cf8926ed3bf246e3e6612e771d99352f648"
},
{
"ImportPath": "github.com/go-sql-driver/mysql",

85
Godeps/_workspace/src/github.com/endophage/gotuf/data/keys.go generated vendored
View File

@@ -12,6 +12,15 @@ type Key interface {
ID() string
Algorithm() KeyAlgorithm
Public() []byte
}
type PublicKey interface {
Key
}
type PrivateKey interface {
Key
Private() []byte
}
@@ -20,13 +29,18 @@ type KeyPair struct {
Private []byte `json:"private"`
}
// TUFKey is the structure used for both public and private keys in TUF.
// Normally it would make sense to use a different structures for public and
// private keys, but that would change the key ID algorithm (since the canonical
// JSON would be different). This structure should normally be accessed through
// the PublicKey or PrivateKey interfaces.
type TUFKey struct {
id string `json:"-"`
Type KeyAlgorithm `json:"keytype"`
Value KeyPair `json:"keyval"`
}
func NewTUFKey(algorithm KeyAlgorithm, public, private []byte) *TUFKey {
func NewPrivateKey(algorithm KeyAlgorithm, public, private []byte) *TUFKey {
return &TUFKey{
Type: algorithm,
Value: KeyPair{
@@ -42,7 +56,7 @@ func (k TUFKey) Algorithm() KeyAlgorithm {
func (k *TUFKey) ID() string {
if k.id == "" {
pubK := NewTUFKey(k.Algorithm(), k.Public(), nil)
pubK := NewPublicKey(k.Algorithm(), k.Public())
data, err := cjson.Marshal(&pubK)
if err != nil {
logrus.Error("Error generating key ID:", err)
@@ -57,51 +71,26 @@ func (k TUFKey) Public() []byte {
return k.Value.Public
}
type PublicKey struct {
TUFKey
}
func (k PublicKey) Private() []byte {
return nil
}
func NewPublicKey(algorithm KeyAlgorithm, public []byte) *PublicKey {
return &PublicKey{
TUFKey{
Type: algorithm,
Value: KeyPair{
Public: public,
Private: nil,
},
},
}
}
func PublicKeyFromPrivate(pk *PrivateKey) *PublicKey {
pub := &PublicKey{
pk.TUFKey,
}
pub.TUFKey.Value.Private = nil
return pub
}
type PrivateKey struct {
TUFKey
}
func NewPrivateKey(algorithm KeyAlgorithm, public, private []byte) *PrivateKey {
return &PrivateKey{
TUFKey{
Type: algorithm,
Value: KeyPair{
Public: []byte(public),
Private: []byte(private),
},
},
}
}
func (k PrivateKey) Private() []byte {
func (k *TUFKey) Private() []byte {
return k.Value.Private
}
func NewPublicKey(algorithm KeyAlgorithm, public []byte) PublicKey {
return &TUFKey{
Type: algorithm,
Value: KeyPair{
Public: public,
Private: nil,
},
}
}
func PublicKeyFromPrivate(pk PrivateKey) PublicKey {
return &TUFKey{
Type: pk.Algorithm(),
Value: KeyPair{
Public: pk.Public(),
Private: nil,
},
}
}

40
Godeps/_workspace/src/github.com/endophage/gotuf/data/root.go generated vendored
View File

@@ -14,27 +14,47 @@ type SignedRoot struct {
}
type Root struct {
Type string `json:"_type"`
Version int `json:"version"`
Expires time.Time `json:"expires"`
Keys map[string]*PublicKey `json:"keys"`
Roles map[string]*RootRole `json:"roles"`
ConsistentSnapshot bool `json:"consistent_snapshot"`
Type string `json:"_type"`
Version int `json:"version"`
Expires time.Time `json:"expires"`
// These keys are public keys. We use TUFKey instead of PublicKey to
// support direct JSON unmarshaling.
Keys map[string]*TUFKey `json:"keys"`
Roles map[string]*RootRole `json:"roles"`
ConsistentSnapshot bool `json:"consistent_snapshot"`
}
func NewRoot(keys map[string]*PublicKey, roles map[string]*RootRole, consistent bool) (*SignedRoot, error) {
return &SignedRoot{
func NewRoot(keys map[string]PublicKey, roles map[string]*RootRole, consistent bool) (*SignedRoot, error) {
signedRoot := &SignedRoot{
Signatures: make([]Signature, 0),
Signed: Root{
Type: TUFTypes["root"],
Version: 0,
Expires: DefaultExpires("root"),
Keys: keys,
Keys: make(map[string]*TUFKey),
Roles: roles,
ConsistentSnapshot: consistent,
},
Dirty: true,
}, nil
}
// Convert PublicKeys to TUFKey structures
// The Signed.Keys map needs to have *TUFKey values, since this
// structure gets directly unmarshalled from JSON, and it's not
// possible to unmarshal into an interface type. But this function
// takes a map with PublicKey values to avoid exposing this ugliness.
// The loop below converts to the TUFKey type.
for k, v := range keys {
signedRoot.Signed.Keys[k] = &TUFKey{
Type: v.Algorithm(),
Value: KeyPair{
Public: v.Public(),
Private: nil,
},
}
}
return signedRoot, nil
}
func (r SignedRoot) ToSigned() (*Signed, error) {

6
Godeps/_workspace/src/github.com/endophage/gotuf/data/types.go generated vendored
View File

@@ -125,13 +125,13 @@ func NewFileMeta(r io.Reader, hashAlgorithms ...string) (FileMeta, error) {
}
type Delegations struct {
Keys map[string]*PublicKey `json:"keys"`
Roles []*Role `json:"roles"`
Keys map[string]PublicKey `json:"keys"`
Roles []*Role `json:"roles"`
}
func NewDelegations() *Delegations {
return &Delegations{
Keys: make(map[string]*PublicKey),
Keys: make(map[string]PublicKey),
Roles: make([]*Role, 0),
}
}

