Temporarily remove imgcrypt in CRI to fix circular dependency

Signed-off-by: Derek McGowan <derek@mcg.dev>

go.mod

@@ -17,7 +17,6 @@ require (
 	github.com/containerd/fifo v1.1.0
 	github.com/containerd/go-cni v1.1.9
 	github.com/containerd/go-runc v1.1.0
-	github.com/containerd/imgcrypt v1.1.7
 	github.com/containerd/log v0.1.0
 	github.com/containerd/nri v0.5.0
 	github.com/containerd/ttrpc v1.2.2
@@ -83,8 +82,6 @@ require (
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cilium/ebpf v0.9.1 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/containers/ocicrypt v1.1.6 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/emicklei/go-restful/v3 v3.10.2 // indirect
 	github.com/go-logr/logr v1.2.4 // indirect
@@ -100,7 +97,6 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
@@ -110,15 +106,12 @@ require (
 	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.10.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 // indirect
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0 // indirect
 	go.opentelemetry.io/otel/metric v0.37.0 // indirect
 	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
-	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/mod v0.12.0 // indirect
 	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/oauth2 v0.10.0 // indirect
@@ -130,7 +123,6 @@ require (
 	google.golang.org/genproto v0.0.0-20230720185612-659f7aaaa771 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.28.2 // indirect

pkg/cri/server/images/image_pull.go

@@ -33,8 +33,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/containerd/imgcrypt"
-	"github.com/containerd/imgcrypt/images/encryption"
 	imagedigest "github.com/opencontainers/go-digest"
 	imagespec "github.com/opencontainers/image-spec/specs-go/v1"
 	runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
@@ -171,7 +169,8 @@ func (c *CRIImageService) PullImage(ctx context.Context, r *runtime.PullImageReq
 		}),
 	}
 
-	pullOpts = append(pullOpts, c.encryptedImagesPullOpts()...)
+	// Temporarily removed for v2 upgrade
+	//pullOpts = append(pullOpts, c.encryptedImagesPullOpts()...)
 	if !c.config.ContainerdConfig.DisableSnapshotAnnotations {
 		pullOpts = append(pullOpts,
 			containerd.WithImageHandlerWrapper(snpkg.AppendInfoHandlerWrapper(ref)))
@@ -545,15 +544,16 @@ func newTransport() *http.Transport {
 
 // encryptedImagesPullOpts returns the necessary list of pull options required
 // for decryption of encrypted images based on the cri decryption configuration.
-func (c *CRIImageService) encryptedImagesPullOpts() []containerd.RemoteOpt {
+// Temporarily removed for v2 upgrade
-	if c.config.ImageDecryption.KeyModel == criconfig.KeyModelNode {
+//func (c *CRIImageService) encryptedImagesPullOpts() []containerd.RemoteOpt {
-		ltdd := imgcrypt.Payload{}
+//	if c.config.ImageDecryption.KeyModel == criconfig.KeyModelNode {
-		decUnpackOpt := encryption.WithUnpackConfigApplyOpts(encryption.WithDecryptedUnpack(&ltdd))
+//		ltdd := imgcrypt.Payload{}
-		opt := containerd.WithUnpackOpts([]containerd.UnpackOpt{decUnpackOpt})
+//		decUnpackOpt := encryption.WithUnpackConfigApplyOpts(encryption.WithDecryptedUnpack(&ltdd))
-		return []containerd.RemoteOpt{opt}
+//		opt := containerd.WithUnpackOpts([]containerd.UnpackOpt{decUnpackOpt})
-	}
+//		return []containerd.RemoteOpt{opt}
-	return nil
+//	}
-}
+//	return nil
+//}
 
 const (
 	// minPullProgressReportInternal is used to prevent the reporter from

pkg/cri/server/images/image_pull_test.go

@@ -348,32 +348,33 @@ func TestDefaultScheme(t *testing.T) {
 	}
 }
 
-func TestEncryptedImagePullOpts(t *testing.T) {
+// Temporarily remove for v2 upgrade
-	for _, test := range []struct {
+//func TestEncryptedImagePullOpts(t *testing.T) {
-		desc         string
+//	for _, test := range []struct {
-		keyModel     string
+//		desc         string
-		expectedOpts int
+//		keyModel     string
-	}{
+//		expectedOpts int
-		{
+//	}{
-			desc:         "node key model should return one unpack opt",
+//		{
-			keyModel:     criconfig.KeyModelNode,
+//			desc:         "node key model should return one unpack opt",
-			expectedOpts: 1,
+//			keyModel:     criconfig.KeyModelNode,
-		},
+//			expectedOpts: 1,
-		{
+//		},
-			desc:         "no key model selected should default to node key model",
+//		{
-			keyModel:     "",
+//			desc:         "no key model selected should default to node key model",
-			expectedOpts: 0,
+//			keyModel:     "",
-		},
+//			expectedOpts: 0,
-	} {
+//		},
-		test := test
+//	} {
-		t.Run(test.desc, func(t *testing.T) {
+//		test := test
-			c := newTestCRIService()
+//		t.Run(test.desc, func(t *testing.T) {
-			c.config.ImageDecryption.KeyModel = test.keyModel
+//			c := newTestCRIService()
-			got := len(c.encryptedImagesPullOpts())
+//			c.config.ImageDecryption.KeyModel = test.keyModel
-			assert.Equal(t, test.expectedOpts, got)
+//			got := len(c.encryptedImagesPullOpts())
-		})
+//			assert.Equal(t, test.expectedOpts, got)
-	}
+//		})
-}
+//	}
+//}
 
 func TestSnapshotterFromPodSandboxConfig(t *testing.T) {
 	defaultSnashotter := "native"

vendor/github.com/containerd/imgcrypt/.gitignore

@@ -1,2 +0,0 @@
-*~
-/bin/

vendor/github.com/containerd/imgcrypt/.golangci.yml

@@ -1,20 +0,0 @@
-linters:
-  enable:
-    - structcheck
-    - varcheck
-    - staticcheck
-    - unconvert
-    - gofmt
-    - goimports
-    - revive
-    - ineffassign
-    - vet
-    - unused
-    - misspell
-
-run:
-  skip-dirs:
-    - cmd/ctr/commands/run
-    - cmd/ctr/commands/images
-    - cmd\\ctr\\commands\\run
-    - cmd\\ctr\\commands\\images

vendor/github.com/containerd/imgcrypt/CHANGES

@@ -1,48 +0,0 @@
-CHANGES
-
-v1.1.7:
-  - Added support for zstd-compressed layers
-  - Update to ocicrypt v1.1.6 for zstd-related dependencies
-  - Update to containerd v1.6.8
-  - Sync'ed ctr-enc with upstream ctr changes to import command
-  - Add support for --all-platforms to encrypt command of ctr-enc
-
-v1.1.6:
-  - Update to ocicrypt v1.1.5 for yaml v3.0 dependency
-  - Update to containerd v1.6.6 for runc v1.1.2 dependency
-
-v1.1.5:
-  - Update to ocicrypt v1.1.4; sha256 is the default now for padding in OAEP
-    for pkcs11; Set OCICRYPT_OAEP_HASHALG=sha1 environment variable to force
-    sha1 usage, which is required for example for SoftHSM 2.6.1.
-
-v1.1.4:
-  - Fixed issue in CheckAuthorization() callpath for images with a ManifestList
-    - CVE-2022-24778
-    - Fix: https://github.com/containerd/imgcrypt/commit/6fdd9818a4d8142107b7ecd767d839c9707700d9
-    - Added test case covering this
-  - Updated to ocicrypt 1.1.3
-  - Updated to containerd 1.6.1
-
-v1.1.3:
-  - Release v1.1.3 addresses issue #62 due to re-tagging of v1.1.2
-  - docs: update referenced containerd project branch to main
-  - Update linter to match containerd repo
-  - Update CI golang version
-  - Updated to containerd 1.5.8
-
-v1.1.2:
-  - Decouple CreateCryptoConfig() from github.com/urfave/cli
-  - Updated to containerd 1.5.7
-  - Implemented ConvertFunc for image en- and decryption
-  - Replace pkg/errors with errors package
-  - Updated to ocicrypt 1.1.2
-  - Sync'ed ctr-enc with ctr of containerd-1.5.0
-
-v1.1.1:
-  - rebased on ocicrypt 1.1.1
-
-v1.1.0:
-  - rebased on ocicrypt 1.1.0
-  - added pkcs11 support; experimental
-  - added keyprovider support

vendor/github.com/containerd/imgcrypt/LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright The containerd Authors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       https://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/containerd/imgcrypt/MAINTAINERS

@@ -1,9 +0,0 @@
-# imgcrypt maintainers
-#
-# As a containerd sub-project, containerd maintainers are also included from https://github.com/containerd/project/blob/main/MAINTAINERS.
-# See https://github.com/containerd/project/blob/main/GOVERNANCE.md for description of maintainer role
-#
-# MAINTAINERS
-# GitHub ID, Name, Email address
-stefanberger, Stefan Berger, stefanb@linux.ibm.com
-lumjjb, Brandon Lum, lumjjb@gmail.com

vendor/github.com/containerd/imgcrypt/Makefile

@@ -1,67 +0,0 @@
-#   Copyright The containerd Authors.
-
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-
-#       http://www.apache.org/licenses/LICENSE-2.0
-
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-
-# Base path used to install.
-DESTDIR ?= /usr/local
-
-VERSION=$(shell git describe --match 'v[0-9]*' --dirty='.m' --always)
-
-CTR_LDFLAGS=-ldflags '-X github.com/containerd/containerd/version.Version=$(VERSION)'
-COMMANDS=ctd-decoder ctr-enc
-RELEASE_COMMANDS=ctd-decoder
-
-BINARIES=$(addprefix bin/,$(COMMANDS))
-RELEASE_BINARIES=$(addprefix bin/,$(RELEASE_COMMANDS))
-
-.PHONY: check build ctd-decoder
-
-all: build
-
-build: $(BINARIES)
-
-FORCE:
-
-bin/ctd-decoder: cmd/ctd-decoder FORCE
-	go build -o $@ -v ./cmd/ctd-decoder/
-
-bin/ctr-enc: cmd/ctr FORCE
-	go build -o $@ ${CTR_LDFLAGS} -v ./cmd/ctr/
-
-check:
-	@echo "$@"
-	@golangci-lint run
-	@script/check_format.sh
-
-install:
-	@echo "$@"
-	@mkdir -p $(DESTDIR)/bin
-	@install $(BINARIES) $(DESTDIR)/bin
-
-containerd-release:
-	@echo "$@"
-	@mkdir -p $(DESTDIR)/bin
-	@install $(RELEASE_BINARIES) $(DESTDIR)/bin
-
-uninstall:
-	@echo "$@"
-	@rm -f $(addprefix $(DESTDIR)/bin/,$(notdir $(BINARIES)))
-
-clean:
-	@echo "$@"
-	@rm -f $(BINARIES)
-
-test:
-	@echo "$@"
-	@go test ./...

vendor/github.com/containerd/imgcrypt/README.md

@@ -1,107 +0,0 @@
-# imgcrypt image encryption library and command line tool
-
-Project `imgcrypt` is a non-core subproject of containerd.
-
-The `imgcrypt` library provides API exensions for containerd to support encrypted container images and implements
-the `ctd-decoder` command line tool for use by containerd to decrypt encrypted container images. An extended version
-of containerd's `ctr` tool (`ctr-enc`) with support for encrypting and decrypting container images is also provided.
-
-`imgcrypt` relies on the [`ocicrypt`](https://github.com/containers/ocicrypt) library for crypto functions on image layers.
-
-# Usage
-
-`imgcrypt` requires containerd 1.3 or later. Containerd 1.4 or later is required when used with Kubernetes.
-For configuration instructions for kubernetes, please consult the [CRI decryption document](https://github.com/containerd/containerd/blob/main/docs/cri/decryption.md).
-
-Build and install `imgcrypt`:
-
-```
-# make
-# sudo make install
-```
-
-Start containerd with a configuration file that looks as follows. To avoid interference with a containerd from a Docker
-installation we use /tmp for directories. Also, we build containerd 1.3 from the source but do not install it.
-
-```
-# cat config.toml
-disable_plugins = ["cri"]
-root = "/tmp/var/lib/containerd"
-state = "/tmp/run/containerd"
-[grpc]
-  address = "/tmp/run/containerd/containerd.sock"
-  uid = 0
-  gid = 0
-[stream_processors]
-    [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
-        accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
-        returns = "application/vnd.oci.image.layer.v1.tar+gzip"
-        path = "/usr/local/bin/ctd-decoder"
-    [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.zstd"]
-        accepts = ["application/vnd.oci.image.layer.v1.tar+zstd+encrypted"]
-        returns = "application/vnd.oci.image.layer.v1.tar+zstd"
-        path = "/usr/local/bin/ctd-decoder"
-    [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
-        accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
-        returns = "application/vnd.oci.image.layer.v1.tar"
-        path = "/usr/local/bin/ctd-decoder"
-
-# sudo ~/src/github.com/containerd/containerd/bin/containerd -c config.toml
-```
-
-Create an RSA key pair using the openssl command line tool and encrypted an image:
-
-```
-# openssl genrsa -out mykey.pem
-Generating RSA private key, 2048 bit long modulus (2 primes)
-...............................................+++++
-............................+++++
-e is 65537 (0x010001)
-# openssl rsa -in mykey.pem -pubout -out mypubkey.pem
-writing RSA key
-# sudo chmod 0666 /tmp/run/containerd/containerd.sock
-# CTR="/usr/local/bin/ctr-enc -a /tmp/run/containerd/containerd.sock"
-# $CTR images pull --all-platforms docker.io/library/bash:latest
-[...]
-# $CTR images layerinfo --platform linux/amd64 docker.io/library/bash:latest
-   #                                                                    DIGEST      PLATFORM      SIZE   ENCRYPTION   RECIPIENTS
-   0   sha256:9d48c3bd43c520dc2784e868a780e976b207cbf493eaff8c6596eb871cbd9609   linux/amd64   2789669                          
-   1   sha256:7dd01fd971d4ec7058c5636a505327b24e5fc8bd7f62816a9d518472bd9b15c0   linux/amd64   3174665                          
-   2   sha256:691cfbca522787898c8b37f063dd20e5524e7d103e1a3b298bd2e2b8da54faf5   linux/amd64       340                          
-# $CTR images encrypt --recipient jwe:mypubkey.pem --platform linux/amd64 docker.io/library/bash:latest bash.enc:latest
-Encrypting docker.io/library/bash:latest to bash.enc:latest
-$ $CTR images layerinfo --platform linux/amd64 bash.enc:latest
-   #                                                                    DIGEST      PLATFORM      SIZE   ENCRYPTION   RECIPIENTS
-   0   sha256:360be141b01f69b25427a9085b36ba8ad7d7a335449013fa6b32c1ecb894ab5b   linux/amd64   2789669          jwe        [jwe]
-   1   sha256:ac601e66cdd275ee0e10afead03a2722e153a60982122d2d369880ea54fe82f8   linux/amd64   3174665          jwe        [jwe]
-   2   sha256:41e47064fd00424e328915ad2f7f716bd86ea2d0d8315edaf33ecaa6a2464530   linux/amd64       340          jwe        [jwe]
-```
-
-Start a local image registry so we can push the encrypted image to it. A recent versions of the registry is required
-to accept encrypted container images.
-```
-# docker pull registry:latest
-# docker run -d -p 5000:5000 --restart=always --name registry registry
-```
-
-Push the encrypted image to the local registry, pull it using `ctr-enc`, and then run the image.
-```
-# $CTR images tag bash.enc:latest localhost:5000/bash.enc:latest
-# $CTR images push localhost:5000/bash.enc:latest
-# $CTR images rm localhost:5000/bash.enc:latest bash.enc:latest
-# $CTR images pull localhost:5000/bash.enc:latest
-# sudo $CTR run --rm localhost:5000/bash.enc:latest test echo 'Hello World!'
-ctr: you are not authorized to use this image: missing private key needed for decryption
-# sudo $CTR run --rm --key mykey.pem localhost:5000/bash.enc:latest test echo 'Hello World!'
-Hello World!
-```
-
-## Project details
-
-**imgcrypt** is a non-core containerd sub-project, licensed under the [Apache 2.0 license](./LICENSE).
-As a containerd sub-project, you will find the:
- * [Project governance](https://github.com/containerd/project/blob/main/GOVERNANCE.md),
- * [Maintainers](MAINTAINERS),
- * and [Contributing guidelines](https://github.com/containerd/project/blob/main/CONTRIBUTING.md)
-
-information in our [`containerd/project`](https://github.com/containerd/project) repository.

vendor/github.com/containerd/imgcrypt/images/encryption/any.go

@@ -1,42 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package encryption
-
-import "github.com/gogo/protobuf/types"
-
-// pbAny takes proto-generated Any type.
-// https://developers.google.com/protocol-buffers/docs/proto3#any
-type pbAny interface {
-	GetTypeUrl() string
-	GetValue() []byte
-}
-
-func fromAny(from pbAny) *types.Any {
-	if from == nil {
-		return nil
-	}
-
-	pbany, ok := from.(*types.Any)
-	if ok {
-		return pbany
-	}
-
-	return &types.Any{
-		TypeUrl: from.GetTypeUrl(),
-		Value:   from.GetValue(),
-	}
-}

vendor/github.com/containerd/imgcrypt/images/encryption/client.go

@@ -1,80 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package encryption
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/containerd/containerd"
-	"github.com/containerd/containerd/containers"
-	"github.com/containerd/containerd/diff"
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/imgcrypt"
-	"github.com/containerd/typeurl"
-
-	encconfig "github.com/containers/ocicrypt/config"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-// WithDecryptedUnpack allows to pass parameters the 'layertool' needs to the applier
-func WithDecryptedUnpack(data *imgcrypt.Payload) diff.ApplyOpt {
-	return func(_ context.Context, desc ocispec.Descriptor, c *diff.ApplyConfig) error {
-		data.Descriptor = desc
-		any, err := typeurl.MarshalAny(data)
-		if err != nil {
-			return fmt.Errorf("failed to marshal payload: %w", err)
-		}
-
-		for _, id := range imgcrypt.PayloadToolIDs {
-			setProcessorPayload(c, id, any)
-		}
-		return nil
-	}
-}
-
-// WithUnpackConfigApplyOpts allows to pass an ApplyOpt
-func WithUnpackConfigApplyOpts(opt diff.ApplyOpt) containerd.UnpackOpt {
-	return func(_ context.Context, uc *containerd.UnpackConfig) error {
-		uc.ApplyOpts = append(uc.ApplyOpts, opt)
-		return nil
-	}
-}
-
-// WithUnpackOpts is used to add unpack options to the unpacker.
-func WithUnpackOpts(opts []containerd.UnpackOpt) containerd.RemoteOpt {
-	return func(_ *containerd.Client, c *containerd.RemoteContext) error {
-		c.UnpackOpts = append(c.UnpackOpts, opts...)
-		return nil
-	}
-}
-
-// WithAuthorizationCheck checks the authorization of keys used for encrypted containers
-// be checked upon creation of a container
-func WithAuthorizationCheck(dc *encconfig.DecryptConfig) containerd.NewContainerOpts {
-	return func(ctx context.Context, client *containerd.Client, c *containers.Container) error {
-		image, err := client.ImageService().Get(ctx, c.Image)
-		if errdefs.IsNotFound(err) {
-			// allow creation of container without a existing image
-			return nil
-		} else if err != nil {
-			return err
-		}
-
-		return CheckAuthorization(ctx, client.ContentStore(), image.Target, dc)
-	}
-}

