diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8a78265a..221c7394 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -66,7 +66,8 @@ jobs: if: env.NUM_PROVIDERS > 0 uses: actions/setup-go@v6 with: - go-version: ^1.19 + go-version-file: go.mod + cache-dependency-path: signing/go.sum check-latest: true cache: true id: go @@ -74,7 +75,8 @@ jobs: - name: "[PACKAGE] build sign tool" if: env.NUM_PROVIDERS > 0 run: | - go build -o ed25519tool ./signing/Ed25519/app/cmd/main + cd signing + go build -o ../pqsig ./cmd/pqsig - name: "[PACKAGE] prepare provider dirs" if: env.NUM_PROVIDERS > 0 @@ -94,12 +96,17 @@ jobs: - name: "[PACKAGE] sign provider docs" if: env.NUM_PROVIDERS > 0 env: - SIGNING_VERSION: v1 - SIGNING_CERT: ${{ secrets.V1_SIGNING_CERT }} - SIGNING_PRIV_KEY: '${{ secrets.V1_SIGNING_PRIV_KEY }}' - SIGNING_PUB_KEY: ${{ secrets.V1_SIGNING_PUB_KEY }} + STACKQL_SIGNING_KID: stackql-2026-01 + STACKQL_SIGNING_SEED: ${{ github.event_name != 'pull_request' && secrets.MLDSA_SIGNING_SEED || '' }} run: | + # PRs exercise the complete packaging path without a production signing key. + if [ "${{ github.event_name }}" = "pull_request" ]; then + export STACKQL_SIGNING_SEED="$(python -c 'import secrets; print(secrets.token_hex(32))')" + fi python scripts/package/sign-provider-docs.py + if [ "${{ github.event_name }}" != "pull_request" ]; then + find signed/providers/src -type f -name '*.yaml' -exec ./pqsig verify-doc {} + + fi - name: "[PACKAGE] package provider docs" if: env.NUM_PROVIDERS > 0 @@ -122,6 +129,10 @@ jobs: do echo "testing ${provider}..." sh test-provider.sh "$provider" false "$providersdir" + if [ "${{ github.event_name }}" != "pull_request" ]; then + python verify-provider.py "$provider" \ + --registry-root "$providersdir" --stackql-bin "$(pwd)/stackql" + fi done < ../providers.txt # diff --git a/.github/workflows/signing.yml b/.github/workflows/signing.yml new file mode 100644 index 00000000..e7567152 --- /dev/null +++ b/.github/workflows/signing.yml @@ -0,0 +1,29 @@ +name: Provider document signatures + +on: + pull_request: + branches: [main, dev] + push: + branches: [main, dev] + workflow_dispatch: + +permissions: + contents: read + +jobs: + signing: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + cache-dependency-path: | + go.sum + signing/go.sum + - run: go test ./... && go vet ./... + - run: go test ./... && go vet ./... + working-directory: signing + env: + PQSIG_PROVIDER_ROOT: ${{ github.workspace }}/providers/src + - run: python -m unittest discover -s scripts/package -p 'test_*.py' diff --git a/.gitignore b/.gitignore index 531661e7..cc38613c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,7 @@ -ed25519tool +/pqsig +/pqsig.exe +# Preserve ignored local key material left by the retired tool. +/signing/Ed25519/ .DS_Store scripts/*/node_modules/ scripts/*/package-lock.json diff --git a/.vscode/launch.json b/.vscode/launch.json deleted file mode 100644 index 67103b5a..00000000 --- a/.vscode/launch.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - // Use IntelliSense to learn about possible attributes. - // Hover to view descriptions of existing attributes. - // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 - "version": "0.2.0", - "configurations": [ - { - "name": "Debug createkeys", - "type": "go", - "request": "launch", - "mode": "debug", - "program": "${workspaceFolder}/signing/Ed25519/app/cmd/main", - "args": [ - "createkeys", - "${workspaceFolder}/signing/Ed25519/setup/ed25519-testing-private-key.pem", - "${workspaceFolder}/signing/Ed25519/setup/ed25519-testing-public-key.pem", - ] - }, - { - "name": "Debug sign", - "type": "go", - "request": "launch", - "mode": "debug", - "program": "${workspaceFolder}/signing/Ed25519/app/cmd/main", - "args": [ - "sign", - "--privatekeypath=${workspaceFolder}/signing/Ed25519/setup/ed25519-testing-private-key.pem", - "${workspaceFolder}/signing/Ed25519/test/sample-infile.txt", - "-o=${workspaceFolder}/signing/Ed25519/test/sample-infile.txt.testing.sig", - ] - }, - { - "name": "Debug verify", - "type": "go", - "request": "launch", - "mode": "debug", - "program": "${workspaceFolder}/signing/Ed25519/app/cmd/main", - "args": [ - "verify", - "--publickeypath=${workspaceFolder}/signing/Ed25519/setup/ed25519-testing-public-key.pem", - "${workspaceFolder}/signing/Ed25519/test/sample-infile.txt", - "${workspaceFolder}/signing/Ed25519/test/sample-infile.txt.testing.sig" - ] - }, - ] -} \ No newline at end of file diff --git a/README.md b/README.md index 90cf3d7a..b3924b1e 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,14 @@ A repository of `provider` interface documents supporting [stackql](https://stackql.io/) ([stackql GitHub repo](https://github.com/stackql/stackql)). +> [!IMPORTANT] +> New and updated provider revisions published after the signing cutover use +> quantum-safe ML-DSA-65 signatures. Signature verification requires +> **StackQL v0.13 or later** and remains opt-in, disabled by default. Existing +> provider revisions gain the new signatures as they are updated or republished; +> legacy revisions must be republished before they can pass the new verifier. +> See [signing and verification](docs/signing-and-verification.md). + ## Table of Contents diff --git a/docs/command-line-tool.md b/docs/command-line-tool.md index 1e7cb183..719f2ead 100644 --- a/docs/command-line-tool.md +++ b/docs/command-line-tool.md @@ -1,75 +1,41 @@ +# Provider signing command line -# Working with the command line tool +Requires Go 1.27.3 or later: -To build the signing and verification tool: - -``` -go build -o ed25519tool ./signing/Ed25519/app/cmd/main +```sh +cd signing +go build -o ../pqsig ./cmd/pqsig +cd .. ``` -Then, from the repository root directory: - -```bash -. ./scripts/setup-env.sh - -CREDENTIALS_DIR="${REPOSITORY_ROOT_DIR}/signing/Ed25519/setup/scratchpad" -TESTING_INPUT_DIR="${REPOSITORY_ROOT_DIR}/signing/Ed25519/test" -TESTING_OUTPUT_DIR="${CREDENTIALS_DIR}" - -PRIVATE_KEY_FILE="smoke-testing-private-key.pem" - -PUBLIC_KEY_FILE="smoke-testing-public-key.pem" - -CERT_FILE="smoke-testing-cert.pem" - -CSR_FILE="smoke-testing.csr" - -## Create key pair and cert -./ed25519tool createkeys ${CREDENTIALS_DIR}/${PRIVATE_KEY_FILE} ${CREDENTIALS_DIR}/${PUBLIC_KEY_FILE} ${CREDENTIALS_DIR}/${CERT_FILE} ${CREDENTIALS_DIR}/${CSR_FILE} - -## Store the private key in an env var -SIGNING_KEY_SECRET=$(cat ${CREDENTIALS_DIR}/${PRIVATE_KEY_FILE}) - -## Sign some files -./ed25519tool sign --privatekeyenvvar="SIGNING_KEY_SECRET" --signaturetime="Jan 2 15:04:05 2006" ${TESTING_INPUT_DIR}/sample-infile.txt -o ${TESTING_OUTPUT_DIR}/old-timestamp-sample-infile.txt.sig - -./ed25519tool sign --privatekeyenvvar="SIGNING_KEY_SECRET" --signaturetime="Jan 2 15:04:05 2023" ${TESTING_INPUT_DIR}/sample-infile.txt -o ${TESTING_OUTPUT_DIR}/acceptable-timestamp-sample-infile.txt.sig - -./ed25519tool sign --privatekeyenvvar="SIGNING_KEY_SECRET" --signaturetime="now" ${TESTING_INPUT_DIR}/sample-infile.txt -o ${TESTING_OUTPUT_DIR}/now-timestamp-sample-infile.txt.sig +Provision a new production key without writing or displaying the private seed: -./ed25519tool sign --privatekeyenvvar="SIGNING_KEY_SECRET" --signaturetime="Jan 2 15:04:05 2033" ${TESTING_INPUT_DIR}/sample-infile.txt -o ${TESTING_OUTPUT_DIR}/future-timestamp-sample-infile.txt.sig - -## Now, verify - -## will succeed -./ed25519tool verify --publickeypath=${CREDENTIALS_DIR}/${PUBLIC_KEY_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/old-timestamp-sample-infile.txt.sig - -## should and will fail with timestamp message -./ed25519tool certverify --localcerts.signingbundle=${CREDENTIALS_DIR}/${CERT_FILE} --localcerts.cabundle=${CREDENTIALS_DIR}/${CERT_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/old-timestamp-sample-infile.txt.sig - -## will succeed -./ed25519tool verify --publickeypath=${CREDENTIALS_DIR}/${PUBLIC_KEY_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/acceptable-timestamp-sample-infile.txt.sig - -## will succeed -./ed25519tool certverify --localcerts.signingbundle=${CREDENTIALS_DIR}/${CERT_FILE} --localcerts.cabundle=${CREDENTIALS_DIR}/${CERT_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/acceptable-timestamp-sample-infile.txt.sig - -## will succeed -./ed25519tool verify --publickeypath=${CREDENTIALS_DIR}/${PUBLIC_KEY_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/now-timestamp-sample-infile.txt.sig - -## will succeed -./ed25519tool certverify --localcerts.signingbundle=${CREDENTIALS_DIR}/${CERT_FILE} --localcerts.cabundle=${CREDENTIALS_DIR}/${CERT_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/now-timestamp-sample-infile.txt.sig - - -## all good with self signed CA if we supply it as a command line arg -./ed25519tool certverify --localcerts.signingbundle=${CREDENTIALS_DIR}/${CERT_FILE} --localcerts.cabundle=${CREDENTIALS_DIR}/${CERT_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt --strict=true ${TESTING_OUTPUT_DIR}/acceptable-timestamp-sample-infile.txt.sig - -## will fail due to self-signed certificate in strict mode, if we do not supply same as CA -./ed25519tool certverify --localcerts.signingbundle=${CREDENTIALS_DIR}/${CERT_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt --strict=true ${TESTING_OUTPUT_DIR}/acceptable-timestamp-sample-infile.txt.sig - -## will succeed -./ed25519tool verify --publickeypath=${CREDENTIALS_DIR}/${PUBLIC_KEY_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/future-timestamp-sample-infile.txt.sig +```sh +./pqsig keygen -kid stackql-2026-01 \ + -public-keys new-public-keys.json \ + -github-secret MLDSA_SIGNING_SEED \ + -repo stackql/stackql-provider-registry +``` -## should and will fail with timestamp message -./ed25519tool certverify --localcerts.signingbundle=${CREDENTIALS_DIR}/${CERT_FILE} --localcerts.cabundle=${CREDENTIALS_DIR}/${CERT_FILE} ${TESTING_INPUT_DIR}/sample-infile.txt ${TESTING_OUTPUT_DIR}/future-timestamp-sample-infile.txt.sig +The command generates an ML-DSA-65 key, pipes its hex-encoded 32-byte seed +directly to `gh secret set`, and writes only the public key. It refuses to +overwrite the public key file. Review and add the public entry to +[`signing/pqsig/keys.json`](../signing/pqsig/keys.json); never commit a seed. +For rotation, add rather than replace public entries until old archives expire. +Ship the updated verifier before using the new key to publish documents. + +Sign in place, or write to a separate output: + +```sh +# STACKQL_SIGNING_SEED is supplied by the secret manager, not a command argument. +./pqsig sign-doc -kid stackql-2026-01 provider.yaml +./pqsig sign-doc -kid stackql-2026-01 -out signed.yaml provider.yaml +./pqsig verify-doc signed.yaml +./pqsig verify-doc -public-keys custom-public-keys.json signed.yaml +./pqsig validate-doc provider.yaml +``` -``` \ No newline at end of file +`sign-doc` checks the generated signature before replacing the output. It does +not assert that the key is an embedded production key; `verify-doc` does that. +CI runs both before publishing. Missing seeds, unknown keys, malformed documents +and invalid signatures exit nonzero. See [the format and policy](signing-and-verification.md). diff --git a/docs/signing-and-verification.md b/docs/signing-and-verification.md index f2ea23a2..c48b8f70 100644 --- a/docs/signing-and-verification.md +++ b/docs/signing-and-verification.md @@ -1,72 +1,92 @@ - -# Cryptographic Signing of Provider Repository Artifacts - -## Preamble - -### Industry norms - -We draw the analogy that signing of documents in our repository is similar in nature to signing software archives in a software distribution repository. At this stage of our development especially there are differences in scale, volume and frequency of update. We are thinking for the future. - -As of early 2022, [PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) is still the pre-eminent signing mechanism for software repositories, eg: - -- [maven / gradle](https://central.sonatype.org/publish/requirements/#sign-files-with-gpgpgp) -- [debian](https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html) - -### The trouble with PGP - -There is some furore over the continued utility of PGP: - -- High profile published exploits in [GnuPG](https://bugs.chromium.org/p/project-zero/issues/detail?id=2145) and [PGP for email encryption](https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-poddebniak.pdf). -- `golang` has effectively [dropped standard lib support for PGP](https://golang.org/issue/44226). - -[^1] aggregates a bunch of concerns. And [^2] is in a similar vein. - -We do not make any judgement on the future of PGP, beyond assessing it as unsuitable for a repository beginning life today. - -[^1]: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html -[^2]: https://blog.gtank.cc/modern-alternatives-to-pgp/ - -### Alternatives - -In light of [^1] and [^2], some indicated options for software signing instead of PGP: - -- [TUF](https://theupdateframework.io/). This does not come with an obvious public key distribution pattern and [the provided reference implementation](https://github.com/theupdateframework/python-tuf) contain a bunch of public keys baked in. We prefer to avoid this method of key distribution, favouring something that is either fully automated or leverages existing chain of trust infrastructure. -- [signify](https://www.openbsd.org/papers/bsdcan-signify.html) / [minisign](https://jedisct1.github.io/minisign/). Both use the `Ed25519` algorithm. Former is used for BSD distro signing. Key distribution is not automated. - - -### Ed25519 - -The "Edwards-Curve Digital Signature Algorithm (EdDSA)" including `Ed25519` and `Ed448` variants are described in [RFC3082](https://datatracker.ietf.org/doc/html/rfc8032). - - -Some more context and sample code can be drawn from: - -- https://www.scottbrady91.com/openssl/creating-elliptical-curve-keys-using-openssl -- https://www.openssl.org/docs/man1.1.1/man7/Ed25519.html -- https://www.openssl.org/docs/manmaster/man1/openssl-pkeyutl.html - - -### Corollary - -1. Given the controversy around PGP, we will avoid that. -2. We will use the indicated `Ed25519` signing algorithm. -3. We will couple (2) with a code signing pattern inclusive of chain of trust, similar in nature to [this](https://www.digicert.com/signing/code-signing-certificates#Code-Signing). - -### Practicalities - -It is possible retrospectively regenerate certificates manually (requires `faketime`): - -```bash - -signing/Ed25519/setup/re-generate-faketime.sh - +# Quantum-safe provider document signatures + +Provider documents use **ML-DSA-65**, the post-quantum signature scheme specified +by FIPS 204, implemented by Go 1.27's standard-library `crypto/mldsa`. +This is algorithm compliance, not a claim that the deployment is FIPS 140 validated. +There is no Ed25519, X.509, signed timestamp, certificate-renewal tool, or `.sig` +sidecar fallback. + +Every `provider.yaml` and service document carries: + +```yaml +x-stackql-signature: + format: raw-v1 + alg: ML-DSA-65 + kid: stackql-2026-01 + sig: <6618 hexadecimal characters> + end: stackql-provider-signature ``` -Easiest thing is edit this script to reflect desired window start datetime. Of course, you will need to possess key material and ensure it is in expected location per script. - -Then, simply copy the output from `signing/Ed25519/setup/out/stackql-cert.pem` to both: - -- `signing/Ed25519/app/edcrypto/embeddedcerts/signingcerts/stackql-signing-bundle.pem`. -- `signing/Ed25519/app/edcrypto/embeddedcerts/stackql-root-cert-bundle.pem`. - -Following this, need to propogate a new version of this module through the toolchain. +[`signing/pqsig`](../signing/pqsig) owns the wire format, payload framing, +signing, verification and embedded public keys. Both SDKs use this package; +they must not implement separate framing logic. +It is published as the small, nested Go module +`github.com/stackql/stackql-provider-registry/signing`, with tags named +`signing/vX.Y.Z`. Provider YAML data is not shipped in this module: the full +registry exceeds Go's module-zip size limit. + +The initial prerelease is `signing/v0.1.0-alpha01` (module version +`v0.1.0-alpha01`). Squash the library feature branch before tagging its final +commit, then merge it with a merge commit, not squash or rebase, so the tagged +commit remains in `main` history. SDK releases follow the same rule. Consumers +pin named module versions and run `go mod tidy` before CI; published tags must +never be moved. StackQL itself can be squash-merged as usual. + +1. The payload is the exact original block-style YAML mapping, including its + original whitespace, comments and line endings. +2. Append a separating LF and the exact field shown above, with two-space + indentation, the prescribed field order, and a final LF. +3. Sign or verify the payload bytes (excluding the separating LF and frame) + with ML-DSA context `stackql-provider-doc-bytes-v1`. +4. On success, parse the returned **exact authenticated payload**, not the + envelope-bearing document. + +Only the prescribed terminal frame is accepted. Extra fields, trailing content, +duplicate frames, malformed signatures and unknown formats fail closed. +Multiple YAML documents, flow-style/JSON roots and explicit `...