-
Notifications
You must be signed in to change notification settings - Fork 12
/
tuf_repo_priv_keys.go
107 lines (86 loc) · 2.44 KB
/
tuf_repo_priv_keys.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
package publisher
import (
"fmt"
"github.com/theupdateframework/go-tuf"
"github.com/theupdateframework/go-tuf/data"
"github.com/theupdateframework/go-tuf/pkg/keys"
)
type TufRepoPrivKeys struct {
Root *data.PrivateKey `json:"root"`
Snapshot *data.PrivateKey `json:"snapshot"`
Targets *data.PrivateKey `json:"targets"`
Timestamp *data.PrivateKey `json:"timestamp"`
}
func (keys *TufRepoPrivKeys) SetKeyFromSigner(role string, signer keys.Signer) error {
pk, err := signer.MarshalPrivateKey()
if err != nil {
return fmt.Errorf("unable to marshal signer private key: %w", err)
}
switch role {
case "root":
keys.Root = pk
case "targets":
keys.Targets = pk
case "snapshot":
keys.Snapshot = pk
case "timestamp":
keys.Timestamp = pk
default:
panic(fmt.Sprintf("unknown role %q", role))
}
return nil
}
func (privKeys TufRepoPrivKeys) SetupStoreSigners(store tuf.LocalStore) error {
for _, role := range []string{"root", "targets", "snapshot", "timestamp"} {
signer, err := privKeys.GetSigner(role)
if err != nil {
return fmt.Errorf("unable to get key signer for role %q: %w", role, err)
}
if signer != nil {
if err := store.SaveSigner(role, signer); err != nil {
return fmt.Errorf("unable to save key signer for role %q into tuf store: %w", role, err)
}
}
}
return nil
}
func (privKeys TufRepoPrivKeys) SetupTufRepoSigners(tufRepo *tuf.Repo) error {
for _, desc := range []struct {
role string
key *data.PrivateKey
}{
{"root", privKeys.Root},
{"targets", privKeys.Targets},
{"snapshot", privKeys.Snapshot},
{"timestamp", privKeys.Timestamp},
} {
signer, err := keys.GetSigner(desc.key)
if err != nil {
return fmt.Errorf("unable to get key signer for role %s: %w", desc.role, err)
}
if err := tufRepo.AddPrivateKeyWithExpires(desc.role, signer, data.DefaultExpires("root")); err != nil {
return fmt.Errorf("unable to add tuf repository private key for role %s: %w", desc.role, err)
}
}
return nil
}
func (privKeys TufRepoPrivKeys) GetSigner(role string) (keys.Signer, error) {
switch role {
case "root":
return toSigner(privKeys.Root)
case "targets":
return toSigner(privKeys.Targets)
case "snapshot":
return toSigner(privKeys.Snapshot)
case "timestamp":
return toSigner(privKeys.Timestamp)
default:
panic(fmt.Sprintf("unknown role %q", role))
}
}
func toSigner(key *data.PrivateKey) (keys.Signer, error) {
if key == nil {
return nil, nil
}
return keys.GetSigner(key)
}