vendor/github.com/containerd/imgcrypt/images/encryption/encryption.go

@@ -1,512 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package encryption
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"math/rand"
-
-	"github.com/containerd/containerd/content"
-	"github.com/containerd/containerd/errdefs"
-	"github.com/containerd/containerd/images"
-	"github.com/containerd/containerd/images/converter"
-	"github.com/containerd/containerd/platforms"
-
-	"github.com/containers/ocicrypt"
-	encconfig "github.com/containers/ocicrypt/config"
-	encocispec "github.com/containers/ocicrypt/spec"
-	"github.com/opencontainers/go-digest"
-	"github.com/opencontainers/image-spec/specs-go"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-type cryptoOp int
-
-const (
-	cryptoOpEncrypt    cryptoOp = iota
-	cryptoOpDecrypt             = iota
-	cryptoOpUnwrapOnly          = iota
-)
-
-// LayerFilter allows to select Layers by certain criteria
-type LayerFilter func(desc ocispec.Descriptor) bool
-
-// isLocalPlatform determines whether the given platform matches the local one
-func isLocalPlatform(platform *ocispec.Platform) bool {
-	matcher := platforms.NewMatcher(*platform)
-
-	return matcher.Match(platforms.DefaultSpec())
-}
-
-// IsEncryptedDiff returns true if mediaType is a known encrypted media type.
-func IsEncryptedDiff(ctx context.Context, mediaType string) bool {
-	switch mediaType {
-	case encocispec.MediaTypeLayerZstdEnc, encocispec.MediaTypeLayerGzipEnc, encocispec.MediaTypeLayerEnc:
-		return true
-	}
-	return false
-}
-
-// HasEncryptedLayer returns true if any LayerInfo indicates that the layer is encrypted
-func HasEncryptedLayer(ctx context.Context, layerInfos []ocispec.Descriptor) bool {
-	for i := 0; i < len(layerInfos); i++ {
-		if IsEncryptedDiff(ctx, layerInfos[i].MediaType) {
-			return true
-		}
-	}
-	return false
-}
-
-// encryptLayer encrypts the layer using the CryptoConfig and creates a new OCI Descriptor.
-// A call to this function may also only manipulate the wrapped keys list.
-// The caller is expected to store the returned encrypted data and OCI Descriptor
-func encryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor) (ocispec.Descriptor, io.Reader, ocicrypt.EncryptLayerFinalizer, error) {
-	var (
-		size int64
-		d    digest.Digest
-		err  error
-	)
-
-	encLayerReader, encLayerFinalizer, err := ocicrypt.EncryptLayer(cc.EncryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc)
-	if err != nil {
-		return ocispec.Descriptor{}, nil, nil, err
-	}
-
-	// were data touched ?
-	if encLayerReader != nil {
-		size = 0
-		d = ""
-	} else {
-		size = desc.Size
-		d = desc.Digest
-	}
-
-	newDesc := ocispec.Descriptor{
-		Digest:   d,
-		Size:     size,
-		Platform: desc.Platform,
-	}
-
-	switch desc.MediaType {
-	case images.MediaTypeDockerSchema2LayerGzip:
-		newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
-	case images.MediaTypeDockerSchema2Layer:
-		newDesc.MediaType = encocispec.MediaTypeLayerEnc
-	case encocispec.MediaTypeLayerGzipEnc:
-		newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
-	case encocispec.MediaTypeLayerZstdEnc:
-		newDesc.MediaType = encocispec.MediaTypeLayerZstdEnc
-	case encocispec.MediaTypeLayerEnc:
-		newDesc.MediaType = encocispec.MediaTypeLayerEnc
-
-	// TODO: Mediatypes to be added in ocispec
-	case ocispec.MediaTypeImageLayerGzip:
-		newDesc.MediaType = encocispec.MediaTypeLayerGzipEnc
-	case ocispec.MediaTypeImageLayerZstd:
-		newDesc.MediaType = encocispec.MediaTypeLayerZstdEnc
-	case ocispec.MediaTypeImageLayer:
-		newDesc.MediaType = encocispec.MediaTypeLayerEnc
-
-	default:
-		return ocispec.Descriptor{}, nil, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
-	}
-
-	return newDesc, encLayerReader, encLayerFinalizer, nil
-}
-
-// DecryptLayer decrypts the layer using the DecryptConfig and creates a new OCI Descriptor.
-// The caller is expected to store the returned plain data and OCI Descriptor
-func DecryptLayer(dc *encconfig.DecryptConfig, dataReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (ocispec.Descriptor, io.Reader, digest.Digest, error) {
-	resultReader, layerDigest, err := ocicrypt.DecryptLayer(dc, dataReader, desc, unwrapOnly)
-	if err != nil || unwrapOnly {
-		return ocispec.Descriptor{}, nil, "", err
-	}
-
-	newDesc := ocispec.Descriptor{
-		Size:     0,
-		Platform: desc.Platform,
-	}
-
-	switch desc.MediaType {
-	case encocispec.MediaTypeLayerGzipEnc:
-		newDesc.MediaType = images.MediaTypeDockerSchema2LayerGzip
-	case encocispec.MediaTypeLayerZstdEnc:
-		newDesc.MediaType = ocispec.MediaTypeImageLayerZstd
-	case encocispec.MediaTypeLayerEnc:
-		newDesc.MediaType = images.MediaTypeDockerSchema2Layer
-	default:
-		return ocispec.Descriptor{}, nil, "", fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
-	}
-	return newDesc, resultReader, layerDigest, nil
-}
-
-// decryptLayer decrypts the layer using the CryptoConfig and creates a new OCI Descriptor.
-// The caller is expected to store the returned plain data and OCI Descriptor
-func decryptLayer(cc *encconfig.CryptoConfig, dataReader content.ReaderAt, desc ocispec.Descriptor, unwrapOnly bool) (ocispec.Descriptor, io.Reader, error) {
-	resultReader, d, err := ocicrypt.DecryptLayer(cc.DecryptConfig, ocicrypt.ReaderFromReaderAt(dataReader), desc, unwrapOnly)
-	if err != nil || unwrapOnly {
-		return ocispec.Descriptor{}, nil, err
-	}
-
-	newDesc := ocispec.Descriptor{
-		Digest:   d,
-		Size:     0,
-		Platform: desc.Platform,
-	}
-
-	switch desc.MediaType {
-	case encocispec.MediaTypeLayerGzipEnc:
-		newDesc.MediaType = images.MediaTypeDockerSchema2LayerGzip
-	case encocispec.MediaTypeLayerZstdEnc:
-		newDesc.MediaType = ocispec.MediaTypeImageLayerZstd
-	case encocispec.MediaTypeLayerEnc:
-		newDesc.MediaType = images.MediaTypeDockerSchema2Layer
-	default:
-		return ocispec.Descriptor{}, nil, fmt.Errorf("unsupporter layer MediaType: %s", desc.MediaType)
-	}
-	return newDesc, resultReader, nil
-}
-
-// cryptLayer handles the changes due to encryption or decryption of a layer
-func cryptLayer(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, cryptoOp cryptoOp) (ocispec.Descriptor, error) {
-	var (
-		resultReader      io.Reader
-		newDesc           ocispec.Descriptor
-		encLayerFinalizer ocicrypt.EncryptLayerFinalizer
-	)
-
-	dataReader, err := cs.ReaderAt(ctx, desc)
-	if err != nil {
-		return ocispec.Descriptor{}, err
-	}
-	defer dataReader.Close()
-
-	if cryptoOp == cryptoOpEncrypt {
-		newDesc, resultReader, encLayerFinalizer, err = encryptLayer(cc, dataReader, desc)
-	} else {
-		newDesc, resultReader, err = decryptLayer(cc, dataReader, desc, cryptoOp == cryptoOpUnwrapOnly)
-	}
-	if err != nil || cryptoOp == cryptoOpUnwrapOnly {
-		return ocispec.Descriptor{}, err
-	}
-
-	newDesc.Annotations = ocicrypt.FilterOutAnnotations(desc.Annotations)
-
-	// some operations, such as changing recipients, may not touch the layer at all
-	if resultReader != nil {
-		var ref string
-		// If we have the digest, write blob with checks
-		haveDigest := newDesc.Digest.String() != ""
-		if haveDigest {
-			ref = fmt.Sprintf("layer-%s", newDesc.Digest.String())
-		} else {
-			ref = fmt.Sprintf("blob-%d-%d", rand.Int(), rand.Int())
-		}
-
-		if haveDigest {
-			if err := content.WriteBlob(ctx, cs, ref, resultReader, newDesc); err != nil {
-				return ocispec.Descriptor{}, fmt.Errorf("failed to write config: %w", err)
-			}
-		} else {
-			newDesc.Digest, newDesc.Size, err = ingestReader(ctx, cs, ref, resultReader)
-			if err != nil {
-				return ocispec.Descriptor{}, err
-			}
-		}
-	}
-
-	// After performing encryption, call finalizer to get annotations
-	if encLayerFinalizer != nil {
-		annotations, err := encLayerFinalizer()
-		if err != nil {
-			return ocispec.Descriptor{}, fmt.Errorf("error getting annotations from encLayer finalizer: %w", err)
-		}
-		for k, v := range annotations {
-			newDesc.Annotations[k] = v
-		}
-	}
-	return newDesc, err
-}
-
-func ingestReader(ctx context.Context, cs content.Ingester, ref string, r io.Reader) (digest.Digest, int64, error) {
-	cw, err := content.OpenWriter(ctx, cs, content.WithRef(ref))
-	if err != nil {
-		return "", 0, fmt.Errorf("failed to open writer: %w", err)
-	}
-	defer cw.Close()
-
-	if _, err := content.CopyReader(cw, r); err != nil {
-		return "", 0, fmt.Errorf("copy failed: %w", err)
-	}
-
-	st, err := cw.Status()
-	if err != nil {
-		return "", 0, fmt.Errorf("failed to get state: %w", err)
-	}
-
-	if err := cw.Commit(ctx, st.Offset, ""); err != nil {
-		if !errdefs.IsAlreadyExists(err) {
-			return "", 0, fmt.Errorf("failed commit on ref %q: %w", ref, err)
-		}
-	}
-
-	return cw.Digest(), st.Offset, nil
-}
-
-// Encrypt or decrypt all the Children of a given descriptor
-func cryptChildren(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp, thisPlatform *ocispec.Platform) (ocispec.Descriptor, bool, error) {
-	children, err := images.Children(ctx, cs, desc)
-	if err != nil {
-		if errdefs.IsNotFound(err) {
-			return desc, false, nil
-		}
-		return ocispec.Descriptor{}, false, err
-	}
-
-	var newLayers []ocispec.Descriptor
-	var config ocispec.Descriptor
-	modified := false
-
-	for _, child := range children {
-		// we only encrypt child layers and have to update their parents if encryption happened
-		switch child.MediaType {
-		case images.MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig:
-			config = child
-		case images.MediaTypeDockerSchema2LayerGzip, images.MediaTypeDockerSchema2Layer,
-			ocispec.MediaTypeImageLayerGzip, ocispec.MediaTypeImageLayer,
-			ocispec.MediaTypeImageLayerZstd:
-			if cryptoOp == cryptoOpEncrypt && lf(child) {
-				nl, err := cryptLayer(ctx, cs, child, cc, cryptoOp)
-				if err != nil {
-					return ocispec.Descriptor{}, false, err
-				}
-				modified = true
-				newLayers = append(newLayers, nl)
-			} else {
-				newLayers = append(newLayers, child)
-			}
-		case encocispec.MediaTypeLayerGzipEnc, encocispec.MediaTypeLayerZstdEnc, encocispec.MediaTypeLayerEnc:
-			// this one can be decrypted but also its recipients list changed
-			if lf(child) {
-				nl, err := cryptLayer(ctx, cs, child, cc, cryptoOp)
-				if err != nil || cryptoOp == cryptoOpUnwrapOnly {
-					return ocispec.Descriptor{}, false, err
-				}
-				modified = true
-				newLayers = append(newLayers, nl)
-			} else {
-				newLayers = append(newLayers, child)
-			}
-		case images.MediaTypeDockerSchema2LayerForeign, images.MediaTypeDockerSchema2LayerForeignGzip:
-			// never encrypt/decrypt
-			newLayers = append(newLayers, child)
-		default:
-			return ocispec.Descriptor{}, false, fmt.Errorf("bad/unhandled MediaType %s in encryptChildren", child.MediaType)
-		}
-	}
-
-	if modified && len(newLayers) > 0 {
-		newManifest := ocispec.Manifest{
-			Versioned: specs.Versioned{
-				SchemaVersion: 2,
-			},
-			Config: config,
-			Layers: newLayers,
-		}
-
-		mb, err := json.MarshalIndent(newManifest, "", "   ")
-		if err != nil {
-			return ocispec.Descriptor{}, false, fmt.Errorf("failed to marshal image: %w", err)
-		}
-
-		newDesc := ocispec.Descriptor{
-			MediaType: ocispec.MediaTypeImageManifest,
-			Size:      int64(len(mb)),
-			Digest:    digest.Canonical.FromBytes(mb),
-			Platform:  desc.Platform,
-		}
-
-		labels := map[string]string{}
-		labels["containerd.io/gc.ref.content.0"] = newManifest.Config.Digest.String()
-		for i, ch := range newManifest.Layers {
-			labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i+1)] = ch.Digest.String()
-		}
-
-		ref := fmt.Sprintf("manifest-%s", newDesc.Digest.String())
-
-		if err := content.WriteBlob(ctx, cs, ref, bytes.NewReader(mb), newDesc, content.WithLabels(labels)); err != nil {
-			return ocispec.Descriptor{}, false, fmt.Errorf("failed to write config: %w", err)
-		}
-		return newDesc, true, nil
-	}
-
-	return desc, modified, nil
-}
-
-// cryptManifest encrypts or decrypts the children of a top level manifest
-func cryptManifest(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
-	p, err := content.ReadBlob(ctx, cs, desc)
-	if err != nil {
-		return ocispec.Descriptor{}, false, err
-	}
-	var manifest ocispec.Manifest
-	if err := json.Unmarshal(p, &manifest); err != nil {
-		return ocispec.Descriptor{}, false, err
-	}
-	platform := platforms.DefaultSpec()
-	newDesc, modified, err := cryptChildren(ctx, cs, desc, cc, lf, cryptoOp, &platform)
-	if err != nil || cryptoOp == cryptoOpUnwrapOnly {
-		return ocispec.Descriptor{}, false, err
-	}
-	return newDesc, modified, nil
-}
-
-// cryptManifestList encrypts or decrypts the children of a top level manifest list
-func cryptManifestList(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
-	// read the index; if any layer is encrypted and any manifests change we will need to rewrite it
-	b, err := content.ReadBlob(ctx, cs, desc)
-	if err != nil {
-		return ocispec.Descriptor{}, false, err
-	}
-
-	var index ocispec.Index
-	if err := json.Unmarshal(b, &index); err != nil {
-		return ocispec.Descriptor{}, false, err
-	}
-
-	var newManifests []ocispec.Descriptor
-	modified := false
-	for _, manifest := range index.Manifests {
-		if cryptoOp == cryptoOpUnwrapOnly && !isLocalPlatform(manifest.Platform) {
-			continue
-		}
-		newManifest, m, err := cryptChildren(ctx, cs, manifest, cc, lf, cryptoOp, manifest.Platform)
-		if err != nil || cryptoOp == cryptoOpUnwrapOnly {
-			return ocispec.Descriptor{}, false, err
-		}
-		if m {
-			modified = true
-		}
-		newManifests = append(newManifests, newManifest)
-	}
-	if cryptoOp == cryptoOpUnwrapOnly {
-		return ocispec.Descriptor{}, false, fmt.Errorf("No manifest found for local platform")
-	}
-
-	if modified {
-		// we need to update the index
-		newIndex := ocispec.Index{
-			Versioned: index.Versioned,
-			Manifests: newManifests,
-		}
-
-		mb, err := json.MarshalIndent(newIndex, "", "   ")
-		if err != nil {
-			return ocispec.Descriptor{}, false, fmt.Errorf("failed to marshal index: %w", err)
-		}
-
-		newDesc := ocispec.Descriptor{
-			MediaType: ocispec.MediaTypeImageIndex,
-			Size:      int64(len(mb)),
-			Digest:    digest.Canonical.FromBytes(mb),
-		}
-
-		labels := map[string]string{}
-		for i, m := range newIndex.Manifests {
-			labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i)] = m.Digest.String()
-		}
-
-		ref := fmt.Sprintf("index-%s", newDesc.Digest.String())
-
-		if err = content.WriteBlob(ctx, cs, ref, bytes.NewReader(mb), newDesc, content.WithLabels(labels)); err != nil {
-			return ocispec.Descriptor{}, false, fmt.Errorf("failed to write index: %w", err)
-		}
-		return newDesc, true, nil
-	}
-
-	return desc, false, nil
-}
-
-// cryptImage is the dispatcher to encrypt/decrypt an image; it accepts either an OCI descriptor
-// representing a manifest list or a single manifest
-func cryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter, cryptoOp cryptoOp) (ocispec.Descriptor, bool, error) {
-	if cc == nil {
-		return ocispec.Descriptor{}, false, errors.New("invalid argument: CryptoConfig must not be nil")
-	}
-	switch desc.MediaType {
-	case ocispec.MediaTypeImageIndex, images.MediaTypeDockerSchema2ManifestList:
-		return cryptManifestList(ctx, cs, desc, cc, lf, cryptoOp)
-	case ocispec.MediaTypeImageManifest, images.MediaTypeDockerSchema2Manifest:
-		return cryptManifest(ctx, cs, desc, cc, lf, cryptoOp)
-	default:
-		return ocispec.Descriptor{}, false, fmt.Errorf("unhandled media type: %s", desc.MediaType)
-	}
-}
-
-// EncryptImage encrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
-func EncryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
-	return cryptImage(ctx, cs, desc, cc, lf, cryptoOpEncrypt)
-}
-
-// DecryptImage decrypts an image; it accepts either an OCI descriptor representing a manifest list or a single manifest
-func DecryptImage(ctx context.Context, cs content.Store, desc ocispec.Descriptor, cc *encconfig.CryptoConfig, lf LayerFilter) (ocispec.Descriptor, bool, error) {
-	return cryptImage(ctx, cs, desc, cc, lf, cryptoOpDecrypt)
-}
-
-// GetImageEncryptConverter returns a converter function for image encryption
-func GetImageEncryptConverter(cc *encconfig.CryptoConfig, lf LayerFilter) converter.ConvertFunc {
-	return func(ctx context.Context, cs content.Store, desc ocispec.Descriptor) (*ocispec.Descriptor, error) {
-		newDesc, _, err := EncryptImage(ctx, cs, desc, cc, lf)
-		if err != nil {
-			return nil, err
-		}
-		return &newDesc, nil
-	}
-}
-
-// GetImageDecryptConverter returns a converter function for image decryption
-func GetImageDecryptConverter(cc *encconfig.CryptoConfig, lf LayerFilter) converter.ConvertFunc {
-	return func(ctx context.Context, cs content.Store, desc ocispec.Descriptor) (*ocispec.Descriptor, error) {
-		newDesc, _, err := DecryptImage(ctx, cs, desc, cc, lf)
-		if err != nil {
-			return nil, err
-		}
-		return &newDesc, nil
-	}
-}
-
-// CheckAuthorization checks whether a user has the right keys to be allowed to access an image (every layer)
-// It takes decrypting of the layers only as far as decrypting the asymmetrically encrypted data
-// The decryption is only done for the current platform
-func CheckAuthorization(ctx context.Context, cs content.Store, desc ocispec.Descriptor, dc *encconfig.DecryptConfig) error {
-	cc := encconfig.InitDecryption(dc.Parameters)
-
-	lf := func(desc ocispec.Descriptor) bool {
-		return true
-	}
-
-	_, _, err := cryptImage(ctx, cs, desc, &cc, lf, cryptoOpUnwrapOnly)
-	if err != nil {
-		return fmt.Errorf("you are not authorized to use this image: %w", err)
-	}
-	return nil
-}

vendor/github.com/containerd/imgcrypt/images/encryption/payload.go

@@ -1,53 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package encryption
-
-import (
-	"reflect"
-
-	"github.com/containerd/containerd/diff"
-	"github.com/gogo/protobuf/types"
-)
-
-var processorPayloadsUseGogo bool
-
-func init() {
-	var c = &diff.ApplyConfig{}
-	var pbany *types.Any
-
-	pp := reflect.TypeOf(c.ProcessorPayloads)
-	processorPayloadsUseGogo = pp.Elem() == reflect.TypeOf(pbany)
-}
-
-func clearProcessorPayloads(c *diff.ApplyConfig) {
-	var empty = reflect.MakeMap(reflect.TypeOf(c.ProcessorPayloads))
-	reflect.ValueOf(&c.ProcessorPayloads).Elem().Set(empty)
-}
-
-func setProcessorPayload(c *diff.ApplyConfig, id string, value pbAny) {
-	if c.ProcessorPayloads == nil {
-		clearProcessorPayloads(c)
-	}
-
-	var v reflect.Value
-	if processorPayloadsUseGogo {
-		v = reflect.ValueOf(fromAny(value))
-	} else {
-		v = reflect.ValueOf(value)
-	}
-	reflect.ValueOf(c.ProcessorPayloads).SetMapIndex(reflect.ValueOf(id), v)
-}

vendor/github.com/containerd/imgcrypt/payload.go

@@ -1,44 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package imgcrypt
-
-import (
-	"github.com/containerd/typeurl"
-
-	encconfig "github.com/containers/ocicrypt/config"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-)
-
-const (
-	PayloadURI = "io.containerd.ocicrypt.v1.Payload"
-)
-
-var PayloadToolIDs = []string{
-	"io.containerd.ocicrypt.decoder.v1.tar",
-	"io.containerd.ocicrypt.decoder.v1.tar.gzip",
-}
-
-func init() {
-	typeurl.Register(&Payload{}, PayloadURI)
-}
-
-// Payload holds data that the external layer decryption tool
-// needs for decrypting a layer
-type Payload struct {
-	DecryptConfig encconfig.DecryptConfig
-	Descriptor    ocispec.Descriptor
-}

vendor/github.com/containerd/typeurl/.gitignore

@@ -1,2 +0,0 @@
-*.test
-coverage.txt

vendor/github.com/containerd/typeurl/LICENSE

@@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright The containerd Authors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       https://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/containerd/typeurl/README.md

@@ -1,20 +0,0 @@
-# typeurl
-
-[![PkgGoDev](https://pkg.go.dev/badge/github.com/containerd/typeurl)](https://pkg.go.dev/github.com/containerd/typeurl)
-[![Build Status](https://github.com/containerd/typeurl/workflows/CI/badge.svg)](https://github.com/containerd/typeurl/actions?query=workflow%3ACI)
-[![codecov](https://codecov.io/gh/containerd/typeurl/branch/master/graph/badge.svg)](https://codecov.io/gh/containerd/typeurl)
-[![Go Report Card](https://goreportcard.com/badge/github.com/containerd/typeurl)](https://goreportcard.com/report/github.com/containerd/typeurl)
-
-A Go package for managing the registration, marshaling, and unmarshaling of encoded types.
-
-This package helps when types are sent over a GRPC API and marshaled as a [protobuf.Any](https://github.com/gogo/protobuf/blob/master/protobuf/google/protobuf/any.proto).
-
-## Project details
-
-**typeurl** is a containerd sub-project, licensed under the [Apache 2.0 license](./LICENSE).
-As a containerd sub-project, you will find the:
- * [Project governance](https://github.com/containerd/project/blob/master/GOVERNANCE.md),
- * [Maintainers](https://github.com/containerd/project/blob/master/MAINTAINERS),
- * and [Contributing guidelines](https://github.com/containerd/project/blob/master/CONTRIBUTING.md)
-
-information in our [`containerd/project`](https://github.com/containerd/project) repository.