` document-end +markers cannot carry this frame and are rejected. An existing raw-v1 frame can +be replaced when re-signing. Editing or reformatting a signed file invalidates it. + +This intentionally supersedes the issues' RFC 8785 proposal: an audit found +hundreds of existing documents with aliases and large numeric values that +canonical JSON could not preserve exactly. Raw payload signatures preserve +those existing specifications without rounding numbers or rewriting YAML. +Public trust stores map key IDs to hex-encoded ML-DSA-65 public keys. +Unknown IDs, algorithms, malformed envelopes, missing signatures and tampering +fail closed when verification is enabled. + +## CI and key management + +The production seed is held only in the registry's `MLDSA_SIGNING_SEED` Actions +secret; the public key is in [`keys.json`](../signing/pqsig/keys.json). +The packaging script signs into the staged tree, never the source tree. +PR builds use ephemeral seeds, never the production secret. Trusted publication +jobs additionally verify against the embedded public keys before packaging. +The standalone signature checks run even when no provider source changed. + +See [CLI usage and rotation](command-line-tool.md). Keep old public keys while +their signed archives remain supported. There is no certificate expiry or +automatic trust-on-first-use. + +## Runtime compatibility and scope + +StackQL's default `verifyConfig.nopVerify: true` is unchanged. Explicit +`nopVerify: false` requires an embedded ML-DSA signature on every document read. +Existing unsigned providers and old sidecar-only archives remain usable with +verification disabled; enabling verification requires republishing/re-signing +them. Legacy certificate configuration and sidecars are no longer used. +An explicit `publicKeys` map replaces the embedded roots for private registries. + +any-sdk verifies local, cached and remote reads. omnisdk offers +`stackqldoc.WithVerifier` and `Args.DocumentVerifier`, including referenced +operation documents. Verified omnisdk reads bypass the shared parsed-document +cache so an unverified or differently trusted cache entry cannot be reused. + +This change does **not** authenticate archive downloads or extraction, the +provider index, freshness, or provider/version placement. It does not prevent +rollback to an older valid signed document. Those are separate trust-policy +and verify-before-extraction work under stackql/stackql#832. + +The originally proposed dual-sign/fallback transition is intentionally omitted: +verification has been opt-in for years, and the coordinated migration removes +the legacy implementation rather than maintaining two trust mechanisms. diff --git a/go.mod b/go.mod index 8d64c54c..6786d028 100644 --- a/go.mod +++ b/go.mod @@ -1,33 +1,10 @@ module github.com/stackql/stackql-provider-registry -go 1.17 +go 1.27.3 -require ( - github.com/sirupsen/logrus v1.8.3 - github.com/spf13/cobra v1.4.0 - github.com/spf13/viper v1.10.1 - gotest.tools v2.2.0+incompatible -) +require gotest.tools v2.2.0+incompatible require ( - github.com/fsnotify/fsnotify v1.5.1 // indirect github.com/google/go-cmp v0.5.8 // indirect - github.com/hashicorp/hcl v1.0.0 // indirect - github.com/inconshreveable/mousetrap v1.0.0 // indirect - github.com/kr/pretty v0.2.0 // indirect - github.com/magiconair/properties v1.8.5 // indirect - github.com/mitchellh/mapstructure v1.4.3 // indirect - github.com/pelletier/go-toml v1.9.4 // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/spf13/afero v1.6.0 // indirect - github.com/spf13/cast v1.4.1 // indirect - github.com/spf13/jwalterweatherman v1.1.0 // indirect - github.com/spf13/pflag v1.0.5 // indirect - github.com/subosito/gotenv v1.2.0 // indirect - golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect - golang.org/x/text v0.3.8 // indirect - gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect - gopkg.in/ini.v1 v1.66.2 // indirect - gopkg.in/yaml.v2 v2.4.0 // indirect - gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 50a1f5d3..8366c5a3 100644 --- a/go.sum +++ b/go.sum @@ -1,789 +1,6 @@ -cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= -cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU= -cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY= -cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc= -cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0= -cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To= -cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4= -cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M= -cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc= -cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk= -cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs= -cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc= -cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY= -cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI= -cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk= -cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg= -cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8= -cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0= -cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY= -cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM= -cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY= -cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ= -cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI= -cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4= -cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc= -cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA= -cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= -cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE= -cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc= -cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= -cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= -cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= -cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= -cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= -cloud.google.com/go/firestore v1.6.1/go.mod h1:asNXNOzBdyVQmEU+ggO8UPodTkEVFW5Qx+rwHnAz+EY= -cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= -cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw= -cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA= -cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU= -cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw= -cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos= -cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= -cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= -cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= -dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= -github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= -github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= -github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ= -github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= -github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= -github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= -github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= -github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= -github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= -github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o= -github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY= -github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc= -github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= -github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= -github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= -github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= -github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= -github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs= -github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= -github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= -github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= -github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= -github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= -github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= -github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag= -github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I= -github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= -github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= -github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= -github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= -github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= -github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= -github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= -github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= -github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= -github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= -github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= -github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= -github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= -github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= -github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= -github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= -github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= -github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po= -github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= -github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= -github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ= -github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0= -github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ= -github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= -github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws= -github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= -github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= -github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= -github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI= -github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU= -github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= -github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= -github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= -github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= -github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= -github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= -github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= -github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= -github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= -github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= -github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= -github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= -github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= -github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= -github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= -github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= -github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= -github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= -github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y= -github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= -github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= -github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= -github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4= -github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8= -github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs= -github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= -github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= -github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk= -github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= -github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= -github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= -github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= -github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= -github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8= -github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= -github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= -github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= -github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM= -github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= -github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= -github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= -github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= -github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= -github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= -github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= -github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg= github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= -github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs= -github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0= -github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0= -github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk= -github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= -github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= -github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= -github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= -github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= -github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= -github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0= -github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM= -github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= -github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0= -github.com/hashicorp/consul/sdk v0.8.0/go.mod h1:GBvyrGALthsZObzUGsfgHZQDXjg4lOjagTIwIR1vPms= -github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= -github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80= -github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80= -github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= -github.com/hashicorp/go-hclog v0.12.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ= -github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ= -github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= -github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60= -github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM= -github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= -github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA= -github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs= -github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8= -github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU= -github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4= -github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= -github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= -github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= -github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= -github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4= -github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4= -github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= -github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64= -github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc= -github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE= -github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4= -github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho= -github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM= -github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= -github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= -github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= -github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= -github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= -github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk= -github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= -github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= -github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= -github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg= -github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= -github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= -github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs= -github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= -github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= -github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= -github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= -github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w= -github.com/magiconair/properties v1.8.5 h1:b6kJs+EmPFMYGkow9GiUyCyOvIwYetYJ3fSaWak/Gls= -github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60= -github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= -github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= -github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= -github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= -github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= -github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= -github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84= -github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= -github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= -github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= -github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= -github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso= -github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI= -github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI= -github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= -github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI= -github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= -github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= -github.com/mitchellh/mapstructure v1.4.3 h1:OVowDSCllw/YjdLkam3/sm7wEtOy59d8ndGgCcyj8cs= -github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= -github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= -github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= -github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= -github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= -github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= -github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= -github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= -github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= -github.com/pelletier/go-toml v1.9.4 h1:tjENF6MfZAg8e4ZmZTeWaWiT2vXtsoO6+iuOjFhECwM= -github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c= -github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= -github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s= -github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= -github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= -github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU= -github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= -github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= -github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4= -github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= -github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= -github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A= -github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= -github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= -github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= -github.com/sagikazarmark/crypt v0.4.0/go.mod h1:ALv2SRj7GxYV4HO9elxH9nS6M9gW+xDNxqmyJ6RfDFM= -github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= -github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= -github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= -github.com/sirupsen/logrus v1.8.3 h1:DBBfY8eMYazKEJHb3JKpSPfpgd2mBCoNFlQx6C5fftU= -github.com/sirupsen/logrus v1.8.