summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2021-06-29 14:51:10 -0400
committerGitHub <noreply@github.com>2021-06-29 14:51:10 -0400
commit793063e086d2a7fe15833be5456af95bc9b6ba24 (patch)
tree50ef38b2db7954a634e11f90b8eeb01b361d20ce
parent599b7d746a6ccad6ebbd70abb72be30bead094a6 (diff)
parentfb5f70296b1fddd48024b5f1bef70d182b6c2008 (diff)
downloadpodman-793063e086d2a7fe15833be5456af95bc9b6ba24.tar.gz
podman-793063e086d2a7fe15833be5456af95bc9b6ba24.tar.bz2
podman-793063e086d2a7fe15833be5456af95bc9b6ba24.zip
Merge pull request #10811 from containers/dependabot/go_modules/github.com/containers/ocicrypt-1.1.2
Bump github.com/containers/ocicrypt from 1.1.1 to 1.1.2
-rw-r--r--go.mod2
-rw-r--r--go.sum3
-rw-r--r--vendor/github.com/containers/ocicrypt/ADOPTERS.md10
-rw-r--r--vendor/github.com/containers/ocicrypt/README.md6
-rw-r--r--vendor/github.com/containers/ocicrypt/helpers/parse_helpers.go21
-rw-r--r--vendor/modules.txt2
6 files changed, 32 insertions, 12 deletions
diff --git a/go.mod b/go.mod
index f2be04a9d..ac10f1157 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,7 @@ require (
github.com/containers/common v0.40.2-0.20210624120009-b1d3c4dc2515
github.com/containers/conmon v2.0.20+incompatible
github.com/containers/image/v5 v5.13.2
- github.com/containers/ocicrypt v1.1.1
+ github.com/containers/ocicrypt v1.1.2
github.com/containers/psgo v1.5.2
github.com/containers/storage v1.32.3
github.com/coreos/go-systemd/v22 v22.3.2
diff --git a/go.sum b/go.sum
index 6e4c84ba6..0b72570ca 100644
--- a/go.sum
+++ b/go.sum
@@ -232,8 +232,9 @@ github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b h1:Q8ePgVfHDpl
github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b/go.mod h1:9rfv8iPl1ZP7aqh9YA68wnZv2NUDbXdcdPHVz0pFbPY=
github.com/containers/ocicrypt v1.0.1/go.mod h1:MeJDzk1RJHv89LjsH0Sp5KTY3ZYkjXO/C+bKAeWFIrc=
github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgUV4GP9qXPfu4=
-github.com/containers/ocicrypt v1.1.1 h1:prL8l9w3ntVqXvNH1CiNn5ENjcCnr38JqpSyvKKB4GI=
github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
+github.com/containers/ocicrypt v1.1.2 h1:Ez+GAMP/4GLix5Ywo/fL7O0nY771gsBIigiqUm1aXz0=
+github.com/containers/ocicrypt v1.1.2/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
github.com/containers/psgo v1.5.2 h1:3aoozst/GIwsrr/5jnFy3FrJay98uujPCu9lTuSZ/Cw=
github.com/containers/psgo v1.5.2/go.mod h1:2ubh0SsreMZjSXW1Hif58JrEcFudQyIy9EzPUWfawVU=
github.com/containers/storage v1.23.5/go.mod h1:ha26Q6ngehFNhf3AWoXldvAvwI4jFe3ETQAf/CeZPyM=
diff --git a/vendor/github.com/containers/ocicrypt/ADOPTERS.md b/vendor/github.com/containers/ocicrypt/ADOPTERS.md
new file mode 100644
index 000000000..fa4b03bb8
--- /dev/null
+++ b/vendor/github.com/containers/ocicrypt/ADOPTERS.md
@@ -0,0 +1,10 @@
+Below are list of adopters of the `ocicrypt` library or supports use of OCI encrypted images:
+- [skopeo](https://github.com/containers/skopeo)
+- [buildah](https://github.com/containers/buildah)
+- [containerd](https://github.com/containerd/imgcrypt)
+- [nerdctl](https://github.com/containerd/nerdctl)
+- [distribution](https://github.com/distribution/distribution)
+
+Below are the list of projects that are in the process of adopting support:
+- [quay](https://github.com/quay/quay)
+- [kata-containers](https://github.com/kata-containers/kata-containers)
diff --git a/vendor/github.com/containers/ocicrypt/README.md b/vendor/github.com/containers/ocicrypt/README.md
index 84cab7a40..b69d14e3b 100644
--- a/vendor/github.com/containers/ocicrypt/README.md
+++ b/vendor/github.com/containers/ocicrypt/README.md
@@ -34,6 +34,12 @@ The implementation for both symmetric and asymmetric encryption used in this lib
We note that adding interfaces here is risky outside the OCI spec is not recommended, unless for very specialized and confined usecases. Please open an issue or PR if there is a general usecase that could be added to the OCI spec.