vendor/github.com/containerd/typeurl/doc.go

@@ -1,83 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package typeurl
-
-// Package typeurl assists with managing the registration, marshaling, and
-// unmarshaling of types encoded as protobuf.Any.
-//
-// A protobuf.Any is a proto message that can contain any arbitrary data. It
-// consists of two components, a TypeUrl and a Value, and its proto definition
-// looks like this:
-//
-//   message Any {
-//     string type_url = 1;
-//     bytes value = 2;
-//   }
-//
-// The TypeUrl is used to distinguish the contents from other proto.Any
-// messages. This typeurl library manages these URLs to enable automagic
-// marshaling and unmarshaling of the contents.
-//
-// For example, consider this go struct:
-//
-//   type Foo struct {
-//     Field1 string
-//     Field2 string
-//   }
-//
-// To use typeurl, types must first be registered. This is typically done in
-// the init function
-//
-//   func init() {
-//      typeurl.Register(&Foo{}, "Foo")
-//   }
-//
-// This will register the type Foo with the url path "Foo". The arguments to
-// Register are variadic, and are used to construct a url path. Consider this
-// example, from the github.com/containerd/containerd/client package:
-//
-//   func init() {
-//     const prefix = "types.containerd.io"
-//     // register TypeUrls for commonly marshaled external types
-//     major := strconv.Itoa(specs.VersionMajor)
-//     typeurl.Register(&specs.Spec{}, prefix, "opencontainers/runtime-spec", major, "Spec")
-//     // this function has more Register calls, which are elided.
-//   }
-//
-// This registers several types under a more complex url, which ends up mapping
-// to `types.containerd.io/opencontainers/runtime-spec/1/Spec` (or some other
-// value for major).
-//
-// Once a type is registered, it can be marshaled to a proto.Any message simply
-// by calling `MarshalAny`, like this:
-//
-//   foo := &Foo{Field1: "value1", Field2: "value2"}
-//   anyFoo, err := typeurl.MarshalAny(foo)
-//
-// MarshalAny will resolve the correct URL for the type. If the type in
-// question implements the proto.Message interface, then it will be marshaled
-// as a proto message. Otherwise, it will be marshaled as json. This means that
-// typeurl will work on any arbitrary data, whether or not it has a proto
-// definition, as long as it can be serialized to json.
-//
-// To unmarshal, the process is simply inverse:
-//
-//   iface, err := typeurl.UnmarshalAny(anyFoo)
-//   foo := iface.(*Foo)
-//
-// The correct type is automatically chosen from the type registry, and the
-// returned interface can be cast straight to that type.

vendor/github.com/containerd/typeurl/types.go

@@ -1,214 +0,0 @@
-/*
-   Copyright The containerd Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package typeurl
-
-import (
-	"encoding/json"
-	"path"
-	"reflect"
-	"sync"
-
-	"github.com/gogo/protobuf/proto"
-	"github.com/gogo/protobuf/types"
-	"github.com/pkg/errors"
-)
-
-var (
-	mu       sync.RWMutex
-	registry = make(map[reflect.Type]string)
-)
-
-// Definitions of common error types used throughout typeurl.
-//
-// These error types are used with errors.Wrap and errors.Wrapf to add context
-// to an error.
-//
-// To detect an error class, use errors.Is() functions to tell whether an
-// error is of this type.
-var (
-	ErrNotFound = errors.New("not found")
-)
-
-// Register a type with a base URL for JSON marshaling. When the MarshalAny and
-// UnmarshalAny functions are called they will treat the Any type value as JSON.
-// To use protocol buffers for handling the Any value the proto.Register
-// function should be used instead of this function.
-func Register(v interface{}, args ...string) {
-	var (
-		t = tryDereference(v)
-		p = path.Join(args...)
-	)
-	mu.Lock()
-	defer mu.Unlock()
-	if et, ok := registry[t]; ok {
-		if et != p {
-			panic(errors.Errorf("type registered with alternate path %q != %q", et, p))
-		}
-		return
-	}
-	registry[t] = p
-}
-
-// TypeURL returns the type url for a registered type.
-func TypeURL(v interface{}) (string, error) {
-	mu.RLock()
-	u, ok := registry[tryDereference(v)]
-	mu.RUnlock()
-	if !ok {
-		// fallback to the proto registry if it is a proto message
-		pb, ok := v.(proto.Message)
-		if !ok {
-			return "", errors.Wrapf(ErrNotFound, "type %s", reflect.TypeOf(v))
-		}
-		return proto.MessageName(pb), nil
-	}
-	return u, nil
-}
-
-// Is returns true if the type of the Any is the same as v.
-func Is(any *types.Any, v interface{}) bool {
-	// call to check that v is a pointer
-	tryDereference(v)
-	url, err := TypeURL(v)
-	if err != nil {
-		return false
-	}
-	return any.TypeUrl == url
-}
-
-// MarshalAny marshals the value v into an any with the correct TypeUrl.
-// If the provided object is already a proto.Any message, then it will be
-// returned verbatim. If it is of type proto.Message, it will be marshaled as a
-// protocol buffer. Otherwise, the object will be marshaled to json.
-func MarshalAny(v interface{}) (*types.Any, error) {
-	var marshal func(v interface{}) ([]byte, error)
-	switch t := v.(type) {
-	case *types.Any:
-		// avoid reserializing the type if we have an any.
-		return t, nil
-	case proto.Message:
-		marshal = func(v interface{}) ([]byte, error) {
-			return proto.Marshal(t)
-		}
-	default:
-		marshal = json.Marshal
-	}
-
-	url, err := TypeURL(v)
-	if err != nil {
-		return nil, err
-	}
-
-	data, err := marshal(v)
-	if err != nil {
-		return nil, err
-	}
-	return &types.Any{
-		TypeUrl: url,
-		Value:   data,
-	}, nil
-}
-
-// UnmarshalAny unmarshals the any type into a concrete type.
-func UnmarshalAny(any *types.Any) (interface{}, error) {
-	return UnmarshalByTypeURL(any.TypeUrl, any.Value)
-}
-
-// UnmarshalByTypeURL unmarshals the given type and value to into a concrete type.
-func UnmarshalByTypeURL(typeURL string, value []byte) (interface{}, error) {
-	return unmarshal(typeURL, value, nil)
-}
-
-// UnmarshalTo unmarshals the any type into a concrete type passed in the out
-// argument. It is identical to UnmarshalAny, but lets clients provide a
-// destination type through the out argument.
-func UnmarshalTo(any *types.Any, out interface{}) error {
-	return UnmarshalToByTypeURL(any.TypeUrl, any.Value, out)
-}
-
-// UnmarshalTo unmarshals the given type and value into a concrete type passed
-// in the out argument. It is identical to UnmarshalByTypeURL, but lets clients
-// provide a destination type through the out argument.
-func UnmarshalToByTypeURL(typeURL string, value []byte, out interface{}) error {
-	_, err := unmarshal(typeURL, value, out)
-	return err
-}
-
-func unmarshal(typeURL string, value []byte, v interface{}) (interface{}, error) {
-	t, err := getTypeByUrl(typeURL)
-	if err != nil {
-		return nil, err
-	}
-
-	if v == nil {
-		v = reflect.New(t.t).Interface()
-	} else {
-		// Validate interface type provided by client
-		vURL, err := TypeURL(v)
-		if err != nil {
-			return nil, err
-		}
-		if typeURL != vURL {
-			return nil, errors.Errorf("can't unmarshal type %q to output %q", typeURL, vURL)
-		}
-	}
-
-	if t.isProto {
-		err = proto.Unmarshal(value, v.(proto.Message))
-	} else {
-		err = json.Unmarshal(value, v)
-	}
-
-	return v, err
-}
-
-type urlType struct {
-	t       reflect.Type
-	isProto bool
-}
-
-func getTypeByUrl(url string) (urlType, error) {
-	mu.RLock()
-	for t, u := range registry {
-		if u == url {
-			mu.RUnlock()
-			return urlType{
-				t: t,
-			}, nil
-		}
-	}
-	mu.RUnlock()
-	// fallback to proto registry
-	t := proto.MessageType(url)
-	if t != nil {
-		return urlType{
-			// get the underlying Elem because proto returns a pointer to the type
-			t:       t.Elem(),
-			isProto: true,
-		}, nil
-	}
-	return urlType{}, errors.Wrapf(ErrNotFound, "type with url %s", url)
-}
-
-func tryDereference(v interface{}) reflect.Type {
-	t := reflect.TypeOf(v)
-	if t.Kind() == reflect.Ptr {
-		// require check of pointer but dereference to register
-		return t.Elem()
-	}
-	panic("v is not a pointer to a type")
-}

vendor/github.com/containers/ocicrypt/.travis.yml

@@ -1,29 +0,0 @@
-dist: bionic
-language: go
-
-os:
-- linux
-
-go:
-  - "1.13.x"
-  - "1.16.x"
-
-matrix:
-  include:
-    - os: linux
-
-addons:
-  apt:
-    packages:
-    - gnutls-bin
-    - softhsm2
-
-go_import_path: github.com/containers/ocicrypt
-
-install:
-  - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.46.2
-
-script:
-  - make
-  - make check
-  - make test

vendor/github.com/containers/ocicrypt/ADOPTERS.md

@@ -1,10 +0,0 @@
-Below are list of adopters of the `ocicrypt` library or supports use of OCI encrypted images:
-- [skopeo](https://github.com/containers/skopeo)
-- [buildah](https://github.com/containers/buildah)
-- [containerd](https://github.com/containerd/imgcrypt)
-- [nerdctl](https://github.com/containerd/nerdctl)
-- [distribution](https://github.com/distribution/distribution)
-
-Below are the list of projects that are in the process of adopting support:
-- [quay](https://github.com/quay/quay)
-- [kata-containers](https://github.com/kata-containers/kata-containers)

vendor/github.com/containers/ocicrypt/CODE-OF-CONDUCT.md

@@ -1,3 +0,0 @@
-## The OCIcrypt Library Project Community Code of Conduct
-
-The OCIcrypt Library project follows the [Containers Community Code of Conduct](https://github.com/containers/common/blob/master/CODE-OF-CONDUCT.md).

vendor/github.com/containers/ocicrypt/LICENSE

@@ -1,189 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       https://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/containers/ocicrypt/MAINTAINERS

@@ -1,6 +0,0 @@
-# ocicrypt maintainers
-#
-# Github ID, Name, Email Address
-lumjjb, Brandon Lum, lumjjb@gmail.com
-stefanberger, Stefan Berger, stefanb@linux.ibm.com
-arronwy, Arron Wang, arron.wang@intel.com 

vendor/github.com/containers/ocicrypt/Makefile

@@ -1,34 +0,0 @@
-#   Copyright The containerd Authors.
-
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-
-#       http://www.apache.org/licenses/LICENSE-2.0
-
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-.PHONY: check build decoder generate-protobuf
-
-all: build
-
-FORCE:
-
-check:
-	golangci-lint run
-
-build: vendor
-	go build ./...
-
-vendor:
-	go mod tidy
-
-test:
-	go test ./... -test.v
-
-generate-protobuf:
-	protoc  -I utils/keyprovider/ utils/keyprovider/keyprovider.proto --go_out=plugins=grpc:utils/keyprovider

vendor/github.com/containers/ocicrypt/README.md

@@ -1,50 +0,0 @@
-# OCIcrypt Library
-
-The `ocicrypt` library is the OCI image spec implementation of container image encryption. More details of the spec can be seen in the [OCI repository](https://github.com/opencontainers/image-spec/pull/775). The purpose of this library is to encode spec structures and consts in code, as well as provide a consistent implementation of image encryption across container runtimes and build tools.
-
-Consumers of OCIcrypt:
-
-- [containerd/imgcrypt](https://github.com/containerd/imgcrypt)
-- [cri-o](https://github.com/cri-o/cri-o)
-- [skopeo](https://github.com/containers/skopeo)
-
-
-## Usage
-
-There are various levels of usage for this library. The main consumers of these would be runtime/build tools, and a more specific use would be in the ability to extend cryptographic function.
-
-### Runtime/Build tool usage
-
-The general exposed interface a runtime/build tool would use, would be to perform encryption or decryption of layers:
-
-```
-package "github.com/containers/ocicrypt"
-func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error)
-func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error)
-```
-
-The settings/parameters to these functions can be specified via creation of an encryption config with the `github.com/containers/ocicrypt/config` package. We note that because setting of annotations and other fields of the layer descriptor is done through various means in different runtimes/build tools, it is the responsibility of the caller to still ensure that the layer descriptor follows the OCI specification (i.e. encoding, setting annotations, etc.).
-
-
-### Crypto Agility and Extensibility
-
-The implementation for both symmetric and asymmetric encryption used in this library are behind 2 main interfaces, which users can extend if need be. These are in the following packages:
-- github.com/containers/ocicrypt/blockcipher - LayerBlockCipher interface for block ciphers
-- github.com/containers/ocicrypt/keywrap - KeyWrapper interface for key wrapping
-
-We note that adding interfaces here is risky outside the OCI spec is not recommended, unless for very specialized and confined usecases. Please open an issue or PR if there is a general usecase that could be added to the OCI spec.
-
-
-#### Keyprovider interface
-
-As part of the keywrap interface, there is a [keyprovider](https://github.com/containers/ocicrypt/blob/main/docs/keyprovider.md) implementation that allows one to call out to a binary or service.
-
-
-## Security Issues
-
-We consider security issues related to this library critical. Please report and security related issues by emailing maintainers in the [MAINTAINERS](MAINTAINERS) file.
-
-
-## Ocicrypt Pkcs11 Support
-
-Ocicrypt Pkcs11 support is currently experiemental. For more details, please refer to the [this document](docs/pkcs11.md).

vendor/github.com/containers/ocicrypt/SECURITY.md

@@ -1,3 +0,0 @@
-## Security and Disclosure Information Policy for the OCIcrypt Library Project
-
-The OCIcrypt Library Project follows the [Security and Disclosure Information Policy](https://github.com/containers/common/blob/master/SECURITY.md) for the Containers Projects.

vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go

@@ -1,160 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package blockcipher
-
-import (
-	"io"
-
-	"github.com/opencontainers/go-digest"
-	"github.com/pkg/errors"
-)
-
-// LayerCipherType is the ciphertype as specified in the layer metadata
-type LayerCipherType string
-
-// TODO: Should be obtained from OCI spec once included
-const (
-	AES256CTR LayerCipherType = "AES_256_CTR_HMAC_SHA256"
-)
-
-// PrivateLayerBlockCipherOptions includes the information required to encrypt/decrypt
-// an image which are sensitive and should not be in plaintext
-type PrivateLayerBlockCipherOptions struct {
-	// SymmetricKey represents the symmetric key used for encryption/decryption
-	// This field should be populated by Encrypt/Decrypt calls
-	SymmetricKey []byte `json:"symkey"`
-
-	// Digest is the digest of the original data for verification.
-	// This is NOT populated by Encrypt/Decrypt calls
-	Digest digest.Digest `json:"digest"`
-
-	// CipherOptions contains the cipher metadata used for encryption/decryption
-	// This field should be populated by Encrypt/Decrypt calls
-	CipherOptions map[string][]byte `json:"cipheroptions"`
-}
-
-// PublicLayerBlockCipherOptions includes the information required to encrypt/decrypt
-// an image which are public and can be deduplicated in plaintext across multiple
-// recipients
-type PublicLayerBlockCipherOptions struct {
-	// CipherType denotes the cipher type according to the list of OCI suppported
-	// cipher types.
-	CipherType LayerCipherType `json:"cipher"`
-
-	// Hmac contains the hmac string to help verify encryption
-	Hmac []byte `json:"hmac"`
-
-	// CipherOptions contains the cipher metadata used for encryption/decryption
-	// This field should be populated by Encrypt/Decrypt calls
-	CipherOptions map[string][]byte `json:"cipheroptions"`
-}
-
-// LayerBlockCipherOptions contains the public and private LayerBlockCipherOptions
-// required to encrypt/decrypt an image
-type LayerBlockCipherOptions struct {
-	Public  PublicLayerBlockCipherOptions
-	Private PrivateLayerBlockCipherOptions
-}
-
-// LayerBlockCipher returns a provider for encrypt/decrypt functionality
-// for handling the layer data for a specific algorithm
-type LayerBlockCipher interface {
-	// GenerateKey creates a symmetric key
-	GenerateKey() ([]byte, error)
-	// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
-	Encrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error)
-	// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
-	Decrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error)
-}
-
-// LayerBlockCipherHandler is the handler for encrypt/decrypt for layers
-type LayerBlockCipherHandler struct {
-	cipherMap map[LayerCipherType]LayerBlockCipher
-}
-
-// Finalizer is called after data blobs are written, and returns the LayerBlockCipherOptions for the encrypted blob
-type Finalizer func() (LayerBlockCipherOptions, error)
-
-// GetOpt returns the value of the cipher option and if the option exists
-func (lbco LayerBlockCipherOptions) GetOpt(key string) (value []byte, ok bool) {
-	if v, ok := lbco.Public.CipherOptions[key]; ok {
-		return v, ok
-	} else if v, ok := lbco.Private.CipherOptions[key]; ok {
-		return v, ok
-	} else {
-		return nil, false
-	}
-}
-
-func wrapFinalizerWithType(fin Finalizer, typ LayerCipherType) Finalizer {
-	return func() (LayerBlockCipherOptions, error) {
-		lbco, err := fin()
-		if err != nil {
-			return LayerBlockCipherOptions{}, err
-		}
-		lbco.Public.CipherType = typ
-		return lbco, err
-	}
-}
-
-// Encrypt is the handler for the layer decryption routine
-func (h *LayerBlockCipherHandler) Encrypt(plainDataReader io.Reader, typ LayerCipherType) (io.Reader, Finalizer, error) {
-	if c, ok := h.cipherMap[typ]; ok {
-		sk, err := c.GenerateKey()
-		if err != nil {
-			return nil, nil, err
-		}
-		opt := LayerBlockCipherOptions{
-			Private: PrivateLayerBlockCipherOptions{
-				SymmetricKey: sk,
-			},
-		}
-		encDataReader, fin, err := c.Encrypt(plainDataReader, opt)
-		if err == nil {
-			fin = wrapFinalizerWithType(fin, typ)
-		}
-		return encDataReader, fin, err
-	}
-	return nil, nil, errors.Errorf("unsupported cipher type: %s", typ)
-}
-
-// Decrypt is the handler for the layer decryption routine
-func (h *LayerBlockCipherHandler) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
-	typ := opt.Public.CipherType
-	if typ == "" {
-		return nil, LayerBlockCipherOptions{}, errors.New("no cipher type provided")
-	}
-	if c, ok := h.cipherMap[LayerCipherType(typ)]; ok {
-		return c.Decrypt(encDataReader, opt)
-	}
-	return nil, LayerBlockCipherOptions{}, errors.Errorf("unsupported cipher type: %s", typ)
-}
-
-// NewLayerBlockCipherHandler returns a new default handler
-func NewLayerBlockCipherHandler() (*LayerBlockCipherHandler, error) {
-	h := LayerBlockCipherHandler{
-		cipherMap: map[LayerCipherType]LayerBlockCipher{},
-	}
-
-	var err error
-	h.cipherMap[AES256CTR], err = NewAESCTRLayerBlockCipher(256)
-	if err != nil {
-		return nil, errors.Wrap(err, "unable to set up Cipher AES-256-CTR")
-	}
-
-	return &h, nil
-}

vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go

@@ -1,193 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package blockcipher
-
-import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/hmac"
-	"crypto/rand"
-	"crypto/sha256"
-	"fmt"
-	"hash"
-	"io"
-
-	"github.com/containers/ocicrypt/utils"
-	"github.com/pkg/errors"
-)
-
-// AESCTRLayerBlockCipher implements the AES CTR stream cipher
-type AESCTRLayerBlockCipher struct {
-	keylen         int // in bytes
-	reader         io.Reader
-	encrypt        bool
-	stream         cipher.Stream
-	err            error
-	hmac           hash.Hash
-	expHmac        []byte
-	doneEncrypting bool
-}
-
-type aesctrcryptor struct {
-	bc *AESCTRLayerBlockCipher
-}
-
-// NewAESCTRLayerBlockCipher returns a new AES SIV block cipher of 256 or 512 bits
-func NewAESCTRLayerBlockCipher(bits int) (LayerBlockCipher, error) {
-	if bits != 256 {
-		return nil, errors.New("AES CTR bit count not supported")
-	}
-	return &AESCTRLayerBlockCipher{keylen: bits / 8}, nil
-}
-
-func (r *aesctrcryptor) Read(p []byte) (int, error) {
-	var (
-		o int
-	)
-
-	if r.bc.err != nil {
-		return 0, r.bc.err
-	}
-
-	o, err := utils.FillBuffer(r.bc.reader, p)
-	if err != nil {
-		if err == io.EOF {
-			r.bc.err = err
-		} else {
-			return 0, err
-		}
-	}
-
-	if !r.bc.encrypt {
-		if _, err := r.bc.hmac.Write(p[:o]); err != nil {
-			r.bc.err = errors.Wrapf(err, "could not write to hmac")
-			return 0, r.bc.err
-		}
-
-		if r.bc.err == io.EOF {
-			// Before we return EOF we let the HMAC comparison
-			// provide a verdict
-			if !hmac.Equal(r.bc.hmac.Sum(nil), r.bc.expHmac) {
-				r.bc.err = fmt.Errorf("could not properly decrypt byte stream; exp hmac: '%x', actual hmac: '%s'", r.bc.expHmac, r.bc.hmac.Sum(nil))
-				return 0, r.bc.err
-			}
-		}
-	}
-
-	r.bc.stream.XORKeyStream(p[:o], p[:o])
-
-	if r.bc.encrypt {
-		if _, err := r.bc.hmac.Write(p[:o]); err != nil {
-			r.bc.err = errors.Wrapf(err, "could not write to hmac")
-			return 0, r.bc.err
-		}
-
-		if r.bc.err == io.EOF {
-			// Final data encrypted; Do the 'then-MAC' part
-			r.bc.doneEncrypting = true
-		}
-	}
-
-	return o, r.bc.err
-}
-
-// init initializes an instance
-func (bc *AESCTRLayerBlockCipher) init(encrypt bool, reader io.Reader, opts LayerBlockCipherOptions) (LayerBlockCipherOptions, error) {
-	var (
-		err error
-	)
-
-	key := opts.Private.SymmetricKey
-	if len(key) != bc.keylen {
-		return LayerBlockCipherOptions{}, fmt.Errorf("invalid key length of %d bytes; need %d bytes", len(key), bc.keylen)
-	}
-
-	nonce, ok := opts.GetOpt("nonce")
-	if !ok {
-		nonce = make([]byte, aes.BlockSize)
-		if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-			return LayerBlockCipherOptions{}, errors.Wrap(err, "unable to generate random nonce")
-		}
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return LayerBlockCipherOptions{}, errors.Wrap(err, "aes.NewCipher failed")
-	}
-
-	bc.reader = reader
-	bc.encrypt = encrypt
-	bc.stream = cipher.NewCTR(block, nonce)
-	bc.err = nil
-	bc.hmac = hmac.New(sha256.New, key)
-	bc.expHmac = opts.Public.Hmac
-	bc.doneEncrypting = false
-
-	if !encrypt && len(bc.expHmac) == 0 {
-		return LayerBlockCipherOptions{}, errors.New("HMAC is not provided for decryption process")
-	}
-
-	lbco := LayerBlockCipherOptions{
-		Private: PrivateLayerBlockCipherOptions{
-			SymmetricKey: key,
-			CipherOptions: map[string][]byte{
-				"nonce": nonce,
-			},
-		},
-	}
-
-	return lbco, nil
-}
-
-// GenerateKey creates a synmmetric key
-func (bc *AESCTRLayerBlockCipher) GenerateKey() ([]byte, error) {
-	key := make([]byte, bc.keylen)
-	if _, err := io.ReadFull(rand.Reader, key); err != nil {
-		return nil, err
-	}
-	return key, nil
-}
-
-// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
-func (bc *AESCTRLayerBlockCipher) Encrypt(plainDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error) {
-	lbco, err := bc.init(true, plainDataReader, opt)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	finalizer := func() (LayerBlockCipherOptions, error) {
-		if !bc.doneEncrypting {
-			return LayerBlockCipherOptions{}, errors.New("Read()ing not complete, unable to finalize")
-		}
-		if lbco.Public.CipherOptions == nil {
-			lbco.Public.CipherOptions = map[string][]byte{}
-		}
-		lbco.Public.Hmac = bc.hmac.Sum(nil)
-		return lbco, nil
-	}
-	return &aesctrcryptor{bc}, finalizer, nil
-}
-
-// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
-func (bc *AESCTRLayerBlockCipher) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
-	lbco, err := bc.init(false, encDataReader, opt)
-	if err != nil {
-		return nil, LayerBlockCipherOptions{}, err
-	}
-
-	return utils.NewDelayedReader(&aesctrcryptor{bc}, 1024*10), lbco, nil
-}

vendor/github.com/containers/ocicrypt/config/config.go

@@ -1,114 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package config
-
-// EncryptConfig is the container image PGP encryption configuration holding
-// the identifiers of those that will be able to decrypt the container and
-// the PGP public keyring file data that contains their public keys.
-type EncryptConfig struct {
-	// map holding 'gpg-recipients', 'gpg-pubkeyringfile', 'pubkeys', 'x509s'
-	Parameters map[string][][]byte
-
-	DecryptConfig DecryptConfig
-}
-
-// DecryptConfig wraps the Parameters map that holds the decryption key
-type DecryptConfig struct {
-	// map holding 'privkeys', 'x509s', 'gpg-privatekeys'
-	Parameters map[string][][]byte
-}
-
-// CryptoConfig is a common wrapper for EncryptConfig and DecrypConfig that can
-// be passed through functions that share much code for encryption and decryption
-type CryptoConfig struct {
-	EncryptConfig *EncryptConfig
-	DecryptConfig *DecryptConfig
-}
-
-// InitDecryption initialized a CryptoConfig object with parameters used for decryption
-func InitDecryption(dcparameters map[string][][]byte) CryptoConfig {
-	return CryptoConfig{
-		DecryptConfig: &DecryptConfig{
-			Parameters: dcparameters,
-		},
-	}
-}
-
-// InitEncryption initializes a CryptoConfig object with parameters used for encryption
-// It also takes dcparameters that may be needed for decryption when adding a recipient
-// to an already encrypted image
-func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig {
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters: parameters,
-			DecryptConfig: DecryptConfig{
-				Parameters: dcparameters,
-			},
-		},
-	}
-}
-
-// CombineCryptoConfigs takes a CryptoConfig list and creates a single CryptoConfig
-// containing the crypto configuration of all the key bundles
-func CombineCryptoConfigs(ccs []CryptoConfig) CryptoConfig {
-	ecparam := map[string][][]byte{}
-	ecdcparam := map[string][][]byte{}
-	dcparam := map[string][][]byte{}
-
-	for _, cc := range ccs {
-		if ec := cc.EncryptConfig; ec != nil {
-			addToMap(ecparam, ec.Parameters)
-			addToMap(ecdcparam, ec.DecryptConfig.Parameters)
-		}
-
-		if dc := cc.DecryptConfig; dc != nil {
-			addToMap(dcparam, dc.Parameters)
-		}
-	}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters: ecparam,
-			DecryptConfig: DecryptConfig{
-				Parameters: ecdcparam,
-			},
-		},
-		DecryptConfig: &DecryptConfig{
-			Parameters: dcparam,
-		},
-	}
-
-}
-
-// AttachDecryptConfig adds DecryptConfig to the field of EncryptConfig so that
-// the decryption parameters can be used to add recipients to an existing image
-// if the user is able to decrypt it.
-func (ec *EncryptConfig) AttachDecryptConfig(dc *DecryptConfig) {
-	if dc != nil {
-		addToMap(ec.DecryptConfig.Parameters, dc.Parameters)
-	}
-}
-
-func addToMap(orig map[string][][]byte, add map[string][][]byte) {
-	for k, v := range add {
-		if ov, ok := orig[k]; ok {
-			orig[k] = append(ov, v...)
-		} else {
-			orig[k] = v
-		}
-	}
-}

vendor/github.com/containers/ocicrypt/config/constructors.go

@@ -1,245 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package config
-
-import (
-	"github.com/containers/ocicrypt/crypto/pkcs11"
-	"strings"
-
-	"github.com/pkg/errors"
-	"gopkg.in/yaml.v3"
-)
-
-// EncryptWithJwe returns a CryptoConfig to encrypt with jwe public keys
-func EncryptWithJwe(pubKeys [][]byte) (CryptoConfig, error) {
-	dc := DecryptConfig{}
-	ep := map[string][][]byte{
-		"pubkeys": pubKeys,
-	}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// EncryptWithPkcs7 returns a CryptoConfig to encrypt with pkcs7 x509 certs
-func EncryptWithPkcs7(x509s [][]byte) (CryptoConfig, error) {
-	dc := DecryptConfig{}
-
-	ep := map[string][][]byte{
-		"x509s": x509s,
-	}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// EncryptWithGpg returns a CryptoConfig to encrypt with configured gpg parameters
-func EncryptWithGpg(gpgRecipients [][]byte, gpgPubRingFile []byte) (CryptoConfig, error) {
-	dc := DecryptConfig{}
-	ep := map[string][][]byte{
-		"gpg-recipients":     gpgRecipients,
-		"gpg-pubkeyringfile": {gpgPubRingFile},
-	}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// EncryptWithPkcs11 returns a CryptoConfig to encrypt with configured pkcs11 parameters
-func EncryptWithPkcs11(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Pubkeys, pkcs11Yamls [][]byte) (CryptoConfig, error) {
-	dc := DecryptConfig{}
-	ep := map[string][][]byte{}
-
-	if len(pkcs11Yamls) > 0 {
-		if pkcs11Config == nil {
-			return CryptoConfig{}, errors.New("pkcs11Config must not be nil")
-		}
-		p11confYaml, err := yaml.Marshal(pkcs11Config)
-		if err != nil {
-			return CryptoConfig{}, errors.Wrapf(err, "Could not marshal Pkcs11Config to Yaml")
-		}
-
-		dc = DecryptConfig{
-			Parameters: map[string][][]byte{
-				"pkcs11-config": {p11confYaml},
-			},
-		}
-		ep["pkcs11-yamls"] = pkcs11Yamls
-	}
-	if len(pkcs11Pubkeys) > 0 {
-		ep["pkcs11-pubkeys"] = pkcs11Pubkeys
-	}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// EncryptWithKeyProvider returns a CryptoConfig to encrypt with configured keyprovider parameters
-func EncryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error) {
-	dc := DecryptConfig{}
-	ep := make(map[string][][]byte)
-	for _, keyProvider := range keyProviders {
-		keyProvidersStr := string(keyProvider)
-		idx := strings.Index(keyProvidersStr, ":")
-		if idx > 0 {
-			ep[keyProvidersStr[:idx]] = append(ep[keyProvidersStr[:idx]], []byte(keyProvidersStr[idx+1:]))
-		} else {
-			ep[keyProvidersStr] = append(ep[keyProvidersStr], []byte("Enabled"))
-		}
-	}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// DecryptWithKeyProvider returns a CryptoConfig to decrypt with configured keyprovider parameters
-func DecryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error) {
-	dp := make(map[string][][]byte)
-	ep := map[string][][]byte{}
-	for _, keyProvider := range keyProviders {
-		keyProvidersStr := string(keyProvider)
-		idx := strings.Index(keyProvidersStr, ":")
-		if idx > 0 {
-			dp[keyProvidersStr[:idx]] = append(dp[keyProvidersStr[:idx]], []byte(keyProvidersStr[idx+1:]))
-		} else {
-			dp[keyProvidersStr] = append(dp[keyProvidersStr], []byte("Enabled"))
-		}
-	}
-	dc := DecryptConfig{
-		Parameters: dp,
-	}
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// DecryptWithPrivKeys returns a CryptoConfig to decrypt with configured private keys
-func DecryptWithPrivKeys(privKeys [][]byte, privKeysPasswords [][]byte) (CryptoConfig, error) {
-	if len(privKeys) != len(privKeysPasswords) {
-		return CryptoConfig{}, errors.New("Length of privKeys should match length of privKeysPasswords")
-	}
-
-	dc := DecryptConfig{
-		Parameters: map[string][][]byte{
-			"privkeys":           privKeys,
-			"privkeys-passwords": privKeysPasswords,
-		},
-	}
-
-	ep := map[string][][]byte{}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// DecryptWithX509s returns a CryptoConfig to decrypt with configured x509 certs
-func DecryptWithX509s(x509s [][]byte) (CryptoConfig, error) {
-	dc := DecryptConfig{
-		Parameters: map[string][][]byte{
-			"x509s": x509s,
-		},
-	}
-
-	ep := map[string][][]byte{}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// DecryptWithGpgPrivKeys returns a CryptoConfig to decrypt with configured gpg private keys
-func DecryptWithGpgPrivKeys(gpgPrivKeys, gpgPrivKeysPwds [][]byte) (CryptoConfig, error) {
-	dc := DecryptConfig{
-		Parameters: map[string][][]byte{
-			"gpg-privatekeys":           gpgPrivKeys,
-			"gpg-privatekeys-passwords": gpgPrivKeysPwds,
-		},
-	}
-
-	ep := map[string][][]byte{}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}
-
-// DecryptWithPkcs11Yaml returns a CryptoConfig to decrypt with pkcs11 YAML formatted key files
-func DecryptWithPkcs11Yaml(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Yamls [][]byte) (CryptoConfig, error) {
-	p11confYaml, err := yaml.Marshal(pkcs11Config)
-	if err != nil {
-		return CryptoConfig{}, errors.Wrapf(err, "Could not marshal Pkcs11Config to Yaml")
-	}
-
-	dc := DecryptConfig{
-		Parameters: map[string][][]byte{
-			"pkcs11-yamls":  pkcs11Yamls,
-			"pkcs11-config": {p11confYaml},
-		},
-	}
-
-	ep := map[string][][]byte{}
-
-	return CryptoConfig{
-		EncryptConfig: &EncryptConfig{
-			Parameters:    ep,
-			DecryptConfig: dc,
-		},
-		DecryptConfig: &dc,
-	}, nil
-}

vendor/github.com/containers/ocicrypt/config/keyprovider-config/config.go

@@ -1,81 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package config
-
-import (
-	"encoding/json"
-	"github.com/pkg/errors"
-	"io/ioutil"
-	"os"
-)
-
-// Command describes the structure of command, it consist of path and args, where path defines the location of
-// binary executable and args are passed on to the binary executable
-type Command struct {
-	Path string   `json:"path,omitempty"`
-	Args []string `json:"args,omitempty"`
-}
-
-// KeyProviderAttrs describes the structure of key provider, it defines the way of invocation to key provider
-type KeyProviderAttrs struct {
-	Command *Command `json:"cmd,omitempty"`
-	Grpc    string   `json:"grpc,omitempty"`
-}
-
-// OcicryptConfig represents the format of an ocicrypt_provider.conf config file
-type OcicryptConfig struct {
-	KeyProviderConfig map[string]KeyProviderAttrs `json:"key-providers"`
-}
-
-const ENVVARNAME = "OCICRYPT_KEYPROVIDER_CONFIG"
-
-// parseConfigFile parses a configuration file; it is not an error if the configuration file does
-// not exist, so no error is returned.
-func parseConfigFile(filename string) (*OcicryptConfig, error) {
-	// a non-existent config file is not an error
-	_, err := os.Stat(filename)
-	if os.IsNotExist(err) {
-		return nil, nil
-	}
-
-	data, err := ioutil.ReadFile(filename)
-	if err != nil {
-		return nil, err
-	}
-
-	ic := &OcicryptConfig{}
-	err = json.Unmarshal(data, ic)
-	return ic, err
-}
-
-// getConfiguration tries to read the configuration file at the following locations
-// ${OCICRYPT_KEYPROVIDER_CONFIG} == "/etc/ocicrypt_keyprovider.yaml"
-// If no configuration file could be found or read a null pointer is returned
-func GetConfiguration() (*OcicryptConfig, error) {
-	var ic *OcicryptConfig
-	var err error
-	filename := os.Getenv(ENVVARNAME)
-	if len(filename) > 0 {
-		ic, err = parseConfigFile(filename)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error while parsing keyprovider config file")
-		}
-	} else {
-		return nil, nil
-	}
-	return ic, nil
-}

vendor/github.com/containers/ocicrypt/crypto/pkcs11/common.go

@@ -1,134 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-       http://www.apache.org/licenses/LICENSE-2.0
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs11
-
-import (
-	"fmt"
-	"github.com/pkg/errors"
-	pkcs11uri "github.com/stefanberger/go-pkcs11uri"
-	"gopkg.in/yaml.v3"
-)
-
-// Pkcs11KeyFile describes the format of the pkcs11 (private) key file.
-// It also carries pkcs11 module related environment variables that are transferred to the
-// Pkcs11URI object and activated when the pkcs11 module is used.
-type Pkcs11KeyFile struct {
-	Pkcs11 struct {
-		Uri string `yaml:"uri"`
-	} `yaml:"pkcs11"`
-	Module struct {
-		Env map[string]string `yaml:"env,omitempty"`
-	} `yaml:"module"`
-}
-
-// Pkcs11KeyFileObject is a representation of the Pkcs11KeyFile with the pkcs11 URI as an object
-type Pkcs11KeyFileObject struct {
-	Uri *pkcs11uri.Pkcs11URI
-}
-
-// ParsePkcs11Uri parses a pkcs11 URI
-func ParsePkcs11Uri(uri string) (*pkcs11uri.Pkcs11URI, error) {
-	p11uri := pkcs11uri.New()
-	err := p11uri.Parse(uri)
-	if err != nil {
-		return nil, errors.Wrapf(err, "Could not parse Pkcs11URI from file")
-	}
-	return p11uri, err
-}
-
-// ParsePkcs11KeyFile parses a pkcs11 key file holding a pkcs11 URI describing a private key.
-// The file has the following yaml format:
-// pkcs11:
-//  - uri : <pkcs11 uri>
-// An error is returned if the pkcs11 URI is malformed
-func ParsePkcs11KeyFile(yamlstr []byte) (*Pkcs11KeyFileObject, error) {
-	p11keyfile := Pkcs11KeyFile{}
-
-	err := yaml.Unmarshal([]byte(yamlstr), &p11keyfile)
-	if err != nil {
-		return nil, errors.Wrapf(err, "Could not unmarshal pkcs11 keyfile")
-	}
-
-	p11uri, err := ParsePkcs11Uri(p11keyfile.Pkcs11.Uri)
-	if err != nil {
-		return nil, err
-	}
-	p11uri.SetEnvMap(p11keyfile.Module.Env)
-
-	return &Pkcs11KeyFileObject{Uri: p11uri}, err
-}
-
-// IsPkcs11PrivateKey checks whether the given YAML represents a Pkcs11 private key
-func IsPkcs11PrivateKey(yamlstr []byte) bool {
-	_, err := ParsePkcs11KeyFile(yamlstr)
-	return err == nil
-}
-
-// IsPkcs11PublicKey checks whether the given YAML represents a Pkcs11 public key
-func IsPkcs11PublicKey(yamlstr []byte) bool {
-	_, err := ParsePkcs11KeyFile(yamlstr)
-	return err == nil
-}
-
-// Pkcs11Config describes the layout of a pkcs11 config file
-// The file has the following yaml format:
-// module-directories:
-// - /usr/lib64/pkcs11/
-// allowd-module-paths
-// - /usr/lib64/pkcs11/libsofthsm2.so
-type Pkcs11Config struct {
-	ModuleDirectories  []string `yaml:"module-directories"`
-	AllowedModulePaths []string `yaml:"allowed-module-paths"`
-}
-
-// GetDefaultModuleDirectories returns module directories covering
-// a variety of Linux distros
-func GetDefaultModuleDirectories() []string {
-	dirs := []string{
-		"/usr/lib64/pkcs11/", // Fedora,RHEL,openSUSE
-		"/usr/lib/pkcs11/",   // Fedora,ArchLinux
-		"/usr/local/lib/pkcs11/",
-		"/usr/lib/softhsm/", // Debian,Ubuntu
-	}
-
-	// Debian directory: /usr/lib/(x86_64|aarch64|arm|powerpc64le|s390x)-linux-gnu/
-	hosttype, ostype, q := getHostAndOsType()
-	if len(hosttype) > 0 {
-		dir := fmt.Sprintf("/usr/lib/%s-%s-%s/", hosttype, ostype, q)
-		dirs = append(dirs, dir)
-	}
-	return dirs
-}
-
-// GetDefaultModuleDirectoresFormatted returns the default module directories formatted for YAML
-func GetDefaultModuleDirectoriesYaml(indent string) string {
-	res := ""
-
-	for _, dir := range GetDefaultModuleDirectories() {
-		res += indent + "- " + dir + "\n"
-	}
-	return res
-}
-
-// ParsePkcs11ConfigFile parses a pkcs11 config file hat influences the module search behavior
-// as well as the set of modules that users are allowed to use
-func ParsePkcs11ConfigFile(yamlstr []byte) (*Pkcs11Config, error) {
-	p11conf := Pkcs11Config{}
-
-	err := yaml.Unmarshal([]byte(yamlstr), &p11conf)
-	if err != nil {
-		return &p11conf, errors.Wrapf(err, "Could not parse Pkcs11Config")
-	}
-	return &p11conf, nil
-}