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= -github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4= -github.com/spf13/afero v1.6.0 h1:xoax2sJ2DT8S8xA2paPFjDCScCNeWsg75VG0DLRreiY= -github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I= -github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA= -github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= -github.com/spf13/cobra v1.4.0 h1:y+wJpx64xcgO1V+RcnwW0LEHxTKRi2ZDPSBjWnrg88Q= -github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g= -github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk= -github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo= -github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= -github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/viper v1.10.1 h1:nuJZuYpG7gTj/XqiUwg8bA0cp1+M2mC3J4g5luUYBKk= -github.com/spf13/viper v1.10.1/go.mod h1:IGlFPqhNAPKRxohIzWpI5QEy4kuI7tcl5WvR+8qy1rU= -github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= -github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= -github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= -github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= -github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY= -github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s= -github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= -github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM= -github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= -github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs= -go.etcd.io/etcd/client/pkg/v3 v3.5.1/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g= -go.etcd.io/etcd/client/v2 v2.305.1/go.mod h1:pMEacxZW7o8pg4CrFE7pquyCJJzZvkvdD2RibOCCCGs= -go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= -go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= -go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= -go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= -go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= -go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk= -go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E= -go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= -go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= -go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= -go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= -golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY= -golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= -golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= -golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= -golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek= -golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY= -golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= -golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= -golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= -golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= -golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= -golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= -golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= -golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= -golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= -golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= -golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= -golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= -golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= -golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= -golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs= -golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= -golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= -golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= -golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= -golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE= -golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o= -golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc= -golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY= -golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= -golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= -golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= -golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= -golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= -golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= -golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= -golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= -golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= -golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= -golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= -golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= -golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc= -golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= -golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8= -golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= -golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= -golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= -golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= -golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= -golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f h1:v4INt8xihDGvnrfjMDVXGxw9wrfxYyCjk0KbXjhR55s= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY= -golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= -golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= -golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= -golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= -golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= -golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= -golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= -golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= -golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= -golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= -golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= -golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= -golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw= -golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw= -golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8= -golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= -golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= -golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= -golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= -golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE= -golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0= -golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= -google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M= -google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= -google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= -google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= -google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= -google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= -google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= -google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= -google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= -google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= -google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= -google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= -google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= -google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM= -google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc= -google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg= -google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE= -google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8= -google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU= -google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94= -google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo= -google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4= -google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw= -google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU= -google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k= -google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE= -google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE= -google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI= -google.golang.org/api v0.59.0/go.mod h1:sT2boj7M9YJxZzgeZqXogmhfmRWDtPzT31xkieUbuZU= -google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I= -google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo= -google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= -google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= -google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= -google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= -google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= -google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= -google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= -google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= -google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= -google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= -google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= -google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= -google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= -google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= -google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8= -google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= -google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= -google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= -google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= -google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= -google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= -google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA= -google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U= -google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= -google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA= -google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A= -google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A= -google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0= -google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0= -google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0= -google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24= -google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k= -google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k= -google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48= -google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48= -google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w= -google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY= -google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY= -google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY= -google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY= -google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY= -google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/genproto v0.0.0-20211008145708-270636b82663/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/genproto v0.0.0-20211028162531-8db9c33dc351/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= -google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= -google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= -google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= -google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= -google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= -google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= -google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= -google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60= -google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= -google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0= -google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc= -google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8= -google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= -google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= -google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= -google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM= -google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM= -google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM= -google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE= -google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE= -google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= -google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= -google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU= -google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw= -google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= -google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= -google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= -google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= -google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= -google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= -google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= -google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= -google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= -google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= -google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= -google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= -gopkg.in/ini.v1 v1.66.2 h1:XfR1dOYubytKy4Shzc2LHrrGhU0lDCfDGG1yLPmpgsI= -gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= -gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= -gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= -gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo= gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw= -honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= -honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= -rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= -rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= diff --git a/scripts/package/sign-file.sh b/scripts/package/sign-file.sh deleted file mode 100644 index 6a5fbf78..00000000 --- a/scripts/package/sign-file.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash - -infile=$1 -outfile=$2 - -echo "Signing $infile..." - -./ed25519tool sign --privatekeyenvvar=SIGNING_PRIV_KEY "$infile" -o "$outfile" diff --git a/scripts/package/sign-provider-docs.py b/scripts/package/sign-provider-docs.py index 33a5a497..44f98dcd 100644 --- a/scripts/package/sign-provider-docs.py +++ b/scripts/package/sign-provider-docs.py @@ -1,26 +1,14 @@ -import json, sys, os, subprocess, shutil +import json, sys, os, subprocess sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..')) from common.provider_tree import require_safe_name, validate_provider_source_tree -sign_file_script = "scripts/package/sign-file.sh" - def sign_file(srcfile, tgtfile): - p = subprocess.Popen(["sh", sign_file_script, srcfile, tgtfile], stdout=subprocess.PIPE, stderr=subprocess.PIPE) - p.wait() - err = p.stderr.read().decode() - if err: - print("ERROR: %s" % (err)) - sys.exit(1) - else: - print("SUCCESS: %s" % (p.stdout.read().decode())) - -signing_version = os.getenv('SIGNING_VERSION') - -print("signing with %s keys and certs" % (signing_version)) - -os.environ['PUBLIC_KEY_FILE'] = "%s-public-key.pem" % (signing_version) -os.environ['CERT_FILE'] = "%s-cert.pem" % (signing_version) + subprocess.run([ + os.path.abspath(os.getenv("PQSIG_BIN", "pqsig")), + "sign-doc", "-kid", os.environ["STACKQL_SIGNING_KID"], + "-out", tgtfile, srcfile, + ], check=True) print("getting PROVIDERS env var...") providers = json.loads(os.getenv('PROVIDERS')) @@ -47,14 +35,12 @@ def sign_file(srcfile, tgtfile): os.makedirs(tgt_services_dir) srcfile = "%s/provider.yaml" % (src_root_dir) - tgtfile = "%s/provider.yaml.sig" % (tgt_root_dir) + tgtfile = "%s/provider.yaml" % (tgt_root_dir) sign_file(srcfile, tgtfile) - shutil.copyfile(srcfile, "%s/provider.yaml" % (tgt_root_dir)) # sign each service for service_file in service_files: srcfile = "%s/%s" % (src_services_dir, service_file) - tgtfile = "%s/%s.sig" % (tgt_services_dir, service_file) + tgtfile = "%s/%s" % (tgt_services_dir, service_file) sign_file(srcfile, tgtfile) - shutil.copyfile(srcfile, "%s/%s" % (tgt_services_dir, service_file)) diff --git a/scripts/package/test_sign_provider_docs.py b/scripts/package/test_sign_provider_docs.py new file mode 100644 index 00000000..e3f0454e --- /dev/null +++ b/scripts/package/test_sign_provider_docs.py @@ -0,0 +1,50 @@ +import os +import runpy +import subprocess +import tempfile +import unittest +from pathlib import Path +from unittest.mock import patch + + +SCRIPT = Path(__file__).with_name("sign-provider-docs.py") + + +class SigningPipelineTests(unittest.TestCase): + def test_embedded_signatures_and_subprocess_failure(self): + with patch.dict(os.environ, {"PROVIDERS": "[]", "STACKQL_SIGNING_KID": "test"}): + namespace = runpy.run_path(str(SCRIPT)) + with patch("subprocess.run") as run: + namespace["sign_file"]("provider.yaml", "signed.yaml") + self.assertEqual( + run.call_args.args[0][1:], + ["sign-doc", "-kid", "test", "-out", "signed.yaml", "provider.yaml"], + ) + self.assertTrue(run.call_args.kwargs["check"]) + run.side_effect = subprocess.CalledProcessError(1, "pqsig") + with self.assertRaises(subprocess.CalledProcessError): + namespace["sign_file"]("provider.yaml", "signed.yaml") + + def test_provider_and_all_services_are_signed_without_sidecars(self): + original = os.getcwd() + with tempfile.TemporaryDirectory() as root: + try: + os.chdir(root) + source = Path("providers/src/example/v1") + (source / "services").mkdir(parents=True) + (source / "provider.yaml").write_text("name: example\n", encoding="utf-8") + (source / "services/one.yaml").write_text("openapi: 3.0.3\n", encoding="utf-8") + (source / "services/two.yaml").write_text("openapi: 3.0.3\n", encoding="utf-8") + with patch.dict(os.environ, { + "PROVIDERS": '[{"provider":"example","provider_dir":"example","source_version":"v1","target_version":"v2"}]', + "STACKQL_SIGNING_KID": "test", + }), patch("subprocess.run") as run: + runpy.run_path(str(SCRIPT)) + outputs = {call.args[0][-2] for call in run.call_args_list} + self.assertEqual(outputs, { + "signed/providers/src/example/v2/provider.yaml", + "signed/providers/src/example/v2/services/one.yaml", + "signed/providers/src/example/v2/services/two.yaml", + }) + finally: + os.chdir(original) diff --git a/signing/Ed25519/app/cmd/argparse/argparse.go b/signing/Ed25519/app/cmd/argparse/argparse.go deleted file mode 100644 index 6cedcf04..00000000 --- a/signing/Ed25519/app/cmd/argparse/argparse.go +++ /dev/null @@ -1,135 +0,0 @@ -package argparse - -import ( - "fmt" - - "github.com/spf13/cobra" - "github.com/spf13/viper" - - log "github.com/sirupsen/logrus" -) - -var ( - BuildMajorVersion string = "" - BuildMinorVersion string = "" - BuildPatchVersion string = "" - BuildCommitSHA string = "" - BuildShortCommitSHA string = "" - BuildDate string = "" - BuildPlatform string = "" -) - -var SemVersion string = fmt.Sprintf("%s.