mirror of https://github.com/docker/docs.git
TUF changed to Tuf in all comments and rethink models as per open issue 313
Signed-off-by: avaid96 <avaid1996@gmail.com>
This commit is contained in:
parent
4ad17f6f2a
commit
07265a3635
|
@ -42,7 +42,7 @@ type TufRootData struct {
|
||||||
RoleName string `json:"role"`
|
RoleName string `json:"role"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewTufChange initializes a tufChange object
|
// NewTufChange initializes a TufChange object
|
||||||
func NewTufChange(action string, role, changeType, changePath string, content []byte) *TufChange {
|
func NewTufChange(action string, role, changeType, changePath string, content []byte) *TufChange {
|
||||||
return &TufChange{
|
return &TufChange{
|
||||||
Actn: action,
|
Actn: action,
|
||||||
|
|
|
@ -121,7 +121,7 @@ func repositoryFromKeystores(baseDir, gun, baseURL string, rt http.RoundTripper,
|
||||||
}
|
}
|
||||||
|
|
||||||
// Target represents a simplified version of the data TUF operates on, so external
|
// Target represents a simplified version of the data TUF operates on, so external
|
||||||
// applications don't have to depend on tuf data types.
|
// applications don't have to depend on TUF data types.
|
||||||
type Target struct {
|
type Target struct {
|
||||||
Name string // the name of the target
|
Name string // the name of the target
|
||||||
Hashes data.Hashes // the hash of the target
|
Hashes data.Hashes // the hash of the target
|
||||||
|
@ -605,7 +605,7 @@ func (r *NotaryRepository) publish(cl changelist.Changelist) error {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
// these are the tuf files we will need to update, serialized as JSON before
|
// these are the TUF files we will need to update, serialized as JSON before
|
||||||
// we send anything to remote
|
// we send anything to remote
|
||||||
updatedFiles := make(map[string][]byte)
|
updatedFiles := make(map[string][]byte)
|
||||||
|
|
||||||
|
|
|
@ -207,7 +207,7 @@ func createRepoAndKey(t *testing.T, rootType, tempBaseDir, gun, url string) (
|
||||||
|
|
||||||
// creates a new notary repository with the same gun and url as the previous
|
// creates a new notary repository with the same gun and url as the previous
|
||||||
// repo, in order to eliminate caches (for instance, cryptoservice cache)
|
// repo, in order to eliminate caches (for instance, cryptoservice cache)
|
||||||
// if a new directory is to be created, it also eliminates the tuf metadata
|
// if a new directory is to be created, it also eliminates the TUF metadata
|
||||||
// cache
|
// cache
|
||||||
func newRepoToTestRepo(t *testing.T, existingRepo *NotaryRepository, newDir bool) (
|
func newRepoToTestRepo(t *testing.T, existingRepo *NotaryRepository, newDir bool) (
|
||||||
*NotaryRepository, *passRoleRecorder) {
|
*NotaryRepository, *passRoleRecorder) {
|
||||||
|
|
|
@ -214,7 +214,7 @@ func getRemoteKey(url, gun, role string, rt http.RoundTripper) (data.PublicKey,
|
||||||
return pubKey, nil
|
return pubKey, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// signs and serializes the metadata for a canonical role in a tuf repo to JSON
|
// signs and serializes the metadata for a canonical role in a TUF repo to JSON
|
||||||
func serializeCanonicalRole(tufRepo *tuf.Repo, role string) (out []byte, err error) {
|
func serializeCanonicalRole(tufRepo *tuf.Repo, role string) (out []byte, err error) {
|
||||||
var s *data.Signed
|
var s *data.Signed
|
||||||
switch {
|
switch {
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
// This makes sure that the server is compatible with the tuf httpstore.
|
// This makes sure that the server is compatible with the TUF httpstore.