vendor/github.com/containers/ocicrypt/crypto/pkcs11/pkcs11helpers.go

@@ -1,485 +0,0 @@
-// +build cgo
-
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs11
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/sha1"
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"hash"
-	"net/url"
-	"os"
-	"strconv"
-	"strings"
-
-	"github.com/miekg/pkcs11"
-	"github.com/pkg/errors"
-	pkcs11uri "github.com/stefanberger/go-pkcs11uri"
-)
-
-var (
-	// OAEPLabel defines the label we use for OAEP encryption; this cannot be changed
-	OAEPLabel = []byte("")
-
-	// OAEPSha1Params describes the OAEP parameters with sha1 hash algorithm; needed by SoftHSM
-	OAEPSha1Params = &pkcs11.OAEPParams{
-		HashAlg:    pkcs11.CKM_SHA_1,
-		MGF:        pkcs11.CKG_MGF1_SHA1,
-		SourceType: pkcs11.CKZ_DATA_SPECIFIED,
-		SourceData: OAEPLabel,
-	}
-	// OAEPSha256Params describes the OAEP parameters with sha256 hash algorithm
-	OAEPSha256Params = &pkcs11.OAEPParams{
-		HashAlg:    pkcs11.CKM_SHA256,
-		MGF:        pkcs11.CKG_MGF1_SHA256,
-		SourceType: pkcs11.CKZ_DATA_SPECIFIED,
-		SourceData: OAEPLabel,
-	}
-)
-
-// rsaPublicEncryptOAEP encrypts the given plaintext with the given *rsa.PublicKey; the
-// environment variable OCICRYPT_OAEP_HASHALG can be set to 'sha1' to force usage of sha1 for OAEP (SoftHSM).
-// This function is needed by clients who are using a public key file for pkcs11 encryption
-func rsaPublicEncryptOAEP(pubKey *rsa.PublicKey, plaintext []byte) ([]byte, string, error) {
-	var (
-		hashfunc hash.Hash
-		hashalg  string
-	)
-
-	oaephash := os.Getenv("OCICRYPT_OAEP_HASHALG")
-	// The default is sha256 (previously was sha1)
-	switch strings.ToLower(oaephash) {
-	case "sha1":
-		hashfunc = sha1.New()
-		hashalg = "sha1"
-	case "sha256", "":
-		hashfunc = sha256.New()
-		hashalg = "sha256"
-	default:
-		return nil, "", errors.Errorf("Unsupported OAEP hash '%s'", oaephash)
-	}
-	ciphertext, err := rsa.EncryptOAEP(hashfunc, rand.Reader, pubKey, plaintext, OAEPLabel)
-	if err != nil {
-		return nil, "", errors.Wrapf(err, "rss.EncryptOAEP failed")
-	}
-
-	return ciphertext, hashalg, nil
-}
-
-// pkcs11UriGetLoginParameters gets the parameters necessary for login from the Pkcs11URI
-// PIN and module are mandatory; slot-id is optional and if not found -1 will be returned
-// For a privateKeyOperation a PIN is required and if none is given, this function will return an error
-func pkcs11UriGetLoginParameters(p11uri *pkcs11uri.Pkcs11URI, privateKeyOperation bool) (string, string, int64, error) {
-	var (
-		pin string
-		err error
-	)
-	if privateKeyOperation {
-		if !p11uri.HasPIN() {
-			return "", "", 0, errors.New("Missing PIN for private key operation")
-		}
-	}
-	// some devices require a PIN to find a *public* key object, others don't
-	pin, _ = p11uri.GetPIN()
-
-	module, err := p11uri.GetModule()
-	if err != nil {
-		return "", "", 0, errors.Wrap(err, "No module available in pkcs11 URI")
-	}
-
-	slotid := int64(-1)
-
-	slot, ok := p11uri.GetPathAttribute("slot-id", false)
-	if ok {
-		slotid, err = strconv.ParseInt(slot, 10, 64)
-		if err != nil {
-			return "", "", 0, errors.Wrap(err, "slot-id is not a valid number")
-		}
-		if slotid < 0 {
-			return "", "", 0, fmt.Errorf("slot-id is a negative number")
-		}
-		if uint64(slotid) > 0xffffffff {
-			return "", "", 0, fmt.Errorf("slot-id is larger than 32 bit")
-		}
-	}
-
-	return pin, module, slotid, nil
-}
-
-// pkcs11UriGetKeyIdAndLabel gets the key label by retrieving the value of the 'object' attribute
-func pkcs11UriGetKeyIdAndLabel(p11uri *pkcs11uri.Pkcs11URI) (string, string, error) {
-	keyid, ok2 := p11uri.GetPathAttribute("id", false)
-	label, ok1 := p11uri.GetPathAttribute("object", false)
-	if !ok1 && !ok2 {
-		return "", "", errors.New("Neither 'id' nor 'object' attributes were found in pkcs11 URI")
-	}
-	return keyid, label, nil
-}
-
-// pkcs11OpenSession opens a session with a pkcs11 device at the given slot and logs in with the given PIN
-func pkcs11OpenSession(p11ctx *pkcs11.Ctx, slotid uint, pin string) (session pkcs11.SessionHandle, err error) {
-	session, err = p11ctx.OpenSession(uint(slotid), pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
-	if err != nil {
-		return 0, errors.Wrapf(err, "OpenSession to slot %d failed", slotid)
-	}
-	if len(pin) > 0 {
-		err = p11ctx.Login(session, pkcs11.CKU_USER, pin)
-		if err != nil {
-			_ = p11ctx.CloseSession(session)
-			return 0, errors.Wrap(err, "Could not login to device")
-		}
-	}
-	return session, nil
-}
-
-// pkcs11UriLogin uses the given pkcs11 URI to select the pkcs11 module (share libary) and to get
-// the PIN to use for login; if the URI contains a slot-id, the given slot-id will be used, otherwise
-// one slot after the other will be attempted and the first one where login succeeds will be used
-func pkcs11UriLogin(p11uri *pkcs11uri.Pkcs11URI, privateKeyOperation bool) (ctx *pkcs11.Ctx, session pkcs11.SessionHandle, err error) {
-	pin, module, slotid, err := pkcs11UriGetLoginParameters(p11uri, privateKeyOperation)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	p11ctx := pkcs11.New(module)
-	if p11ctx == nil {
-		return nil, 0, errors.New("Please check module path, input is: " + module)
-	}
-
-	err = p11ctx.Initialize()
-	if err != nil {
-		p11Err := err.(pkcs11.Error)
-		if p11Err != pkcs11.CKR_CRYPTOKI_ALREADY_INITIALIZED {
-			return nil, 0, errors.Wrap(err, "Initialize failed")
-		}
-	}
-
-	if slotid >= 0 {
-		session, err := pkcs11OpenSession(p11ctx, uint(slotid), pin)
-		return p11ctx, session, err
-	} else {
-		slots, err := p11ctx.GetSlotList(true)
-		if err != nil {
-			return nil, 0, errors.Wrap(err, "GetSlotList failed")
-		}
-
-		tokenlabel, ok := p11uri.GetPathAttribute("token", false)
-		if !ok {
-			return nil, 0, errors.New("Missing 'token' attribute since 'slot-id' was not given")
-		}
-
-		for _, slot := range slots {
-			ti, err := p11ctx.GetTokenInfo(slot)
-			if err != nil || ti.Label != tokenlabel {
-				continue
-			}
-
-			session, err = pkcs11OpenSession(p11ctx, slot, pin)
-			if err == nil {
-				return p11ctx, session, err
-			}
-		}
-		if len(pin) > 0 {
-			return nil, 0, errors.New("Could not create session to any slot and/or log in")
-		}
-		return nil, 0, errors.New("Could not create session to any slot")
-	}
-}
-
-func pkcs11Logout(ctx *pkcs11.Ctx, session pkcs11.SessionHandle) {
-	_ = ctx.Logout(session)
-	_ = ctx.CloseSession(session)
-	_ = ctx.Finalize()
-	ctx.Destroy()
-}
-
-// findObject finds an object of the given class with the given keyid and/or label
-func findObject(p11ctx *pkcs11.Ctx, session pkcs11.SessionHandle, class uint, keyid, label string) (pkcs11.ObjectHandle, error) {
-	msg := ""
-
-	template := []*pkcs11.Attribute{
-		pkcs11.NewAttribute(pkcs11.CKA_CLASS, class),
-	}
-	if len(label) > 0 {
-		template = append(template, pkcs11.NewAttribute(pkcs11.CKA_LABEL, label))
-		msg = fmt.Sprintf("label '%s'", label)
-	}
-	if len(keyid) > 0 {
-		template = append(template, pkcs11.NewAttribute(pkcs11.CKA_ID, keyid))
-		if len(msg) > 0 {
-			msg += " and "
-		}
-		msg += url.PathEscape(keyid)
-	}
-
-	if err := p11ctx.FindObjectsInit(session, template); err != nil {
-		return 0, errors.Wrap(err, "FindObjectsInit failed")
-	}
-
-	obj, _, err := p11ctx.FindObjects(session, 100)
-	if err != nil {
-		return 0, errors.Wrap(err, "FindObjects failed")
-	}
-
-	if err := p11ctx.FindObjectsFinal(session); err != nil {
-		return 0, errors.Wrap(err, "FindObjectsFinal failed")
-	}
-	if len(obj) > 1 {
-		return 0, errors.Errorf("There are too many (=%d) keys with %s", len(obj), msg)
-	} else if len(obj) == 1 {
-		return obj[0], nil
-	}
-
-	return 0, errors.Errorf("Could not find any object with %s", msg)
-}
-
-// publicEncryptOAEP uses a public key described by a pkcs11 URI to OAEP encrypt the given plaintext
-func publicEncryptOAEP(pubKey *Pkcs11KeyFileObject, plaintext []byte) ([]byte, string, error) {
-	oldenv, err := setEnvVars(pubKey.Uri.GetEnvMap())
-	if err != nil {
-		return nil, "", err
-	}
-	defer restoreEnv(oldenv)
-
-	p11ctx, session, err := pkcs11UriLogin(pubKey.Uri, false)
-	if err != nil {
-		return nil, "", err
-	}
-	defer pkcs11Logout(p11ctx, session)
-
-	keyid, label, err := pkcs11UriGetKeyIdAndLabel(pubKey.Uri)
-	if err != nil {
-		return nil, "", err
-	}
-
-	p11PubKey, err := findObject(p11ctx, session, pkcs11.CKO_PUBLIC_KEY, keyid, label)
-	if err != nil {
-		return nil, "", err
-	}
-
-	var hashalg string
-
-	var oaep *pkcs11.OAEPParams
-	oaephash := os.Getenv("OCICRYPT_OAEP_HASHALG")
-	// The default is sha256 (previously was sha1)
-	switch strings.ToLower(oaephash) {
-	case "sha1":
-		oaep = OAEPSha1Params
-		hashalg = "sha1"
-	case "sha256", "":
-		oaep = OAEPSha256Params
-		hashalg = "sha256"
-	default:
-		return nil, "", errors.Errorf("Unsupported OAEP hash '%s'", oaephash)
-	}
-
-	err = p11ctx.EncryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_OAEP, oaep)}, p11PubKey)
-	if err != nil {
-		return nil, "", errors.Wrap(err, "EncryptInit error")
-	}
-
-	ciphertext, err := p11ctx.Encrypt(session, plaintext)
-	if err != nil {
-		return nil, "", errors.Wrap(err, "Encrypt failed")
-	}
-	return ciphertext, hashalg, nil
-}
-
-// privateDecryptOAEP uses a pkcs11 URI describing a private key to OAEP decrypt a ciphertext
-func privateDecryptOAEP(privKeyObj *Pkcs11KeyFileObject, ciphertext []byte, hashalg string) ([]byte, error) {
-	oldenv, err := setEnvVars(privKeyObj.Uri.GetEnvMap())
-	if err != nil {
-		return nil, err
-	}
-	defer restoreEnv(oldenv)
-
-	p11ctx, session, err := pkcs11UriLogin(privKeyObj.Uri, true)
-	if err != nil {
-		return nil, err
-	}
-	defer pkcs11Logout(p11ctx, session)
-
-	keyid, label, err := pkcs11UriGetKeyIdAndLabel(privKeyObj.Uri)
-	if err != nil {
-		return nil, err
-	}
-
-	p11PrivKey, err := findObject(p11ctx, session, pkcs11.CKO_PRIVATE_KEY, keyid, label)
-	if err != nil {
-		return nil, err
-	}
-
-	var oaep *pkcs11.OAEPParams
-
-	// An empty string from the Hash in the JSON historically defaults to sha1.
-	switch hashalg {
-	case "sha1", "":
-		oaep = OAEPSha1Params
-	case "sha256":
-		oaep = OAEPSha256Params
-	default:
-		return nil, errors.Errorf("Unsupported hash algorithm '%s' for decryption", hashalg)
-	}
-
-	err = p11ctx.DecryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_RSA_PKCS_OAEP, oaep)}, p11PrivKey)
-	if err != nil {
-		return nil, errors.Wrapf(err, "DecryptInit failed")
-	}
-	plaintext, err := p11ctx.Decrypt(session, ciphertext)
-	if err != nil {
-		return nil, errors.Wrapf(err, "Decrypt failed")
-	}
-	return plaintext, err
-}
-
-//
-// The following part deals with the JSON formatted message for multiple pkcs11 recipients
-//
-
-// Pkcs11Blob holds the encrypted blobs for all recipients; this is what we will put into the image's annotations
-type Pkcs11Blob struct {
-	Version    uint              `json:"version"`
-	Recipients []Pkcs11Recipient `json:"recipients"`
-}
-
-// Pkcs11Recipient holds the b64-encoded and encrypted blob for a particular recipient
-type Pkcs11Recipient struct {
-	Version uint   `json:"version"`
-	Blob    string `json:"blob"`
-	Hash    string `json:"hash,omitempty"`
-}
-
-// EncryptMultiple encrypts for one or multiple pkcs11 devices; the public keys passed to this function
-// may either be *rsa.PublicKey or *pkcs11uri.Pkcs11URI; the returned byte array is a JSON string of the
-// following format:
-// {
-//   recipients: [  // recipient list
-//     {
-//        "version": 0,
-//        "blob": <base64 encoded RSA OAEP encrypted blob>,
-//        "hash": <hash used for OAEP other than 'sha256'>
-//     } ,
-//     {
-//        "version": 0,
-//        "blob": <base64 encoded RSA OAEP encrypted blob>,
-//        "hash": <hash used for OAEP other than 'sha256'>
-//     } ,
-//     [...]
-//   ]
-// }
-func EncryptMultiple(pubKeys []interface{}, data []byte) ([]byte, error) {
-	var (
-		ciphertext []byte
-		err        error
-		pkcs11blob Pkcs11Blob = Pkcs11Blob{Version: 0}
-		hashalg    string
-	)
-
-	for _, pubKey := range pubKeys {
-		switch pkey := pubKey.(type) {
-		case *rsa.PublicKey:
-			ciphertext, hashalg, err = rsaPublicEncryptOAEP(pkey, data)
-		case *Pkcs11KeyFileObject:
-			ciphertext, hashalg, err = publicEncryptOAEP(pkey, data)
-		default:
-			err = errors.Errorf("Unsupported key object type for pkcs11 public key")
-		}
-		if err != nil {
-			return nil, err
-		}
-
-		recipient := Pkcs11Recipient{
-			Version: 0,
-			Blob:    base64.StdEncoding.EncodeToString(ciphertext),
-			Hash:    hashalg,
-		}
-
-		pkcs11blob.Recipients = append(pkcs11blob.Recipients, recipient)
-	}
-	return json.Marshal(&pkcs11blob)
-}
-
-// Decrypt tries to decrypt one of the recipients' blobs using a pkcs11 private key.
-// The input pkcs11blobstr is a string with the following format:
-// {
-//   recipients: [  // recipient list
-//     {
-//        "version": 0,
-//        "blob": <base64 encoded RSA OAEP encrypted blob>,
-//        "hash": <hash used for OAEP other than 'sha1'>
-//     } ,
-//     {
-//        "version": 0,
-//        "blob": <base64 encoded RSA OAEP encrypted blob>,
-//        "hash": <hash used for OAEP other than 'sha1'>
-//     } ,
-//     [...]
-// }
-// Note: More recent versions of this code explicitly write 'sha1'
-//       while older versions left it empty in case of 'sha1'.
-//
-func Decrypt(privKeyObjs []*Pkcs11KeyFileObject, pkcs11blobstr []byte) ([]byte, error) {
-	pkcs11blob := Pkcs11Blob{}
-	err := json.Unmarshal(pkcs11blobstr, &pkcs11blob)
-	if err != nil {
-		return nil, errors.Wrapf(err, "Could not parse Pkcs11Blob")
-	}
-	switch pkcs11blob.Version {
-	case 0:
-		// latest supported version
-	default:
-		return nil, errors.Errorf("Found Pkcs11Blob with version %d but maximum supported version is 0.", pkcs11blob.Version)
-	}
-	// since we do trial and error, collect all encountered errors
-	errs := ""
-
-	for _, recipient := range pkcs11blob.Recipients {
-		switch recipient.Version {
-		case 0:
-			// last supported version
-		default:
-			return nil, errors.Errorf("Found Pkcs11Recipient with version %d but maximum supported version is 0.", recipient.Version)
-		}
-
-		ciphertext, err := base64.StdEncoding.DecodeString(recipient.Blob)
-		if err != nil || len(ciphertext) == 0 {
-			// This should never happen... we skip over decoding issues
-			errs += fmt.Sprintf("Base64 decoding failed: %s\n", err)
-			continue
-		}
-		// try all keys until one works
-		for _, privKeyObj := range privKeyObjs {
-			plaintext, err := privateDecryptOAEP(privKeyObj, ciphertext, recipient.Hash)
-			if err == nil {
-				return plaintext, nil
-			}
-			if uri, err2 := privKeyObj.Uri.Format(); err2 == nil {
-				errs += fmt.Sprintf("%s : %s\n", uri, err)
-			} else {
-				errs += fmt.Sprintf("%s\n", err)
-			}
-		}
-	}
-
-	return nil, errors.Errorf("Could not find a pkcs11 key for decryption:\n%s", errs)
-}

vendor/github.com/containers/ocicrypt/crypto/pkcs11/pkcs11helpers_nocgo.go

@@ -1,31 +0,0 @@
-// +build !cgo
-
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs11
-
-import (
-	"github.com/pkg/errors"
-)
-
-func EncryptMultiple(pubKeys []interface{}, data []byte) ([]byte, error) {
-	return nil, errors.Errorf("ocicrypt pkcs11 not supported on this build")
-}
-
-func Decrypt(privKeyObjs []*Pkcs11KeyFileObject, pkcs11blobstr []byte) ([]byte, error) {
-	return nil, errors.Errorf("ocicrypt pkcs11 not supported on this build")
-}

vendor/github.com/containers/ocicrypt/crypto/pkcs11/utils.go

@@ -1,114 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs11
-
-import (
-	"os"
-	"runtime"
-	"strings"
-	"sync"
-
-	"github.com/pkg/errors"
-)
-
-var (
-	envLock sync.Mutex
-)
-
-// setEnvVars sets the environment variables given in the map and locks the environment from
-// modification with the same function; if successful, you *must* call restoreEnv with the return
-// value from this function
-func setEnvVars(env map[string]string) ([]string, error) {
-	envLock.Lock()
-
-	if len(env) == 0 {
-		return nil, nil
-	}
-
-	oldenv := os.Environ()
-
-	for k, v := range env {
-		err := os.Setenv(k, v)
-		if err != nil {
-			restoreEnv(oldenv)
-			return nil, errors.Wrapf(err, "Could not set environment variable '%s' to '%s'", k, v)
-		}
-	}
-
-	return oldenv, nil
-}
-
-func arrayToMap(elements []string) map[string]string {
-	o := make(map[string]string)
-
-	for _, element := range elements {
-		p := strings.SplitN(element, "=", 2)
-		if len(p) == 2 {
-			o[p[0]] = p[1]
-		}
-	}
-
-	return o
-}
-
-// restoreEnv restores the environment to be exactly as given in the array of strings
-// and unlocks the lock
-func restoreEnv(envs []string) {
-	if envs != nil && len(envs) >= 0 {
-		target := arrayToMap(envs)
-		curr := arrayToMap(os.Environ())
-
-		for nc, vc := range curr {
-			vt, ok := target[nc]
-			if !ok {
-				os.Unsetenv(nc)
-			} else if vc == vt {
-				delete(target, nc)
-			}
-		}
-
-		for nt, vt := range target {
-			os.Setenv(nt, vt)
-		}
-	}
-
-	envLock.Unlock()
-}
-
-func getHostAndOsType() (string, string, string) {
-	ht := ""
-	ot := ""
-	st := ""
-	switch runtime.GOOS {
-	case "linux":
-		ot = "linux"
-		st = "gnu"
-		switch runtime.GOARCH {
-		case "arm":
-			ht = "arm"
-		case "arm64":
-			ht = "aarch64"
-		case "amd64":
-			ht = "x86_64"
-		case "ppc64le":
-			ht = "powerpc64le"
-		case "s390x":
-			ht = "s390x"
-		}
-	}
-	return ht, ot, st
-}

