- func FlattenDependencies(packages map[string]*PackageInfo, names ...string) (map[string]*PackageInfo, error)
- func ReadApkIndex(reader io.Reader, keyProvider KeyProvider) (map[string]*PackageInfo, error)
- func ReadTarball(reader io.Reader, keyProvider KeyProvider) (*tar.Reader, error)
- func Verify(reader io.Reader, keyProvider KeyProvider) error
- type KeyProvider
- type PackageInfo
This section is empty.
This section is empty.
FlattenDependencies walks and flattens the package dependency tree, returning the named packages and all their transitive dependencies.
Ignores version constraints and conflicts.
ReadApkIndex verifies the embedded signature in the file, then extracts and parses the APKINDEX contents.
ReadTarball takes an Alpine APK, verifies the embedded signature using the public keys provided by the keyProvider, verifies the hash of the tarball, and returns a reader over the contents of the APK tarball.
Verify checks the embedded signature within an alpine APK or APKINDEX file.
These files are concatenations of two or more gzip streams, the first of which contains a signature of the (compressed) second stream.
A valid signature is indicated by returning a nil error.
A KeyProvider supplies public keys for use in package verification
func NewFileSystemKeyProvider(fs fs.FS) KeyProvider
NewFileSystemKeyProvider creates a new KeyProvider that will load PEM encoded public keys from the root of the given filesystem.
No validation is performed on key names; the filesystem should be appropriately rooted to ensure only key material is accessible.
PackageInfo describes a package available in a repository.