8
Godeps/_workspace/src/github.com/endophage/gotuf/keys/db.go generated vendored
View File

@@ -18,17 +18,17 @@ var (
type KeyDB struct {
roles map[string]*data.Role
keys map[string]data.Key
keys map[string]data.PublicKey
}
func NewDB() *KeyDB {
return &KeyDB{
roles: make(map[string]*data.Role),
keys: make(map[string]data.Key),
keys: make(map[string]data.PublicKey),
}
}
func (db *KeyDB) AddKey(k data.Key) {
func (db *KeyDB) AddKey(k data.PublicKey) {
db.keys[k.ID()] = k
}
@@ -51,7 +51,7 @@ func (db *KeyDB) AddRole(r *data.Role) error {
return nil
}
func (db *KeyDB) GetKey(id string) data.Key {
func (db *KeyDB) GetKey(id string) data.PublicKey {
return db.keys[id]
}

14
Godeps/_workspace/src/github.com/endophage/gotuf/signed/ed25519.go generated vendored
View File

@@ -10,17 +10,17 @@ import (
// Ed25519 implements a simple in memory cryptosystem for ED25519 keys
type Ed25519 struct {
keys map[string]*data.PrivateKey
keys map[string]data.PrivateKey
}
func NewEd25519() *Ed25519 {
return &Ed25519{
make(map[string]*data.PrivateKey),
make(map[string]data.PrivateKey),
}
}
// addKey allows you to add a private key
func (e *Ed25519) addKey(k *data.PrivateKey) {
func (e *Ed25519) addKey(k data.PrivateKey) {
e.keys[k.ID()] = k
}
@@ -45,7 +45,7 @@ func (e *Ed25519) Sign(keyIDs []string, toSign []byte) ([]data.Signature, error)
}
func (e *Ed25519) Create(role string, algorithm data.KeyAlgorithm) (data.Key, error) {
func (e *Ed25519) Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error) {
if algorithm != data.ED25519Key {
return nil, errors.New("only ED25519 supported by this cryptoservice")
}
@@ -60,8 +60,8 @@ func (e *Ed25519) Create(role string, algorithm data.KeyAlgorithm) (data.Key, er
return public, nil
}
func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]*data.PublicKey, error) {
k := make(map[string]*data.PublicKey)
func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]data.PublicKey, error) {
k := make(map[string]data.PublicKey)
for _, kID := range keyIDs {
if key, ok := e.keys[kID]; ok {
k[kID] = data.PublicKeyFromPrivate(key)
@@ -70,6 +70,6 @@ func (e *Ed25519) PublicKeys(keyIDs ...string) (map[string]*data.PublicKey, erro
return k, nil
}
func (e *Ed25519) GetKey(keyID string) data.Key {
func (e *Ed25519) GetKey(keyID string) data.PublicKey {
return data.PublicKeyFromPrivate(e.keys[keyID])
}

6
Godeps/_workspace/src/github.com/endophage/gotuf/signed/interface.go generated vendored
View File

@@ -20,10 +20,10 @@ type KeyService interface {
// the private key into the appropriate signing service.
// The role isn't currently used for anything, but it's here to support
// future features
Create(role string, algorithm data.KeyAlgorithm) (data.Key, error)
Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error)
// GetKey retrieves the public key if present, otherwise it returns nil
GetKey(keyID string) data.Key
GetKey(keyID string) data.PublicKey
// RemoveKey deletes the specified key
RemoveKey(keyID string) error
@@ -40,5 +40,5 @@ type CryptoService interface {
// of this interface should verify signatures for one and only one
// signing scheme.
type Verifier interface {
Verify(key data.Key, sig []byte, msg []byte) error
Verify(key data.PublicKey, sig []byte, msg []byte) error
}

2
Godeps/_workspace/src/github.com/endophage/gotuf/signed/sign.go generated vendored
View File

@@ -7,7 +7,7 @@ import (
// Sign takes a data.Signed and a key, calculated and adds the signature
// to the data.Signed
func Sign(service CryptoService, s *data.Signed, keys ...data.Key) error {
func Sign(service CryptoService, s *data.Signed, keys ...data.PublicKey) error {
logrus.Debugf("sign called with %d keys", len(keys))
signatures := make([]data.Signature, 0, len(s.Signatures)+1)
keyIDMemb := make(map[string]struct{})

14
Godeps/_workspace/src/github.com/endophage/gotuf/signed/sign_test.go generated vendored
View File

@@ -27,13 +27,13 @@ func (mts *MockCryptoService) Sign(keyIDs []string, _ []byte) ([]data.Signature,
return sigs, nil
}
func (mts *MockCryptoService) Create(_ string, _ data.KeyAlgorithm) (data.Key, error) {
return &mts.testKey, nil
func (mts *MockCryptoService) Create(_ string, _ data.KeyAlgorithm) (data.PublicKey, error) {
return mts.testKey, nil
}
func (mts *MockCryptoService) GetKey(keyID string) data.Key {
func (mts *MockCryptoService) GetKey(keyID string) data.PublicKey {
if keyID == "testID" {
return &mts.testKey
return mts.testKey
}
return nil
}
@@ -48,7 +48,7 @@ var _ CryptoService = &MockCryptoService{}
func TestBasicSign(t *testing.T) {
testKey, _ := pem.Decode([]byte(testKeyPEM1))
k := data.NewPublicKey(data.RSAKey, testKey.Bytes)
mockCryptoService := &MockCryptoService{testKey: *k}
mockCryptoService := &MockCryptoService{testKey: k}
key, err := mockCryptoService.Create("root", data.ED25519Key)
if err != nil {
t.Fatal(err)
@@ -73,7 +73,7 @@ func TestBasicSign(t *testing.T) {
func TestReSign(t *testing.T) {
testKey, _ := pem.Decode([]byte(testKeyPEM1))
k := data.NewPublicKey(data.RSAKey, testKey.Bytes)
mockCryptoService := &MockCryptoService{testKey: *k}
mockCryptoService := &MockCryptoService{testKey: k}
testData := data.Signed{}
Sign(mockCryptoService, &testData, k)
@@ -117,7 +117,7 @@ func TestMultiSign(t *testing.T) {
func TestCreate(t *testing.T) {
testKey, _ := pem.Decode([]byte(testKeyPEM1))
k := data.NewPublicKey(data.RSAKey, testKey.Bytes)
mockCryptoService := &MockCryptoService{testKey: *k}
mockCryptoService := &MockCryptoService{testKey: k}
key, err := mockCryptoService.Create("root", data.ED25519Key)