%s.%s", BuildMajorVersion, BuildMinorVersion, BuildPatchVersion) - -type runtimeContext struct { - CPUProfile string - LogLevelStr string - PrivateKeyEnvVar string - PrivateKeyPath string - PublicKeyPath string - CertificatePath string - OutFilePath string - PrivateKeyFormat string - PublicKeyFormat string - Strict bool - CertificateFormat string - OutFileFormat string - Organization string - Host string - CommonName string - FirstName string - LastName string - URIs string - EmailAddresses string - Delimiter string - SignatureTime string - LocalCertsPath string - LocalCABundlePath string - LocalCertsRegex string -} - -var ( - runtimeCtx runtimeContext -) - -// rootCmd represents the base command when called without any subcommands -var rootCmd = &cobra.Command{ - Use: "ed25519", - Version: SemVersion, - Short: "ed25519 sign and verify", - Long: ` - ed25519 sign and verify - `, - Run: func(cmd *cobra.Command, args []string) { - // in the root command is executed with no arguments, print the help message - usagemsg := cmd.Long + "\n\n" + cmd.UsageString() - fmt.Println(usagemsg) - }, -} - -// Execute adds all child commands to the root command and sets flags appropriately. -// This is called by main.main(). It only needs to happen once to the rootCmd. -func Execute() error { - return rootCmd.Execute() -} - -func init() { - cobra.OnInitialize(initConfig) - rootCmd.SetVersionTemplate("ed25519 v{{.Version}} " + BuildPlatform + " (" + BuildShortCommitSHA + ")\nBuildDate: " + BuildDate + "\nhttps://infraql.io\n") - - // Here you will define your flags and configuration settings. - // Cobra supports persistent flags, which, if defined here, - // will be global for your application. - - rootCmd.PersistentFlags().StringVar(&runtimeCtx.CPUProfile, "cpuprofile", "", "cpuprofile file, none if empty") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.LogLevelStr, "loglevel", "warn", "loglevel") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.PrivateKeyEnvVar, "privatekeyenvvar", "", "env var containing pem format private key") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.PrivateKeyPath, "privatekeypath", "", "file path for pem format private key") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.PublicKeyPath, "publickeypath", "", "file path for public key") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.CertificatePath, "certificatepath", "", "file path for certificate") - rootCmd.PersistentFlags().StringVarP(&runtimeCtx.OutFilePath, "outfile", "o", "", "file path for outfile") - rootCmd.PersistentFlags().BoolVarP(&runtimeCtx.Strict, "strict", "", false, "strict mode") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.PrivateKeyFormat, "privatekeyformat", "pem", "format for private key") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.PublicKeyFormat, "publickeyformat", "pem", "format for public key") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.CertificateFormat, "certificateformat", "pem", "format for certificate") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.OutFileFormat, "outfileformat", "", "format for outfile") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.SignatureTime, "signaturetime", "now", "timestamp to include in signature") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.Delimiter, "delimiter", ",", "delimiter for list fields") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.EmailAddresses, "certificate.emails", "javen@stackql.io", "delimited list of emails") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.URIs, "certificate.urls", "https://stackql.io", "delimited list of urls") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.Organization, "certificate.organization", "StackQL Studios", "delimited list of org strings") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.FirstName, "certificate.firstname", ",", "first name") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.LastName, "certificate.lastname", "", "last name") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.Host, "certificate.host", "stackql.io", "host") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.CommonName, "certificate.commonname", "Jeffrey Aven", "common name") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.LocalCertsPath, "localcerts.signingbundle", "", "path to file containing **only** pem certificate bundle used to sign registry files. Empty string means local certs will be ignored altogether.") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.LocalCABundlePath, "localcerts.cabundle", "", "path to file containing **only** pem certificate bundle to be used as CA. Empty string denotes no change.") - rootCmd.PersistentFlags().StringVar(&runtimeCtx.LocalCertsRegex, "localcerts.regex", ".*", "regex to match when local certs should be used. Only applies when localcerts.path nonempty.") - - rootCmd.AddCommand(signCmd) - rootCmd.AddCommand(verifyCmd) - rootCmd.AddCommand(certVerifyCmd) - rootCmd.AddCommand(createKeysCmd) - -} - -func setLogLevel() { - logLevel, err := log.ParseLevel(runtimeCtx.LogLevelStr) - if err != nil { - log.Fatal(err) - } - log.SetLevel(logLevel) -} - -// initConfig reads in config file and ENV variables if set. -func initConfig() { - - setLogLevel() - - viper.AutomaticEnv() // read in environment variables that match - - // If a config file is found, read it in. - if err := viper.ReadInConfig(); err == nil { - fmt.Println("Using config file:", viper.ConfigFileUsed()) - } -} diff --git a/signing/Ed25519/app/cmd/argparse/signing.go b/signing/Ed25519/app/cmd/argparse/signing.go deleted file mode 100644 index 1b162781..00000000 --- a/signing/Ed25519/app/cmd/argparse/signing.go +++ /dev/null @@ -1,231 +0,0 @@ -package argparse - -import ( - "crypto/x509/pkix" - "encoding/base64" - "fmt" - "os" - "runtime/pprof" - "strings" - "time" - - "github.com/spf13/cobra" - - "github.com/stackql/stackql-provider-registry/signing/Ed25519/app/edcrypto" -) - -func printErrorAndExitOneIfNil(subject interface{}, msg string) { - if subject == nil { - fmt.Fprintln(os.Stderr, fmt.Sprintln(msg)) - os.Exit(1) - } -} - -func printErrorAndExitOne(msg string) { - fmt.Fprintln(os.Stderr, fmt.Sprintln(msg)) - os.Exit(1) -} - -func printErrorAndExitOneIfError(err error) { - if err != nil { - fmt.Fprintln(os.Stderr, fmt.Sprintln(err.Error())) - os.Exit(1) - } -} - -var signCmd = &cobra.Command{ - Use: "sign", - Short: "Simple Ed25519 sign", - Long: `Simple Ed25519 sign`, - Run: func(cmd *cobra.Command, args []string) { - - cb := func() { - if len(args) == 0 || args[0] == "" { - cmd.Help() - os.Exit(1) - } - - var b []byte - var err error - if runtimeCtx.PrivateKeyEnvVar != "" { - if runtimeCtx.SignatureTime == "" { - b, err = edcrypto.SignFileUsingEnvVar(runtimeCtx.PrivateKeyEnvVar, runtimeCtx.PrivateKeyFormat, args[0]) - } else { - b, err = edcrypto.SignFileWithTimestampUsingEnvVar(runtimeCtx.PrivateKeyEnvVar, runtimeCtx.PrivateKeyFormat, args[0], runtimeCtx.SignatureTime) - } - } else { - if runtimeCtx.SignatureTime == "" { - b, err = edcrypto.SignFile(runtimeCtx.PrivateKeyPath, runtimeCtx.PrivateKeyFormat, args[0]) - } else { - b, err = edcrypto.SignFileWithTimestamp(runtimeCtx.PrivateKeyPath, runtimeCtx.PrivateKeyFormat, args[0], runtimeCtx.SignatureTime) - } - } - printErrorAndExitOneIfError(err) - printErrorAndExitOneIfNil(b, "no signature created") - // fmt.Printf("\nhex encoded signature = '%s'\n", hex.EncodeToString(b)) - fmt.Printf("\nbase64 encoded signature = '%s'\n", base64.StdEncoding.EncodeToString(b)) - if runtimeCtx.OutFilePath != "" { - outFileFormat := runtimeCtx.OutFileFormat - if outFileFormat == "" { - outFileFormat = "base64" - } - edcrypto.WriteOutFile(b, runtimeCtx.OutFilePath, outFileFormat) - } - } - executeCommand(runtimeCtx, cb) - }, -} - -func getVerifierConfigFromRuntimeCfg() edcrypto.VerifierConfig { - return edcrypto.NewVerifierConfig(runtimeCtx.LocalCABundlePath, runtimeCtx.LocalCertsPath, runtimeCtx.LocalCertsRegex) -} - -var verifyCmd = &cobra.Command{ - Use: "verify", - Short: "Simple Ed25519 verify", - Long: `Simple Ed25519 verify - - `, - Run: func(cmd *cobra.Command, args []string) { - - cb := func() { - if len(args) < 2 || args[0] == "" || args[1] == "" { - cmd.Help() - os.Exit(1) - } - - filePathToVerify := args[0] - signatureFilePath := args[1] - signatureFileFormat := runtimeCtx.OutFileFormat - if signatureFileFormat == "" { - signatureFileFormat = "base64" - } - - vr, err := edcrypto.NewVerifier(getVerifierConfigFromRuntimeCfg()) - printErrorAndExitOneIfError(err) - - res, _, err := vr.VerifyFile(runtimeCtx.PublicKeyPath, runtimeCtx.PublicKeyFormat, filePathToVerify, signatureFilePath, signatureFileFormat) - printErrorAndExitOneIfError(err) - printErrorAndExitOneIfError(err) - if !res { - printErrorAndExitOne(fmt.Sprintf("signature verification failed for file = '%s' and signature file = '%s'", filePathToVerify, signatureFilePath)) - } - fmt.Printf("\nsignature verification succeeded for file = '%s' and signature file = '%s'\n", filePathToVerify, signatureFilePath) - } - executeCommand(runtimeCtx, cb) - }, -} - -var certVerifyCmd = &cobra.Command{ - Use: "certverify", - Short: "Simple Ed25519 certverify", - Long: `Simple Ed25519 certverify - - `, - Run: func(cmd *cobra.Command, args []string) { - - cb := func() { - if len(args) < 2 || args[0] == "" || args[1] == "" { - cmd.Help() - os.Exit(1) - } - - filePathToVerify := args[0] - signatureFilePath := args[1] - signatureFileFormat := runtimeCtx.OutFileFormat - if signatureFileFormat == "" { - signatureFileFormat = "base64" - } - - vr, err := edcrypto.NewVerifier(getVerifierConfigFromRuntimeCfg()) - printErrorAndExitOneIfError(err) - - res, err := vr.VerifyFileFromCertificate(filePathToVerify, signatureFilePath, signatureFileFormat, runtimeCtx.Strict) - printErrorAndExitOneIfError(err) - printErrorAndExitOneIfError(err) - if !res.IsVerified { - printErrorAndExitOne(fmt.Sprintf("signature verification failed for file = '%s' and signature file = '%s'", filePathToVerify, signatureFilePath)) - } - fmt.Printf("\nsignature verification succeeded for file = '%s' and signature file = '%s'\n", filePathToVerify, signatureFilePath) - } - executeCommand(runtimeCtx, cb) - }, -} - -var createKeysCmd = &cobra.Command{ - Use: "createkeys", - Short: "Create Ed25519 key pair", - Long: `Create Ed25519 key pair - Usage: - createkeys privatekeyfilepath publickeyfilepath certfilepath - - `, - Run: func(cmd *cobra.Command, args []string) { - - cb := func() { - if len(args) < 4 || args[0] == "" || args[1] == "" || args[2] == "" || args[3] == "" { - cmd.Help() - os.Exit(1) - } - - privateKeyFilePath := args[0] - publicKeyFilePath := args[1] - certFilePath := args[2] - csrFilePath := args[3] - keyFileFormat := runtimeCtx.OutFileFormat - if keyFileFormat == "" { - keyFileFormat = "pem" - } - var org, emails []string - if len(runtimeCtx.Organization) > 0 { - org = strings.Split(runtimeCtx.Organization, runtimeCtx.Delimiter) - } - if len(runtimeCtx.EmailAddresses) > 0 { - emails = strings.Split(runtimeCtx.EmailAddresses, runtimeCtx.Delimiter) - } - - cfg := edcrypto.CertificateConfig{ - Hosts: strings.Split(runtimeCtx.Host, runtimeCtx.Delimiter), - Format: keyFileFormat, - Name: pkix.Name{ - Organization: org, - CommonName: runtimeCtx.CommonName, - }, - IsCa: true, - IsEd25519Key: true, - ValidFor: time.Duration(2 * 365 * 24 * time.Hour), - PrivateKeyOutFile: privateKeyFilePath, - CertOutFile: certFilePath, - CsrOutFile: csrFilePath, - PublicKeyOutFile: publicKeyFilePath, - EmailAddresses: emails, - } - - err := edcrypto.CreateKeys(cfg) - printErrorAndExitOneIfError(err) - } - executeCommand(runtimeCtx, cb) - }, -} - -func RunCommand(rtCtx runtimeContext, arg string) { - _, err := os.ReadFile(arg) - switch arg { - case "sign": - - } - printErrorAndExitOneIfError(err) - -} - -func executeCommand(rtCtx runtimeContext, callback func()) { - if runtimeCtx.CPUProfile != "" { - f, err := os.Create(runtimeCtx.CPUProfile) - if err != nil { - printErrorAndExitOneIfError(err) - } - pprof.StartCPUProfile(f) - defer pprof.StopCPUProfile() - } - callback() -} diff --git a/signing/Ed25519/app/cmd/main/main.go b/signing/Ed25519/app/cmd/main/main.go deleted file mode 100644 index eb3791f5..00000000 --- a/signing/Ed25519/app/cmd/main/main.go +++ /dev/null @@ -1,19 +0,0 @@ -package main - -import ( - "fmt" - "os" - - "github.com/stackql/stackql-provider-registry/signing/Ed25519/app/cmd/argparse" -) - -func main() { - if err := execute(); err != nil { - fmt.Println(err) - os.Exit(1) - } -} - -func execute() error { - return argparse.Execute() -} diff --git a/signing/Ed25519/app/edcrypto/cert.go b/signing/Ed25519/app/edcrypto/cert.go deleted file mode 100644 index 4bded3f4..00000000 --- a/signing/Ed25519/app/edcrypto/cert.go +++ /dev/null @@ -1,330 +0,0 @@ -package edcrypto - -// Copyright 2009 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -// Generate a self-signed X.509 certificate for a TLS server. Outputs to -// 'cert.pem' and 'key.pem' and will overwrite existing files. - -import ( - "crypto/ecdsa" - "crypto/ed25519" - "crypto/elliptic" - "crypto/rand" - "crypto/rsa" - "crypto/x509" - "crypto/x509/pkix" - "fmt" - "math/big" - "net" - "net/url" - "os" - "path" - "time" -) - -var ( -// host = flag.String("host", "", "Comma-separated hostnames and IPs to generate a certificate for") -// validFrom = flag.String("start-date", "", "Creation date formatted as Jan 1 15:04:05 2011") -// validFor = flag.Duration("duration", 365*24*time.Hour, "Duration that certificate is valid for") -// isCA = flag.Bool("ca", false, "whether this cert should be its own Certificate Authority") -// rsaBits = flag.Int("rsa-bits", 2048, "Size of RSA key to generate. Ignored if --ecdsa-curve is set") -// ecdsaCurve = flag.String("ecdsa-curve", "", "ECDSA curve to use to generate a key. Valid values are P224, P256 (recommended), P384, P521") -// ed25519Key = flag.Bool("ed25519", false, "Generate an Ed25519 key") -) - -func publicKey(priv interface{}) interface{} { - switch k := priv.(type) { - case *rsa.PrivateKey: - return &k.PublicKey - case *ecdsa.PrivateKey: - return &k.PublicKey - case ed25519.PrivateKey: - return k.Public().(ed25519.PublicKey) - default: - return nil - } -} - -func sigAlg(priv interface{}) (x509.SignatureAlgorithm, error) { - var retVal x509.SignatureAlgorithm - switch k := priv.