centersl/docker-docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-04-05 02:38:52 +07:00
Code Issues Packages Projects Releases Wiki Activity

Adding support for passphrases from env

Browse Source 
Signed-off-by: Diogo Monica <diogo@docker.com>
This commit is contained in:
Diogo Monica
2015-07-27 12:07:03 -07:00
parent b73a7a4cfa
commit 4546ded7e0
2 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
cmd/notary-signer/main.go
View File

@@ -2,17 +2,16 @@ package main
import (
"crypto/rand"
"crypto/sha256"
"crypto/tls"
"database/sql"
"errors"
_ "expvar"
"flag"
"io/ioutil"
"log"
"net"
"net/http"
"os"
"strings"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
@@ -30,10 +29,12 @@ import (
)
const (
_Addr = ":4444"
_RpcAddr = ":7899"
_DebugAddr = "localhost:8080"
_DBType = "mysql"
_Addr = ":4444"
_RpcAddr = ":7899"
_DebugAddr = "localhost:8080"
_DBType = "mysql"
_EnvPrefix = "NOTARY_SIGNER"
_DefaultAliasEnv = _EnvPrefix + "_DEFAULT_ALIAS"
)
var debug bool
@@ -49,13 +50,12 @@ func init() {
}
func passphraseRetriever(keyName, alias string, createNew bool, attempts int) (passphrase string, giveup bool, err error) {
privKeyContent, err := ioutil.ReadFile(keyFile)
if err != nil {
return "", false, errors.New("error while reading the TLS private key")
}
envVar := _EnvPrefix + "_" + strings.ToUpper(alias)
passphrase = os.Getenv(envVar)
privKeyHash := sha256.Sum256(privKeyContent)
passphrase = string(privKeyHash[:])
if passphrase == "" {
return "", false, errors.New("expected env variable to not be empty: " + envVar)
}
return passphrase, false, nil
}
@@ -107,7 +107,7 @@ func main() {
log.Fatalf("failed to open the database: %s, %v", dbURL, err)
}
keyStore, err := trustmanager.NewKeyDBStore(passphraseRetriever, "", _DBType, dbSQL)
keyStore, err := trustmanager.NewKeyDBStore(passphraseRetriever, _DefaultAliasEnv, _DBType, dbSQL)
if err != nil {
log.Fatalf("failed to create a new keydbstore: %v", err)
}

16
trustmanager/keydbstore_test.go
View File

@@ -13,15 +13,15 @@ import (
)
var retriever = func(string, string, bool, int) (string, bool, error) {
return "passphrase-1", false, nil
return "passphrase_1", false, nil
}
var anotherRetriever = func(keyName, alias string, createNew bool, attempts int) (string, bool, error) {
switch alias {
case "alias-1":
return "passphrase-1", false, nil
case "alias-2":
return "passphrase-2", false, nil
case "alias_1":
return "passphrase_1", false, nil
case "alias_2":
return "passphrase_2", false, nil
}
return "", false, errors.New("password alias no found")
}
@@ -142,7 +142,7 @@ func TestKeyRotation(t *testing.T) {
assert.NoError(t, err)
// Create a new KeyDB store
dbStore, err := NewKeyDBStore(anotherRetriever, "alias-1", "sqlite3", db)
dbStore, err := NewKeyDBStore(anotherRetriever, "alias_1", "sqlite3", db)
assert.NoError(t, err)
// Ensure that the private_key table exists
@@ -153,10 +153,10 @@ func TestKeyRotation(t *testing.T) {
assert.NoError(t, err)
// Try rotating the key to alias-2
err = dbStore.RotateKeyPassphrase(testKey.ID(), "alias-2")
err = dbStore.RotateKeyPassphrase(testKey.ID(), "alias_2")
assert.NoError(t, err)
// Try rotating the key to alias-3
err = dbStore.RotateKeyPassphrase(testKey.ID(), "alias-3")
err = dbStore.RotateKeyPassphrase(testKey.ID(), "alias_3")
assert.Error(t, err, "password alias no found")
}