12
Godeps/_workspace/src/github.com/endophage/gotuf/signed/verifiers.go generated vendored
View File

@@ -46,7 +46,7 @@ func RegisterVerifier(algorithm data.SigAlgorithm, v Verifier) {
type Ed25519Verifier struct{}
func (v Ed25519Verifier) Verify(key data.Key, sig []byte, msg []byte) error {
func (v Ed25519Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error {
var sigBytes [ed25519.SignatureSize]byte
if len(sig) != len(sigBytes) {
logrus.Infof("signature length is incorrect, must be %d, was %d.", ed25519.SignatureSize, len(sig))
@@ -79,7 +79,7 @@ func verifyPSS(key interface{}, digest, sig []byte) error {
return nil
}
func getRSAPubKey(key data.Key) (crypto.PublicKey, error) {
func getRSAPubKey(key data.PublicKey) (crypto.PublicKey, error) {
algorithm := key.Algorithm()
var pubKey crypto.PublicKey
@@ -115,7 +115,7 @@ func getRSAPubKey(key data.Key) (crypto.PublicKey, error) {
type RSAPSSVerifier struct{}
// Verify does the actual check.
func (v RSAPSSVerifier) Verify(key data.Key, sig []byte, msg []byte) error {
func (v RSAPSSVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error {
pubKey, err := getRSAPubKey(key)
if err != nil {
return err
@@ -129,7 +129,7 @@ func (v RSAPSSVerifier) Verify(key data.Key, sig []byte, msg []byte) error {
// RSAPKCS1v15SVerifier checks RSA PKCS1v15 signatures
type RSAPKCS1v15Verifier struct{}
func (v RSAPKCS1v15Verifier) Verify(key data.Key, sig []byte, msg []byte) error {
func (v RSAPKCS1v15Verifier) Verify(key data.PublicKey, sig []byte, msg []byte) error {
pubKey, err := getRSAPubKey(key)
if err != nil {
return err
@@ -155,7 +155,7 @@ type RSAPyCryptoVerifier struct{}
// Verify does the actual check.
// N.B. We have not been able to make this work in a way that is compatible
// with PyCrypto.
func (v RSAPyCryptoVerifier) Verify(key data.Key, sig []byte, msg []byte) error {
func (v RSAPyCryptoVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error {
digest := sha256.Sum256(msg)
k, _ := pem.Decode([]byte(key.Public()))
@@ -177,7 +177,7 @@ func (v RSAPyCryptoVerifier) Verify(key data.Key, sig []byte, msg []byte) error
type ECDSAVerifier struct{}
// Verify does the actual check.
func (v ECDSAVerifier) Verify(key data.Key, sig []byte, msg []byte) error {
func (v ECDSAVerifier) Verify(key data.PublicKey, sig []byte, msg []byte) error {
algorithm := key.Algorithm()
var pubKey crypto.PublicKey

38
Godeps/_workspace/src/github.com/endophage/gotuf/signed/verifiers_test.go generated vendored
View File

@@ -30,7 +30,7 @@ const baseECDSAx509Key = `{"keytype":"ecdsa-x509","keyval":{"public":"LS0tLS1CRU
func TestRSAPSSVerifier(t *testing.T) {
// Unmarshal our private RSA Key
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -54,7 +54,7 @@ func TestRSAPSSVerifier(t *testing.T) {
func TestRSAPSSx509Verifier(t *testing.T) {
// Unmarshal our public RSA Key
var testRSAKey data.PublicKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -74,7 +74,7 @@ func TestRSAPSSx509Verifier(t *testing.T) {
}
func TestRSAPSSVerifierWithInvalidKeyType(t *testing.T) {
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -94,7 +94,7 @@ func TestRSAPSSVerifierWithInvalidKeyType(t *testing.T) {
}
func TestRSAPSSVerifierWithInvalidKey(t *testing.T) {
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -114,7 +114,7 @@ func TestRSAPSSVerifierWithInvalidKey(t *testing.T) {
}
func TestRSAPSSVerifierWithInvalidSignature(t *testing.T) {
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -141,7 +141,7 @@ func TestRSAPSSVerifierWithInvalidSignature(t *testing.T) {
func TestRSAPKCS1v15Verifier(t *testing.T) {
// Unmarshal our private RSA Key
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -165,7 +165,7 @@ func TestRSAPKCS1v15Verifier(t *testing.T) {
func TestRSAPKCS1v15x509Verifier(t *testing.T) {
// Unmarshal our public RSA Key
var testRSAKey data.PublicKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -185,7 +185,7 @@ func TestRSAPKCS1v15x509Verifier(t *testing.T) {
}
func TestRSAPKCS1v15VerifierWithInvalidKeyType(t *testing.T) {
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -205,7 +205,7 @@ func TestRSAPKCS1v15VerifierWithInvalidKeyType(t *testing.T) {
}
func TestRSAPKCS1v15VerifierWithInvalidKey(t *testing.T) {
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -225,7 +225,7 @@ func TestRSAPKCS1v15VerifierWithInvalidKey(t *testing.T) {
}
func TestRSAPKCS1v15VerifierWithInvalidSignature(t *testing.T) {
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -251,7 +251,7 @@ func TestRSAPKCS1v15VerifierWithInvalidSignature(t *testing.T) {
}
func TestECDSAVerifier(t *testing.T) {
var testECDSAKey data.PrivateKey
var testECDSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -273,7 +273,7 @@ func TestECDSAVerifier(t *testing.T) {
}
func TestECDSAx509Verifier(t *testing.T) {
var testECDSAKey data.PrivateKey
var testECDSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -293,7 +293,7 @@ func TestECDSAx509Verifier(t *testing.T) {
}
func TestECDSAVerifierWithInvalidKeyType(t *testing.T) {
var testECDSAKey data.PrivateKey
var testECDSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -313,7 +313,7 @@ func TestECDSAVerifierWithInvalidKeyType(t *testing.T) {
}
func TestECDSAVerifierWithInvalidKey(t *testing.T) {
var testECDSAKey data.PrivateKey
var testECDSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -333,7 +333,7 @@ func TestECDSAVerifierWithInvalidKey(t *testing.T) {
}
func TestECDSAVerifierWithInvalidSignature(t *testing.T) {
var testECDSAKey data.PrivateKey
var testECDSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template
@@ -358,7 +358,7 @@ func TestECDSAVerifierWithInvalidSignature(t *testing.T) {
}
func rsaPSSSign(privKey *data.PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
func rsaPSSSign(privKey data.PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
if privKey.Algorithm() != data.RSAKey {
return nil, fmt.Errorf("private key type not supported: %s", privKey.Algorithm())
}
@@ -378,7 +378,7 @@ func rsaPSSSign(privKey *data.PrivateKey, hash crypto.Hash, hashed []byte) ([]by
return sig, nil
}
func rsaPKCS1v15Sign(privKey *data.PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
func rsaPKCS1v15Sign(privKey data.PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error) {
if privKey.Algorithm() != data.RSAKey {
return nil, fmt.Errorf("private key type not supported: %s", privKey.Algorithm())
}
@@ -398,7 +398,7 @@ func rsaPKCS1v15Sign(privKey *data.PrivateKey, hash crypto.Hash, hashed []byte)
return sig, nil
}
func ecdsaSign(privKey *data.PrivateKey, hashed []byte) ([]byte, error) {
func ecdsaSign(privKey data.PrivateKey, hashed []byte) ([]byte, error) {
if privKey.Algorithm() != data.ECDSAKey {
return nil, fmt.Errorf("private key type not supported: %s", privKey.Algorithm())
}
@@ -432,7 +432,7 @@ func ecdsaSign(privKey *data.PrivateKey, hashed []byte) ([]byte, error) {
// the test
func signX509() {
// Unmarshal our private RSA Key
var testRSAKey data.PrivateKey
var testRSAKey data.TUFKey
var jsonKey bytes.Buffer
// Execute our template