|
||||||
|
|
||||||
package server
|
package server
|
||||||
|
|
||||||
|
|
|
@ -12,7 +12,7 @@ import (
|
||||||
"gopkg.in/dancannon/gorethink.v2"
|
"gopkg.in/dancannon/gorethink.v2"
|
||||||
)
|
)
|
||||||
|
|
||||||
// RDBTUFFile is a tuf file record
|
// RDBTUFFile is a TUF file record
|
||||||
type RDBTUFFile struct {
|
type RDBTUFFile struct {
|
||||||
rethinkdb.Timing
|
rethinkdb.Timing
|
||||||
GunRoleVersion []interface{} `gorethink:"gun_role_version"`
|
GunRoleVersion []interface{} `gorethink:"gun_role_version"`
|
||||||
|
@ -269,7 +269,7 @@ func (rdb RethinkDB) deleteByTSChecksum(tsChecksum string) error {
|
||||||
// Bootstrap sets up the database and tables, also creating the notary server user with appropriate db permission
|
// Bootstrap sets up the database and tables, also creating the notary server user with appropriate db permission
|
||||||
func (rdb RethinkDB) Bootstrap() error {
|
func (rdb RethinkDB) Bootstrap() error {
|
||||||
if err := rethinkdb.SetupDB(rdb.sess, rdb.dbName, []rethinkdb.Table{
|
if err := rethinkdb.SetupDB(rdb.sess, rdb.dbName, []rethinkdb.Table{
|
||||||
TufFilesRethinkTable,
|
TUFFilesRethinkTable,
|
||||||
PubKeysRethinkTable,
|
PubKeysRethinkTable,
|
||||||
}); err != nil {
|
}); err != nil {
|
||||||
return err
|
return err
|
||||||
|
|
|
@ -13,7 +13,7 @@ const (
|
||||||
|
|
||||||
var (
|
var (
|
||||||
// TufFilesRethinkTable is the table definition of notary server's TUF metadata files
|
// TufFilesRethinkTable is the table definition of notary server's TUF metadata files
|
||||||
TufFilesRethinkTable = rethinkdb.Table{
|
TUFFilesRethinkTable = rethinkdb.Table{
|
||||||
Name: RDBTUFFile{}.TableName(),
|
Name: RDBTUFFile{}.TableName(),
|
||||||
PrimaryKey: "gun_role_version",
|
PrimaryKey: "gun_role_version",
|
||||||
SecondaryIndexes: map[string][]string{
|
SecondaryIndexes: map[string][]string{
|
||||||
|
|
|
@ -46,23 +46,23 @@ func TestTUFSQLGetCurrent(t *testing.T) {
|
||||||
defer os.RemoveAll(tempBaseDir)
|
defer os.RemoveAll(tempBaseDir)
|
||||||
defer gormDB.Close()
|
defer gormDB.Close()
|
||||||
|
|
||||||
initialRootTufFile := SampleTUF(1)
|
initialRootTUFFile := SampleTUF(1)
|
||||||
|
|
||||||
ConsistentEmptyGetCurrentTest(t, tufDBStore, initialRootTufFile)
|
ConsistentEmptyGetCurrentTest(t, tufDBStore, initialRootTUFFile)
|
||||||
|
|
||||||
// put an initial piece of root metadata data in the database,
|
// put an initial piece of root metadata data in the database,
|
||||||
// there isn't enough state to retrieve it since we require a timestamp and snapshot in our walk
|
// there isn't enough state to retrieve it since we require a timestamp and snapshot in our walk
|
||||||
|
|
||||||
query := gormDB.Create(&initialRootTufFile)
|
query := gormDB.Create(&initialRootTUFFile)
|
||||||
require.NoError(t, query.Error, "Creating a row in an empty DB failed.")
|
require.NoError(t, query.Error, "Creating a row in an empty DB failed.")
|
||||||
|
|
||||||
ConsistentMissingTSAndSnapGetCurrentTest(t, tufDBStore, initialRootTufFile)
|
ConsistentMissingTSAndSnapGetCurrentTest(t, tufDBStore, initialRootTUFFile)
|
||||||
|
|
||||||
// Note that get by checksum succeeds, since it does not try to walk timestamp/snapshot
|
// Note that get by checksum succeeds, since it does not try to walk timestamp/snapshot
|
||||||
_, _, err = tufDBStore.GetChecksum("testGUN", "root", initialRootTufFile.Sha256)
|
_, _, err = tufDBStore.GetChecksum("testGUN", "root", initialRootTUFFile.Sha256)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
// Now setup a valid tuf repo and use it to ensure we walk correctly
|
// Now setup a valid TUF repo and use it to ensure we walk correctly
|
||||||
validTUFRepo, _, err := testutils.EmptyRepo("testGUN")
|
validTUFRepo, _, err := testutils.EmptyRepo("testGUN")
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
@ -125,7 +125,7 @@ func ConsistentGetCurrentFoundTest(t *testing.T, s *TUFMetaStorage, rec TUFFile)
|
||||||
require.Equal(t, rec.Data, byt)
|
require.Equal(t, rec.Data, byt)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Checks that both the walking metastore and underlying metastore do not contain the tuf file
|
// Checks that both the walking metastore and underlying metastore do not contain the TUF file
|
||||||
func ConsistentEmptyGetCurrentTest(t *testing.T, s *TUFMetaStorage, rec TUFFile) {
|
func ConsistentEmptyGetCurrentTest(t *testing.T, s *TUFMetaStorage, rec TUFFile) {
|
||||||
_, byt, err := s.GetCurrent(rec.Gun, rec.Role)
|
_, byt, err := s.GetCurrent(rec.Gun, rec.Role)
|
||||||
require.Nil(t, byt)
|
require.Nil(t, byt)
|
||||||
|
|
|
@ -408,7 +408,7 @@ func removeKey(s Storage, cachedKeys map[string]*cachedKey, name string) error {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// Assumes 2 subdirectories, 1 containing root keys and 1 containing tuf keys
|
// Assumes 2 subdirectories, 1 containing root keys and 1 containing TUF keys
|
||||||
func getSubdir(alias string) string {
|
func getSubdir(alias string) string {
|
||||||
if alias == data.CanonicalRootRole {
|
if alias == data.CanonicalRootRole {