+
+#### Keyprovider interface
+
+As part of the keywrap interface, there is a [keyprovider](https://github.com/containers/ocicrypt/blob/main/docs/keyprovider.md) implementation that allows one to call out to a binary or service.
+
+
## Security Issues
We consider security issues related to this library critical. Please report and security related issues by emailing maintainers in the [MAINTAINERS](MAINTAINERS) file.
diff --git a/vendor/github.com/containers/ocicrypt/helpers/parse_helpers.go b/vendor/github.com/containers/ocicrypt/helpers/parse_helpers.go
index 198c554aa..717e7f218 100644
--- a/vendor/github.com/containers/ocicrypt/helpers/parse_helpers.go
+++ b/vendor/github.com/containers/ocicrypt/helpers/parse_helpers.go
@@ -89,7 +89,11 @@ func processRecipientKeys(recipients []string) ([][]byte, [][]byte, [][]byte, []
func processx509Certs(keys []string) ([][]byte, error) {
var x509s [][]byte
for _, key := range keys {
- tmp, err := ioutil.ReadFile(strings.Split(key, ":")[0])
+ fileName := strings.Split(key, ":")[0]
+ if _, err := os.Stat(fileName); os.IsNotExist(err) {
+ continue
+ }
+ tmp, err := ioutil.ReadFile(fileName)
if err != nil {
return nil, errors.Wrap(err, "Unable to read file")
}
@@ -157,7 +161,7 @@ func processPrivateKeyFiles(keyFilesAndPwds []string) ([][]byte, [][]byte, [][]b
var password []byte
// treat "provider" protocol separately
- if strings.HasPrefix(keyfileAndPwd, "provider:"){
+ if strings.HasPrefix(keyfileAndPwd, "provider:") {
keyProviders = append(keyProviders, []byte(keyfileAndPwd[len("provider:"):]))
continue
}
@@ -207,14 +211,13 @@ func CreateDecryptCryptoConfig(keys []string, decRecipients []string) (encconfig
return encconfig.CryptoConfig{}, err
}
- if len(x509s) > 0 {
- // x509 certs can also be passed in via keys
- x509FromKeys, err := processx509Certs(keys)
- if err != nil {
- return encconfig.CryptoConfig{}, err
- }
- x509s = append(x509s, x509FromKeys...)
+ // x509 certs can also be passed in via keys
+ x509FromKeys, err := processx509Certs(keys)
+ if err != nil {
+ return encconfig.CryptoConfig{}, err
}
+ x509s = append(x509s, x509FromKeys...)
+
gpgSecretKeyRingFiles, gpgSecretKeyPasswords, privKeys, privKeysPasswords, pkcs11Yamls, keyProviders, err := processPrivateKeyFiles(keys)
if err != nil {
return encconfig.CryptoConfig{}, err
diff --git a/vendor/modules.txt b/vendor/modules.txt
index b749ff8e3..e927b5777 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -171,7 +171,7 @@ github.com/containers/image/v5/types
github.com/containers/image/v5/version
# github.com/containers/libtrust v0.0.0-20190913040956-14b96171aa3b
github.com/containers/libtrust
-# github.com/containers/ocicrypt v1.1.1
+# github.com/containers/ocicrypt v1.1.2
github.com/containers/ocicrypt
github.com/containers/ocicrypt/blockcipher
github.com/containers/ocicrypt/config