3
Godeps/_workspace/src/github.com/endophage/gotuf/signed/verify.go generated vendored
View File

@@ -28,7 +28,7 @@ type signedMeta struct {
}
// VerifyRoot checks if a given root file is valid against a known set of keys.
func VerifyRoot(s *data.Signed, minVersion int, keys map[string]*data.PublicKey, threshold int) ([]*data.PublicKey, error) {
func VerifyRoot(s *data.Signed, minVersion int, keys map[string]data.PublicKey, threshold int) (data.PublicKey, error) {
if len(s.Signatures) == 0 {
return nil, ErrNoSignatures
}
@@ -57,7 +57,6 @@ func VerifyRoot(s *data.Signed, minVersion int, keys map[string]*data.PublicKey,
continue
}
valid[sig.KeyID] = struct{}{}
}
if len(valid) < threshold {
return nil, ErrRoleThreshold

4
Godeps/_workspace/src/github.com/endophage/gotuf/signed/verify_test.go generated vendored
View File

@@ -22,7 +22,7 @@ func (VerifySuite) Test(c *C) {
cryptoService := NewEd25519()
type test struct {
name string
keys []data.Key
keys []data.PublicKey
roles map[string]*data.Role
s *data.Signed
ver int
@@ -164,7 +164,7 @@ func (VerifySuite) Test(c *C) {
s := &data.Signed{Signed: b}
Sign(cryptoService, s, k)
t.s = s
t.keys = []data.Key{k}
t.keys = []data.PublicKey{k}
}
if t.roles == nil {
t.roles = map[string]*data.Role{

8
Godeps/_workspace/src/github.com/endophage/gotuf/store/dbstore.go generated vendored
View File

@@ -82,8 +82,8 @@ func (dbs *dbStore) Commit(metafiles map[string]json.RawMessage, consistent bool
}
// GetKeys returns private keys
func (dbs *dbStore) GetKeys(role string) ([]*data.Key, error) {
keys := []*data.Key{}
func (dbs *dbStore) GetKeys(role string) ([]data.PrivateKey, error) {
keys := []data.PrivateKey{}
var r *sql.Rows
var err error
sql := "SELECT `key` FROM `keys` WHERE `role` = ? AND `namespace` = ?;"
@@ -96,7 +96,7 @@ func (dbs *dbStore) GetKeys(role string) ([]*data.Key, error) {
defer r.Close()
for r.Next() {
var jsonStr string
key := new(data.Key)
key := new(data.TUFKey)
r.Scan(&jsonStr)
err := json.Unmarshal([]byte(jsonStr), key)
if err != nil {
@@ -108,7 +108,7 @@ func (dbs *dbStore) GetKeys(role string) ([]*data.Key, error) {
}
// SaveKey saves a new private key
func (dbs *dbStore) SaveKey(role string, key *data.Key) error {
func (dbs *dbStore) SaveKey(role string, key data.PrivateKey) error {
jsonBytes, err := json.Marshal(key)
if err != nil {
return fmt.Errorf("Could not JSON Marshal Key")

10
Godeps/_workspace/src/github.com/endophage/gotuf/store/memorystore.go generated vendored
View File

@@ -15,14 +15,14 @@ func MemoryStore(meta map[string]json.RawMessage, files map[string][]byte) Local
return &memoryStore{
meta: meta,
files: files,
keys: make(map[string][]*data.Key),
keys: make(map[string][]data.PrivateKey),
}
}
type memoryStore struct {
meta map[string]json.RawMessage
files map[string][]byte
keys map[string][]*data.Key
keys map[string][]data.PrivateKey
}
func (m *memoryStore) GetMeta(name string, size int64) (json.RawMessage, error) {
@@ -72,13 +72,13 @@ func (m *memoryStore) Commit(map[string]json.RawMessage, bool, map[string]data.H
return nil
}
func (m *memoryStore) GetKeys(role string) ([]*data.Key, error) {
func (m *memoryStore) GetKeys(role string) ([]data.PrivateKey, error) {
return m.keys[role], nil
}
func (m *memoryStore) SaveKey(role string, key *data.Key) error {
func (m *memoryStore) SaveKey(role string, key data.PrivateKey) error {
if _, ok := m.keys[role]; !ok {
m.keys[role] = make([]*data.Key, 0)
m.keys[role] = make([]data.PrivateKey, 0)
}
m.keys[role] = append(m.keys[role], key)
return nil