vendor/github.com/containers/ocicrypt/encryption.go

@@ -1,356 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package ocicrypt
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	keyproviderconfig "github.com/containers/ocicrypt/config/keyprovider-config"
-	"github.com/containers/ocicrypt/keywrap/keyprovider"
-	"io"
-	"strings"
-
-	"github.com/containers/ocicrypt/blockcipher"
-	"github.com/containers/ocicrypt/config"
-	"github.com/containers/ocicrypt/keywrap"
-	"github.com/containers/ocicrypt/keywrap/jwe"
-	"github.com/containers/ocicrypt/keywrap/pgp"
-	"github.com/containers/ocicrypt/keywrap/pkcs11"
-	"github.com/containers/ocicrypt/keywrap/pkcs7"
-	"github.com/opencontainers/go-digest"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
-)
-
-// EncryptLayerFinalizer is a finalizer run to return the annotations to set for
-// the encrypted layer
-type EncryptLayerFinalizer func() (map[string]string, error)
-
-func init() {
-	keyWrappers = make(map[string]keywrap.KeyWrapper)
-	keyWrapperAnnotations = make(map[string]string)
-	RegisterKeyWrapper("pgp", pgp.NewKeyWrapper())
-	RegisterKeyWrapper("jwe", jwe.NewKeyWrapper())
-	RegisterKeyWrapper("pkcs7", pkcs7.NewKeyWrapper())
-	RegisterKeyWrapper("pkcs11", pkcs11.NewKeyWrapper())
-	ic, err := keyproviderconfig.GetConfiguration()
-	if err != nil {
-		log.Error(err)
-	} else if ic != nil {
-		for provider, attrs := range ic.KeyProviderConfig {
-			RegisterKeyWrapper("provider."+provider, keyprovider.NewKeyWrapper(provider, attrs))
-		}
-	}
-}
-
-var keyWrappers map[string]keywrap.KeyWrapper
-var keyWrapperAnnotations map[string]string
-
-// RegisterKeyWrapper allows to register key wrappers by their encryption scheme
-func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper) {
-	keyWrappers[scheme] = iface
-	keyWrapperAnnotations[iface.GetAnnotationID()] = scheme
-}
-
-// GetKeyWrapper looks up the encryptor interface given an encryption scheme (gpg, jwe)
-func GetKeyWrapper(scheme string) keywrap.KeyWrapper {
-	return keyWrappers[scheme]
-}
-
-// GetWrappedKeysMap returns a map of wrappedKeys as values in a
-// map with the encryption scheme(s) as the key(s)
-func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string {
-	wrappedKeysMap := make(map[string]string)
-
-	for annotationsID, scheme := range keyWrapperAnnotations {
-		if annotation, ok := desc.Annotations[annotationsID]; ok {
-			wrappedKeysMap[scheme] = annotation
-		}
-	}
-	return wrappedKeysMap
-}
-
-// EncryptLayer encrypts the layer by running one encryptor after the other
-func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error) {
-	var (
-		encLayerReader io.Reader
-		err            error
-		encrypted      bool
-		bcFin          blockcipher.Finalizer
-		privOptsData   []byte
-		pubOptsData    []byte
-	)
-
-	if ec == nil {
-		return nil, nil, errors.New("EncryptConfig must not be nil")
-	}
-
-	for annotationsID := range keyWrapperAnnotations {
-		annotation := desc.Annotations[annotationsID]
-		if annotation != "" {
-			privOptsData, err = decryptLayerKeyOptsData(&ec.DecryptConfig, desc)
-			if err != nil {
-				return nil, nil, err
-			}
-			pubOptsData, err = getLayerPubOpts(desc)
-			if err != nil {
-				return nil, nil, err
-			}
-			// already encrypted!
-			encrypted = true
-		}
-	}
-
-	if !encrypted {
-		encLayerReader, bcFin, err = commonEncryptLayer(encOrPlainLayerReader, desc.Digest, blockcipher.AES256CTR)
-		if err != nil {
-			return nil, nil, err
-		}
-	}
-
-	encLayerFinalizer := func() (map[string]string, error) {
-		// If layer was already encrypted, bcFin should be nil, use existing optsData
-		if bcFin != nil {
-			opts, err := bcFin()
-			if err != nil {
-				return nil, err
-			}
-			privOptsData, err = json.Marshal(opts.Private)
-			if err != nil {
-				return nil, errors.Wrapf(err, "could not JSON marshal opts")
-			}
-			pubOptsData, err = json.Marshal(opts.Public)
-			if err != nil {
-				return nil, errors.Wrapf(err, "could not JSON marshal opts")
-			}
-		}
-
-		newAnnotations := make(map[string]string)
-		keysWrapped := false
-		if len(keyWrapperAnnotations) == 0 {
-			return nil, errors.New("missing Annotations needed for decryption")
-		}
-		for annotationsID, scheme := range keyWrapperAnnotations {
-			b64Annotations := desc.Annotations[annotationsID]
-			keywrapper := GetKeyWrapper(scheme)
-			b64Annotations, err = preWrapKeys(keywrapper, ec, b64Annotations, privOptsData)
-			if err != nil {
-				return nil, err
-			}
-			if b64Annotations != "" {
-				keysWrapped = true
-				newAnnotations[annotationsID] = b64Annotations
-			}
-		}
-
-		if !keysWrapped {
-			return nil, errors.New("no wrapped keys produced by encryption")
-		}
-		newAnnotations["org.opencontainers.image.enc.pubopts"] = base64.StdEncoding.EncodeToString(pubOptsData)
-
-		if len(newAnnotations) == 0 {
-			return nil, errors.New("no encryptor found to handle encryption")
-		}
-
-		return newAnnotations, err
-	}
-
-	// if nothing was encrypted, we just return encLayer = nil
-	return encLayerReader, encLayerFinalizer, err
-
-}
-
-// preWrapKeys calls WrapKeys and handles the base64 encoding and concatenation of the
-// annotation data
-func preWrapKeys(keywrapper keywrap.KeyWrapper, ec *config.EncryptConfig, b64Annotations string, optsData []byte) (string, error) {
-	newAnnotation, err := keywrapper.WrapKeys(ec, optsData)
-	if err != nil || len(newAnnotation) == 0 {
-		return b64Annotations, err
-	}
-	b64newAnnotation := base64.StdEncoding.EncodeToString(newAnnotation)
-	if b64Annotations == "" {
-		return b64newAnnotation, nil
-	}
-	return b64Annotations + "," + b64newAnnotation, nil
-}
-
-// DecryptLayer decrypts a layer trying one keywrap.KeyWrapper after the other to see whether it
-// can apply the provided private key
-// If unwrapOnly is set we will only try to decrypt the layer encryption key and return
-func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error) {
-	if dc == nil {
-		return nil, "", errors.New("DecryptConfig must not be nil")
-	}
-	privOptsData, err := decryptLayerKeyOptsData(dc, desc)
-	if err != nil || unwrapOnly {
-		return nil, "", err
-	}
-
-	var pubOptsData []byte
-	pubOptsData, err = getLayerPubOpts(desc)
-	if err != nil {
-		return nil, "", err
-	}
-
-	return commonDecryptLayer(encLayerReader, privOptsData, pubOptsData)
-}
-
-func decryptLayerKeyOptsData(dc *config.DecryptConfig, desc ocispec.Descriptor) ([]byte, error) {
-	privKeyGiven := false
-	errs := ""
-	if len(keyWrapperAnnotations) == 0 {
-		return nil, errors.New("missing Annotations needed for decryption")
-	}
-	for annotationsID, scheme := range keyWrapperAnnotations {
-		b64Annotation := desc.Annotations[annotationsID]
-		if b64Annotation != "" {
-			keywrapper := GetKeyWrapper(scheme)
-
-			if keywrapper.NoPossibleKeys(dc.Parameters) {
-				continue
-			}
-
-			if len(keywrapper.GetPrivateKeys(dc.Parameters)) > 0 {
-				privKeyGiven = true
-			}
-			optsData, err := preUnwrapKey(keywrapper, dc, b64Annotation)
-			if err != nil {
-				// try next keywrap.KeyWrapper
-				errs += fmt.Sprintf("%s\n", err)
-				continue
-			}
-			if optsData == nil {
-				// try next keywrap.KeyWrapper
-				continue
-			}
-			return optsData, nil
-		}
-	}
-	if !privKeyGiven {
-		return nil, errors.New("missing private key needed for decryption")
-	}
-	return nil, errors.Errorf("no suitable key unwrapper found or none of the private keys could be used for decryption:\n%s", errs)
-}
-
-func getLayerPubOpts(desc ocispec.Descriptor) ([]byte, error) {
-	pubOptsString := desc.Annotations["org.opencontainers.image.enc.pubopts"]
-	if pubOptsString == "" {
-		return json.Marshal(blockcipher.PublicLayerBlockCipherOptions{})
-	}
-	return base64.StdEncoding.DecodeString(pubOptsString)
-}
-
-// preUnwrapKey decodes the comma separated base64 strings and calls the Unwrap function
-// of the given keywrapper with it and returns the result in case the Unwrap functions
-// does not return an error. If all attempts fail, an error is returned.
-func preUnwrapKey(keywrapper keywrap.KeyWrapper, dc *config.DecryptConfig, b64Annotations string) ([]byte, error) {
-	if b64Annotations == "" {
-		return nil, nil
-	}
-	errs := ""
-	for _, b64Annotation := range strings.Split(b64Annotations, ",") {
-		annotation, err := base64.StdEncoding.DecodeString(b64Annotation)
-		if err != nil {
-			return nil, errors.New("could not base64 decode the annotation")
-		}
-		optsData, err := keywrapper.UnwrapKey(dc, annotation)
-		if err != nil {
-			errs += fmt.Sprintf("- %s\n", err)
-			continue
-		}
-		return optsData, nil
-	}
-	return nil, errors.Errorf("no suitable key found for decrypting layer key:\n%s", errs)
-}
-
-// commonEncryptLayer is a function to encrypt the plain layer using a new random
-// symmetric key and return the LayerBlockCipherHandler's JSON in string form for
-// later use during decryption
-func commonEncryptLayer(plainLayerReader io.Reader, d digest.Digest, typ blockcipher.LayerCipherType) (io.Reader, blockcipher.Finalizer, error) {
-	lbch, err := blockcipher.NewLayerBlockCipherHandler()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	encLayerReader, bcFin, err := lbch.Encrypt(plainLayerReader, typ)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	newBcFin := func() (blockcipher.LayerBlockCipherOptions, error) {
-		lbco, err := bcFin()
-		if err != nil {
-			return blockcipher.LayerBlockCipherOptions{}, err
-		}
-		lbco.Private.Digest = d
-		return lbco, nil
-	}
-
-	return encLayerReader, newBcFin, err
-}
-
-// commonDecryptLayer decrypts an encrypted layer previously encrypted with commonEncryptLayer
-// by passing along the optsData
-func commonDecryptLayer(encLayerReader io.Reader, privOptsData []byte, pubOptsData []byte) (io.Reader, digest.Digest, error) {
-	privOpts := blockcipher.PrivateLayerBlockCipherOptions{}
-	err := json.Unmarshal(privOptsData, &privOpts)
-	if err != nil {
-		return nil, "", errors.Wrapf(err, "could not JSON unmarshal privOptsData")
-	}
-
-	lbch, err := blockcipher.NewLayerBlockCipherHandler()
-	if err != nil {
-		return nil, "", err
-	}
-
-	pubOpts := blockcipher.PublicLayerBlockCipherOptions{}
-	if len(pubOptsData) > 0 {
-		err := json.Unmarshal(pubOptsData, &pubOpts)
-		if err != nil {
-			return nil, "", errors.Wrapf(err, "could not JSON unmarshal pubOptsData")
-		}
-	}
-
-	opts := blockcipher.LayerBlockCipherOptions{
-		Private: privOpts,
-		Public:  pubOpts,
-	}
-
-	plainLayerReader, opts, err := lbch.Decrypt(encLayerReader, opts)
-	if err != nil {
-		return nil, "", err
-	}
-
-	return plainLayerReader, opts.Private.Digest, nil
-}
-
-// FilterOutAnnotations filters out the annotations belonging to the image encryption 'namespace'
-// and returns a map with those taken out
-func FilterOutAnnotations(annotations map[string]string) map[string]string {
-	a := make(map[string]string)
-	if len(annotations) > 0 {
-		for k, v := range annotations {
-			if strings.HasPrefix(k, "org.opencontainers.image.enc.") {
-				continue
-			}
-			a[k] = v
-		}
-	}
-	return a
-}

vendor/github.com/containers/ocicrypt/gpg.go

@@ -1,425 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package ocicrypt
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"regexp"
-	"strconv"
-	"strings"
-
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
-	"golang.org/x/term"
-)
-
-// GPGVersion enum representing the GPG client version to use.
-type GPGVersion int
-
-const (
-	// GPGv2 signifies gpgv2+
-	GPGv2 GPGVersion = iota
-	// GPGv1 signifies gpgv1+
-	GPGv1
-	// GPGVersionUndetermined signifies gpg client version undetermined
-	GPGVersionUndetermined
-)
-
-// GPGClient defines an interface for wrapping the gpg command line tools
-type GPGClient interface {
-	// ReadGPGPubRingFile gets the byte sequence of the gpg public keyring
-	ReadGPGPubRingFile() ([]byte, error)
-	// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
-	GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error)
-	// GetSecretKeyDetails gets the details of a secret key
-	GetSecretKeyDetails(keyid uint64) ([]byte, bool, error)
-	// GetKeyDetails gets the details of a public key
-	GetKeyDetails(keyid uint64) ([]byte, bool, error)
-	// ResolveRecipients resolves PGP key ids to user names
-	ResolveRecipients([]string) []string
-}
-
-// gpgClient contains generic gpg client information
-type gpgClient struct {
-	gpgHomeDir string
-}
-
-// gpgv2Client is a gpg2 client
-type gpgv2Client struct {
-	gpgClient
-}
-
-// gpgv1Client is a gpg client
-type gpgv1Client struct {
-	gpgClient
-}
-
-// GuessGPGVersion guesses the version of gpg. Defaults to gpg2 if exists, if
-// not defaults to regular gpg.
-func GuessGPGVersion() GPGVersion {
-	if err := exec.Command("gpg2", "--version").Run(); err == nil {
-		return GPGv2
-	} else if err := exec.Command("gpg", "--version").Run(); err == nil {
-		return GPGv1
-	} else {
-		return GPGVersionUndetermined
-	}
-}
-
-// NewGPGClient creates a new GPGClient object representing the given version
-// and using the given home directory
-func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error) {
-	v := new(GPGVersion)
-	switch gpgVersion {
-	case "v1":
-		*v = GPGv1
-	case "v2":
-		*v = GPGv2
-	default:
-		v = nil
-	}
-	return newGPGClient(v, gpgHomeDir)
-}
-
-func newGPGClient(version *GPGVersion, homedir string) (GPGClient, error) {
-	var gpgVersion GPGVersion
-	if version != nil {
-		gpgVersion = *version
-	} else {
-		gpgVersion = GuessGPGVersion()
-	}
-
-	switch gpgVersion {
-	case GPGv1:
-		return &gpgv1Client{
-			gpgClient: gpgClient{gpgHomeDir: homedir},
-		}, nil
-	case GPGv2:
-		return &gpgv2Client{
-			gpgClient: gpgClient{gpgHomeDir: homedir},
-		}, nil
-	case GPGVersionUndetermined:
-		return nil, fmt.Errorf("unable to determine GPG version")
-	default:
-		return nil, fmt.Errorf("unhandled case: NewGPGClient")
-	}
-}
-
-// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
-func (gc *gpgv2Client) GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error) {
-	var args []string
-
-	if gc.gpgHomeDir != "" {
-		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
-	}
-
-	rfile, wfile, err := os.Pipe()
-	if err != nil {
-		return nil, errors.Wrapf(err, "could not create pipe")
-	}
-	defer func() {
-		rfile.Close()
-		wfile.Close()
-	}()
-	// fill pipe in background
-	go func(passphrase string) {
-		_, _ = wfile.Write([]byte(passphrase))
-		wfile.Close()
-	}(passphrase)
-
-	args = append(args, []string{"--pinentry-mode", "loopback", "--batch", "--passphrase-fd", fmt.Sprintf("%d", 3), "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
-
-	cmd := exec.Command("gpg2", args...)
-	cmd.ExtraFiles = []*os.File{rfile}
-
-	return runGPGGetOutput(cmd)
-}
-
-// ReadGPGPubRingFile reads the GPG public key ring file
-func (gc *gpgv2Client) ReadGPGPubRingFile() ([]byte, error) {
-	var args []string
-
-	if gc.gpgHomeDir != "" {
-		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
-	}
-	args = append(args, []string{"--batch", "--export"}...)
-
-	cmd := exec.Command("gpg2", args...)
-
-	return runGPGGetOutput(cmd)
-}
-
-func (gc *gpgv2Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
-	var args []string
-
-	if gc.gpgHomeDir != "" {
-		args = []string{"--homedir", gc.gpgHomeDir}
-	}
-	args = append(args, option, fmt.Sprintf("0x%x", keyid))
-
-	cmd := exec.Command("gpg2", args...)
-
-	keydata, err := runGPGGetOutput(cmd)
-	return keydata, err == nil, err
-}
-
-// GetSecretKeyDetails retrieves the secret key details of key with keyid.
-// returns a byte array of the details and a bool if the key exists
-func (gc *gpgv2Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
-	return gc.getKeyDetails("-K", keyid)
-}
-
-// GetKeyDetails retrieves the public key details of key with keyid.
-// returns a byte array of the details and a bool if the key exists
-func (gc *gpgv2Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
-	return gc.getKeyDetails("-k", keyid)
-}
-
-// ResolveRecipients converts PGP keyids to email addresses, if possible
-func (gc *gpgv2Client) ResolveRecipients(recipients []string) []string {
-	return resolveRecipients(gc, recipients)
-}
-
-// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
-func (gc *gpgv1Client) GetGPGPrivateKey(keyid uint64, _ string) ([]byte, error) {
-	var args []string
-
-	if gc.gpgHomeDir != "" {
-		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
-	}
-	args = append(args, []string{"--batch", "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
-
-	cmd := exec.Command("gpg", args...)
-
-	return runGPGGetOutput(cmd)
-}
-
-// ReadGPGPubRingFile reads the GPG public key ring file
-func (gc *gpgv1Client) ReadGPGPubRingFile() ([]byte, error) {
-	var args []string
-
-	if gc.gpgHomeDir != "" {
-		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
-	}
-	args = append(args, []string{"--batch", "--export"}...)
-
-	cmd := exec.Command("gpg", args...)
-
-	return runGPGGetOutput(cmd)
-}
-
-func (gc *gpgv1Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
-	var args []string
-
-	if gc.gpgHomeDir != "" {
-		args = []string{"--homedir", gc.gpgHomeDir}
-	}
-	args = append(args, option, fmt.Sprintf("0x%x", keyid))
-
-	cmd := exec.Command("gpg", args...)
-
-	keydata, err := runGPGGetOutput(cmd)
-
-	return keydata, err == nil, err
-}
-
-// GetSecretKeyDetails retrieves the secret key details of key with keyid.
-// returns a byte array of the details and a bool if the key exists
-func (gc *gpgv1Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
-	return gc.getKeyDetails("-K", keyid)
-}
-
-// GetKeyDetails retrieves the public key details of key with keyid.
-// returns a byte array of the details and a bool if the key exists
-func (gc *gpgv1Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
-	return gc.getKeyDetails("-k", keyid)
-}
-
-// ResolveRecipients converts PGP keyids to email addresses, if possible
-func (gc *gpgv1Client) ResolveRecipients(recipients []string) []string {
-	return resolveRecipients(gc, recipients)
-}
-
-// runGPGGetOutput runs the GPG commandline and returns stdout as byte array
-// and any stderr in the error
-func runGPGGetOutput(cmd *exec.Cmd) ([]byte, error) {
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return nil, err
-	}
-	stderr, err := cmd.StderrPipe()
-	if err != nil {
-		return nil, err
-	}
-	if err := cmd.Start(); err != nil {
-		return nil, err
-	}
-
-	stdoutstr, err2 := ioutil.ReadAll(stdout)
-	stderrstr, _ := ioutil.ReadAll(stderr)
-
-	if err := cmd.Wait(); err != nil {
-		return nil, fmt.Errorf("error from %s: %s", cmd.Path, string(stderrstr))
-	}
-
-	return stdoutstr, err2
-}
-
-// resolveRecipients walks the list of recipients and attempts to convert
-// all keyIds to email addresses; if something goes wrong during the
-// conversion of a recipient, the original string is returned for that
-// recpient
-func resolveRecipients(gc GPGClient, recipients []string) []string {
-	var result []string
-
-	for _, recipient := range recipients {
-		keyID, err := strconv.ParseUint(recipient, 0, 64)
-		if err != nil {
-			result = append(result, recipient)
-		} else {
-			details, found, _ := gc.GetKeyDetails(keyID)
-			if !found {
-				result = append(result, recipient)
-			} else {
-				email := extractEmailFromDetails(details)
-				if email == "" {
-					result = append(result, recipient)
-				} else {
-					result = append(result, email)
-				}
-			}
-		}
-	}
-	return result
-}
-
-var emailPattern = regexp.MustCompile(`uid\s+\[.*\]\s.*\s<(?P<email>.+)>`)
-
-func extractEmailFromDetails(details []byte) string {
-	loc := emailPattern.FindSubmatchIndex(details)
-	if len(loc) == 0 {
-		return ""
-	}
-	return string(emailPattern.Expand(nil, []byte("$email"), details, loc))
-}
-
-// uint64ToStringArray converts an array of uint64's to an array of strings
-// by applying a format string to each uint64
-func uint64ToStringArray(format string, in []uint64) []string {
-	var ret []string
-
-	for _, v := range in {
-		ret = append(ret, fmt.Sprintf(format, v))
-	}
-	return ret
-}
-
-// GPGGetPrivateKey walks the list of layerInfos and tries to decrypt the
-// wrapped symmetric keys. For this it determines whether a private key is
-// in the GPGVault or on this system and prompts for the passwords for those
-// that are available. If we do not find a private key on the system for
-// getting to the symmetric key of a layer then an error is generated.
-func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, mustFindKey bool) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error) {
-	// PrivateKeyData describes a private key
-	type PrivateKeyData struct {
-		KeyData         []byte
-		KeyDataPassword []byte
-	}
-	var pkd PrivateKeyData
-	keyIDPasswordMap := make(map[uint64]PrivateKeyData)
-
-	for _, desc := range descs {
-		for scheme, b64pgpPackets := range GetWrappedKeysMap(desc) {
-			if scheme != "pgp" {
-				continue
-			}
-			keywrapper := GetKeyWrapper(scheme)
-			if keywrapper == nil {
-				return nil, nil, errors.Errorf("could not get KeyWrapper for %s\n", scheme)
-			}
-			keyIds, err := keywrapper.GetKeyIdsFromPacket(b64pgpPackets)
-			if err != nil {
-				return nil, nil, err
-			}
-
-			found := false
-			for _, keyid := range keyIds {
-				// do we have this key? -- first check the vault
-				if gpgVault != nil {
-					_, keydata := gpgVault.GetGPGPrivateKey(keyid)
-					if len(keydata) > 0 {
-						pkd = PrivateKeyData{
-							KeyData:         keydata,
-							KeyDataPassword: nil, // password not supported in this case
-						}
-						keyIDPasswordMap[keyid] = pkd
-						found = true
-						break
-					}
-				} else if gpgClient != nil {
-					// check the local system's gpg installation
-					keyinfo, haveKey, _ := gpgClient.GetSecretKeyDetails(keyid)
-					// this may fail if the key is not here; we ignore the error
-					if !haveKey {
-						// key not on this system
-						continue
-					}
-
-					_, found = keyIDPasswordMap[keyid]
-					if !found {
-						fmt.Printf("Passphrase required for Key id 0x%x: \n%v", keyid, string(keyinfo))
-						fmt.Printf("Enter passphrase for key with Id 0x%x: ", keyid)
-
-						password, err := term.ReadPassword(int(os.Stdin.Fd()))
-						fmt.Printf("\n")
-						if err != nil {
-							return nil, nil, err
-						}
-						keydata, err := gpgClient.GetGPGPrivateKey(keyid, string(password))
-						if err != nil {
-							return nil, nil, err
-						}
-						pkd = PrivateKeyData{
-							KeyData:         keydata,
-							KeyDataPassword: password,
-						}
-						keyIDPasswordMap[keyid] = pkd
-						found = true
-					}
-					break
-				} else {
-					return nil, nil, errors.New("no GPGVault or GPGClient passed")
-				}
-			}
-			if !found && len(b64pgpPackets) > 0 && mustFindKey {
-				ids := uint64ToStringArray("0x%x", keyIds)
-
-				return nil, nil, errors.Errorf("missing key for decryption of layer %x of %s. Need one of the following keys: %s", desc.Digest, desc.Platform, strings.Join(ids, ", "))
-			}
-		}
-	}
-
-	for _, pkd := range keyIDPasswordMap {
-		gpgPrivKeys = append(gpgPrivKeys, pkd.KeyData)
-		gpgPrivKeysPwds = append(gpgPrivKeysPwds, pkd.KeyDataPassword)
-	}
-
-	return gpgPrivKeys, gpgPrivKeysPwds, nil
-}