|
||||||
return notary.RootKeysSubdir
|
return notary.RootKeysSubdir
|
||||||
|
|
|
@ -565,7 +565,7 @@ func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string
|
||||||
memKeyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
|
memKeyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
|
||||||
cs := cryptoservice.NewCryptoService(memKeyStore)
|
cs := cryptoservice.NewCryptoService(memKeyStore)
|
||||||
|
|
||||||
// Tuf key with PEM-encoded x509 certificate
|
// TUF key with PEM-encoded x509 certificate
|
||||||
origRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
origRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
@ -593,7 +593,7 @@ func testValidateSuccessfulRootRotation(t *testing.T, keyAlg, rootKeyType string
|
||||||
prevRoot, err := data.RootFromSigned(signedOrigTestRoot)
|
prevRoot, err := data.RootFromSigned(signedOrigTestRoot)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
// Tuf key with PEM-encoded x509 certificate
|
// TUF key with PEM-encoded x509 certificate
|
||||||
replRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
replRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
@ -645,7 +645,7 @@ func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType st
|
||||||
memKeyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
|
memKeyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
|
||||||
cs := cryptoservice.NewCryptoService(memKeyStore)
|
cs := cryptoservice.NewCryptoService(memKeyStore)
|
||||||
|
|
||||||
// Tuf key with PEM-encoded x509 certificate
|
// TUF key with PEM-encoded x509 certificate
|
||||||
origRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
origRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
@ -673,7 +673,7 @@ func testValidateRootRotationMissingOrigSig(t *testing.T, keyAlg, rootKeyType st
|
||||||
prevRoot, err := data.RootFromSigned(signedOrigTestRoot)
|
prevRoot, err := data.RootFromSigned(signedOrigTestRoot)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
// Tuf key with PEM-encoded x509 certificate
|
// TUF key with PEM-encoded x509 certificate
|
||||||
replRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
replRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
@ -721,7 +721,7 @@ func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType str
|
||||||
memKeyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
|
memKeyStore := trustmanager.NewKeyMemoryStore(passphraseRetriever)
|
||||||
cs := cryptoservice.NewCryptoService(memKeyStore)
|
cs := cryptoservice.NewCryptoService(memKeyStore)
|
||||||
|
|
||||||
// Tuf key with PEM-encoded x509 certificate
|
// TUF key with PEM-encoded x509 certificate
|
||||||
origRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
origRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
@ -749,7 +749,7 @@ func testValidateRootRotationMissingNewSig(t *testing.T, keyAlg, rootKeyType str
|
||||||
prevRoot, err := data.RootFromSigned(signedOrigTestRoot)
|
prevRoot, err := data.RootFromSigned(signedOrigTestRoot)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
// Tuf key with PEM-encoded x509 certificate
|
// TUF key with PEM-encoded x509 certificate
|
||||||
replRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
replRootKey, err := testutils.CreateKey(cs, gun, data.CanonicalRootRole, keyAlg)
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
|
|
@ -12,7 +12,7 @@ from Docker should be considered the official CLI to be used with this implement
|
||||||
|
|
||||||
- [X] Add Targets to existing repo
|
- [X] Add Targets to existing repo
|
||||||
- [X] Sign metadata files
|
- [X] Sign metadata files
|
||||||
- [X] Refactor TufRepo to take care of signing ~~and verification~~
|
- [X] Refactor TUFRepo to take care of signing ~~and verification~~
|
||||||
- [ ] Ensure consistent capitalization in naming (TUF\_\_\_ vs Tuf\_\_\_)
|
- [ ] Ensure consistent capitalization in naming (TUF\_\_\_ vs Tuf\_\_\_)
|
||||||
- [X] Make caching of metadata files smarter - PR #5
|
- [X] Make caching of metadata files smarter - PR #5
|
||||||
- [ ] ~~Add configuration for CLI commands. Order of configuration priority from most to least: flags, config file, defaults~~ Notary should be the official CLI
|
- [ ] ~~Add configuration for CLI commands. Order of configuration priority from most to least: flags, config file, defaults~~ Notary should be the official CLI
|
||||||
|
|
|
@ -102,7 +102,7 @@ func EmptyRepo(gun string, delegationRoles ...string) (*tuf.Repo, signed.CryptoS
|
||||||
// first
|
// first
|
||||||
sort.Strings(delegationRoles)
|
sort.Strings(delegationRoles)
|
||||||
for _, delgName := range delegationRoles {
|
for _, delgName := range delegationRoles {
|
||||||
// create a delegations key and a delegation in the tuf repo
|
// create a delegations key and a delegation in the TUF repo
|
||||||
delgKey, err := CreateKey(cs, gun, delgName, data.ECDSAKey)
|
delgKey, err := CreateKey(cs, gun, delgName, data.ECDSAKey)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, nil, err
|
return nil, nil, err
|
||||||
|
|
Loading…
Reference in New Issue