chore: vendor

vendor/github.com/theupdateframework/notary/tuf/data/snapshot.go

@@ -0,0 +1,169 @@
+package data
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/docker/go/canonical/json"
+	"github.com/sirupsen/logrus"
+	"github.com/theupdateframework/notary"
+)
+
+// SignedSnapshot is a fully unpacked snapshot.json
+type SignedSnapshot struct {
+	Signatures []Signature
+	Signed     Snapshot
+	Dirty      bool
+}
+
+// Snapshot is the Signed component of a snapshot.json
+type Snapshot struct {
+	SignedCommon
+	Meta Files `json:"meta"`
+}
+
+// IsValidSnapshotStructure returns an error, or nil, depending on whether the content of the
+// struct is valid for snapshot metadata.  This does not check signatures or expiry, just that
+// the metadata content is valid.
+func IsValidSnapshotStructure(s Snapshot) error {
+	expectedType := TUFTypes[CanonicalSnapshotRole]
+	if s.Type != expectedType {
+		return ErrInvalidMetadata{
+			role: CanonicalSnapshotRole, msg: fmt.Sprintf("expected type %s, not %s", expectedType, s.Type)}
+	}
+
+	if s.Version < 1 {
+		return ErrInvalidMetadata{
+			role: CanonicalSnapshotRole, msg: "version cannot be less than one"}
+	}
+
+	for _, file := range []RoleName{CanonicalRootRole, CanonicalTargetsRole} {
+		// Meta is a map of FileMeta, so if the role isn't in the map it returns
+		// an empty FileMeta, which has an empty map, and you can check on keys
+		// from an empty map.
+		//
+		// For now sha256 is required and sha512 is not.
+		if _, ok := s.Meta[file.String()].Hashes[notary.SHA256]; !ok {
+			return ErrInvalidMetadata{
+				role: CanonicalSnapshotRole,
+				msg:  fmt.Sprintf("missing %s sha256 checksum information", file.String()),
+			}
+		}
+		if err := CheckValidHashStructures(s.Meta[file.String()].Hashes); err != nil {
+			return ErrInvalidMetadata{
+				role: CanonicalSnapshotRole,
+				msg:  fmt.Sprintf("invalid %s checksum information, %v", file.String(), err),
+			}
+		}
+	}
+	return nil
+}
+
+// NewSnapshot initializes a SignedSnapshot with a given top level root
+// and targets objects
+func NewSnapshot(root *Signed, targets *Signed) (*SignedSnapshot, error) {
+	logrus.Debug("generating new snapshot...")
+	targetsJSON, err := json.Marshal(targets)
+	if err != nil {
+		logrus.Debug("Error Marshalling Targets")
+		return nil, err
+	}
+	rootJSON, err := json.Marshal(root)
+	if err != nil {
+		logrus.Debug("Error Marshalling Root")
+		return nil, err
+	}
+	rootMeta, err := NewFileMeta(bytes.NewReader(rootJSON), NotaryDefaultHashes...)
+	if err != nil {
+		return nil, err
+	}
+	targetsMeta, err := NewFileMeta(bytes.NewReader(targetsJSON), NotaryDefaultHashes...)
+	if err != nil {
+		return nil, err
+	}
+	return &SignedSnapshot{
+		Signatures: make([]Signature, 0),
+		Signed: Snapshot{
+			SignedCommon: SignedCommon{
+				Type:    TUFTypes[CanonicalSnapshotRole],
+				Version: 0,
+				Expires: DefaultExpires(CanonicalSnapshotRole),
+			},
+			Meta: Files{
+				CanonicalRootRole.String():    rootMeta,
+				CanonicalTargetsRole.String(): targetsMeta,
+			},
+		},
+	}, nil
+}
+
+// ToSigned partially serializes a SignedSnapshot for further signing
+func (sp *SignedSnapshot) ToSigned() (*Signed, error) {
+	s, err := defaultSerializer.MarshalCanonical(sp.Signed)
+	if err != nil {
+		return nil, err
+	}
+	signed := json.RawMessage{}
+	err = signed.UnmarshalJSON(s)
+	if err != nil {
+		return nil, err
+	}
+	sigs := make([]Signature, len(sp.Signatures))
+	copy(sigs, sp.Signatures)
+	return &Signed{
+		Signatures: sigs,
+		Signed:     &signed,
+	}, nil
+}
+
+// AddMeta updates a role in the snapshot with new meta
+func (sp *SignedSnapshot) AddMeta(role RoleName, meta FileMeta) {
+	sp.Signed.Meta[role.String()] = meta
+	sp.Dirty = true
+}
+
+// GetMeta gets the metadata for a particular role, returning an error if it's
+// not found
+func (sp *SignedSnapshot) GetMeta(role RoleName) (*FileMeta, error) {
+	if meta, ok := sp.Signed.Meta[role.String()]; ok {
+		if _, ok := meta.Hashes["sha256"]; ok {
+			return &meta, nil
+		}
+	}
+	return nil, ErrMissingMeta{Role: role.String()}
+}
+
+// DeleteMeta removes a role from the snapshot. If the role doesn't
+// exist in the snapshot, it's a noop.
+func (sp *SignedSnapshot) DeleteMeta(role RoleName) {
+	if _, ok := sp.Signed.Meta[role.String()]; ok {
+		delete(sp.Signed.Meta, role.String())
+		sp.Dirty = true
+	}
+}
+
+// MarshalJSON returns the serialized form of SignedSnapshot as bytes
+func (sp *SignedSnapshot) MarshalJSON() ([]byte, error) {
+	signed, err := sp.ToSigned()
+	if err != nil {
+		return nil, err
+	}
+	return defaultSerializer.Marshal(signed)
+}
+
+// SnapshotFromSigned fully unpacks a Signed object into a SignedSnapshot
+func SnapshotFromSigned(s *Signed) (*SignedSnapshot, error) {
+	sp := Snapshot{}
+	if err := defaultSerializer.Unmarshal(*s.Signed, &sp); err != nil {
+		return nil, err
+	}
+	if err := IsValidSnapshotStructure(sp); err != nil {
+		return nil, err
+	}
+	sigs := make([]Signature, len(s.Signatures))
+	copy(sigs, s.Signatures)
+	return &SignedSnapshot{
+		Signatures: sigs,
+		Signed:     sp,
+	}, nil
+}