docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[PATCH 4/8] Add sha512 when updating 

Actually there are two way to implement this.

One is check the present hash algorithm first and then only update
what we have.

The other is update/add both sha256 and sha512 no matter whether we
have the hash of sha512 or not.

Personally I prefer the latter, for it brings much less change of the
code and will also not affect the validate of the old clients.

Signed-off-by: Hu Keping <hukeping@huawei.com>
This commit is contained in:
HuKeping 2016-02-25 19:11:10 +08:00
parent 6b96c7e56d
commit 206d02ab4d
4 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
tuf/data/snapshot.go
View File

@ -2,7 +2,6 @@ package data
import (
"bytes"
"crypto/sha256"
"fmt"
"time"
@ -39,10 +38,18 @@ func isValidSnapshotStructure(s Snapshot) error {
// Meta is a map of FileMeta, so if the role isn't in the map it returns
// an empty FileMeta, which has an empty map, and you can check on keys
// from an empty map.
if checksum, ok := s.Meta[role].Hashes["sha256"]; !ok || len(checksum) != sha256.Size {
//
// For now sha256 is required and sha512 is not.
if _, ok := s.Meta[role].Hashes["sha256"]; !ok {
return ErrInvalidMetadata{
role: CanonicalSnapshotRole,
msg: fmt.Sprintf("missing or invalid %s sha256 checksum information", role),
msg: fmt.Sprintf("missing %s sha256 checksum information", role),
}
}
if err := CheckValidHashStructures(s.Meta[role].Hashes); err != nil {
return ErrInvalidMetadata{
role: CanonicalSnapshotRole,
msg: fmt.Sprintf("invalid %s checksum information, %v", role, err),
}
}
}

12
tuf/data/timestamp.go
View File

@ -2,7 +2,6 @@ package data
import (
"bytes"
"crypto/sha256"
"fmt"
"time"
@ -37,10 +36,17 @@ func isValidTimestampStructure(t Timestamp) error {
// Meta is a map of FileMeta, so if the role isn't in the map it returns
// an empty FileMeta, which has an empty map, and you can check on keys
// from an empty map.
if cs, ok := t.Meta[CanonicalSnapshotRole].Hashes["sha256"]; !ok || len(cs) != sha256.Size {
//
// For now sha256 is required and sha512 is not.
if _, ok := t.Meta[CanonicalSnapshotRole].Hashes["sha256"]; !ok {
return ErrInvalidMetadata{
role: CanonicalTimestampRole, msg: "missing or invalid snapshot sha256 checksum information"}
role: CanonicalTimestampRole, msg: "missing snapshot sha256 checksum information"}
}
if err := CheckValidHashStructures(t.Meta[CanonicalSnapshotRole].Hashes); err != nil {
return ErrInvalidMetadata{
role: CanonicalTimestampRole, msg: fmt.Sprintf("invalid snapshot checksum information, %v", err)}
}
return nil
}

4
tuf/testutils/swizzler.go
View File

@ -530,7 +530,7 @@ func (m *MetadataSwizzler) UpdateSnapshotHashes(roles ...string) error {
return err
}
meta, err := data.NewFileMeta(bytes.NewReader(metaBytes), "sha256")
meta, err := data.NewFileMeta(bytes.NewReader(metaBytes), data.NotaryDefaultHashes...)
if err != nil {
return err
}
@ -575,7 +575,7 @@ func (m *MetadataSwizzler) UpdateTimestampHash() error {
return err
}
snapshotMeta, err := data.NewFileMeta(bytes.NewReader(metaBytes), "sha256")
snapshotMeta, err := data.NewFileMeta(bytes.NewReader(metaBytes), data.NotaryDefaultHashes...)
if err != nil {
return err
}

4
tuf/tuf.go
View File

@ -760,7 +760,7 @@ func (tr *Repo) UpdateSnapshot(role string, s *data.Signed) error {
if err != nil {
return err
}
meta, err := data.NewFileMeta(bytes.NewReader(jsonData), "sha256")
meta, err := data.NewFileMeta(bytes.NewReader(jsonData), data.NotaryDefaultHashes...)
if err != nil {
return err
}
@ -775,7 +775,7 @@ func (tr *Repo) UpdateTimestamp(s *data.Signed) error {
if err != nil {
return err
}
meta, err := data.NewFileMeta(bytes.NewReader(jsonData), "sha256")
meta, err := data.NewFileMeta(bytes.NewReader(jsonData), data.NotaryDefaultHashes...)
if err != nil {
return err
}