mirror of
https://github.com/tailscale/tailscale.git
synced 2024-11-26 11:35:35 +00:00
f61dd12f05
To make key management less error-prone, use different PEM block types for root and signing keys. As a result, separate out most of the Go code between root/signing keys too. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
55 lines
1.0 KiB
Go
55 lines
1.0 KiB
Go
// Copyright (c) Tailscale Inc & AUTHORS
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
package distsign
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"embed"
|
|
"errors"
|
|
"fmt"
|
|
"path"
|
|
"path/filepath"
|
|
"sync"
|
|
)
|
|
|
|
//go:embed roots
|
|
var rootsFS embed.FS
|
|
|
|
var roots = sync.OnceValue(func() []ed25519.PublicKey {
|
|
roots, err := parseRoots()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return roots
|
|
})
|
|
|
|
func parseRoots() ([]ed25519.PublicKey, error) {
|
|
files, err := rootsFS.ReadDir("roots")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var keys []ed25519.PublicKey
|
|
for _, f := range files {
|
|
if !f.Type().IsRegular() {
|
|
continue
|
|
}
|
|
if filepath.Ext(f.Name()) != ".pub" {
|
|
continue
|
|
}
|
|
raw, err := rootsFS.ReadFile(path.Join("roots", f.Name()))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
key, err := parseSinglePublicKey(raw, pemTypeRootPublic)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parsing root key %q: %w", f.Name(), err)
|
|
}
|
|
keys = append(keys, key)
|
|
}
|
|
if len(keys) == 0 {
|
|
return nil, errors.New("no embedded root keys, please check clientupdate/distsign/roots/")
|
|
}
|
|
return keys, nil
|
|
}
|