16
Godeps/_workspace/src/github.com/endophage/gotuf/tuf.go generated vendored
View File

@@ -70,15 +70,17 @@ func NewTufRepo(keysDB *keys.KeyDB, cryptoService signed.CryptoService) *TufRepo
}
// AddBaseKeys is used to add keys to the role in root.json
func (tr *TufRepo) AddBaseKeys(role string, keys ...data.Key) error {
func (tr *TufRepo) AddBaseKeys(role string, keys ...*data.TUFKey) error {
if tr.Root == nil {
return &ErrNotLoaded{role: "root"}
}
for _, k := range keys {
key := data.NewPublicKey(k.Algorithm(), k.Public())
tr.Root.Signed.Keys[key.ID()] = key
tr.keysDB.AddKey(key)
tr.Root.Signed.Roles[role].KeyIDs = append(tr.Root.Signed.Roles[role].KeyIDs, key.ID())
// Store only the public portion
pubKey := *k
pubKey.Value.Private = nil
tr.Root.Signed.Keys[pubKey.ID()] = &pubKey
tr.keysDB.AddKey(&pubKey)
tr.Root.Signed.Roles[role].KeyIDs = append(tr.Root.Signed.Roles[role].KeyIDs, pubKey.ID())
}
tr.Root.Dirty = true
return nil
@@ -191,7 +193,7 @@ func (tr *TufRepo) InitRepo(consistent bool) error {
func (tr *TufRepo) InitRoot(consistent bool) error {
rootRoles := make(map[string]*data.RootRole)
rootKeys := make(map[string]*data.PublicKey)
rootKeys := make(map[string]data.PublicKey)
for _, r := range data.ValidRoles {
role := tr.keysDB.GetRole(r)
if role == nil {
@@ -579,7 +581,7 @@ func (tr *TufRepo) SignTimestamp(expires time.Time, cryptoService signed.CryptoS
}
func (tr TufRepo) sign(signedData *data.Signed, role data.Role, cryptoService signed.CryptoService) (*data.Signed, error) {
ks := make([]data.Key, 0, len(role.KeyIDs))
ks := make([]data.PublicKey, 0, len(role.KeyIDs))
for _, kid := range role.KeyIDs {
k := tr.keysDB.GetKey(kid)
if k == nil {

4
client/client_test.go
View File

@@ -306,7 +306,7 @@ func testAddListTarget(t *testing.T, rootType data.KeyAlgorithm) {
err = applyChangelist(repo.tufRepo, cl)
assert.NoError(t, err, "could not apply changelist")
var tempKey data.PrivateKey
var tempKey data.TUFKey
json.Unmarshal([]byte(timestampECDSAKeyJSON), &tempKey)
repo.KeyStoreManager.NonRootKeyStore().AddKey(filepath.Join(filepath.FromSlash(gun), tempKey.ID()), &tempKey)
@@ -426,7 +426,7 @@ func testValidateRootKey(t *testing.T, rootType data.KeyAlgorithm) {
if key, ok := decodedRoot.Keys[keyid]; !ok {
t.Fatal("key id not found in keys")
} else {
_, err := trustmanager.LoadCertFromPEM(key.Value.Public)
_, err := trustmanager.LoadCertFromPEM(key.Public())
assert.NoError(t, err, "key is not a valid cert")
}
}

14
cryptoservice/crypto_service.go
View File

@@ -34,8 +34,8 @@ func NewCryptoService(gun string, keyStore trustmanager.KeyStore, passphrase str
}
// Create is used to generate keys for targets, snapshots and timestamps
func (ccs *CryptoService) Create(role string, algorithm data.KeyAlgorithm) (data.Key, error) {
var privKey *data.PrivateKey
func (ccs *CryptoService) Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error) {
var privKey data.PrivateKey
var err error
switch algorithm {
@@ -68,7 +68,7 @@ func (ccs *CryptoService) Create(role string, algorithm data.KeyAlgorithm) (data
}
// GetKey returns a key by ID
func (ccs *CryptoService) GetKey(keyID string) data.Key {
func (ccs *CryptoService) GetKey(keyID string) data.PublicKey {
key, err := ccs.keyStore.GetKey(keyID)
if err != nil {
return nil
@@ -90,7 +90,7 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
// ccs.gun will be empty if this is the root key
keyName := filepath.Join(ccs.gun, keyid)
var privKey *data.PrivateKey
var privKey data.PrivateKey
var err error
// Read PrivateKey from file and decrypt it if there is a passphrase.
@@ -142,7 +142,7 @@ func (ccs *CryptoService) Sign(keyIDs []string, payload []byte) ([]data.Signatur
return signatures, nil
}
func rsaSign(privKey *data.PrivateKey, message []byte) ([]byte, error) {
func rsaSign(privKey data.PrivateKey, message []byte) ([]byte, error) {
if privKey.Algorithm() != data.RSAKey {
return nil, fmt.Errorf("private key type not supported: %s", privKey.Algorithm())
}
@@ -164,7 +164,7 @@ func rsaSign(privKey *data.PrivateKey, message []byte) ([]byte, error) {
return sig, nil
}
func ecdsaSign(privKey *data.PrivateKey, message []byte) ([]byte, error) {
func ecdsaSign(privKey data.PrivateKey, message []byte) ([]byte, error) {
if privKey.Algorithm() != data.ECDSAKey {
return nil, fmt.Errorf("private key type not supported: %s", privKey.Algorithm())
}
@@ -196,7 +196,7 @@ func ecdsaSign(privKey *data.PrivateKey, message []byte) ([]byte, error) {
return append(rBuf, sBuf...), nil
}
func ed25519Sign(privKey *data.PrivateKey, message []byte) ([]byte, error) {
func ed25519Sign(privKey data.PrivateKey, message []byte) ([]byte, error) {
if privKey.Algorithm() != data.ED25519Key {
return nil, fmt.Errorf("private key type not supported: %s", privKey.Algorithm())
}

