alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

vendor: update buildkit to e18be41828

Browse Source 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
2025-11-05 12:53:09 -08:00
parent 5f5beef2c2
commit ae33cdc550
389 changed files with 31159 additions and 9009 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go
Generated Vendored
+18 -17
View File
@@ -15,29 +15,19 @@ var ErrNoSigners = errors.New("no signers provided")
// EnvelopeSigner creates signed Envelopes.
type EnvelopeSigner struct {
providers []SignerVerifier
providers []Signer
}
/*
NewEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer algorithms to
sign the data. Creates a verifier with threshold=1, at least one of the
providers must validate signatures successfully.
sign the data.
*/
func NewEnvelopeSigner(p ...SignerVerifier) (*EnvelopeSigner, error) {
return NewMultiEnvelopeSigner(1, p...)
}
func NewEnvelopeSigner(p ...Signer) (*EnvelopeSigner, error) {
var providers []Signer
/*
NewMultiEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer
algorithms to sign the data. Creates a verifier with threshold. Threshold
indicates the amount of providers that must validate the envelope.
*/
func NewMultiEnvelopeSigner(threshold int, p ...SignerVerifier) (*EnvelopeSigner, error) {
var providers []SignerVerifier
for _, sv := range p {
if sv != nil {
providers = append(providers, sv)
for _, s := range p {
if s != nil {
providers = append(providers, s)
}
}
@@ -50,6 +40,17 @@ func NewMultiEnvelopeSigner(threshold int, p ...SignerVerifier) (*EnvelopeSigner
}, nil
}
/*
NewMultiEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer
algorithms to sign the data. The threshold parameter is legacy and is ignored.
Deprecated: This function simply calls NewEnvelopeSigner, and that function should
be preferred.
*/
func NewMultiEnvelopeSigner(threshold int, p ...Signer) (*EnvelopeSigner, error) {
return NewEnvelopeSigner(p...)
}
/*
SignPayload signs a payload and payload type according to DSSE.
Returned is an envelope as defined here:
vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go
Generated Vendored
+2 -1
View File
@@ -43,7 +43,8 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
// If *any* signature is found to be incorrect, it is skipped
var acceptedKeys []AcceptedKey
usedKeyids := make(map[string]string)
unverified_providers := ev.providers
unverified_providers := make([]Verifier, len(ev.providers))
copy(unverified_providers, ev.providers)
for _, s := range e.Signatures {
sig, err := b64Decode(s.Sig)
if err != nil {
vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go
Generated Vendored
+10 -2
View File
@@ -11,7 +11,10 @@ import (
"os"
)
const ECDSAKeyType = "ecdsa"
const (
ECDSAKeyType = "ecdsa"
ECDSAKeyScheme = "ecdsa-sha2-nistp256"
)
// ECDSASignerVerifier is a dsse.SignerVerifier compliant interface to sign and
// verify signatures using ECDSA keys.
@@ -89,13 +92,18 @@ func (sv *ECDSASignerVerifier) Public() crypto.PublicKey {
// LoadECDSAKeyFromFile returns an SSLibKey instance for an ECDSA key stored in
// a file in the custom securesystemslib format.
//
// Deprecated: use LoadKey(). The custom serialization format has been
// deprecated. Use
// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
// to convert your key.
func LoadECDSAKeyFromFile(path string) (*SSLibKey, error) {
contents, err := os.ReadFile(path)
if err != nil {
return nil, fmt.Errorf("unable to load ECDSA key from file: %w", err)
}
return loadKeyFromSSLibBytes(contents)
return LoadKeyFromSSLibBytes(contents)
}
func getECDSAHashedData(data []byte, curveSize int) []byte {
vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go
Generated Vendored
+6 -1
View File
@@ -88,11 +88,16 @@ func (sv *ED25519SignerVerifier) Public() crypto.PublicKey {
// LoadED25519KeyFromFile returns an SSLibKey instance for an ED25519 key stored
// in a file in the custom securesystemslib format.