(type) { - case *rsa.PrivateKey: - return x509.SHA512WithRSA, nil - case *ecdsa.PrivateKey: - return x509.ECDSAWithSHA512, nil - case ed25519.PrivateKey: - return x509.PureEd25519, nil - default: - return retVal, fmt.Errorf("private key type '%T' not supported", k) - } -} - -type CertificateConfig struct { - EcdsaCurve string - Format string - Hosts []string - EmailAddresses []string - IsCa bool - IsEd25519Key bool - RsaBits int - ValidFor time.Duration - ValidFrom string - CertOutFile string - CsrOutFile string - URIs []string - PrivateKeyOutFile string - PublicKeyOutFile string - Name pkix.Name -} - -func GenerateTLSArtifacts(cc CertificateConfig) error { - return generateTLSArtifacts(cc) -} - -// Serves as a *x509.Certificate "template" generator for https://pkg.go.dev/crypto/x509#CreateCertificate -func getCertTemplate(cc CertificateConfig, keyUsage x509.KeyUsage) (*x509.Certificate, error) { - var notBefore time.Time - var err error - if len(cc.ValidFrom) == 0 { - notBefore = time.Now() - } else { - notBefore, err = time.Parse("Jan 2 15:04:05 2006", cc.ValidFrom) - if err != nil { - return nil, err - } - } - - notAfter := notBefore.Add(cc.ValidFor) - - serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) - serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) - if err != nil { - return nil, err - } - - template := &x509.Certificate{ - SerialNumber: serialNumber, - Subject: cc.Name, - NotBefore: notBefore, - NotAfter: notAfter, - - KeyUsage: keyUsage, - ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, - BasicConstraintsValid: true, - } - - hosts := cc.Hosts - for _, h := range hosts { - if ip := net.ParseIP(h); ip != nil { - template.IPAddresses = append(template.IPAddresses, ip) - } else { - template.DNSNames = append(template.DNSNames, h) - } - } - template.EmailAddresses = cc.EmailAddresses - for _, s := range cc.URIs { - u, err := url.Parse(s) - if err != nil { - return nil, err - } - template.URIs = append(template.URIs, u) - } - - if cc.IsCa { - template.IsCA = true - template.KeyUsage |= x509.KeyUsageCertSign - } - return template, nil -} - -// Serves as a *x509.CertificateRequest "template" generator for https://pkg.go.dev/crypto/x509#CreateCertificateRequest -// The following template members are used: -// - SignatureAlgorithm -// - Subject -// - DNSNames -// - EmailAddresses -// - IPAddresses -// - URIs -// - ExtraExtensions -// - Attributes (deprecated) -func getCsrTemplate(cc CertificateConfig, sigAlg x509.SignatureAlgorithm) (*x509.CertificateRequest, error) { - var err error - if err != nil { - return nil, err - } - - template := &x509.CertificateRequest{ - SignatureAlgorithm: sigAlg, - Subject: cc.Name, - } - - hosts := cc.Hosts - for _, h := range hosts { - if ip := net.ParseIP(h); ip != nil { - template.IPAddresses = append(template.IPAddresses, ip) - } else { - template.DNSNames = append(template.DNSNames, h) - } - } - template.EmailAddresses = cc.EmailAddresses - for _, s := range cc.URIs { - u, err := url.Parse(s) - if err != nil { - return nil, err - } - template.URIs = append(template.URIs, u) - } - return template, nil -} - -func generateTLSArtifacts(cc CertificateConfig) error { - - if len(cc.Hosts) == 0 { - return fmt.Errorf("missing required Host parameter") - } - - var priv interface{} - var err error - switch cc.EcdsaCurve { - case "": - if cc.IsEd25519Key { - _, priv, err = ed25519.GenerateKey(rand.Reader) - if err != nil { - return err - } - } else { - priv, err = rsa.GenerateKey(rand.Reader, cc.RsaBits) - if err != nil { - return err - } - } - case "P224": - priv, err = ecdsa.GenerateKey(elliptic.P224(), rand.Reader) - case "P256": - priv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader) - case "P384": - priv, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader) - case "P521": - priv, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader) - default: - return fmt.Errorf("Unrecognized elliptic curve: %q", cc.EcdsaCurve) - } - if err != nil { - return err - } - - // ECDSA, ED25519 and RSA subject keys should have the DigitalSignature - // KeyUsage bits set in the x509.Certificate template - keyUsage := x509.KeyUsageDigitalSignature - // Only RSA subject keys should have the KeyEncipherment KeyUsage bits set. In - // the context of TLS this KeyUsage is particular to RSA key exchange and - // authentication. - if _, isRSA := priv.(*rsa.PrivateKey); isRSA { - keyUsage |= x509.KeyUsageKeyEncipherment - } - - // Private Key preparation - privBytes, err := x509.MarshalPKCS8PrivateKey(priv) - if err != nil { - return fmt.Errorf("unable to marshal private key: %v", err) - } - privOut := createPemBytes(privBytes, "PRIVATE KEY") - - // Public Key preparation - pubKey := publicKey(priv) - pkb, err := x509.MarshalPKIXPublicKey(pubKey) - if err != nil { - return err - } - pub := createPemBytes(pkb, "PUBLIC KEY") - - // Self-signed Certificate preparation - template, err := getCertTemplate(cc, keyUsage) - if err != nil { - return err - } - derBytes, err := x509.CreateCertificate(rand.Reader, template, template, pubKey, priv) - if err != nil { - return err - } - certOut := createPemBytes(derBytes, "CERTIFICATE") - - // CSR preparation - sAlg, err := sigAlg(priv) - if err != nil { - return err - } - csrTemplate, err := getCsrTemplate(cc, sAlg) - if err != nil { - return err - } - csrBytes, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, priv) - if err != nil { - return err - } - csrOut := createPemBytes(csrBytes, "CERTIFICATE REQUEST") - - // Write files - err = os.WriteFile(cc.PrivateKeyOutFile, privOut, 0600) - if err != nil { - return err - } - err = os.WriteFile(cc.PublicKeyOutFile, pub, 0666) - if err != nil { - return err - } - err = os.WriteFile(cc.CertOutFile, certOut, 0666) - if err != nil { - return err - } - err = os.WriteFile(cc.CsrOutFile, csrOut, 0666) - if err != nil { - return err - } - - return nil -} - -func getAllEmbeddedCerts() ([]*x509.Certificate, error) { - c, err := getEmbbededCert(signingBundlePath) - if err != nil { - return nil, err - } - return c, nil -} - -func getAllLocalCerts(localCertsPath string) ([]*x509.Certificate, error) { - c, err := getLocalCert(localCertsPath) - if err != nil { - return nil, err - } - return c, nil -} - -func getLocalCert(certPath string) ([]*x509.Certificate, error) { - b, err := os.ReadFile(certPath) - if err != nil { - return nil, err - } - return retrieveCertBundleFromPem(b) -} - -func getAllLocalSigningCertPaths(localSigningCertRootPath string) ([]string, error) { - var rv []string - paths, err := os.ReadDir(localSigningCertRootPath) - if err != nil { - return nil, err - } - for _, s := range paths { - if s.Type().IsRegular() { - rv = append(rv, path.Join(localSigningCertRootPath, s.Name())) - } - } - return rv, nil -} - -func getLocalCertBundle(localRootBundlePath string) ([]byte, error) { - return os.ReadFile(localRootBundlePath) -} diff --git a/signing/Ed25519/app/edcrypto/edcrypto.go b/signing/Ed25519/app/edcrypto/edcrypto.go deleted file mode 100644 index 36515012..00000000 --- a/signing/Ed25519/app/edcrypto/edcrypto.go +++ /dev/null @@ -1,571 +0,0 @@ -package edcrypto - -import ( - "bytes" - "fmt" - "io" - "os" - "regexp" - "time" - - "crypto/ed25519" - "crypto/x509" - "encoding/base64" - "encoding/hex" - "encoding/pem" - - log "github.com/sirupsen/logrus" -) - -const ( - privateKeyRexStr string = `PRIVATE\ KEY` - publicKeyRexStr string = `PUBLIC\ KEY` -) - -var ( - privateKeyRegex *regexp.Regexp = regexp.MustCompile(privateKeyRexStr) - publicKeyRegex *regexp.Regexp = regexp.MustCompile(publicKeyRexStr) -) - -func isPrivateKeyType(typeStr string) bool { - return privateKeyRegex.MatchString(typeStr) -} - -func isPublicKeyType(typeStr string) bool { - return publicKeyRegex.MatchString(typeStr) -} - -func retrievePemFile(filePath string) ([]byte, error) { - b, err := os.ReadFile(filePath) - if err != nil { - return nil, err - } - return retrievePemBytes(b) -} - -func retrievePemBytes(b []byte) ([]byte, error) { - var err error - blk, _ := pem.Decode(b) - if blk == nil || blk.Bytes == nil || len(blk.Bytes) == 0 { - return nil, fmt.Errorf("ERROR could not decode bytes (retrievePemBytes)") - } - var key interface{} - if isPrivateKeyType(blk.Type) { - key, err = x509.ParsePKCS8PrivateKey(blk.Bytes) - } else if isPublicKeyType(blk.Type) { - key, err = x509.ParsePKIXPublicKey(blk.Bytes) - } else { - return blk.Bytes, nil - } - if err != nil { - return nil, err - } - switch key := key.(type) { - case ed25519.PrivateKey: - return key, nil - case ed25519.PublicKey: - return key, nil - default: - return nil, fmt.Errorf("ERROR key type '%T' not supported yet", key) - } -} - -func retrieveCertBundleFromPem(b []byte) ([]*x509.Certificate, error) { - var derBytes []byte - blk, rest := pem.Decode(b) - if blk == nil || blk.Bytes == nil || len(blk.Bytes) == 0 { - return nil, fmt.Errorf("ERROR could not decode bytes (retrieveCertBundleFromPem)") - } - derBytes = append(derBytes, blk.Bytes...) - for { - if len(rest) == 0 { - break - } - blk, rest = pem.Decode(rest) - derBytes = append(derBytes, blk.Bytes...) - } - return x509.ParseCertificates(derBytes) -} - -func RetrieveAndDecodeHexFile(filePath string) ([]byte, error) { - b, err := os.ReadFile(filePath) - if err != nil { - return nil, err - } - return retrieveAndDecodeHexBytes(b) -} - -func RetrieveSignatureFromFile(filePath string, format string) ([]byte, error) { - return retrieveSignatureFromFile(filePath, format) -} - -func retrieveSignatureFromFile(filePath string, format string) ([]byte, error) { - b, err := os.ReadFile(filePath) - if err != nil { - return nil, err - } - return retrieveSignatureFromBytes(b, format) -} - -func retrieveSignatureFromBytes(b []byte, format string) ([]byte, error) { - switch format { - case "base64": - return retrieveAndDecodeBase64Bytes(b) - case "hex": - return retrieveAndDecodeHexBytes(b) - default: - return nil, fmt.Errorf("ERROR signature format '%s' not supported", format) - } -} - -func retrieveAndDecodeHexBytes(b []byte) ([]byte, error) { - return hex.DecodeString(string(b)) -} - -func retrieveAndDecodeBase64Bytes(b []byte) ([]byte, error) { - return base64.StdEncoding.DecodeString(string(b)) -} - -func WriteOutFile(outBytes []byte, filePath string, format string) error { - return writeOutFile(outBytes, filePath, format) -} - -func writeOutFile(outBytes []byte, filePath string, format string) error { - switch format { - case "base64": - outBytes = []byte(base64.StdEncoding.EncodeToString(outBytes)) - case "hex": - outBytes = []byte(hex.EncodeToString(outBytes)) - } - err := os.WriteFile(filePath, outBytes, 0666) - return err -} - -func createPemBlock(outBytes []byte, pemType string) *pem.Block { - return &pem.Block{ - Type: pemType, - Bytes: outBytes, - } -} - -func createPemBytes(objectBytes []byte, objectType string) []byte { - pb := createPemBlock(objectBytes, objectType) - return pem.EncodeToMemory(pb) -} - -func CreateKeys(cc CertificateConfig) error { - if cc.Format != "pem" { - return fmt.Errorf("ERROR key format '%s' not suported", cc.Format) - } - return generateTLSArtifacts(cc) -} - -func ReadSignatureFile(outBytes []byte, filePath string, format string) error { - switch format { - case "hex": - outBytes = []byte(hex.EncodeToString(outBytes)) - } - err := os.WriteFile(filePath, outBytes, 0666) - return err -} - -func SignFile(pkFilePath string, pkFileFormat string, filePathToSign string) ([]byte, error) { - return signFileUsingPkFile(pkFilePath, pkFileFormat, filePathToSign, "") -} - -func SignFileWithTimestamp(pkFilePath string, pkFileFormat string, filePathToSign string, tmstp string) ([]byte, error) { - return signFileUsingPkFile(pkFilePath, pkFileFormat, filePathToSign, tmstp) -} - -func SignFileAndWriteSignatureFile(pkFilePath string, pkFileFormat string, filePathToSign string, signatureFilePath string) ([]byte, error) { - return signFileAndWriteSignatureFileUsingFile(pkFilePath, pkFileFormat, filePathToSign, signatureFilePath) -} - -func SignFileUsingEnvVar(pkEnvVar string, pkFileFormat string, filePathToSign string) ([]byte, error) { - return signFileUsingPkEnvVar(pkEnvVar, pkFileFormat, filePathToSign, "") -} - -func SignFileWithTimestampUsingEnvVar(pkEnvVar string, pkFileFormat string, filePathToSign string, tmstp string) ([]byte, error) { - return signFileUsingPkEnvVar(pkEnvVar, pkFileFormat, filePathToSign, tmstp) -} - -func SignFileAndWriteSignatureFileUsingEnvVar(pkEnvVar string, pkFileFormat string, filePathToSign string, signatureFilePath string) ([]byte, error) { - return signFileAndWriteSignatureFileUsingEnvVar(pkEnvVar, pkFileFormat, filePathToSign, signatureFilePath) -} - -func signFileAndWriteSignatureFileUsingFile(pkFile string, pkFileFormat string, filePathToSign string, signatureFilePath string) ([]byte, error) { - b, err := signFileUsingPkFile(pkFile, pkFileFormat, filePathToSign, "") - if err != nil { - return nil, err - } - err = os.WriteFile(signatureFilePath, b, 0666) - return b, err -} - -func signFileAndWriteSignatureFileUsingEnvVar(pkEnvVar string, pkFileFormat string, filePathToSign string, signatureFilePath string) ([]byte, error) { - b, err := signFileUsingPkEnvVar(pkEnvVar, pkFileFormat, filePathToSign, "") - if err != nil { - return nil, err - } - err = os.WriteFile(signatureFilePath, b, 0666) - return b, err -} - -func signFileUsingPkEnvVar(pkEnvVar string, pkFileFormat string, filePathToSign string, timestampToInclude string) ([]byte, error) { - var pkBytes ed25519.PrivateKey - var err error - fmt.Printf("using private key env var: %s", pkEnvVar) - pk, ok := os.LookupEnv(pkEnvVar) - if !ok { - return nil, fmt.Errorf("ERROR env var '%s' not present as required", pkEnvVar) - } - switch pkFileFormat { - case "pem": - pkBytes, err = retrievePemBytes([]byte(pk)) - } - if err != nil { - return nil, err - } - return signFile(pkBytes, pkFileFormat, filePathToSign, timestampToInclude) -} - -func signFileUsingPkFile(pkFilePath string, pkFileFormat string, filePathToSign string, timestampToInclude string) ([]byte, error) { - var pkBytes ed25519.PrivateKey - var err error - pk, err := os.ReadFile(pkFilePath) - if err != nil { - return nil, err - } - switch pkFileFormat { - case "pem": - pkBytes, err = retrievePemBytes([]byte(pk)) - } - if err != nil { - return nil, err - } - return signFile(pkBytes, pkFileFormat, filePathToSign, timestampToInclude) -} - -func signFile(pkBytes []byte, pkFileFormat string, filePathToSign string, timestampToInclude string) ([]byte, error) { - var err error - if len(pkBytes) != ed25519.PrivateKeySize { - return nil, fmt.Errorf("ERROR private key is not the correct size (%d != %d)", len(pkBytes), ed25519.PrivateKeySize) - } - msg, err := os.ReadFile(filePathToSign) - if err != nil { - return nil, fmt.Errorf("ERROR cant read file to sign: %s", err.Error()) - } - var nowBytes []byte - if timestampToInclude != "" { - var tmstp time.Time - if timestampToInclude == "now" { - tmstp = time.Now() - } else { - tmstp, err = time.Parse("Jan 2 15:04:05 2006", timestampToInclude) - if err != nil { - return nil, err - } - } - nowBytes, err = tmstp.MarshalBinary() - if err != nil { - return nil, err - } - msg = append(msg, nowBytes...) - } - return append(nowBytes, ed25519.Sign(pkBytes, msg)...), nil -} - -type Verifier struct { - cc CertChecker - signingCerts []*x509.Certificate - localSigningCerts []*x509.Certificate - vc VerifierConfig - localCertsRegex *regexp.Regexp -} - -func NewVerifierConfig(localCafilePath, localSigningCertPath, localCertRegexStr string) VerifierConfig { - return VerifierConfig{ - LocalCAFilePath: localCafilePath, - LocalSigningCertPath: localSigningCertPath, - LocalCertRegexStr: localCertRegexStr, - } -} - -func NewVerifier(vc VerifierConfig) (*Verifier, error) { - cc, err := getCertChecker(vc.LocalCAFilePath) - if err != nil { - return nil, err - } - var scs []*x509.Certificate - scs, err = getAllEmbeddedCerts() - if err != nil { - return nil, err - } - var localCerts []*x509.Certificate - var localCertsRegex *regexp.Regexp - if vc.LocalSigningCertPath != "" { - localCerts, err = getAllLocalCerts(vc.LocalSigningCertPath) - if err != nil { - return nil, err - } - localCertsRegex, err = regexp.Compile(vc.LocalCertRegexStr) - if err != nil { - return nil, err - } - } - return &Verifier{cc: cc, signingCerts: scs, localSigningCerts: localCerts, localCertsRegex: localCertsRegex, vc: vc}, nil -} - -func (v *Verifier) VerifyFile(publicKeyFilePath string, publicKeyFileFormat string, filePathToVerify string, signatureFilePath string, signatureFileFormat string) (bool, *ObjectSignature, error) { - return v.verifyFile(publicKeyFilePath, publicKeyFileFormat, filePathToVerify, signatureFilePath, signatureFileFormat, nil, nil) -} - -func (v *Verifier) VerifyFileWithTimestamp(publicKeyFilePath string, publicKeyFileFormat string, filePathToVerify string, signatureFilePath string, signatureFileFormat string) (bool, *ObjectSignature, error) { - return v.verifyFile(publicKeyFilePath, publicKeyFileFormat, filePathToVerify, signatureFilePath, signatureFileFormat, nil, nil) -} - -func (v *Verifier) inferCertificate(vc VerifyContext, vb []byte, signature *ObjectSignature) (bool, *x509.Certificate, error) { - if signature.tmstp == nil { - return false, nil, fmt.Errorf("ERROR timestamp missing from signature; cannot infer matching certificate") - } - if v.vc.LocalSigningCertPath != "" && v.localCertsRegex != nil && v.localCertsRegex.MatchString(vc.VerifyURL) { - return v.findFirstMatchingCert(vc, vb, v.localSigningCerts, signature) - } - return v.findFirstMatchingCert(vc, vb, v.signingCerts, signature) -} - -func (v *Verifier) findFirstMatchingCert(vc VerifyContext, vb []byte, cs []*x509.Certificate, signature *ObjectSignature) (bool, *x509.Certificate, error) { - for _, cert := range cs { - if vc.StrictMode { - chains, err := v.cc.Verify(cert) - if err != nil { - return false, nil, fmt.Errorf("ERROR certificate verify error: %s", err.Error()) - } - if len(chains) == 0 { - return false, nil, fmt.Errorf("ERROR chain of trust could not be established") - } - } - publicKeyBytes, err := extractPublicKeyFromCertificate(cert) - if err != nil { - return false, nil, err - } - if len(publicKeyBytes) != ed25519.PublicKeySize { - return false, nil, fmt.Errorf("ERROR public key is not the correct size (%d != %d)", len(publicKeyBytes), ed25519.PublicKeySize) - } - if !signature.HasTimestamp() || !cert.NotBefore.Before(*signature.GetTimestamp()) || !cert.NotAfter.After(*signature.GetTimestamp()) { - return false, nil, fmt.Errorf("ERROR problems with signed timestamp: %v, not in cert timestamp range (%v, %v)", signature.GetTimestamp(), cert.NotBefore, cert.NotAfter) - } - testSubstrate := append(vb, signature.GetTimestampBytes()...) - sigBytesCheck := signature.GetSignature() - log.Debugf("\nhex encoded vb: %s\n\n", hex.EncodeToString(vb)) - log.Debugf("calling verify with len(vb) = %d, len(testSubstrate) = %d and len(sigBytesCheck) = %d\n", len(vb), len(testSubstrate), len(sigBytesCheck)) - isVerified := ed25519.Verify(publicKeyBytes, testSubstrate, sigBytesCheck) - if isVerified { - rv := cert - return true, rv, nil - } - } - return false, nil, fmt.Errorf("ERROR cannot locate appropriate certificate") -} - -func findFirstMatchingCert(cs []*x509.Certificate, t time.Time) (*x509.Certificate, error) { - for _, c := range cs { - if (c.NotBefore.Before(t) || c.NotBefore.Equal(t)) && (c.NotAfter.After(t) || c.NotAfter.Equal(t)) { - return c, nil - } - } - return nil, fmt.Errorf("ERROR cannot find cert covering time = %s", t.String()) -} - -func (v *Verifier) verifyFile(publicKeyFilePath string, publicKeyFileFormat string, filePathToVerify string, signatureFilePath string, signatureFileFormat string, minTime *time.Time, maxTime *time.Time) (bool, *ObjectSignature, error) { - var publicKeyBytes ed25519.PublicKey - var err error - switch publicKeyFileFormat { - case "pem": - publicKeyBytes, err = retrievePemFile(publicKeyFilePath) - } - if err != nil { - return false, nil, err - } - if len(publicKeyBytes) != ed25519.PublicKeySize { - return false, nil, fmt.Errorf("ERROR private key '%s' is not the correct size (%d != %d)", publicKeyFilePath, len(publicKeyBytes), ed25519.PublicKeySize) - } - msg, err := os.ReadFile(filePathToVerify) - if err != nil { - return false, nil, fmt.Errorf("ERROR cant read file to sign: %s", err.Error()) - } - b, err := retrieveSignatureFromFile(signatureFilePath, signatureFileFormat) - if err != nil { - return false, nil, fmt.Errorf("ERROR cant read signature file: %s", err.Error()) - } - obSig, err := extractSignature(b) - if err != nil { - return false, nil, fmt.Errorf("ERROR problems with signature: %s", err.Error()) - } - return ed25519.Verify(publicKeyBytes, append(msg, obSig.GetTimestampBytes()...), obSig.GetSignature()), obSig, nil -} - -func extractPublicKeyFromCertificate(cert *x509.Certificate) (ed25519.PublicKey, error) { - rv, ok := cert.PublicKey.