6
cryptoservice/unlocked_crypto_service.go
View File

@@ -17,12 +17,12 @@ import (
// uses that private key, providing convinience methods for generation of
// certificates.
type UnlockedCryptoService struct {
PrivKey *data.PrivateKey
PrivKey data.PrivateKey
CryptoService signed.CryptoService
}
// NewUnlockedCryptoService creates an UnlockedCryptoService instance
func NewUnlockedCryptoService(privKey *data.PrivateKey, cryptoService signed.CryptoService) *UnlockedCryptoService {
func NewUnlockedCryptoService(privKey data.PrivateKey, cryptoService signed.CryptoService) *UnlockedCryptoService {
return &UnlockedCryptoService{
PrivKey: privKey,
CryptoService: cryptoService,
@@ -35,7 +35,7 @@ func (ucs *UnlockedCryptoService) ID() string {
}
// PublicKey Returns the public key associated with the private key
func (ucs *UnlockedCryptoService) PublicKey() *data.PublicKey {
func (ucs *UnlockedCryptoService) PublicKey() data.PublicKey {
return data.PublicKeyFromPrivate(ucs.PrivKey)
}

2
keystoremanager/import_export.go
View File

@@ -206,7 +206,7 @@ func (km *KeyStoreManager) ImportKeysZip(zipReader zip.Reader, passphrase string
// an error (for example, wrong passphrase), without leaving the key
// store in an inconsistent state
newRootKeys := make(map[string][]byte)
newNonRootKeys := make(map[string]*data.PrivateKey)
newNonRootKeys := make(map[string]data.PrivateKey)
// Note that using / as a separator is okay here - the zip package
// guarantees that the separator will be /

4
keystoremanager/keystoremanager.go
View File

@@ -124,7 +124,7 @@ func (km *KeyStoreManager) AddTrustedCACert(cert *x509.Certificate) {
// TODO(diogo): show not create keys manually, should use a cryptoservice instead
func (km *KeyStoreManager) GenRootKey(algorithm, passphrase string) (string, error) {
var err error
var privKey *data.PrivateKey
var privKey data.PrivateKey
// We don't want external API callers to rely on internal TUF data types, so
// the API here should continue to receive a string algorithm, and ensure
@@ -196,7 +196,7 @@ func (km *KeyStoreManager) ValidateRoot(root *data.Signed, dnsName string) error
return err
}
certs := make(map[string]*data.PublicKey)
certs := make(map[string]data.PublicKey)
for _, keyID := range rootSigned.Roles["root"].KeyIDs {
// TODO(dlaw): currently assuming only one cert contained in
// public key entry. Need to fix when we want to pass in chains.

8
server/timestamp/timestamp.go
View File

@@ -17,10 +17,10 @@ import (
// found. It attempts to handle the race condition that may occur if 2 servers try to
// create the key at the same time by simply querying the store a second time if it
// receives a conflict when writing.
func GetOrCreateTimestampKey(gun string, store storage.MetaStore, crypto signed.CryptoService, fallBackAlgorithm data.KeyAlgorithm) (*data.TUFKey, error) {
func GetOrCreateTimestampKey(gun string, store storage.MetaStore, crypto signed.CryptoService, fallBackAlgorithm data.KeyAlgorithm) (data.PublicKey, error) {
keyAlgorithm, public, err := store.GetTimestampKey(gun)
if err == nil {
return data.NewTUFKey(keyAlgorithm, public, nil), nil
return data.NewPublicKey(keyAlgorithm, public), nil
}
if _, ok := err.(*storage.ErrNoKey); ok {
@@ -30,7 +30,7 @@ func GetOrCreateTimestampKey(gun string, store storage.MetaStore, crypto signed.
}
err = store.SetTimestampKey(gun, key.Algorithm(), key.Public())
if err == nil {
return data.NewTUFKey(key.Algorithm(), key.Public(), key.Private()), nil
return key, nil
}
if _, ok := err.(*storage.ErrTimestampKeyExists); ok {
@@ -38,7 +38,7 @@ func GetOrCreateTimestampKey(gun string, store storage.MetaStore, crypto signed.
if err != nil {
return nil, err
}
return data.NewTUFKey(keyAlgorithm, public, nil), nil
return data.NewPublicKey(keyAlgorithm, public), nil
}
return nil, err
}

4
signer/api/rsa_hardware_crypto_service.go
View File

@@ -23,7 +23,7 @@ type RSAHardwareCryptoService struct {
}
// Create creates a key and returns its public components
func (s *RSAHardwareCryptoService) Create(role string, algo data.KeyAlgorithm) (data.Key, error) {
func (s *RSAHardwareCryptoService) Create(role string, algo data.KeyAlgorithm) (data.PublicKey, error) {
// For now generate random labels for keys
// (diogo): add link between keyID and label in database so we can support multiple keys
randomLabel := make([]byte, 32)
@@ -112,7 +112,7 @@ func (s *RSAHardwareCryptoService) RemoveKey(keyID string) error {
}
// GetKey returns the public components of a particular key
func (s *RSAHardwareCryptoService) GetKey(keyID string) data.Key {
func (s *RSAHardwareCryptoService) GetKey(keyID string) data.PublicKey {
return s.keys[keyID]
}

4
signer/keys/keys.go
View File

@@ -39,7 +39,7 @@ func (rsa *HSMRSAKey) Algorithm() data.KeyAlgorithm {
// ID implements a method of the data.Key interface
func (rsa *HSMRSAKey) ID() string {
if rsa.id == "" {
pubK := data.NewTUFKey(rsa.Algorithm(), rsa.Public(), nil)
pubK := data.NewPublicKey(rsa.Algorithm(), rsa.Public())
rsa.id = pubK.ID()
}
return rsa.id
@@ -50,7 +50,7 @@ func (rsa *HSMRSAKey) Public() []byte {
return rsa.public
}
// Private implements a method of the data.Key interface
// Private implements a method of the data.PrivateKey interface
func (rsa *HSMRSAKey) Private() []byte {
// Not possible to return private key bytes from a hardware device
return nil