//
// Deprecated: use LoadKey(). The custom serialization format has been
// deprecated. Use
// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
// to convert your key.
func LoadED25519KeyFromFile(path string) (*SSLibKey, error) {
contents, err := os.ReadFile(path)
if err != nil {
return nil, fmt.Errorf("unable to load ED25519 key from file: %w", err)
}
return loadKeyFromSSLibBytes(contents)
return LoadKeyFromSSLibBytes(contents)
}
vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go
Generated Vendored
+42 -13
View File
@@ -94,12 +94,28 @@ func (sv *RSAPSSSignerVerifier) Public() crypto.PublicKey {
// LoadRSAPSSKeyFromFile returns an SSLibKey instance for an RSA key stored in a
// file.
//
// Deprecated: use LoadKey(). The custom serialization format has been
// deprecated. Use
// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
// to convert your key.
func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
contents, err := os.ReadFile(path)
if err != nil {
return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
}
return LoadRSAPSSKeyFromBytes(contents)
}
// LoadRSAPSSKeyFromBytes is a function that takes a byte array as input. This
// byte array should represent a PEM encoded RSA key, as PEM encoding is
// required. The function returns an SSLibKey instance, which is a struct that
// holds the key data.
//
// Deprecated: use LoadKey() for all key types, RSA is no longer the only key
// that uses PEM serialization.
func LoadRSAPSSKeyFromBytes(contents []byte) (*SSLibKey, error) {
pemData, keyObj, err := decodeAndParsePEM(contents)
if err != nil {
return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
@@ -112,20 +128,13 @@ func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
KeyVal: KeyVal{},
}
switch k := keyObj.(type) {
case *rsa.PublicKey:
pubKeyBytes, err := x509.MarshalPKIXPublicKey(k)
if err != nil {
return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
}
key.KeyVal.Public = strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM)))
pubKeyBytes, err := marshalAndGeneratePEM(keyObj)
if err != nil {
return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
}
key.KeyVal.Public = strings.TrimSpace(string(pubKeyBytes))
case *rsa.PrivateKey:
pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public())
if err != nil {
return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
}
key.KeyVal.Public = strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM)))
if _, ok := keyObj.(*rsa.PrivateKey); ok {
key.KeyVal.Private = strings.TrimSpace(string(generatePEMBlock(pemData.Bytes, RSAPrivateKeyPEM)))
}
@@ -139,3 +148,23 @@ func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
return key, nil
}
func marshalAndGeneratePEM(key interface{}) ([]byte, error) {
var pubKeyBytes []byte
var err error
switch k := key.(type) {
case *rsa.PublicKey:
pubKeyBytes, err = x509.MarshalPKIXPublicKey(k)
case *rsa.PrivateKey:
pubKeyBytes, err = x509.MarshalPKIXPublicKey(k.Public())
default:
return nil, fmt.Errorf("unexpected key type: %T", k)
}
if err != nil {
return nil, err
}
return generatePEMBlock(pubKeyBytes, PublicKeyPEM), nil
}
vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/signerverifier.go
Generated Vendored
+113 -1
View File
@@ -1,7 +1,13 @@
package signerverifier
import (
"crypto/ecdsa"
"crypto/ed25519"
"crypto/rsa"
"crypto/x509"
"encoding/hex"
"errors"
"strings"
)
var KeyIDHashAlgorithms = []string{"sha256", "sha512"}
@@ -12,6 +18,7 @@ var (
ErrUnknownKeyType = errors.New("unknown key type")
ErrInvalidThreshold = errors.New("threshold is either less than 1 or greater than number of provided public keys")
ErrInvalidKey = errors.New("key object has no value")
ErrInvalidPEM = errors.New("unable to parse PEM block")
)
const (
@@ -29,6 +36,111 @@ type SSLibKey struct {
type KeyVal struct {
Private string `json:"private,omitempty"`
Public string `json:"public"`
Public string `json:"public,omitempty"`
Certificate string `json:"certificate,omitempty"`
Identity string `json:"identity,omitempty"`
Issuer string `json:"issuer,omitempty"`
}
// LoadKey returns an SSLibKey object when provided a PEM encoded key.