(ed25519.PublicKey) - if !ok { - return nil, fmt.Errorf("ERROR cannot extract public key from certificate") - } - return rv, nil -} - -func (v *Verifier) VerifyFileFromCertificate(filePathToVerify string, signatureFilePath string, signatureFileFormat string, strictMode bool) (VerifierResponse, error) { - return v.verifyFileFromCertificate(filePathToVerify, signatureFilePath, signatureFileFormat, strictMode) -} - -type VerifyContext struct { - VerifyURL string - SignatureFile, VerifyFile io.ReadCloser - CertificateFormat string - SignatureEncoding string - StrictMode bool - VerifyOptions x509.VerifyOptions -} - -func NewVerifyContext(verifyURL string, signatureFile, verifyFile io.ReadCloser, sigEncoding string, strictMode bool, verifyOptions x509.VerifyOptions) VerifyContext { - return VerifyContext{ - VerifyURL: verifyURL, - SignatureFile: signatureFile, - VerifyFile: verifyFile, - SignatureEncoding: sigEncoding, - StrictMode: strictMode, - VerifyOptions: verifyOptions, - } -} - -func (v *Verifier) verifyFileFromCertificate(filePathToVerify string, signatureFilePath string, signatureFileFormat string, strictMode bool) (VerifierResponse, error) { - sb, err := os.Open(signatureFilePath) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), err - } - vb, err := os.Open(filePathToVerify) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), err - } - vc := NewVerifyContext(fmt.Sprintf("file://%s", filePathToVerify), sb, vb, signatureFileFormat, strictMode, x509.VerifyOptions{}) - return v.verifyFileFromCertificateBytes(vc) -} - -func (v *Verifier) VerifyFileFromCertificateBytes(vc VerifyContext) (VerifierResponse, error) { - return v.verifyFileFromCertificateBytes(vc) -} - -type VerifierResponse struct { - IsVerified bool - Sig *ObjectSignature - VerifyFile io.ReadCloser - SignatureFile io.ReadCloser -} - -func NewVerifierResponse(isVerified bool, sig *ObjectSignature, verifyFile, sigFile io.ReadCloser) VerifierResponse { - return VerifierResponse{ - IsVerified: isVerified, - Sig: sig, - VerifyFile: verifyFile, - SignatureFile: sigFile, - } -} - -// Might eventually do this in chunks, io.ReadCloser is appropriate interface to pass through -func (v *Verifier) verifyFileFromCertificateBytes(vc VerifyContext) (VerifierResponse, error) { - if v.vc.IsNopVerify() { - return NewVerifierResponse(true, nil, vc.VerifyFile, vc.SignatureFile), nil - } - var err error - var decodedSigBytes []byte - cleanup := func() { - vc.SignatureFile.Close() - vc.VerifyFile.Close() - } - defer cleanup() - sb, err := io.ReadAll(vc.SignatureFile) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), err - } - sbc := make([]byte, len(sb)) - copy(sbc, sb) - sigReader := io.NopCloser(bytes.NewReader(sbc)) - vb, err := io.ReadAll(vc.VerifyFile) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), err - } - log.Debugf("at birth; len(vb) = %d\n", len(vb)) - vbc := make([]byte, len(vb)) - copy(vbc, vb) - log.Debugf("after copy; len(vb) = %d\n", len(vb)) - verReader := io.NopCloser(bytes.NewReader(vbc)) - decodedSigBytes, err = retrieveSignatureFromBytes(sb, vc.SignatureEncoding) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), err - } - obSig, err := extractSignature(decodedSigBytes) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), fmt.Errorf("ERROR problems with signature: %s", err.Error()) - } - isVerified, _, err := v.inferCertificate(vc, vb, obSig) - if err != nil { - return NewVerifierResponse(false, nil, nil, nil), err - } - return NewVerifierResponse(isVerified, obSig, verReader, sigReader), nil -} - -type ObjectSignature struct { - tmstpBytes []byte - sigBytes []byte - tmstp *time.Time -} - -func (obs *ObjectSignature) HasTimestamp() bool { - return obs.tmstp != nil -} - -func (obs *ObjectSignature) GetTimestamp() *time.Time { - return obs.tmstp -} - -func (obs *ObjectSignature) GetTimestampBytes() []byte { - return obs.tmstpBytes -} - -func (obs *ObjectSignature) GetSignature() []byte { - return obs.sigBytes -} - -func newObjectSignature(tmstpBytes, sigBytes []byte) (*ObjectSignature, error) { - rv := &ObjectSignature{ - tmstpBytes: make([]byte, len(tmstpBytes)), - tmstp: nil, - sigBytes: make([]byte, ed25519.SignatureSize), - } - if len(tmstpBytes) > 0 { - copy(rv.tmstpBytes, tmstpBytes) - t := &time.Time{} - err := t.UnmarshalBinary(rv.tmstpBytes) - if err != nil { - return nil, err - } - rv.tmstp = t - } - copy(rv.sigBytes, sigBytes) - return rv, nil -} - -func extractSignature(b []byte) (*ObjectSignature, error) { - if len(b) > ed25519.SignatureSize { - return newObjectSignature( - b[:len(b)-ed25519.SignatureSize], - b[len(b)-ed25519.SignatureSize:], - ) - } - if len(b) == ed25519.SignatureSize { - return newObjectSignature( - nil, - b, - ) - } - return nil, fmt.Errorf("ERROR cannot process signature of size = %d", len(b)) -} diff --git a/signing/Ed25519/app/edcrypto/edcrypto_test.go b/signing/Ed25519/app/edcrypto/edcrypto_test.go deleted file mode 100644 index 5aad9874..00000000 --- a/signing/Ed25519/app/edcrypto/edcrypto_test.go +++ /dev/null @@ -1,374 +0,0 @@ -package edcrypto_test - -import ( - "crypto/x509/pkix" - "fmt" - "os" - "path" - "testing" - "time" - - "gotest.tools/assert" - - "github.com/stackql/stackql-provider-registry/registry/pkg/nomenclature" - "github.com/stackql/stackql-provider-registry/signing/pkg/fileutil" - - . "github.com/stackql/stackql-provider-registry/signing/Ed25519/app/edcrypto" -) - -func TestEdCrypToE2EPublicKeyOnly(t *testing.T) { - - testName := "TestEdCrypToE2EPublicKeyOnly" - - tmpDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/tmp") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - privKeyPath := fmt.Sprintf("%s-private-key.pem", path.Join(tmpDir, testName)) - pubKeyPath := fmt.Sprintf("%s-public-key.pem", path.Join(tmpDir, testName)) - certPath := fmt.Sprintf("%s-cert.pem", path.Join(tmpDir, testName)) - csrPath := fmt.Sprintf("%s.csr", path.Join(tmpDir, testName)) - sigFilePath := fmt.Sprintf("%s.sig", path.Join(tmpDir, testName)) - - cfg := CertificateConfig{ - Hosts: []string{"example.com"}, - Format: "pem", - Name: pkix.Name{ - Organization: []string{"stackql.io"}, - }, - IsCa: true, - IsEd25519Key: true, - ValidFor: time.Duration(2 * 365 * 24 * time.Hour), - PrivateKeyOutFile: privKeyPath, - CertOutFile: certPath, - CsrOutFile: csrPath, - PublicKeyOutFile: pubKeyPath, - } - - err = CreateKeys(cfg) - - assert.NilError(t, err) - - b, err := SignFile(privKeyPath, "pem", fileToSign) - - assert.NilError(t, err) - - err = WriteOutFile(b, sigFilePath, "base64") - - assert.NilError(t, err) - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verified, _, err := vr.VerifyFile(pubKeyPath, "pem", fileToSign, sigFilePath, "base64") - - assert.NilError(t, err) - - assert.Equal(t, verified, true) - -} - -func TestTimestampedEdCrypToE2EPublicKeyOnly(t *testing.T) { - - testName := "TestTimestampedEdCrypToE2EPublicKeyOnly" - - tmpDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/tmp") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - privKeyPath := fmt.Sprintf("%s/%s-private-key.pem", tmpDir, testName) - pubKeyPath := fmt.Sprintf("%s/%s-public-key.pem", tmpDir, testName) - certPath := fmt.Sprintf("%s/%s-cert.pem", tmpDir, testName) - csrPath := fmt.Sprintf("%s/%s.csr", tmpDir, testName) - sigFilePath := fmt.Sprintf("%s/%s.sig", tmpDir, testName) - - cfg := CertificateConfig{ - Hosts: []string{"example.com"}, - Format: "pem", - Name: pkix.Name{ - Organization: []string{"stackql.io"}, - }, - IsCa: true, - IsEd25519Key: true, - ValidFor: time.Duration(2 * 365 * 24 * time.Hour), - PrivateKeyOutFile: privKeyPath, - CertOutFile: certPath, - CsrOutFile: csrPath, - PublicKeyOutFile: pubKeyPath, - } - - err = CreateKeys(cfg) - - assert.NilError(t, err) - - b, err := SignFileWithTimestamp(privKeyPath, "pem", fileToSign, "Jan 2 15:04:05 2006") - - assert.NilError(t, err) - - err = WriteOutFile(b, sigFilePath, "base64") - - assert.NilError(t, err) - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verified, obs, err := vr.VerifyFile(pubKeyPath, "pem", fileToSign, sigFilePath, "base64") - - assert.NilError(t, err) - - assert.Equal(t, verified, true) - - assert.Equal(t, obs.HasTimestamp(), true) - -} - -func TestTimestampedEdCrypToE2EPublicKeyOnlyEnvVar(t *testing.T) { - - testName := "TestTimestampedEdCrypToE2EPublicKeyOnlyEnvVar" - - tmpDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/tmp") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - privKeyPath := fmt.Sprintf("%s/%s-private-key.pem", tmpDir, testName) - pubKeyPath := fmt.Sprintf("%s/%s-public-key.pem", tmpDir, testName) - certPath := fmt.Sprintf("%s/%s-cert.pem", tmpDir, testName) - csrPath := fmt.Sprintf("%s/%s.csr", tmpDir, testName) - sigFilePath := fmt.Sprintf("%s/%s.sig", tmpDir, testName) - - cfg := CertificateConfig{ - Hosts: []string{"example.com"}, - Format: "pem", - Name: pkix.Name{ - Organization: []string{"stackql.io"}, - }, - IsCa: true, - IsEd25519Key: true, - ValidFor: time.Duration(2 * 365 * 24 * time.Hour), - PrivateKeyOutFile: privKeyPath, - CertOutFile: certPath, - CsrOutFile: csrPath, - PublicKeyOutFile: pubKeyPath, - } - - err = CreateKeys(cfg) - - pkb, err := os.ReadFile(privKeyPath) - - assert.NilError(t, err) - - pkEnvVarName := "SIGNING_KEY_SECRET" - - os.Setenv(pkEnvVarName, string(pkb)) - - b, err := SignFileWithTimestampUsingEnvVar(pkEnvVarName, "pem", fileToSign, "Jan 2 15:04:05 2006") - - assert.NilError(t, err) - - err = WriteOutFile(b, sigFilePath, "base64") - - assert.NilError(t, err) - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verified, obs, err := vr.VerifyFile(pubKeyPath, "pem", fileToSign, sigFilePath, "base64") - - assert.NilError(t, err) - - assert.Equal(t, verified, true) - - assert.Equal(t, obs.HasTimestamp(), true) - -} - -func TestTimestampedEdCryptoCert(t *testing.T) { - - credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - sigFilePath := path.Join(credsDir, "sample-ed25519-signed-with-timestamp.sig") - - vr, err := NewVerifier(NewVerifierConfig("", path.Join(credsDir, "sample", "sample-signing-bundle.pem"), "")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", false) - - assert.NilError(t, err) - - assert.Equal(t, verResponse.IsVerified, true) - - assert.Equal(t, verResponse.Sig.HasTimestamp(), true) - -} - -func TestTimestampedEdCryptoCertAcceptable(t *testing.T) { - - credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - sigFilePath := path.Join(credsDir, "acceptable-timestamp-sample-infile.txt.sig") - - vr, err := NewVerifier(NewVerifierConfig("", path.Join(credsDir, "sample", "sample-signing-bundle.pem"), ".*")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", false) - - assert.NilError(t, err) - - assert.Equal(t, verResponse.IsVerified, true) - - assert.Equal(t, verResponse.Sig.HasTimestamp(), true) - -} - -func TestTimestampedEdCryptoCertAcceptableButCertVerifyFail(t *testing.T) { - - credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - sigFilePath := path.Join(credsDir, "acceptable-timestamp-sample-infile.txt.sig") - - vr, err := NewVerifier(NewVerifierConfig("", path.Join(credsDir, "sample", "sample-signing-bundle.pem"), "")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", true) - - assert.Assert(t, err != nil) - - assert.Equal(t, verResponse.IsVerified, false) - - assert.Assert(t, verResponse.Sig == nil) - -} - -func TestTimestampedEdCryptoCertAcceptableAndCertVerifyFromEmbeddedSuccessful(t *testing.T) { - - credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - sigFilePath := path.Join(credsDir, "acceptable-timestamp-sample-infile.txt.embedded.sig") - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", true) - - assert.NilError(t, err) - - assert.Equal(t, verResponse.IsVerified, true) - - assert.Assert(t, verResponse.Sig != nil) - -} - -func TestTimestampedEdCryptoCertAcceptableAndCertVerifyFromEmbeddedSuccessfulProviderDoc(t *testing.T) { - - // credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - // assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot(fmt.Sprintf("test/providers/src/okta/%s/provider.yaml", nomenclature.FallbackProviderVersionTag)) - - assert.NilError(t, err) - - sigFilePath, err := fileutil.GetFilePathFromRepositoryRoot(fmt.Sprintf("test/providers/src/okta/%s/provider.yaml.sig", nomenclature.FallbackProviderVersionTag)) - - assert.NilError(t, err) - - // sigFilePath := path.Join(credsDir, "acceptable-timestamp-sample-infile.txt.embedded.sig") - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", true) - - assert.NilError(t, err) - - assert.Equal(t, verResponse.IsVerified, true) - - assert.Assert(t, verResponse.Sig != nil) - -} - -func TestTimestampedEdCryptoCertTooOld(t *testing.T) { - - credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - sigFilePath := path.Join(credsDir, "old-timestamp-sample-infile.txt.sig") - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", false) - - assert.Assert(t, err != nil) - - assert.Equal(t, verResponse.IsVerified, false) - - assert.Assert(t, verResponse.Sig == nil) - -} - -func TestTimestampedEdCryptoCertTooNew(t *testing.T) { - - credsDir, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test") - - assert.NilError(t, err) - - fileToSign, err := fileutil.GetFilePathFromRepositoryRoot("signing/Ed25519/test/sample-infile.txt") - - assert.NilError(t, err) - - sigFilePath := path.Join(credsDir, "future-timestamp-sample-infile.txt.sig") - - vr, err := NewVerifier(NewVerifierConfig("", "", "")) - assert.NilError(t, err) - - verResponse, err := vr.VerifyFileFromCertificate(fileToSign, sigFilePath, "base64", false) - - assert.Assert(t, err != nil) - - assert.Equal(t, verResponse.IsVerified, false) - - assert.Assert(t, verResponse.Sig == nil) - -} diff --git a/signing/Ed25519/app/edcrypto/embedded.go b/signing/Ed25519/app/edcrypto/embedded.go deleted file mode 100644 index d2345061..00000000 --- a/signing/Ed25519/app/edcrypto/embedded.go +++ /dev/null @@ -1,41 +0,0 @@ -package edcrypto - -import ( - "crypto/x509" - "embed" - "path" -) - -const ( - rootBundlePath string = "embeddedcerts/stackql-root-cert-bundle.pem" - signingBundlePath string = "embeddedcerts/signingcerts/stackql-signing-bundle.pem" -) - -//go:embed embeddedcerts/* embeddedcerts/signingcerts/* -var certProvider embed.FS - -func getEmbbededCertBundle() ([]byte, error) { - return certProvider.ReadFile(rootBundlePath) -} - -func getEmbbededCert(certPath string) ([]*x509.Certificate, error) { - b, err := certProvider.ReadFile(certPath) - if err != nil { - return nil, err - } - return retrieveCertBundleFromPem(b) -} - -func getAllEmbeddedSigningCertPaths() ([]string, error) { - var rv []string - paths, err := certProvider.ReadDir("embeddedcerts/signingcerts") - if err != nil { - return nil, err - } - for _, s := range paths { - if s.Type().IsRegular() { - rv = append(rv, path.Join("embeddedcerts/signingcerts", s.Name())) - } - } - return rv, nil -} diff --git a/signing/Ed25519/app/edcrypto/embeddedcerts/signingcerts/stackql-signing-bundle.pem b/signing/Ed25519/app/edcrypto/embeddedcerts/signingcerts/stackql-signing-bundle.pem deleted file mode 100644 index 350743f6..00000000 --- a/signing/Ed25519/app/edcrypto/embeddedcerts/signingcerts/stackql-signing-bundle.pem +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIBRDCB96ADAgECAhRIs2XA4fflUvQYcTySrcw8mgGJHDAFBgMrZXAwMTEYMBYG -A1UECgwPU3RhY2tRTCBTdHVkaW9zMRUwEwYDVQQDDAxKZWZmcmV5IEF2ZW4wHhcN -MjUwMjI3MjExNTAwWhcNMjcwODE2MjExNTAwWjAxMRgwFgYDVQQKDA9TdGFja1FM -IFN0dWRpb3MxFTATBgNVBAMMDEplZmZyZXkgQXZlbjAqMAUGAytlcAMhAHrnFfXl -umkc0rjmsXtRUw2mrSV+ycdCLAjBuhs2Y5E5oyEwHzAdBgNVHQ4EFgQUhcjFUmsF -artlM13eyE+xnv5CAUowBQYDK2VwA0EAgVdO/JhQTQQcfV5lvqMJPXst/zUM917I -Qtt4ep6bRb5KopxEP6K71sv5YCYHcr6KiiTD4z+E03eJYK8JMMjIBQ== ------END CERTIFICATE----- diff --git a/signing/Ed25519/app/edcrypto/embeddedcerts/stackql-root-cert-bundle.pem b/signing/Ed25519/app/edcrypto/embeddedcerts/stackql-root-cert-bundle.pem deleted file mode 100644 index 350743f6..00000000 --- a/signing/Ed25519/app/edcrypto/embeddedcerts/stackql-root-cert-bundle.pem +++ /dev/null @@ -1,9 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIBRDCB96ADAgECAhRIs2XA4fflUvQYcTySrcw8mgGJHDAFBgMrZXAwMTEYMBYG -A1UECgwPU3RhY2tRTCBTdHVkaW9zMRUwEwYDVQQDDAxKZWZmcmV5IEF2ZW4wHhcN -MjUwMjI3MjExNTAwWhcNMjcwODE2MjExNTAwWjAxMRgwFgYDVQQKDA9TdGFja1FM -IFN0dWRpb3MxFTATBgNVBAMMDEplZmZyZXkgQXZlbjAqMAUGAytlcAMhAHrnFfXl -umkc0rjmsXtRUw2mrSV+ycdCLAjBuhs2Y5E5oyEwHzAdBgNVHQ4EFgQUhcjFUmsF -artlM13eyE+xnv5CAUowBQYDK2VwA0EAgVdO/JhQTQQcfV5lvqMJPXst/zUM917I -Qtt4ep6bRb5KopxEP6K71sv5YCYHcr6KiiTD4z+E03eJYK8JMMjIBQ== ------END CERTIFICATE----- diff --git a/signing/Ed25519/app/edcrypto/trust.go b/signing/Ed25519/app/edcrypto/trust.go deleted file mode 100644 index 49c0a944..00000000 --- a/signing/Ed25519/app/edcrypto/trust.go +++ /dev/null @@ -1,69 +0,0 @@ -package edcrypto - -import ( - "crypto/x509" - "fmt" -) - -type CertChecker interface { - Verify(*x509.Certificate) ([][]*x509.Certificate, error) -} - -func getCertChecker(localCafilePath string) (CertChecker, error) { - return newCompositeCertChecker(localCafilePath) -} - -type CompositeCertChecker struct { - certPool *x509.CertPool - isComposite bool -} - -func (cc *CompositeCertChecker) Verify(ct *x509.Certificate) ([][]*x509.Certificate, error) { - vo := x509.VerifyOptions{ - Roots: cc.certPool, - } - if cc.isComposite { - return ct.Verify(vo) - } - chains, err := ct.Verify(vo) - if err == nil { - return chains, err - } - return ct.Verify(x509.VerifyOptions{}) -} - -func newCompositeCertChecker(localCafilePath string) (*CompositeCertChecker, error) { - // if goo - b, err := getEmbbededCertBundle() - if err != nil { - return nil, err - } - var lb []byte - if localCafilePath != "" { - lb, err = getLocalCertBundle(localCafilePath) - if err != nil { - return nil, err - } - } - sp, err := x509.SystemCertPool() - if err == nil && sp != nil && sp.AppendCertsFromPEM(b) { - if lb != nil { - sp.AppendCertsFromPEM(lb) - } - return &CompositeCertChecker{ - certPool: sp, - isComposite: true, - }, nil - } - vp := x509.NewCertPool() - if vp.AppendCertsFromPEM(b) { - if lb != nil { - vp.AppendCertsFromPEM(lb) - } - return &CompositeCertChecker{ - certPool: vp, - isComposite: false, - }, nil - } - return nil, fmt.Errorf("cannot initialise cert pool where len(b) = %d and len(lb) = %d", len(b), len(lb)) -} diff --git a/signing/Ed25519/app/edcrypto/verifier_config.go b/signing/Ed25519/app/edcrypto/verifier_config.go deleted file mode 100644 index 23af01e4..00000000 --- a/signing/Ed25519/app/edcrypto/verifier_config.go +++ /dev/null @@ -1,12 +0,0 @@ -package edcrypto - -type VerifierConfig struct { - LocalCAFilePath string `json:"CAFile" yaml:"CAFile"` - LocalSigningCertPath string `json:"signingCertFile" yaml:"signingCertFile"` - LocalCertRegexStr string `json:"certRegex" yaml:"certRegex"` - NopVerify bool `json:"nopVerify" yaml:"nopVerify"` -} - -func (vc VerifierConfig) IsNopVerify() bool { - return vc.NopVerify -} diff --git a/signing/Ed25519/setup/.gitignore b/signing/Ed25519/setup/.gitignore deleted file mode 100644 index eeac3c9e..00000000 --- a/signing/Ed25519/setup/.gitignore +++ /dev/null @@ -1,8 +0,0 @@ -* -!README.md -!generate.sh -!re-generate-faketime.sh -!openssl-ed25519.cnf -!scratchpad -!.gitignore -!v1/ \ No newline at end of file diff --git a/signing/Ed25519/setup/generate.sh b/signing/Ed25519/setup/generate.sh deleted file mode 100755 index 6966cf64..00000000 --- a/signing/Ed25519/setup/generate.sh +++ /dev/null @@ -1,67 +0,0 @@ -#!