11
signer/signer.go
View File

@@ -34,14 +34,3 @@ type KeyManager interface {
type Signer interface {
Sign(request *pb.SignatureRequest) (*pb.Signature, error)
}
// KeyDatabase is the interface that allows the implementation of multiple database backends
type KeyDatabase interface {
KeyManager
// GetKey returns the private key to do signing operations
GetKey(keyID *pb.KeyID) (data.Key, error)
// AddKey allows the direct addition and removal of keys from the database
AddKey(key data.Key) error
}

4
signer/signer_trust.go
View File

@@ -63,7 +63,7 @@ func (trust *NotarySigner) Sign(keyIDs []string, toSign []byte) ([]data.Signatur
}
// Create creates a remote key and returns the PublicKey associated with the remote private key
func (trust *NotarySigner) Create(role string, algorithm data.KeyAlgorithm) (data.Key, error) {
func (trust *NotarySigner) Create(role string, algorithm data.KeyAlgorithm) (data.PublicKey, error) {
publicKey, err := trust.kmClient.CreateKey(context.Background(), &pb.Algorithm{Algorithm: algorithm.String()})
if err != nil {
return nil, err
@@ -80,7 +80,7 @@ func (trust *NotarySigner) RemoveKey(keyid string) error {
}
// GetKey retrieves a key
func (trust *NotarySigner) GetKey(keyid string) data.Key {
func (trust *NotarySigner) GetKey(keyid string) data.PublicKey {
//TODO(aaronl): Not implemented yet
return nil
}

32
trustmanager/keyfilestore.go
View File

@@ -15,10 +15,10 @@ const (
type KeyStore interface {
LimitedFileStore
AddKey(name string, privKey *data.PrivateKey) error
GetKey(name string) (*data.PrivateKey, error)
AddEncryptedKey(name string, privKey *data.PrivateKey, passphrase string) error
GetDecryptedKey(name string, passphrase string) (*data.PrivateKey, error)
AddKey(name string, privKey data.PrivateKey) error
GetKey(name string) (data.PrivateKey, error)
AddEncryptedKey(name string, privKey data.PrivateKey, passphrase string) error
GetDecryptedKey(name string, passphrase string) (data.PrivateKey, error)
ListKeys() []string
}
@@ -44,23 +44,23 @@ func NewKeyFileStore(baseDir string) (*KeyFileStore, error) {
}
// AddKey stores the contents of a PEM-encoded private key as a PEM block
func (s *KeyFileStore) AddKey(name string, privKey *data.PrivateKey) error {
func (s *KeyFileStore) AddKey(name string, privKey data.PrivateKey) error {
return addKey(s, name, privKey)
}
// GetKey returns the PrivateKey given a KeyID
func (s *KeyFileStore) GetKey(name string) (*data.PrivateKey, error) {
func (s *KeyFileStore) GetKey(name string) (data.PrivateKey, error) {
return getKey(s, name)
}
// AddEncryptedKey stores the contents of a PEM-encoded private key as an encrypted PEM block
func (s *KeyFileStore) AddEncryptedKey(name string, privKey *data.PrivateKey, passphrase string) error {
func (s *KeyFileStore) AddEncryptedKey(name string, privKey data.PrivateKey, passphrase string) error {
return addEncryptedKey(s, name, privKey, passphrase)
}
// GetDecryptedKey decrypts and returns the PEM Encoded private key given a flename
// and a passphrase
func (s *KeyFileStore) GetDecryptedKey(name string, passphrase string) (*data.PrivateKey, error) {
func (s *KeyFileStore) GetDecryptedKey(name string, passphrase string) (data.PrivateKey, error) {
return getDecryptedKey(s, name, passphrase)
}
@@ -79,23 +79,23 @@ func NewKeyMemoryStore() *KeyMemoryStore {
}
// AddKey stores the contents of a PEM-encoded private key as a PEM block
func (s *KeyMemoryStore) AddKey(name string, privKey *data.PrivateKey) error {
func (s *KeyMemoryStore) AddKey(name string, privKey data.PrivateKey) error {
return addKey(s, name, privKey)
}
// GetKey returns the PrivateKey given a KeyID
func (s *KeyMemoryStore) GetKey(name string) (*data.PrivateKey, error) {
func (s *KeyMemoryStore) GetKey(name string) (data.PrivateKey, error) {
return getKey(s, name)
}
// AddEncryptedKey stores the contents of a PEM-encoded private key as an encrypted PEM block
func (s *KeyMemoryStore) AddEncryptedKey(name string, privKey *data.PrivateKey, passphrase string) error {
func (s *KeyMemoryStore) AddEncryptedKey(name string, privKey data.PrivateKey, passphrase string) error {
return addEncryptedKey(s, name, privKey, passphrase)
}
// GetDecryptedKey decrypts and returns the PEM Encoded private key given a flename
// and a passphrase
func (s *KeyMemoryStore) GetDecryptedKey(name string, passphrase string) (*data.PrivateKey, error) {
func (s *KeyMemoryStore) GetDecryptedKey(name string, passphrase string) (data.PrivateKey, error) {
return getDecryptedKey(s, name, passphrase)
}
@@ -106,7 +106,7 @@ func (s *KeyMemoryStore) ListKeys() []string {
return listKeys(s)
}
func addKey(s LimitedFileStore, name string, privKey *data.PrivateKey) error {
func addKey(s LimitedFileStore, name string, privKey data.PrivateKey) error {
pemPrivKey, err := KeyToPEM(privKey)
if err != nil {
return err
@@ -115,7 +115,7 @@ func addKey(s LimitedFileStore, name string, privKey *data.PrivateKey) error {
return s.Add(name, pemPrivKey)
}
func getKey(s LimitedFileStore, name string) (*data.PrivateKey, error) {
func getKey(s LimitedFileStore, name string) (data.PrivateKey, error) {
keyBytes, err := s.Get(name)
if err != nil {
return nil, err
@@ -130,7 +130,7 @@ func getKey(s LimitedFileStore, name string) (*data.PrivateKey, error) {
return privKey, nil
}
func addEncryptedKey(s LimitedFileStore, name string, privKey *data.PrivateKey, passphrase string) error {
func addEncryptedKey(s LimitedFileStore, name string, privKey data.PrivateKey, passphrase string) error {
encryptedPrivKey, err := EncryptPrivateKey(privKey, passphrase)
if err != nil {
return err
@@ -139,7 +139,7 @@ func addEncryptedKey(s LimitedFileStore, name string, privKey *data.PrivateKey,
return s.Add(name, encryptedPrivKey)
}
func getDecryptedKey(s LimitedFileStore, name string, passphrase string) (*data.PrivateKey, error) {
func getDecryptedKey(s LimitedFileStore, name string, passphrase string) (data.PrivateKey, error) {
keyBytes, err := s.Get(name)
if err != nil {
return nil, err