// Currently, RSA, ED25519, and ECDSA keys are supported.
func LoadKey(keyBytes []byte) (*SSLibKey, error) {
pemBlock, rawKey, err := decodeAndParsePEM(keyBytes)
if err != nil {
return nil, err
}
var key *SSLibKey
switch k := rawKey.(type) {
case *rsa.PublicKey:
pubKeyBytes, err := x509.MarshalPKIXPublicKey(k)
if err != nil {
return nil, err
}
key = &SSLibKey{
KeyIDHashAlgorithms: KeyIDHashAlgorithms,
KeyType: RSAKeyType,
KeyVal: KeyVal{
Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
},
Scheme: RSAKeyScheme,
}
case *rsa.PrivateKey:
pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public())
if err != nil {
return nil, err
}
key = &SSLibKey{
KeyIDHashAlgorithms: KeyIDHashAlgorithms,
KeyType: RSAKeyType,
KeyVal: KeyVal{
Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
Private: strings.TrimSpace(string(generatePEMBlock(pemBlock.Bytes, pemBlock.Type))),
},
Scheme: RSAKeyScheme,
}
case ed25519.PublicKey:
key = &SSLibKey{
KeyIDHashAlgorithms: KeyIDHashAlgorithms,
KeyType: ED25519KeyType,
KeyVal: KeyVal{
Public: strings.TrimSpace(hex.EncodeToString(k)),
},
Scheme: ED25519KeyType,
}
case ed25519.PrivateKey:
pubKeyBytes := k.Public()
key = &SSLibKey{
KeyIDHashAlgorithms: KeyIDHashAlgorithms,
KeyType: ED25519KeyType,
KeyVal: KeyVal{
Public: strings.TrimSpace(hex.EncodeToString(pubKeyBytes.(ed25519.PublicKey))),
Private: strings.TrimSpace(hex.EncodeToString(k)),
},
Scheme: ED25519KeyType,
}
case *ecdsa.PublicKey:
pubKeyBytes, err := x509.MarshalPKIXPublicKey(k)
if err != nil {
return nil, err
}
key = &SSLibKey{
KeyIDHashAlgorithms: KeyIDHashAlgorithms,
KeyType: ECDSAKeyType,
KeyVal: KeyVal{
Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
},
Scheme: ECDSAKeyScheme,
}
case *ecdsa.PrivateKey:
pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public())
if err != nil {
return nil, err
}
key = &SSLibKey{
KeyIDHashAlgorithms: KeyIDHashAlgorithms,
KeyType: ECDSAKeyType,
KeyVal: KeyVal{
Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
Private: strings.TrimSpace(string(generatePEMBlock(pemBlock.Bytes, PrivateKeyPEM))),
},
Scheme: ECDSAKeyScheme,
}
default:
return nil, ErrUnknownKeyType
}
keyID, err := calculateKeyID(key)
if err != nil {
return nil, err
}
key.KeyID = keyID
return key, nil
}
vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/utils.go
Generated Vendored
+6 -14
View File
@@ -8,7 +8,6 @@ import (
"encoding/pem"
"errors"
"hash"
"testing"
"github.com/secure-systems-lab/go-securesystemslib/cjson"
)
@@ -24,15 +23,17 @@ var (
ErrFailedPEMParsing = errors.New("failed parsing the PEM block: unsupported PEM type")
)
// loadKeyFromSSLibBytes returns a pointer to a Key instance created from the
// LoadKeyFromSSLibBytes returns a pointer to a Key instance created from the
// contents of the bytes. The key contents are expected to be in the custom
// securesystemslib format.
func loadKeyFromSSLibBytes(contents []byte) (*SSLibKey, error) {
//
// Deprecated: use LoadKey() for all key types, RSA is no longer the only key
// that uses PEM serialization.
func LoadKeyFromSSLibBytes(contents []byte) (*SSLibKey, error) {
var key *SSLibKey
if err := json.Unmarshal(contents, &key); err != nil {
return nil, err
return LoadRSAPSSKeyFromBytes(contents)
}
if len(key.KeyID) == 0 {
keyID, err := calculateKeyID(key)
if err != nil {
@@ -139,12 +140,3 @@ func hashBeforeSigning(data []byte, h hash.Hash) []byte {
h.Write(data)
return h.Sum(nil)
}
func hexDecode(t *testing.T, data string) []byte {
t.Helper()
b, err := hex.DecodeString(data)
if err != nil {
t.Fatal(err)
}
return b
}