/usr/bin/env bash - -SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) - -## as per https://www.scottbrady91.com/openssl/creating-elliptical-curve-keys-using-openssl - -# openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem - -# openssl ec -in private-key.pem -pubout -out public-key.pem - -# openssl req -new -x509 -key private-key.pem -out cert.pem -days 720 - -# ## as per https://www.openssl.org/docs/manmaster/man1/openssl-pkeyutl.html - -# openssl pkeyutl -sign -in sample-file.txt -inkey private-key.pem -out sig - -# openssl pkeyutl -verify -in sample-file.txt -sigfile sig -inkey private-key.pem - - -#### - - - - -#### https://blog.pinterjann.is/ed25519-certificates.html - -CNF_FILE="openssl-ed25519.cnf" -CSR_FILE_NAME="stackql.io.csr" -PRIVATE_KEY_FILE_NAME="ed25519-private-key.pem" -PUBLIC_KEY_FILE_NAME="ed25519-public-key.pem" -SELF_SIGNED_CERT_FILE_NAME="stackql.io.cert.pem" - -openssl genpkey -algorithm Ed25519 -out ${SCRIPT_DIR}/${PRIVATE_KEY_FILE_NAME} - -openssl pkey -in ${SCRIPT_DIR}/${PRIVATE_KEY_FILE_NAME} -pubout -out ${SCRIPT_DIR}/${PUBLIC_KEY_FILE_NAME} - -openssl req -new -out ${SCRIPT_DIR}/${CSR_FILE_NAME} -key ${SCRIPT_DIR}/${PRIVATE_KEY_FILE_NAME} -config ${SCRIPT_DIR}/${CNF_FILE} - -echo -echo "########################################################" -echo "######### CSR DETAILS ##################################" -echo "########################################################" -echo - -openssl req -in ${SCRIPT_DIR}/${CSR_FILE_NAME} -text -noout - -echo -echo "########################################################" -echo "########################################################" -echo "########################################################" -echo - -openssl x509 -req -days 700 -in ${SCRIPT_DIR}/${CSR_FILE_NAME} -signkey ${SCRIPT_DIR}/${PRIVATE_KEY_FILE_NAME} -out ${SCRIPT_DIR}/${SELF_SIGNED_CERT_FILE_NAME} - -echo -echo "########################################################" -echo "######### SELF SIGNED CERT DETAILS #####################" -echo "########################################################" -echo - -openssl x509 -in ${SCRIPT_DIR}/${SELF_SIGNED_CERT_FILE_NAME} -text -noout - -echo -echo "########################################################" -echo "########################################################" -echo "########################################################" -echo \ No newline at end of file diff --git a/signing/Ed25519/setup/openssl-ed25519.cnf b/signing/Ed25519/setup/openssl-ed25519.cnf deleted file mode 100644 index 7a97ec8c..00000000 --- a/signing/Ed25519/setup/openssl-ed25519.cnf +++ /dev/null @@ -1,14 +0,0 @@ -[req] -distinguished_name = req_distinguished_name -req_extensions = v3_req -prompt = no -[req_distinguished_name] -O=StackQL Studios -CN=Jeffrey Aven -[v3_req] -keyUsage = keyEncipherment, dataEncipherment -extendedKeyUsage = serverAuth -subjectAltName = @alt_names -[alt_names] -DNS.1 = stackql.io -email.1 = javen@stackql.io \ No newline at end of file diff --git a/signing/Ed25519/setup/re-generate-faketime.sh b/signing/Ed25519/setup/re-generate-faketime.sh deleted file mode 100755 index e588ab7f..00000000 --- a/signing/Ed25519/setup/re-generate-faketime.sh +++ /dev/null @@ -1,54 +0,0 @@ -#!/usr/bin/env bash - -SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) - - -_version="${1:-"v1"}" - -_out_dir="${SCRIPT_DIR}/out" - -_fakeTime="${2:-"2025-02-28 08:15:00"}" - -_durationDays="${3:-"900"}" - - -#### https://blog.pinterjann.is/ed25519-certificates.html - -CNF_FILE="openssl-ed25519.cnf" -CSR_FILE_NAME="stackql.io.csr" -PRIVATE_KEY_FILE_NAME="${_version}-private-key.pem" -PUBLIC_KEY_FILE_NAME="${_version}-public-key.pem" -SELF_SIGNED_CERT_FILE_NAME="stackql-cert.pem" - - -openssl req -new -out ${_out_dir}/${CSR_FILE_NAME} -key ${SCRIPT_DIR}/${_version}/${PRIVATE_KEY_FILE_NAME} -config ${SCRIPT_DIR}/${CNF_FILE} - -echo -echo "########################################################" -echo "######### CSR DETAILS ##################################" -echo "########################################################" -echo - -openssl req -in ${_out_dir}/${CSR_FILE_NAME} -text -noout - -echo -echo "########################################################" -echo "########################################################" -echo "########################################################" -echo - -faketime "${_fakeTime}" openssl x509 -req -days "${_durationDays}" -in ${_out_dir}/${CSR_FILE_NAME} -signkey ${SCRIPT_DIR}/${_version}/${PRIVATE_KEY_FILE_NAME} -out ${_out_dir}/${SELF_SIGNED_CERT_FILE_NAME} - -echo -echo "########################################################" -echo "######### SELF SIGNED CERT DETAILS #####################" -echo "########################################################" -echo - -openssl x509 -in ${_out_dir}/${SELF_SIGNED_CERT_FILE_NAME} -text -noout - -echo -echo "########################################################" -echo "########################################################" -echo "########################################################" -echo \ No newline at end of file diff --git a/signing/Ed25519/setup/scratchpad/.gitignore b/signing/Ed25519/setup/scratchpad/.gitignore deleted file mode 100644 index c96a04f0..00000000 --- a/signing/Ed25519/setup/scratchpad/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -* -!.gitignore \ No newline at end of file diff --git a/signing/Ed25519/setup/v1/.gitignore b/signing/Ed25519/setup/v1/.gitignore deleted file mode 100644 index c96a04f0..00000000 --- a/signing/Ed25519/setup/v1/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -* -!.gitignore \ No newline at end of file diff --git a/signing/Ed25519/test/.gitignore b/signing/Ed25519/test/.gitignore deleted file mode 100644 index e69de29b..00000000 diff --git a/signing/Ed25519/test/acceptable-timestamp-sample-infile.txt.embedded.sig b/signing/Ed25519/test/acceptable-timestamp-sample-infile.txt.embedded.sig deleted file mode 100644 index c73b98a1..00000000 --- a/signing/Ed25519/test/acceptable-timestamp-sample-infile.txt.embedded.sig +++ /dev/null @@ -1 +0,0 @@ -AQAAAA7bROllAAAAAP//f6Q+5oTQMOc8gTHG+FOsGC8yo/CszL21B04QfWy0H0ZC1entKRb0Z2yfjIjhIn274AKVc0GaeqjdQ6vXKYRHCQ== \ No newline at end of file diff --git a/signing/Ed25519/test/acceptable-timestamp-sample-infile.txt.sig b/signing/Ed25519/test/acceptable-timestamp-sample-infile.txt.sig deleted file mode 100644 index d0fef584..00000000 --- a/signing/Ed25519/test/acceptable-timestamp-sample-infile.txt.sig +++ /dev/null @@ -1 +0,0 @@ -AQAAAA7bROllAAAAAP//LxFtaIUDyqPB+okh3joCCPgd5kMIP/cTZgz3aietomtyZfFnWzX9e1ESjoPu4G9yIhuCYJsumOc9t5COHNdYCw== \ No newline at end of file diff --git a/signing/Ed25519/test/embedded-cert.pem b/signing/Ed25519/test/embedded-cert.pem deleted file mode 100644 index 13cf6d19..00000000 --- a/signing/Ed25519/test/embedded-cert.pem +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIBojCCAVSgAwIBAgIRAKAWgEHxNF0qkxpplNUZAP0wBQYDK2VwMDExGDAWBgNV -BAoTD1N0YWNrUUwgU3R1ZGlvczEVMBMGA1UEAxMMSmVmZnJleSBBdmVuMB4XDTIy -MDIxMjEwNTUwNVoXDTI0MDIxMjEwNTUwNVowMTEYMBYGA1UEChMPU3RhY2tRTCBT -dHVkaW9zMRUwEwYDVQQDEwxKZWZmcmV5IEF2ZW4wKjAFBgMrZXADIQB65xX15bpp -HNK45rF7UVMNpq0lfsnHQiwIwbobNmOROaOBgDB+MA4GA1UdDwEB/wQEAwIChDAT -BgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSF -yMVSawVqu2UzXd7IT7Ge/kIBSjAnBgNVHREEIDAeggpzdGFja3FsLmlvgRBqYXZl -bkBzdGFja3FsLmlvMAUGAytlcANBAKg1uOra6+vlpbtzXXPw0mqiHVygyrh2jIr4 -oz//4tApDLcPvbErdixrMwq5fKtgD/w10Z0Hu/wKFe89o0ZU7AI= ------END CERTIFICATE----- diff --git a/signing/Ed25519/test/future-timestamp-sample-infile.txt.sig b/signing/Ed25519/test/future-timestamp-sample-infile.txt.sig deleted file mode 100644 index b599e996..00000000 --- a/signing/Ed25519/test/future-timestamp-sample-infile.txt.sig +++ /dev/null @@ -1 +0,0 @@ -AQAAAA7uFODlAAAAAP//yzuFKB9nB2WbJFs2S3SYtEzAurviNNeHFi/yGG2dArpy0K3PoS2d3FzuclIpbHS2RHUKTV1Hc4urQoHmwVJjBw== \ No newline at end of file diff --git a/signing/Ed25519/test/old-timestamp-sample-infile.txt.sig b/signing/Ed25519/test/old-timestamp-sample-infile.txt.sig deleted file mode 100644 index 368d6a83..00000000 --- a/signing/Ed25519/test/old-timestamp-sample-infile.txt.sig +++ /dev/null @@ -1 +0,0 @@ -AQAAAA67SzflAAAAAP//nqgXIBA4EuhMF+VpzWm8NYtZg4E/PVRA181N5UTM/z1NVkUqVFgPeWWYr+3Nfu3BH5hGsMS+pfE9ys/SwUKVAw== \ No newline at end of file diff --git a/signing/Ed25519/test/sample-ed25519-signed-with-timestamp.sig b/signing/Ed25519/test/sample-ed25519-signed-with-timestamp.sig deleted file mode 100644 index 146ded15..00000000 --- a/signing/Ed25519/test/sample-ed25519-signed-with-timestamp.sig +++ /dev/null @@ -1 +0,0 @@ -AQAAAA7ZmF3FDrVpUAKUwQIdOTEuxrk0if6FszYWW4lzTAI99NqInC01KOY28COiWiNMP/7luFW4lVvmGPhtlsDXPivVntHLaVUibguGCQ== \ No newline at end of file diff --git a/signing/Ed25519/test/sample-infile.txt b/signing/Ed25519/test/sample-infile.txt deleted file mode 100644 index e4186f7b..00000000 --- a/signing/Ed25519/test/sample-infile.txt +++ /dev/null @@ -1 +0,0 @@ -This is just some testing input. No more. diff --git a/signing/Ed25519/test/sample/sample-signing-bundle.pem b/signing/Ed25519/test/sample/sample-signing-bundle.pem deleted file mode 100644 index 2b59c510..00000000 --- a/signing/Ed25519/test/sample/sample-signing-bundle.pem +++ /dev/null @@ -1,20 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIBUTCCAQOgAwIBAgIQUzxNR+exiQv+0Vl7S+tdLzAFBgMrZXAwEjEQMA4GA1UE -ChMHQWNtZSBDbzAeFw0yMjAyMTExMzM4MTNaFw0yNDAyMTExMzM4MTNaMBIxEDAO -BgNVBAoTB0FjbWUgQ28wKjAFBgMrZXADIQDHBKtZYqy5i9YOEf99xMO+9zTz4HjW -MkXjXuwKUKjHWqNvMG0wDgYDVR0PAQH/BAQDAgKEMBMGA1UdJQQMMAoGCCsGAQUF -BwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHwW/mnxgIombdeZE9LKjKwh -EXKjMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMAUGAytlcANBALP6Z2KkLg3P1KcP -m/8IyZgFDwzgh52vnybxkSnaUZCGutyoUPgpFJ8vrWJ11xtQ/lV/nN0Rx+v2T5Yq -LyUXVwI= ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIBUjCCAQSgAwIBAgIRAJSjeLIHkuRyFsfmfKV9G6kwBQYDK2VwMBIxEDAOBgNV -BAoTB0FjbWUgQ28wHhcNMjIwMjExMTQyNjU1WhcNMjQwMjExMTQyNjU1WjASMRAw -DgYDVQQKEwdBY21lIENvMCowBQYDK2VwAyEAuuQ/90ekTf212RZAP4+P1jxst6Wj -v5J6vMol7UZ2atajbzBtMA4GA1UdDwEB/wQEAwIChDATBgNVHSUEDDAKBggrBgEF -BQcDATAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQo4JB6BleTUejCeY6WjZIL -V/CMozAWBgNVHREEDzANggtleGFtcGxlLmNvbTAFBgMrZXADQQCS8AkjP11W7Fwx -VqhIDT+XDUUQyamdGxvgT9/MewGg0oXsyqw2YHB0dyfTWY5gW3gZAVLV0PupjFDG -pgq4JloD ------END CERTIFICATE----- diff --git a/signing/Ed25519/test/tmp/.gitignore b/signing/Ed25519/test/tmp/.gitignore deleted file mode 100644 index c96a04f0..00000000 --- a/signing/Ed25519/test/tmp/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -* -!.gitignore \ No newline at end of file diff --git a/signing/cmd/pqsig/main.go b/signing/cmd/pqsig/main.go new file mode 100644 index 00000000..83d3e326 --- /dev/null +++ b/signing/cmd/pqsig/main.go @@ -0,0 +1,159 @@ +package main + +import ( + "crypto/mldsa" + "encoding/hex" + "encoding/json" + "flag" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "strings" + + "github.com/stackql/stackql-provider-registry/signing/pqsig" +) + +func main() { + if err := run(os.Args[1:], os.Stdout); err != nil { + fmt.Fprintln(os.Stderr, err) + os.Exit(1) + } +} + +func run(args []string, stdout io.Writer) error { + if len(args) == 0 { + return fmt.Errorf("usage: pqsig [options] [files...]") + } + flags := flag.NewFlagSet(args[0], flag.ContinueOnError) + kid := flags.String("kid", "", "signing key ID") + seedEnv := flags.String("seed-env", "STACKQL_SIGNING_SEED", "environment variable containing a hex seed") + publicOut := flags.String("public-keys", "", "public keyset JSON file") + secret := flags.String("github-secret", "", "store a newly generated seed in this Actions secret (never print it)") + repo := flags.String("repo", "", "GitHub repository for key provisioning") + output := flags.String("out", "", "output file (sign-doc defaults to in-place)") + if err := flags.Parse(args[1:]); err != nil { + return err + } + if args[0] == "keygen" { + if *kid == "" || *publicOut == "" || *secret == "" || *repo == "" || flags.NArg() != 0 { + return fmt.Errorf("keygen requires -kid, -public-keys, -github-secret and -repo") + } + if _, err := os.Stat(*publicOut); !os.IsNotExist(err) { + return fmt.Errorf("keygen refuses to overwrite public key file %q", *publicOut) + } + key, err := mldsa.GenerateKey(mldsa.MLDSA65()) + if err != nil { + return err + } + cmd := exec.Command("gh", "secret", "set", *secret, "--repo", *repo) + cmd.Stdin = strings.NewReader(hex.EncodeToString(key.Bytes())) + cmd.Stderr = os.Stderr + if err := cmd.Run(); err != nil { + return fmt.Errorf("store signing seed in GitHub Actions: %w", err) + } + data, err := json.MarshalIndent(map[string]string{ + *kid: hex.EncodeToString(key.PublicKey().Bytes()), + }, "", " ") + if err != nil { + return err + } + if err := os.WriteFile(*publicOut, append(data, '\n'), 0644); err != nil { + return fmt.Errorf("write public key (seed is already provisioned): %w", err) + } + fmt.Fprintf(stdout, "Provisioned %s public key %s; seed stored in %s\n", pqsig.Algorithm, *kid, *secret) + return nil + } + if flags.NArg() == 0 || (*output != "" && flags.NArg() != 1) { + return fmt.Errorf("%s requires files; -out requires exactly one input file", args[0]) + } + var signer *mldsa.PrivateKey + var verifier pqsig.Verifier + switch args[0] { + case "sign-doc": + seed, err := hex.DecodeString(os.Getenv(*seedEnv)) + if err != nil || len(seed) != mldsa.PrivateKeySize { + return fmt.Errorf("%s must contain a hex-encoded 32-byte ML-DSA seed", *seedEnv) + } + signer, err = mldsa.NewPrivateKey(mldsa.MLDSA65(), seed) + if err != nil { + return err + } + verifier, err = pqsig.NewVerifier(map[string]string{*kid: hex.EncodeToString(signer.PublicKey().Bytes())}) + if err != nil { + return err + } + case "verify-doc": + var keys map[string]string + if *publicOut != "" { + data, err := os.ReadFile(*publicOut) + if err != nil { + return err + } + if err := json.Unmarshal(data, &keys); err != nil { + return err + } + if keys == nil { + return fmt.Errorf("public key file must contain a non-empty object") + } + } + var err error + verifier, err = pqsig.NewVerifier(keys) + if err != nil { + return err + } + case "validate-doc": + default: + return fmt.Errorf("unknown command %q", args[0]) + } + for _, file := range flags.Args() { + data, err := os.ReadFile(file) + if err != nil { + return err + } + switch args[0] { + case "sign-doc": + data, err = pqsig.Sign(data, *kid, signer) + if err == nil { + _, err = verifier.Verify(data) + } + if err == nil { + target := file + if *output != "" { + target = *output + } + err = writeDocument(target, data) + } + case "verify-doc": + _, err = verifier.Verify(data) + case "validate-doc": + err = pqsig.Validate(data) + } + if err != nil { + return fmt.Errorf("%s: %w", file, err) + } + fmt.Fprintf(stdout, "%s: %s OK\n", args[0], file) + } + return nil +} + +func writeDocument(target string, data []byte) error { + file, err := os.CreateTemp(filepath.Dir(target), ".pqsig-*") + if err != nil { + return err + } + defer os.Remove(file.Name()) + if _, err := file.Write(data); err != nil { + file.Close() + return err + } + if err := file.Chmod(0644); err != nil { + file.Close() + return err + } + if err := file.Close(); err != nil { + return err + } + return os.Rename(file.Name(), target) +} diff --git a/signing/cmd/pqsig/main_test.go b/signing/cmd/pqsig/main_test.go new file mode 100644 index 00000000..7f2201e6 --- /dev/null +++ b/signing/cmd/pqsig/main_test.go @@ -0,0 +1,48 @@ +package main + +import ( + "crypto/mldsa" + "encoding/hex" + "encoding/json" + "io" + "os" + "path/filepath" + "testing" +) + +func TestSignAndVerifyCLI(t *testing.T) { + key, err := mldsa.GenerateKey(mldsa.MLDSA65()) + if err != nil { + t.Fatal(err) + } + t.Setenv("STACKQL_SIGNING_SEED", hex.EncodeToString(key.Bytes())) + dir := t.TempDir() + doc := filepath.Join(dir, "provider.yaml") + keys := filepath.Join(dir, "keys.json") + if err := os.WriteFile(doc, []byte("name: example\n"), 0600); err != nil { + t.Fatal(err) + } + keyBytes, err := json.Marshal(map[string]string{"test": hex.EncodeToString(key.PublicKey().Bytes())}) + if err != nil { + t.Fatal(err) + } + if err := os.WriteFile(keys, keyBytes, 0600); err != nil { + t.Fatal(err) + } + if err := run([]string{"sign-doc", "-kid", "test", doc}, io.Discard); err != nil { + t.Fatal(err) + } + if err := run([]string{"verify-doc", "-public-keys", keys, doc}, io.Discard); err != nil { + t.Fatal(err) + } + if _, err := os.Stat(doc + ".sig"); !os.IsNotExist(err) { + t.Fatal("unexpected sidecar") + } + if err := run([]string{"verify-doc", doc}, io.Discard); err == nil { + t.Fatal("ephemeral key was trusted by production verifier") + } + t.Setenv("STACKQL_SIGNING_SEED", "bad") + if err := run([]string{"sign-doc", "-kid", "test", doc}, io.Discard); err == nil { + t.Fatal("accepted invalid seed") + } +} diff --git a/signing/go.mod b/signing/go.mod new file mode 100644 index 00000000..f97248ca --- /dev/null +++ b/signing/go.mod @@ -0,0 +1,5 @@ +module github.com/stackql/stackql-provider-registry/signing + +go 1.27.3 + +require gopkg.in/yaml.v3 v3.0.1 diff --git a/signing/go.sum b/signing/go.sum new file mode 100644 index 00000000..a62c313c --- /dev/null +++ b/signing/go.sum @@ -0,0 +1,4 @@ +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/signing/pkg/fileutil/util.go b/signing/pkg/fileutil/util.go deleted file mode 100644 index 50e1a47b..00000000 --- a/signing/pkg/fileutil/util.go +++ /dev/null @@ -1,14 +0,0 @@ -package fileutil - -import ( - "path/filepath" - "runtime" - "strings" -) - -func GetFilePathFromRepositoryRoot(relativePath string) (string, error) { - _, filename, _, _ := runtime.Caller(0) - curDir := filepath.Dir(filename) - rv, err := filepath.Abs(filepath.Join(curDir, "../../..", relativePath)) - return strings.ReplaceAll(rv, `\`, `\\`), err -} diff --git a/signing/pqsig/document.go b/signing/pqsig/document.go new file mode 100644 index 00000000..d62815dc --- /dev/null +++ b/signing/pqsig/document.go @@ -0,0 +1,68 @@ +package pqsig + +import ( + "bytes" + "fmt" + "io" + "regexp" + "strings" + + "gopkg.in/yaml.v3" +) + +const signatureMarker = "\nx-stackql-signature:\n" + +var keyIDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`) +var documentEndPattern = regexp.MustCompile(`(?m)^\.