20
trustmanager/x509utils.go
View File

@@ -112,7 +112,7 @@ func fingerprintCert(cert *x509.Certificate) (CertID, error) {
}
// Create new TUF Key so we can compute the TUF-compliant CertID
tufKey := data.NewTUFKey(keyType, pemdata, nil)
tufKey := data.NewPublicKey(keyType, pemdata)
logrus.Debugf("certificate fingerprint generated for key type %s: %s", keyType, tufKey.ID())
@@ -150,7 +150,7 @@ func LoadCertFromFile(filename string) (*x509.Certificate, error) {
// ParsePEMPrivateKey returns a data.PrivateKey from a PEM encoded private key. It
// only supports RSA (PKCS#1) and attempts to decrypt using the passphrase, if encrypted.
func ParsePEMPrivateKey(pemBytes []byte, passphrase string) (*data.PrivateKey, error) {
func ParsePEMPrivateKey(pemBytes []byte, passphrase string) (data.PrivateKey, error) {
block, _ := pem.Decode(pemBytes)
if block == nil {
return nil, errors.New("no valid private key found")
@@ -234,7 +234,7 @@ func ParsePEMPrivateKey(pemBytes []byte, passphrase string) (*data.PrivateKey, e
}
// GenerateRSAKey generates an RSA private key and returns a TUF PrivateKey
func GenerateRSAKey(random io.Reader, bits int) (*data.PrivateKey, error) {
func GenerateRSAKey(random io.Reader, bits int) (data.PrivateKey, error) {
rsaPrivKey, err := rsa.GenerateKey(random, bits)
if err != nil {
return nil, fmt.Errorf("could not generate private key: %v", err)
@@ -251,7 +251,7 @@ func GenerateRSAKey(random io.Reader, bits int) (*data.PrivateKey, error) {
}
// RSAToPrivateKey converts an rsa.Private key to a TUF data.PrivateKey type
func RSAToPrivateKey(rsaPrivKey *rsa.PrivateKey) (*data.PrivateKey, error) {
func RSAToPrivateKey(rsaPrivKey *rsa.PrivateKey) (data.PrivateKey, error) {
// Get a DER-encoded representation of the PublicKey
rsaPubBytes, err := x509.MarshalPKIXPublicKey(&rsaPrivKey.PublicKey)
if err != nil {
@@ -265,7 +265,7 @@ func RSAToPrivateKey(rsaPrivKey *rsa.PrivateKey) (*data.PrivateKey, error) {
}
// GenerateECDSAKey generates an ECDSA private key and returns a TUF PrivateKey
func GenerateECDSAKey(random io.Reader) (*data.PrivateKey, error) {
func GenerateECDSAKey(random io.Reader) (data.PrivateKey, error) {
// TODO(diogo): For now hardcode P256. There were timming attacks on the other
// curves, but I can't seem to find the issue.
ecdsaPrivKey, err := ecdsa.GenerateKey(elliptic.P256(), random)
@@ -286,7 +286,7 @@ func GenerateECDSAKey(random io.Reader) (*data.PrivateKey, error) {
// GenerateED25519Key generates an ED25519 private key and returns a TUF
// PrivateKey. The serialization format we use is just the public key bytes
// followed by the private key bytes
func GenerateED25519Key(random io.Reader) (*data.PrivateKey, error) {
func GenerateED25519Key(random io.Reader) (data.PrivateKey, error) {
pub, priv, err := ed25519.GenerateKey(rand.Reader)
if err != nil {
return nil, err
@@ -307,7 +307,7 @@ func GenerateED25519Key(random io.Reader) (*data.PrivateKey, error) {
}
// ECDSAToPrivateKey converts an rsa.Private key to a TUF data.PrivateKey type
func ECDSAToPrivateKey(ecdsaPrivKey *ecdsa.PrivateKey) (*data.PrivateKey, error) {
func ECDSAToPrivateKey(ecdsaPrivKey *ecdsa.PrivateKey) (data.PrivateKey, error) {
// Get a DER-encoded representation of the PublicKey
ecdsaPubBytes, err := x509.MarshalPKIXPublicKey(&ecdsaPrivKey.PublicKey)
if err != nil {
@@ -325,7 +325,7 @@ func ECDSAToPrivateKey(ecdsaPrivKey *ecdsa.PrivateKey) (*data.PrivateKey, error)
// ED25519ToPrivateKey converts a serialized ED25519 key to a TUF
// data.PrivateKey type
func ED25519ToPrivateKey(privKeyBytes []byte) (*data.PrivateKey, error) {
func ED25519ToPrivateKey(privKeyBytes []byte) (data.PrivateKey, error) {
if len(privKeyBytes) != ed25519.PublicKeySize+ed25519.PrivateKeySize {
return nil, errors.New("malformed ed25519 private key")
}
@@ -347,7 +347,7 @@ func blockType(algorithm data.KeyAlgorithm) (string, error) {
}
// KeyToPEM returns a PEM encoded key from a Private Key
func KeyToPEM(privKey *data.PrivateKey) ([]byte, error) {
func KeyToPEM(privKey data.PrivateKey) ([]byte, error) {
blockType, err := blockType(privKey.Algorithm())
if err != nil {
return nil, err
@@ -358,7 +358,7 @@ func KeyToPEM(privKey *data.PrivateKey) ([]byte, error) {
// EncryptPrivateKey returns an encrypted PEM key given a Privatekey
// and a passphrase
func EncryptPrivateKey(key *data.PrivateKey, passphrase string) ([]byte, error) {
func EncryptPrivateKey(key data.PrivateKey, passphrase string) ([]byte, error) {
blockType, err := blockType(key.Algorithm())
if err != nil {
return nil, err