\.\.[ \t]*(#[^\r\n]*)?\r?$`) + +// Validate checks that an unsigned payload can carry the signature's final +// top-level YAML field. Values, aliases, numbers and formatting are not rewritten. +func Validate(data []byte) error { + decoder := yaml.NewDecoder(bytes.NewReader(data)) + var root yaml.Node + if err := decoder.Decode(&root); err != nil { + return fmt.Errorf("pqsig: decode document: %w", err) + } + var extra yaml.Node + if err := decoder.Decode(&extra); err != io.EOF { + if err == nil { + return fmt.Errorf("pqsig: multiple YAML documents are not permitted") + } + return fmt.Errorf("pqsig: trailing document: %w", err) + } + if len(root.Content) != 1 || root.Content[0].Kind != yaml.MappingNode || + root.Content[0].Style&yaml.FlowStyle != 0 { + return fmt.Errorf("pqsig: document must be a block-style YAML mapping") + } + if documentEndPattern.Match(data) { + return fmt.Errorf("pqsig: explicit YAML document-end markers are not permitted") + } + for i := 0; i < len(root.Content[0].Content); i += 2 { + key := root.Content[0].Content[i] + if key.Value == SignatureField { + return fmt.Errorf("pqsig: reserved top-level %s outside the signature frame", SignatureField) + } + } + return nil +} + +func splitSignature(doc []byte) (payload []byte, kid, signature string, err error) { + index := bytes.LastIndex(doc, []byte(signatureMarker)) + if index < 0 { + return nil, "", "", fmt.Errorf("pqsig: missing or invalid %s frame", SignatureField) + } + lines := strings.Split(string(doc[index+len(signatureMarker):]), "\n") + if len(lines) != 6 || lines[0] != " format: raw-v1" || + lines[1] != " alg: "+Algorithm || lines[5] != "" || lines[4] != " end: stackql-provider-signature" { + return nil, "", "", fmt.Errorf("pqsig: invalid signature frame or unsupported format/algorithm") + } + kid, ok := strings.CutPrefix(lines[2], " kid: ") + if !ok || !keyIDPattern.MatchString(kid) { + return nil, "", "", fmt.Errorf("pqsig: invalid signature key ID") + } + signature, ok = strings.CutPrefix(lines[3], " sig: ") + if !ok { + return nil, "", "", fmt.Errorf("pqsig: invalid signature frame") + } + return doc[:index], kid, signature, nil +} diff --git a/signing/pqsig/keys.json b/signing/pqsig/keys.json new file mode 100644 index 00000000..1d400125 --- /dev/null +++ b/signing/pqsig/keys.json @@ -0,0 +1,3 @@ +{ + "stackql-2026-01": "5541d963712d25550d80dc19a8aba8de46d4adbe3833ab02d3067b492039c8f5bdb797e0306854c95ca2286dd31e2f4b8508371c10c8a6af763cb4a0bc1cc18750b10e194780b2f34d080ee95ed9c63e48e11ce10f8820dc0b085264282fedcac71b7f255f3b10722b1d4da67631adac40e7e31dede487f23d8ceb706c8540503c755ea661aeaf69c4696af6de3dab14f68da9875455c2d809db333e8889c187bb0be067c9cdbe53750dee1715bd57070890f54274176be14dbdf975815e2d56a39b58f8cc98e7bc960cf57dc08a566fd4ccb9b82452f12d7c93275b25d2a5b8772de71d93acb0a0ba4e6e52658dfdeaf6d280d7dd43b56431256cdab81d045770019bb2e39fdbfc35959586bd307bfd19ec268cf5cd08e385c79c5379f1c337beb74f7949d568a3048450973ad2bc255aa7276c0f9f593195d232167a7feec7840772e6cb0a9ca9bb1bd4a1cc2c7eddad2bd6725c76312c699733b579bfe3774a5ef6c56c4013e0fb2b9d1a027fb971a5ce73f126dcde531ebc13197df34d550c4aec463bc5d5b04fb99b11fe3599051f0fd113a44f1c9333735f65af2e408a0ded639810c86df4c929fe7bdaf3dbbc8004aa06858c38fd0e00675bca8ba995c4b277be3901d3459fe3685c36a069c4d3424c54a935093f8b9aed468ff10718945d8fca57b0d509b4db29e92d5ddb4220546bd08a37f6e69a83b86fb8ac5568c1413fffd7b2f83f3b7cda75d8ccf531f84e7a4633d6aa7d29e7003e444dee69da8b70a2e93d87db8fde86635eccaa058437a5520a320b47f1feb3fd8f84b6a6064a94b5148c41a6888e0c2fdbf4bd81845d12594a8e5a844c5c99b49b2301e8ed5e2ae690cf8790333efcfba1198861ec88f13ee7b6d0dea01650f488506bf8a75db8220504d7e9927e38b99fe104fb4302c9feefcb8e20f548243f17488c6ef8b5366a81c5ebe8556b180604b7bee36ed4e18b7213cb32a8e9c74907bc7734a0b4eab2f9c4975ec561f12743253ff49f04466f28f7670866059791faa43577c35fe04ace376383aa903cc68a0ffb40dfa2007c5082604942c64c7724e197c952b3127e7fd3cc75ee64ea7f686f747efcad7c4c3ec0d0750f1f75d5f39f39548c0b354ac5ebb5433f8c052d55793a8d578cebdce8e63d67130a45f0b1d609531a984742c89966f78941ef0d57784b10929724f3edb14089bd26d9abbf015b788730b4221ab7a7d35b7025b443b6c05cac24f99b89077dfa1cf7f075cc97248f31b1c86241aeddc2568bfbc4785a5034278dd3ca637ddab77cfb5bf4c3ac96f4c4201b0c84d788495ef4a86ae74ca59d7ea0c475746b8ea4ed962a951e14f7d2ad129669ffa5c41399c7822445eb01db1644a4dee08cb2323e14788a9a3a23be39e6addd62275f9016410d28ebe738803b23a31c2404347ea053d12cc09ffa732ee9bb1bf9b3d7ff92c7c25cd8f5ba50e2f3bbd00fcfd21bdbc4df4aeda419ecd605d34676cc73b7d8cb65c799ce6d707749cee050c44d4173db7f90bd030d1d59bb07e00c5546129acb6c492388bdcf8498e2fcc4eea99e4ed088adf6a3731f9060ab01446475b76376342688740515cdc9661e6a3959631b4a60f7d27289142b8ca240bc9a3a16201c8667f59a57ea7d417ad14834ba048ad460dba4b4e65dd2b7577257eae9e62d83d6d0e36a2d5ab8121c0b17e70b7d6f8a3c970b51f4c6516e26035e07a4528c4c8eb853ea5b8cc34ce271532ab4bd3ad3eff943058baa611069f860803277d9db651389c8bc2002263650e62e4668685eac884474f09fe2ab5168b418f43fb0051cb136394ffd633cd1c1550069e4b1216d3ebb4a9c39a6ea7a7d9a1373b8f55f25b75bbb0995f21ac03a3fbde60aac9801023ebaaaacbc120df08c7724eb23f32fa2af1b909707f66fd3f7279fd9371254899c89b5c77cb0f0a7276e2ff336b23bb8115d8d7e92ac2a4cd21b8bbc0607ab46b8a96c33fdc67fbcdb74d9be3f3074d6fdd4f2cfac1be76977f4575b1067008a396e9a4eb3b4a73d1426f85a2fe3d41d10b7205a4d3d0bf963b3e80a5775690644ac6bd3e8044566a96056c2785b6a23f34a1f2163197987e5d88a5b5fc5f1c031a2a1ed2ecdac3517500f517a810221d6a8a6051eecc2d84cb89286755f45696cf1b36a99da32f18082a1f23cd3404de47631c9db5862dbe6ccb7302fe4ab5a69a179a42467357d45d7658f6381e6201661423ee1cc49deb6b22481dbeb4f40b449b039f0136b59a9db15147a33a723f445cdd3cc0bac70bcd60056f2551e45960f873af5867b7b4921bade540038feae7575b71ff1c9c4d0e7a22eefc1fab94ff1ec16ee3280cd357058e4c31313ae3dfd5f405ad5d47107e1d65fbedab2852af89061251b8ebd0192400e0ed5c293805de98b6c3b3b1728546b79c7fac982cfbc03cf1770c5b006717e001886c552e076b9844ee24d55e726186beccdcae9cb8ac0d9a44293d8d7493f2e15958a56bd2b249e99434e95bb66c2895abab040d7cc8965a396c4be90ae8ffcccca6e381607605389d4bed138fdfa19a240050e414cbf9cdca8e6cce75f326ec10c32c78e6bd527eab4dc9685aa64bb950a21c1da88249a1ccf0b66eaef5974bd899f7ce0c6faad31690b69e154cfd916d34fc26a8f3062e32548b5bcdcdbd9a329ab18768b69633508cf575acf22a750212c6f44fb5f269a24e7003d9082710e9df1cf851173edfab0ba96281d927e9a2e5d9a32172c49" +} diff --git a/signing/pqsig/signature.go b/signing/pqsig/signature.go new file mode 100644 index 00000000..cefa2464 --- /dev/null +++ b/signing/pqsig/signature.go @@ -0,0 +1,119 @@ +// Package pqsig signs and verifies provider documents using FIPS 204 ML-DSA-65. +package pqsig + +import ( + "bytes" + "crypto/mldsa" + _ "embed" + "encoding/hex" + "encoding/json" + "fmt" +) + +const ( + Algorithm = "ML-DSA-65" + Context = "stackql-provider-doc-bytes-v1" + SignatureField = "x-stackql-signature" +) + +// VerifierConfig is the registry's opt-in verification configuration. A nil +// PublicKeys uses the embedded trust roots; an explicit keyset replaces them. +type VerifierConfig struct { + NopVerify bool `json:"nopVerify" yaml:"nopVerify"` + PublicKeys map[string]string `json:"publicKeys,omitempty" yaml:"publicKeys,omitempty"` +} + +// Verifier authenticates a document and returns the exact signed payload bytes. +// Callers must parse these returned bytes, not the envelope-bearing document. +type Verifier interface { + Verify(doc []byte) ([]byte, error) +} + +type verifier struct { + keys map[string]*mldsa.PublicKey +} + +//go:embed keys.json +var embeddedKeys []byte + +// NewVerifier copies and validates a kid -> hex public key trust store. +// nil selects the embedded production keys. An empty trust store is an error. +func NewVerifier(keys map[string]string) (Verifier, error) { + if keys == nil { + if err := json.Unmarshal(embeddedKeys, &keys); err != nil { + return nil, fmt.Errorf("pqsig: decode embedded keys: %w", err) + } + } + if len(keys) == 0 { + return nil, fmt.Errorf("pqsig: no trusted public keys") + } + v := &verifier{keys: make(map[string]*mldsa.PublicKey, len(keys))} + for kid, encoded := range keys { + if !keyIDPattern.MatchString(kid) { + return nil, fmt.Errorf("pqsig: invalid key ID %q", kid) + } + raw, err := hex.DecodeString(encoded) + if err != nil { + return nil, fmt.Errorf("pqsig: key %q is not hex: %w", kid, err) + } + key, err := mldsa.NewPublicKey(mldsa.MLDSA65(), raw) + if err != nil { + return nil, fmt.Errorf("pqsig: key %q: %w", kid, err) + } + v.keys[kid] = key + } + return v, nil +} + +// Sign appends a strictly framed signature field without re-encoding the payload. +// An existing raw-v1 frame is replaced. The separating newline is not payload. +func Sign(doc []byte, kid string, key *mldsa.PrivateKey) ([]byte, error) { + if key == nil || key.PublicKey().Parameters() != mldsa.MLDSA65() { + return nil, fmt.Errorf("pqsig: an ML-DSA-65 private key is required") + } + if !keyIDPattern.MatchString(kid) { + return nil, fmt.Errorf("pqsig: invalid key ID %q", kid) + } + if bytes.Contains(doc, []byte(signatureMarker)) { + var err error + doc, _, _, err = splitSignature(doc) + if err != nil { + return nil, err + } + } + if err := Validate(doc); err != nil { + return nil, err + } + signature, err := key.Sign(nil, doc, &mldsa.Options{Context: Context}) + if err != nil { + return nil, fmt.Errorf("pqsig: sign: %w", err) + } + envelope := fmt.Sprintf("%s format: raw-v1\n alg: %s\n kid: %s\n sig: %s\n end: stackql-provider-signature\n", + signatureMarker, Algorithm, kid, hex.EncodeToString(signature)) + out := make([]byte, 0, len(doc)+len(envelope)) + out = append(out, doc...) + out = append(out, envelope...) + return out, nil +} + +func (v *verifier) Verify(doc []byte) ([]byte, error) { + message, kid, encoded, err := splitSignature(doc) + if err != nil { + return nil, err + } + key, ok := v.keys[kid] + if !ok { + return nil, fmt.Errorf("pqsig: unknown key ID %q", kid) + } + signature, err := hex.DecodeString(encoded) + if err != nil || len(signature) != mldsa.MLDSA65SignatureSize { + return nil, fmt.Errorf("pqsig: invalid signature encoding or length") + } + if err := mldsa.Verify(key, message, signature, &mldsa.Options{Context: Context}); err != nil { + return nil, fmt.Errorf("pqsig: signature verification failed: %w", err) + } + if err := Validate(message); err != nil { + return nil, err + } + return message, nil +} diff --git a/signing/pqsig/signature_test.go b/signing/pqsig/signature_test.go new file mode 100644 index 00000000..ad383917 --- /dev/null +++ b/signing/pqsig/signature_test.go @@ -0,0 +1,191 @@ +package pqsig_test + +import ( + "bytes" + "crypto/mldsa" + "encoding/hex" + "io/fs" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/stackql/stackql-provider-registry/signing/pqsig" + "gopkg.in/yaml.v3" +) + +func fixture(t *testing.T) (*mldsa.PrivateKey, pqsig.Verifier) { + t.Helper() + key, err := mldsa.GenerateKey(mldsa.MLDSA65()) + if err != nil { + t.Fatal(err) + } + v, err := pqsig.NewVerifier(map[string]string{"test": hex.EncodeToString(key.PublicKey().Bytes())}) + if err != nil { + t.Fatal(err) + } + return key, v +} + +func TestSignVerifyPreservesExactPayload(t *testing.T) { + key, v := fixture(t) + for _, source := range []string{ + "name: example\n", + "name: example", + "name: example\r\n", + "---\nname: example\n", + "name: example\nlarge: 18446744073709551615\ndate: 2026-10-23\n", + "original: &value {name: example}\ncopy: *value\nmerged: {<<: *value}\n", + } { + signed, err := pqsig.Sign([]byte(source), "test", key) + if err != nil { + t.Fatal(err) + } + got, err := v.Verify(signed) + if err != nil || string(got) != source { + t.Fatalf("payload changed: got %q, %v; want %q", got, err, source) + } + var object map[string]any + if err := yaml.Unmarshal(signed, &object); err != nil { + t.Fatalf("signed output is not valid YAML: %v", err) + } + envelope := object[pqsig.SignatureField].(map[string]any) + if len(envelope["sig"].(string)) != 2*mldsa.MLDSA65SignatureSize { + t.Fatal("signature is not hex-encoded ML-DSA-65") + } + resigned, err := pqsig.Sign(signed, "test", key) + if err != nil { + t.Fatal(err) + } + got, err = v.Verify(resigned) + if err != nil || string(got) != source { + t.Fatalf("re-signing changed payload: %v", err) + } + } +} + +func TestVerificationFailsClosed(t *testing.T) { + key, v := fixture(t) + source := []byte("name: original\n") + signed, err := pqsig.Sign(source, "test", key) + if err != nil { + t.Fatal(err) + } + tests := map[string][]byte{ + "tampered": bytes.Replace(signed, []byte("original"), []byte("modified"), 1), + "unknown key": bytes.Replace(signed, []byte("kid: test"), []byte("kid: unknown"), 1), + "algorithm": bytes.Replace(signed, []byte("ML-DSA-65"), []byte("ML-DSA-44"), 1), + "format": bytes.Replace(signed, []byte("raw-v1"), []byte("raw-v2"), 1), + "missing": source, + "null": []byte("name: original\nx-stackql-signature: null\n"), + "line endings": bytes.ReplaceAll(signed, []byte("\n"), []byte("\r\n")), + "duplicate signature": append(append([]byte{}, signed...), signed[len(source):]...), + "trailing content": append(append([]byte{}, signed...), []byte("name: other\n")...), + "extra document": append(append([]byte{}, signed...), []byte("---\nname: other\n")...), + "truncated": signed[:len(signed)-1], + "payload whitespace": append([]byte(" "), signed...), + "invalid hex": bytes.Replace(signed, []byte(" sig: "), []byte(" sig: zz"), 1), + } + for name, doc := range tests { + t.Run(name, func(t *testing.T) { + if result, err := v.Verify(doc); err == nil || result != nil { + t.Fatalf("accepted unauthenticated document: %v", err) + } + }) + } + _, wrongKey := fixture(t) + if _, err := wrongKey.Verify(signed); err == nil { + t.Fatal("accepted wrong public key") + } + sig, err := key.Sign(nil, source, &mldsa.Options{Context: "stackql-provider-doc-v1"}) + if err != nil { + t.Fatal(err) + } + var object map[string]any + if err := yaml.Unmarshal(signed, &object); err != nil { + t.Fatal(err) + } + original := object[pqsig.SignatureField].(map[string]any)["sig"].(string) + if _, err := v.Verify(bytes.Replace(signed, []byte(original), []byte(hex.EncodeToString(sig)), 1)); err == nil { + t.Fatal("accepted signature from another context") + } +} + +func TestRejectUnframeableDocuments(t *testing.T) { + key, _ := fixture(t) + for _, input := range []string{ + "", "[]", "null", `{"name":"example"}`, "a: 1\n---\nb: 2", + "a: 1\n...\n", "a: 1\n... # end\n", "x-stackql-signature: existing\n", + "name: example\nx-stackql-signature:\n invalid: frame\n", + } { + t.Run(strings.ReplaceAll(input, "\n", " "), func(t *testing.T) { + if _, err := pqsig.Sign([]byte(input), "test", key); err == nil { + t.Fatalf("accepted %q", input) + } + }) + } +} + +func TestTrustStore(t *testing.T) { + if _, err := pqsig.NewVerifier(nil); err != nil { + t.Fatalf("embedded production trust store: %v", err) + } + for _, keys := range []map[string]string{{}, {"": "00"}, {"test": "zz"}, {"test": "00"}} { + if _, err := pqsig.NewVerifier(keys); err == nil { + t.Fatal("accepted invalid trust store") + } + } + key, _ := fixture(t) + keys := map[string]string{"test": hex.EncodeToString(key.PublicKey().Bytes())} + v, err := pqsig.NewVerifier(keys) + if err != nil { + t.Fatal(err) + } + keys["test"] = "00" + doc, err := pqsig.Sign([]byte("name: example"), "test", key) + if err != nil { + t.Fatal(err) + } + if _, err := v.Verify(doc); err != nil { + t.Fatal("caller mutation changed verifier keys") + } +} + +func TestProviderCorpus(t *testing.T) { + root := os.Getenv("PQSIG_PROVIDER_ROOT") + if root == "" { + t.Skip("set PQSIG_PROVIDER_ROOT to audit provider sources before a rollout") + } + key, v := fixture(t) + count := 0 + err := filepath.WalkDir(root, func(file string, entry fs.DirEntry, walkErr error) error { + if walkErr != nil { + return walkErr + } + if entry.IsDir() || filepath.Ext(file) != ".yaml" { + return nil + } + data, err := os.ReadFile(file) + if err != nil { + return err + } + count++ + signed, err := pqsig.Sign(data, "test", key) + if err != nil { + t.Errorf("%s: %v", file, err) + return nil + } + got, err := v.Verify(signed) + if err != nil || !bytes.Equal(got, data) { + t.Errorf("%s: payload round-trip failed: %v", file, err) + } + return nil + }) + if err != nil { + t.Fatal(err) + } + if count == 0 { + t.Fatal("no provider documents found") + } + t.Logf("signed and verified %d provider documents byte-for-byte", count) +} diff --git a/test/providers/src/okta/v00.00.00000/provider.yaml.sig b/test/providers/src/okta/v00.00.00000/provider.yaml.sig deleted file mode 100644 index 420e9242..00000000 --- a/test/providers/src/okta/v00.00.00000/provider.yaml.sig +++ /dev/null @@ -1 +0,0 @@ -AQAAAA7bpg1IOYdDsAKUp1f2Y0MM+zGjBgdSsTMnPsArQIkYEaIcnS0fvZS2AIASwnel0vGxDq4bl8N6JPy5kwUnxj2RXthlpQboGgjSDg== \ No newline at end of file