vendor/github.com/containers/ocicrypt/gpgvault.go

@@ -1,100 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package ocicrypt
-
-import (
-	"bytes"
-	"io/ioutil"
-
-	"github.com/pkg/errors"
-	"golang.org/x/crypto/openpgp"
-	"golang.org/x/crypto/openpgp/packet"
-)
-
-// GPGVault defines an interface for wrapping multiple secret key rings
-type GPGVault interface {
-	// AddSecretKeyRingData adds a secret keyring via its raw byte array
-	AddSecretKeyRingData(gpgSecretKeyRingData []byte) error
-	// AddSecretKeyRingDataArray adds secret keyring via its raw byte arrays
-	AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error
-	// AddSecretKeyRingFiles adds secret keyrings given their filenames
-	AddSecretKeyRingFiles(filenames []string) error
-	// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
-	GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte)
-}
-
-// gpgVault wraps an array of gpgSecretKeyRing
-type gpgVault struct {
-	entityLists []openpgp.EntityList
-	keyDataList [][]byte // the raw data original passed in
-}
-
-// NewGPGVault creates an empty GPGVault
-func NewGPGVault() GPGVault {
-	return &gpgVault{}
-}
-
-// AddSecretKeyRingData adds a secret keyring's to the gpgVault; the raw byte
-// array read from the file must be passed and will be parsed by this function
-func (g *gpgVault) AddSecretKeyRingData(gpgSecretKeyRingData []byte) error {
-	// read the private keys
-	r := bytes.NewReader(gpgSecretKeyRingData)
-	entityList, err := openpgp.ReadKeyRing(r)
-	if err != nil {
-		return errors.Wrapf(err, "could not read keyring")
-	}
-	g.entityLists = append(g.entityLists, entityList)
-	g.keyDataList = append(g.keyDataList, gpgSecretKeyRingData)
-	return nil
-}
-
-// AddSecretKeyRingDataArray adds secret keyrings to the gpgVault; the raw byte
-// arrays read from files must be passed
-func (g *gpgVault) AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error {
-	for _, gpgSecretKeyRingData := range gpgSecretKeyRingDataArray {
-		if err := g.AddSecretKeyRingData(gpgSecretKeyRingData); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// AddSecretKeyRingFiles adds the secret key rings given their filenames
-func (g *gpgVault) AddSecretKeyRingFiles(filenames []string) error {
-	for _, filename := range filenames {
-		gpgSecretKeyRingData, err := ioutil.ReadFile(filename)
-		if err != nil {
-			return err
-		}
-		err = g.AddSecretKeyRingData(gpgSecretKeyRingData)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
-func (g *gpgVault) GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte) {
-	for i, el := range g.entityLists {
-		decKeys := el.KeysByIdUsage(keyid, packet.KeyFlagEncryptCommunications)
-		if len(decKeys) > 0 {
-			return decKeys, g.keyDataList[i]
-		}
-	}
-	return nil, nil
-}

vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go

@@ -1,136 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package jwe
-
-import (
-	"crypto/ecdsa"
-
-	"github.com/containers/ocicrypt/config"
-	"github.com/containers/ocicrypt/keywrap"
-	"github.com/containers/ocicrypt/utils"
-	"github.com/pkg/errors"
-	jose "gopkg.in/square/go-jose.v2"
-)
-
-type jweKeyWrapper struct {
-}
-
-func (kw *jweKeyWrapper) GetAnnotationID() string {
-	return "org.opencontainers.image.enc.keys.jwe"
-}
-
-// NewKeyWrapper returns a new key wrapping interface using jwe
-func NewKeyWrapper() keywrap.KeyWrapper {
-	return &jweKeyWrapper{}
-}
-
-// WrapKeys wraps the session key for recpients and encrypts the optsData, which
-// describe the symmetric key used for encrypting the layer
-func (kw *jweKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
-	var joseRecipients []jose.Recipient
-
-	err := addPubKeys(&joseRecipients, ec.Parameters["pubkeys"])
-	if err != nil {
-		return nil, err
-	}
-	// no recipients is not an error...
-	if len(joseRecipients) == 0 {
-		return nil, nil
-	}
-
-	encrypter, err := jose.NewMultiEncrypter(jose.A256GCM, joseRecipients, nil)
-	if err != nil {
-		return nil, errors.Wrapf(err, "jose.NewMultiEncrypter failed")
-	}
-	jwe, err := encrypter.Encrypt(optsData)
-	if err != nil {
-		return nil, errors.Wrapf(err, "JWE Encrypt failed")
-	}
-	return []byte(jwe.FullSerialize()), nil
-}
-
-func (kw *jweKeyWrapper) UnwrapKey(dc *config.DecryptConfig, jweString []byte) ([]byte, error) {
-	jwe, err := jose.ParseEncrypted(string(jweString))
-	if err != nil {
-		return nil, errors.New("jose.ParseEncrypted failed")
-	}
-
-	privKeys := kw.GetPrivateKeys(dc.Parameters)
-	if len(privKeys) == 0 {
-		return nil, errors.New("No private keys found for JWE decryption")
-	}
-	privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
-	if len(privKeysPasswords) != len(privKeys) {
-		return nil, errors.New("Private key password array length must be same as that of private keys")
-	}
-
-	for idx, privKey := range privKeys {
-		key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "JWE")
-		if err != nil {
-			return nil, err
-		}
-		_, _, plain, err := jwe.DecryptMulti(key)
-		if err == nil {
-			return plain, nil
-		}
-	}
-	return nil, errors.New("JWE: No suitable private key found for decryption")
-}
-
-func (kw *jweKeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
-	return len(kw.GetPrivateKeys(dcparameters)) == 0
-}
-
-func (kw *jweKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
-	return dcparameters["privkeys"]
-}
-
-func (kw *jweKeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
-	return dcparameters["privkeys-passwords"]
-}
-
-func (kw *jweKeyWrapper) GetKeyIdsFromPacket(b64jwes string) ([]uint64, error) {
-	return nil, nil
-}
-
-func (kw *jweKeyWrapper) GetRecipients(b64jwes string) ([]string, error) {
-	return []string{"[jwe]"}, nil
-}
-
-func addPubKeys(joseRecipients *[]jose.Recipient, pubKeys [][]byte) error {
-	if len(pubKeys) == 0 {
-		return nil
-	}
-	for _, pubKey := range pubKeys {
-		key, err := utils.ParsePublicKey(pubKey, "JWE")
-		if err != nil {
-			return err
-		}
-
-		alg := jose.RSA_OAEP
-		switch key.(type) {
-		case *ecdsa.PublicKey:
-			alg = jose.ECDH_ES_A256KW
-		}
-
-		*joseRecipients = append(*joseRecipients, jose.Recipient{
-			Algorithm: alg,
-			Key:       key,
-		})
-	}
-	return nil
-}

vendor/github.com/containers/ocicrypt/keywrap/keyprovider/keyprovider.go

@@ -1,242 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package keyprovider
-
-import (
-	"context"
-	"encoding/json"
-	"github.com/containers/ocicrypt/config"
-	keyproviderconfig "github.com/containers/ocicrypt/config/keyprovider-config"
-	"github.com/containers/ocicrypt/keywrap"
-	"github.com/containers/ocicrypt/utils"
-	keyproviderpb "github.com/containers/ocicrypt/utils/keyprovider"
-	"github.com/pkg/errors"
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-)
-
-type keyProviderKeyWrapper struct {
-	provider string
-	attrs    keyproviderconfig.KeyProviderAttrs
-}
-
-func (kw *keyProviderKeyWrapper) GetAnnotationID() string {
-	return "org.opencontainers.image.enc.keys.provider." + kw.provider
-}
-
-// NewKeyWrapper returns a new key wrapping interface using keyprovider
-func NewKeyWrapper(p string, a keyproviderconfig.KeyProviderAttrs) keywrap.KeyWrapper {
-	return &keyProviderKeyWrapper{provider: p, attrs: a}
-}
-
-type KeyProviderKeyWrapProtocolOperation string
-
-var (
-	OpKeyWrap   KeyProviderKeyWrapProtocolOperation = "keywrap"
-	OpKeyUnwrap KeyProviderKeyWrapProtocolOperation = "keyunwrap"
-)
-
-// KeyProviderKeyWrapProtocolInput defines the input to the key provider binary or grpc method.
-type KeyProviderKeyWrapProtocolInput struct {
-	// Operation is either "keywrap" or "keyunwrap"
-	Operation KeyProviderKeyWrapProtocolOperation `json:"op"`
-	// KeyWrapParams encodes the arguments to key wrap if operation is set to wrap
-	KeyWrapParams KeyWrapParams `json:"keywrapparams,omitempty"`
-	// KeyUnwrapParams encodes the arguments to key unwrap if operation is set to unwrap
-	KeyUnwrapParams KeyUnwrapParams `json:"keyunwrapparams,omitempty"`
-}
-
-// KeyProviderKeyWrapProtocolOutput defines the output of the key provider binary or grpc method.
-type KeyProviderKeyWrapProtocolOutput struct {
-	// KeyWrapResult encodes the results to key wrap if operation is to wrap
-	KeyWrapResults KeyWrapResults `json:"keywrapresults,omitempty"`
-	// KeyUnwrapResult encodes the result to key unwrap if operation is to unwrap
-	KeyUnwrapResults KeyUnwrapResults `json:"keyunwrapresults,omitempty"`
-}
-
-type KeyWrapParams struct {
-	Ec       *config.EncryptConfig `json:"ec"`
-	OptsData []byte                `json:"optsdata"`
-}
-
-type KeyUnwrapParams struct {
-	Dc         *config.DecryptConfig `json:"dc"`
-	Annotation []byte                `json:"annotation"`
-}
-
-type KeyUnwrapResults struct {
-	OptsData []byte `json:"optsdata"`
-}
-
-type KeyWrapResults struct {
-	Annotation []byte `json:"annotation"`
-}
-
-var runner utils.CommandExecuter
-
-func init() {
-	runner = utils.Runner{}
-}
-
-// WrapKeys calls appropriate binary executable/grpc server for wrapping the session key for recipients and gets encrypted optsData, which
-// describe the symmetric key used for encrypting the layer
-func (kw *keyProviderKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
-
-	input, err := json.Marshal(KeyProviderKeyWrapProtocolInput{
-		Operation: OpKeyWrap,
-		KeyWrapParams: KeyWrapParams{
-			Ec:       ec,
-			OptsData: optsData,
-		},
-	})
-
-	if err != nil {
-		return nil, err
-	}
-
-	if _, ok := ec.Parameters[kw.provider]; ok {
-		if kw.attrs.Command != nil {
-			protocolOuput, err := getProviderCommandOutput(input, kw.attrs.Command)
-			if err != nil {
-				return nil, errors.Wrap(err, "error while retrieving keyprovider protocol command output")
-			}
-			return protocolOuput.KeyWrapResults.Annotation, nil
-		} else if kw.attrs.Grpc != "" {
-			protocolOuput, err := getProviderGRPCOutput(input, kw.attrs.Grpc, OpKeyWrap)
-			if err != nil {
-				return nil, errors.Wrap(err, "error while retrieving keyprovider protocol grpc output")
-			}
-
-			return protocolOuput.KeyWrapResults.Annotation, nil
-		} else {
-			return nil, errors.New("Unsupported keyprovider invocation. Supported invocation methods are grpc and cmd")
-		}
-	}
-
-	return nil, nil
-}
-
-// UnwrapKey calls appropriate binary executable/grpc server for unwrapping the session key based on the protocol given in annotation for recipients and gets decrypted optsData,
-// which describe the symmetric key used for decrypting the layer
-func (kw *keyProviderKeyWrapper) UnwrapKey(dc *config.DecryptConfig, jsonString []byte) ([]byte, error) {
-	input, err := json.Marshal(KeyProviderKeyWrapProtocolInput{
-		Operation: OpKeyUnwrap,
-		KeyUnwrapParams: KeyUnwrapParams{
-			Dc:         dc,
-			Annotation: jsonString,
-		},
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	if kw.attrs.Command != nil {
-		protocolOuput, err := getProviderCommandOutput(input, kw.attrs.Command)
-		if err != nil {
-			// If err is not nil, then ignore it and continue with rest of the given keyproviders
-			return nil, err
-		}
-
-		return protocolOuput.KeyUnwrapResults.OptsData, nil
-	} else if kw.attrs.Grpc != "" {
-		protocolOuput, err := getProviderGRPCOutput(input, kw.attrs.Grpc, OpKeyUnwrap)
-		if err != nil {
-			// If err is not nil, then ignore it and continue with rest of the given keyproviders
-			return nil, err
-		}
-
-		return protocolOuput.KeyUnwrapResults.OptsData, nil
-	} else {
-		return nil, errors.New("Unsupported keyprovider invocation. Supported invocation methods are grpc and cmd")
-	}
-}
-
-func getProviderGRPCOutput(input []byte, connString string, operation KeyProviderKeyWrapProtocolOperation) (*KeyProviderKeyWrapProtocolOutput, error) {
-	var protocolOuput KeyProviderKeyWrapProtocolOutput
-	var grpcOutput *keyproviderpb.KeyProviderKeyWrapProtocolOutput
-	cc, err := grpc.Dial(connString, grpc.WithInsecure())
-	if err != nil {
-		return nil, errors.Wrap(err, "error while dialing rpc server")
-	}
-	defer func() {
-		derr := cc.Close()
-		if derr != nil {
-			log.WithError(derr).Error("Error closing grpc socket")
-		}
-	}()
-
-	client := keyproviderpb.NewKeyProviderServiceClient(cc)
-	req := &keyproviderpb.KeyProviderKeyWrapProtocolInput{
-		KeyProviderKeyWrapProtocolInput: input,
-	}
-
-	if operation == OpKeyWrap {
-		grpcOutput, err = client.WrapKey(context.Background(), req)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error from grpc method")
-		}
-	} else if operation == OpKeyUnwrap {
-		grpcOutput, err = client.UnWrapKey(context.Background(), req)
-		if err != nil {
-			return nil, errors.Wrap(err, "Error from grpc method")
-		}
-	} else {
-		return nil, errors.New("Unsupported operation")
-	}
-
-	respBytes := grpcOutput.GetKeyProviderKeyWrapProtocolOutput()
-	err = json.Unmarshal(respBytes, &protocolOuput)
-	if err != nil {
-		return nil, errors.Wrap(err, "Error while unmarshalling grpc method output")
-	}
-
-	return &protocolOuput, nil
-}
-
-func getProviderCommandOutput(input []byte, command *keyproviderconfig.Command) (*KeyProviderKeyWrapProtocolOutput, error) {
-	var protocolOuput KeyProviderKeyWrapProtocolOutput
-	// Convert interface to command structure
-	respBytes, err := runner.Exec(command.Path, command.Args, input)
-	if err != nil {
-		return nil, err
-	}
-	err = json.Unmarshal(respBytes, &protocolOuput)
-	if err != nil {
-		return nil, errors.Wrap(err, "Error while unmarshalling binary executable command output")
-	}
-	return &protocolOuput, nil
-}
-
-// Return false as it is not applicable to keyprovider protocol
-func (kw *keyProviderKeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
-	return false
-}
-
-// Return nil as it is not applicable to keyprovider protocol
-func (kw *keyProviderKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
-	return nil
-}
-
-// Return nil as it is not applicable to keyprovider protocol
-func (kw *keyProviderKeyWrapper) GetKeyIdsFromPacket(_ string) ([]uint64, error) {
-	return nil, nil
-}
-
-// Return nil as it is not applicable to keyprovider protocol
-func (kw *keyProviderKeyWrapper) GetRecipients(_ string) ([]string, error) {
-	return nil, nil
-}

vendor/github.com/containers/ocicrypt/keywrap/keywrap.go

@@ -1,48 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package keywrap
-
-import (
-	"github.com/containers/ocicrypt/config"
-)
-
-// KeyWrapper is the interface used for wrapping keys using
-// a specific encryption technology (pgp, jwe)
-type KeyWrapper interface {
-	WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error)
-	UnwrapKey(dc *config.DecryptConfig, annotation []byte) ([]byte, error)
-	GetAnnotationID() string
-
-	// NoPossibleKeys returns true if there is no possibility of performing
-	// decryption for parameters provided.
-	NoPossibleKeys(dcparameters map[string][][]byte) bool
-
-	// GetPrivateKeys (optional) gets the array of private keys. It is an optional implementation
-	// as in some key services, a private key may not be exportable (i.e. HSM)
-	// If not implemented, return nil
-	GetPrivateKeys(dcparameters map[string][][]byte) [][]byte
-
-	// GetKeyIdsFromPacket (optional) gets a list of key IDs. This is optional as some encryption
-	// schemes may not have a notion of key IDs
-	// If not implemented, return the nil slice
-	GetKeyIdsFromPacket(packet string) ([]uint64, error)
-
-	// GetRecipients (optional) gets a list of recipients. It is optional due to the validity of
-	// recipients in a particular encryptiong scheme
-	// If not implemented, return the nil slice
-	GetRecipients(packet string) ([]string, error)
-}

vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go

@@ -1,273 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pgp
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/rand"
-	"encoding/base64"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net/mail"
-	"strconv"
-	"strings"
-
-	"github.com/containers/ocicrypt/config"
-	"github.com/containers/ocicrypt/keywrap"
-	"github.com/pkg/errors"
-	"golang.org/x/crypto/openpgp"
-	"golang.org/x/crypto/openpgp/packet"
-)
-
-type gpgKeyWrapper struct {
-}
-
-// NewKeyWrapper returns a new key wrapping interface for pgp
-func NewKeyWrapper() keywrap.KeyWrapper {
-	return &gpgKeyWrapper{}
-}
-
-var (
-	// GPGDefaultEncryptConfig is the default configuration for layer encryption/decryption
-	GPGDefaultEncryptConfig = &packet.Config{
-		Rand:              rand.Reader,
-		DefaultHash:       crypto.SHA256,
-		DefaultCipher:     packet.CipherAES256,
-		CompressionConfig: &packet.CompressionConfig{Level: 0}, // No compression
-		RSABits:           2048,
-	}
-)
-
-func (kw *gpgKeyWrapper) GetAnnotationID() string {
-	return "org.opencontainers.image.enc.keys.pgp"
-}
-
-// WrapKeys wraps the session key for recpients and encrypts the optsData, which
-// describe the symmetric key used for encrypting the layer
-func (kw *gpgKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
-	ciphertext := new(bytes.Buffer)
-	el, err := kw.createEntityList(ec)
-	if err != nil {
-		return nil, errors.Wrap(err, "unable to create entity list")
-	}
-	if len(el) == 0 {
-		// nothing to do -- not an error
-		return nil, nil
-	}
-
-	plaintextWriter, err := openpgp.Encrypt(ciphertext,
-		el,  /*EntityList*/
-		nil, /* Sign*/
-		nil, /* FileHint */
-		GPGDefaultEncryptConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	if _, err = plaintextWriter.Write(optsData); err != nil {
-		return nil, err
-	} else if err = plaintextWriter.Close(); err != nil {
-		return nil, err
-	}
-	return ciphertext.Bytes(), err
-}
-
-// UnwrapKey unwraps the symmetric key with which the layer is encrypted
-// This symmetric key is encrypted in the PGP payload.
-func (kw *gpgKeyWrapper) UnwrapKey(dc *config.DecryptConfig, pgpPacket []byte) ([]byte, error) {
-	pgpPrivateKeys, pgpPrivateKeysPwd, err := kw.getKeyParameters(dc.Parameters)
-	if err != nil {
-		return nil, err
-	}
-
-	for idx, pgpPrivateKey := range pgpPrivateKeys {
-		r := bytes.NewBuffer(pgpPrivateKey)
-		entityList, err := openpgp.ReadKeyRing(r)
-		if err != nil {
-			return nil, errors.Wrap(err, "unable to parse private keys")
-		}
-
-		var prompt openpgp.PromptFunction
-		if len(pgpPrivateKeysPwd) > idx {
-			responded := false
-			prompt = func(keys []openpgp.Key, symmetric bool) ([]byte, error) {
-				if responded {
-					return nil, fmt.Errorf("don't seem to have the right password")
-				}
-				responded = true
-				for _, key := range keys {
-					if key.PrivateKey != nil {
-						_ = key.PrivateKey.Decrypt(pgpPrivateKeysPwd[idx])
-					}
-				}
-				return pgpPrivateKeysPwd[idx], nil
-			}
-		}
-
-		r = bytes.NewBuffer(pgpPacket)
-		md, err := openpgp.ReadMessage(r, entityList, prompt, GPGDefaultEncryptConfig)
-		if err != nil {
-			continue
-		}
-		// we get the plain key options back
-		optsData, err := ioutil.ReadAll(md.UnverifiedBody)
-		if err != nil {
-			continue
-		}
-		return optsData, nil
-	}
-	return nil, errors.New("PGP: No suitable key found to unwrap key")
-}
-
-// GetKeyIdsFromWrappedKeys converts the base64 encoded PGPPacket to uint64 keyIds
-func (kw *gpgKeyWrapper) GetKeyIdsFromPacket(b64pgpPackets string) ([]uint64, error) {
-
-	var keyids []uint64
-	for _, b64pgpPacket := range strings.Split(b64pgpPackets, ",") {
-		pgpPacket, err := base64.StdEncoding.DecodeString(b64pgpPacket)
-		if err != nil {
-			return nil, errors.Wrapf(err, "could not decode base64 encoded PGP packet")
-		}
-		newids, err := kw.getKeyIDs(pgpPacket)
-		if err != nil {
-			return nil, err
-		}
-		keyids = append(keyids, newids...)
-	}
-	return keyids, nil
-}
-
-// getKeyIDs parses a PGPPacket and gets the list of recipients' key IDs
-func (kw *gpgKeyWrapper) getKeyIDs(pgpPacket []byte) ([]uint64, error) {
-	var keyids []uint64
-
-	kbuf := bytes.NewBuffer(pgpPacket)
-	packets := packet.NewReader(kbuf)
-ParsePackets:
-	for {
-		p, err := packets.Next()
-		if err == io.EOF {
-			break ParsePackets
-		}
-		if err != nil {
-			return []uint64{}, errors.Wrapf(err, "packets.Next() failed")
-		}
-		switch p := p.(type) {
-		case *packet.EncryptedKey:
-			keyids = append(keyids, p.KeyId)
-		case *packet.SymmetricallyEncrypted:
-			break ParsePackets
-		}
-	}
-	return keyids, nil
-}
-
-// GetRecipients converts the wrappedKeys to an array of recipients
-func (kw *gpgKeyWrapper) GetRecipients(b64pgpPackets string) ([]string, error) {
-	keyIds, err := kw.GetKeyIdsFromPacket(b64pgpPackets)
-	if err != nil {
-		return nil, err
-	}
-	var array []string
-	for _, keyid := range keyIds {
-		array = append(array, "0x"+strconv.FormatUint(keyid, 16))
-	}
-	return array, nil
-}
-
-func (kw *gpgKeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
-	return len(kw.GetPrivateKeys(dcparameters)) == 0
-}
-
-func (kw *gpgKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
-	return dcparameters["gpg-privatekeys"]
-}
-
-func (kw *gpgKeyWrapper) getKeyParameters(dcparameters map[string][][]byte) ([][]byte, [][]byte, error) {
-
-	privKeys := kw.GetPrivateKeys(dcparameters)
-	if len(privKeys) == 0 {
-		return nil, nil, errors.New("GPG: Missing private key parameter")
-	}
-
-	return privKeys, dcparameters["gpg-privatekeys-passwords"], nil
-}
-
-// createEntityList creates the opengpg EntityList by reading the KeyRing
-// first and then filtering out recipients' keys
-func (kw *gpgKeyWrapper) createEntityList(ec *config.EncryptConfig) (openpgp.EntityList, error) {
-	pgpPubringFile := ec.Parameters["gpg-pubkeyringfile"]
-	if len(pgpPubringFile) == 0 {
-		return nil, nil
-	}
-	r := bytes.NewReader(pgpPubringFile[0])
-
-	entityList, err := openpgp.ReadKeyRing(r)
-	if err != nil {
-		return nil, err
-	}
-
-	gpgRecipients := ec.Parameters["gpg-recipients"]
-	if len(gpgRecipients) == 0 {
-		return nil, nil
-	}
-
-	rSet := make(map[string]int)
-	for _, r := range gpgRecipients {
-		rSet[string(r)] = 0
-	}
-
-	var filteredList openpgp.EntityList
-	for _, entity := range entityList {
-		for k := range entity.Identities {
-			addr, err := mail.ParseAddress(k)
-			if err != nil {
-				return nil, err
-			}
-			for _, r := range gpgRecipients {
-				recp := string(r)
-				if strings.Compare(addr.Name, recp) == 0 || strings.Compare(addr.Address, recp) == 0 {
-					filteredList = append(filteredList, entity)
-					rSet[recp] = rSet[recp] + 1
-				}
-			}
-		}
-	}
-
-	// make sure we found keys for all the Recipients...
-	var buffer bytes.Buffer
-	notFound := false
-	buffer.WriteString("PGP: No key found for the following recipients: ")
-
-	for k, v := range rSet {
-		if v == 0 {
-			if notFound {
-				buffer.WriteString(", ")
-			}
-			buffer.WriteString(k)
-			notFound = true
-		}
-	}
-
-	if notFound {
-		return nil, errors.New(buffer.String())
-	}
-
-	return filteredList, nil
-}

vendor/github.com/containers/ocicrypt/keywrap/pkcs11/keywrapper_pkcs11.go

@@ -1,147 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs11
-
-import (
-	"github.com/containers/ocicrypt/config"
-	"github.com/containers/ocicrypt/crypto/pkcs11"
-	"github.com/containers/ocicrypt/keywrap"
-	"github.com/containers/ocicrypt/utils"
-
-	"github.com/pkg/errors"
-)
-
-type pkcs11KeyWrapper struct {
-}
-
-func (kw *pkcs11KeyWrapper) GetAnnotationID() string {
-	return "org.opencontainers.image.enc.keys.pkcs11"
-}
-
-// NewKeyWrapper returns a new key wrapping interface using pkcs11
-func NewKeyWrapper() keywrap.KeyWrapper {
-	return &pkcs11KeyWrapper{}
-}
-
-// WrapKeys wraps the session key for recpients and encrypts the optsData, which
-// describe the symmetric key used for encrypting the layer
-func (kw *pkcs11KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
-	pkcs11Recipients, err := addPubKeys(&ec.DecryptConfig, append(ec.Parameters["pkcs11-pubkeys"], ec.Parameters["pkcs11-yamls"]...))
-	if err != nil {
-		return nil, err
-	}
-	// no recipients is not an error...
-	if len(pkcs11Recipients) == 0 {
-		return nil, nil
-	}
-
-	jsonString, err := pkcs11.EncryptMultiple(pkcs11Recipients, optsData)
-	if err != nil {
-		return nil, errors.Wrapf(err, "PKCS11 EncryptMulitple failed")
-	}
-	return jsonString, nil
-}
-
-func (kw *pkcs11KeyWrapper) UnwrapKey(dc *config.DecryptConfig, jsonString []byte) ([]byte, error) {
-	var pkcs11PrivKeys []*pkcs11.Pkcs11KeyFileObject
-
-	privKeys := kw.GetPrivateKeys(dc.Parameters)
-	if len(privKeys) == 0 {
-		return nil, errors.New("No private keys found for PKCS11 decryption")
-	}
-
-	p11conf, err := p11confFromParameters(dc.Parameters)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, privKey := range privKeys {
-		key, err := utils.ParsePrivateKey(privKey, nil, "PKCS11")
-		if err != nil {
-			return nil, err
-		}
-		switch pkcs11PrivKey := key.(type) {
-		case *pkcs11.Pkcs11KeyFileObject:
-			if p11conf != nil {
-				pkcs11PrivKey.Uri.SetModuleDirectories(p11conf.ModuleDirectories)
-				pkcs11PrivKey.Uri.SetAllowedModulePaths(p11conf.AllowedModulePaths)
-			}
-			pkcs11PrivKeys = append(pkcs11PrivKeys, pkcs11PrivKey)
-		default:
-			continue
-		}
-	}
-
-	plaintext, err := pkcs11.Decrypt(pkcs11PrivKeys, jsonString)
-	if err == nil {
-		return plaintext, nil
-	}
-
-	return nil, errors.Wrapf(err, "PKCS11: No suitable private key found for decryption")
-}
-
-func (kw *pkcs11KeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
-	return len(kw.GetPrivateKeys(dcparameters)) == 0
-}
-
-func (kw *pkcs11KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
-	return dcparameters["pkcs11-yamls"]
-}
-
-func (kw *pkcs11KeyWrapper) GetKeyIdsFromPacket(_ string) ([]uint64, error) {
-	return nil, nil
-}
-
-func (kw *pkcs11KeyWrapper) GetRecipients(_ string) ([]string, error) {
-	return []string{"[pkcs11]"}, nil
-}
-
-func addPubKeys(dc *config.DecryptConfig, pubKeys [][]byte) ([]interface{}, error) {
-	var pkcs11Keys []interface{}
-
-	if len(pubKeys) == 0 {
-		return pkcs11Keys, nil
-	}
-
-	p11conf, err := p11confFromParameters(dc.Parameters)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, pubKey := range pubKeys {
-		key, err := utils.ParsePublicKey(pubKey, "PKCS11")
-		if err != nil {
-			return nil, err
-		}
-		switch pkcs11PubKey := key.(type) {
-		case *pkcs11.Pkcs11KeyFileObject:
-			if p11conf != nil {
-				pkcs11PubKey.Uri.SetModuleDirectories(p11conf.ModuleDirectories)
-				pkcs11PubKey.Uri.SetAllowedModulePaths(p11conf.AllowedModulePaths)
-			}
-		}
-		pkcs11Keys = append(pkcs11Keys, key)
-	}
-	return pkcs11Keys, nil
-}
-
-func p11confFromParameters(dcparameters map[string][][]byte) (*pkcs11.Pkcs11Config, error) {
-	if _, ok := dcparameters["pkcs11-config"]; ok {
-		return pkcs11.ParsePkcs11ConfigFile(dcparameters["pkcs11-config"][0])
-	}
-	return nil, nil
-}

vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go

@@ -1,136 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs7
-
-import (
-	"crypto"
-	"crypto/x509"
-
-	"github.com/containers/ocicrypt/config"
-	"github.com/containers/ocicrypt/keywrap"
-	"github.com/containers/ocicrypt/utils"
-	"github.com/pkg/errors"
-	"go.mozilla.org/pkcs7"
-)
-
-type pkcs7KeyWrapper struct {
-}
-
-// NewKeyWrapper returns a new key wrapping interface using jwe
-func NewKeyWrapper() keywrap.KeyWrapper {
-	return &pkcs7KeyWrapper{}
-}
-
-func (kw *pkcs7KeyWrapper) GetAnnotationID() string {
-	return "org.opencontainers.image.enc.keys.pkcs7"
-}
-
-// WrapKeys wraps the session key for recpients and encrypts the optsData, which
-// describe the symmetric key used for encrypting the layer
-func (kw *pkcs7KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
-	x509Certs, err := collectX509s(ec.Parameters["x509s"])
-	if err != nil {
-		return nil, err
-	}
-	// no recipients is not an error...
-	if len(x509Certs) == 0 {
-		return nil, nil
-	}
-
-	pkcs7.ContentEncryptionAlgorithm = pkcs7.EncryptionAlgorithmAES128GCM
-	return pkcs7.Encrypt(optsData, x509Certs)
-}
-
-func collectX509s(x509s [][]byte) ([]*x509.Certificate, error) {
-	if len(x509s) == 0 {
-		return nil, nil
-	}
-	var x509Certs []*x509.Certificate
-	for _, x509 := range x509s {
-		x509Cert, err := utils.ParseCertificate(x509, "PKCS7")
-		if err != nil {
-			return nil, err
-		}
-		x509Certs = append(x509Certs, x509Cert)
-	}
-	return x509Certs, nil
-}
-
-func (kw *pkcs7KeyWrapper) NoPossibleKeys(dcparameters map[string][][]byte) bool {
-	return len(kw.GetPrivateKeys(dcparameters)) == 0
-}
-
-func (kw *pkcs7KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
-	return dcparameters["privkeys"]
-}
-
-func (kw *pkcs7KeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
-	return dcparameters["privkeys-passwords"]
-}
-
-// UnwrapKey unwraps the symmetric key with which the layer is encrypted
-// This symmetric key is encrypted in the PKCS7 payload.
-func (kw *pkcs7KeyWrapper) UnwrapKey(dc *config.DecryptConfig, pkcs7Packet []byte) ([]byte, error) {
-	privKeys := kw.GetPrivateKeys(dc.Parameters)
-	if len(privKeys) == 0 {
-		return nil, errors.New("no private keys found for PKCS7 decryption")
-	}
-	privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
-	if len(privKeysPasswords) != len(privKeys) {
-		return nil, errors.New("private key password array length must be same as that of private keys")
-	}
-
-	x509Certs, err := collectX509s(dc.Parameters["x509s"])
-	if err != nil {
-		return nil, err
-	}
-	if len(x509Certs) == 0 {
-		return nil, errors.New("no x509 certificates found needed for PKCS7 decryption")
-	}
-
-	p7, err := pkcs7.Parse(pkcs7Packet)
-	if err != nil {
-		return nil, errors.Wrapf(err, "could not parse PKCS7 packet")
-	}
-
-	for idx, privKey := range privKeys {
-		key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "PKCS7")
-		if err != nil {
-			return nil, err
-		}
-		for _, x509Cert := range x509Certs {
-			optsData, err := p7.Decrypt(x509Cert, crypto.PrivateKey(key))
-			if err != nil {
-				continue
-			}
-			return optsData, nil
-		}
-	}
-	return nil, errors.New("PKCS7: No suitable private key found for decryption")
-}
-
-// GetKeyIdsFromWrappedKeys converts the base64 encoded Packet to uint64 keyIds;
-// We cannot do this with pkcs7
-func (kw *pkcs7KeyWrapper) GetKeyIdsFromPacket(b64pkcs7Packets string) ([]uint64, error) {
-	return nil, nil
-}
-
-// GetRecipients converts the wrappedKeys to an array of recipients
-// We cannot do this with pkcs7
-func (kw *pkcs7KeyWrapper) GetRecipients(b64pkcs7Packets string) ([]string, error) {
-	return []string{"[pkcs7]"}, nil
-}

vendor/github.com/containers/ocicrypt/reader.go

@@ -1,40 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package ocicrypt
-
-import (
-	"io"
-)
-
-type readerAtReader struct {
-	r   io.ReaderAt
-	off int64
-}
-
-// ReaderFromReaderAt takes an io.ReaderAt and returns an io.Reader
-func ReaderFromReaderAt(r io.ReaderAt) io.Reader {
-	return &readerAtReader{
-		r:   r,
-		off: 0,
-	}
-}
-
-func (rar *readerAtReader) Read(p []byte) (n int, err error) {
-	n, err = rar.r.ReadAt(p, rar.off)
-	rar.off += int64(n)
-	return n, err
-}

vendor/github.com/containers/ocicrypt/spec/spec.go

@@ -1,16 +0,0 @@
-package spec
-
-const (
-	// MediaTypeLayerEnc is MIME type used for encrypted layers.
-	MediaTypeLayerEnc = "application/vnd.oci.image.layer.v1.tar+encrypted"
-	// MediaTypeLayerGzipEnc is MIME type used for encrypted gzip-compressed layers.
-	MediaTypeLayerGzipEnc = "application/vnd.oci.image.layer.v1.tar+gzip+encrypted"
-	// MediaTypeLayerZstdEnc is MIME type used for encrypted zstd-compressed layers.
-	MediaTypeLayerZstdEnc = "application/vnd.oci.image.layer.v1.tar+zstd+encrypted"
-	// MediaTypeLayerNonDistributableEnc is MIME type used for non distributable encrypted layers.
-	MediaTypeLayerNonDistributableEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+encrypted"
-	// MediaTypeLayerGzipEnc is MIME type used for non distributable encrypted gzip-compressed layers.
-	MediaTypeLayerNonDistributableGzipEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip+encrypted"
-	// MediaTypeLayerZstdEnc is MIME type used for non distributable encrypted zstd-compressed layers.
-	MediaTypeLayerNonDistributableZsdtEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+zstd+encrypted"
-)

vendor/github.com/containers/ocicrypt/utils/delayedreader.go

@@ -1,109 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package utils
-
-import (
-	"io"
-)
-
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}
-
-// DelayedReader wraps a io.Reader and allows a client to use the Reader
-// interface. The DelayedReader holds back some buffer to the client
-// so that it can report any error that occurred on the Reader it wraps
-// early to the client while it may still have held some data back.
-type DelayedReader struct {
-	reader   io.Reader // Reader to Read() bytes from and delay them
-	err      error     // error that occurred on the reader
-	buffer   []byte    // delay buffer
-	bufbytes int       // number of bytes in the delay buffer to give to Read(); on '0' we return 'EOF' to caller
-	bufoff   int       // offset in the delay buffer to give to Read()
-}
-
-// NewDelayedReader wraps a io.Reader and allocates a delay buffer of bufsize bytes
-func NewDelayedReader(reader io.Reader, bufsize uint) io.Reader {
-	return &DelayedReader{
-		reader: reader,
-		buffer: make([]byte, bufsize),
-	}
-}
-
-// Read implements the io.Reader interface
-func (dr *DelayedReader) Read(p []byte) (int, error) {
-	if dr.err != nil && dr.err != io.EOF {
-		return 0, dr.err
-	}
-
-	// if we are completely drained, return io.EOF
-	if dr.err == io.EOF && dr.bufbytes == 0 {
-		return 0, io.EOF
-	}
-
-	// only at the beginning we fill our delay buffer in an extra step
-	if dr.bufbytes < len(dr.buffer) && dr.err == nil {
-		dr.bufbytes, dr.err = FillBuffer(dr.reader, dr.buffer)
-		if dr.err != nil && dr.err != io.EOF {
-			return 0, dr.err
-		}
-	}
-	// dr.err != nil means we have EOF and can drain the delay buffer
-	// otherwise we need to still read from the reader
-
-	var tmpbuf []byte
-	tmpbufbytes := 0
-	if dr.err == nil {
-		tmpbuf = make([]byte, len(p))
-		tmpbufbytes, dr.err = FillBuffer(dr.reader, tmpbuf)
-		if dr.err != nil && dr.err != io.EOF {
-			return 0, dr.err
-		}
-	}
-
-	// copy out of the delay buffer into 'p'
-	tocopy1 := min(len(p), dr.bufbytes)
-	c1 := copy(p[:tocopy1], dr.buffer[dr.bufoff:])
-	dr.bufoff += c1
-	dr.bufbytes -= c1
-
-	c2 := 0
-	// can p still hold more data?
-	if c1 < len(p) {
-		// copy out of the tmpbuf into 'p'
-		c2 = copy(p[tocopy1:], tmpbuf[:tmpbufbytes])
-	}
-
-	// if tmpbuf holds data we need to hold onto, copy them
-	// into the delay buffer
-	if tmpbufbytes-c2 > 0 {
-		// left-shift the delay buffer and append the tmpbuf's remaining data
-		dr.buffer = dr.buffer[dr.bufoff : dr.bufoff+dr.bufbytes]
-		dr.buffer = append(dr.buffer, tmpbuf[c2:tmpbufbytes]...)
-		dr.bufoff = 0
-		dr.bufbytes = len(dr.buffer)
-	}
-
-	var err error
-	if dr.bufbytes == 0 {
-		err = io.EOF
-	}
-	return c1 + c2, err
-}

vendor/github.com/containers/ocicrypt/utils/ioutils.go

@@ -1,56 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package utils
-
-import (
-	"bytes"
-	"github.com/pkg/errors"
-	"io"
-	"os/exec"
-)
-
-// FillBuffer fills the given buffer with as many bytes from the reader as possible. It returns
-// EOF if an EOF was encountered or any other error.
-func FillBuffer(reader io.Reader, buffer []byte) (int, error) {
-	n, err := io.ReadFull(reader, buffer)
-	if err == io.ErrUnexpectedEOF {
-		return n, io.EOF
-	}
-	return n, err
-}
-
-// first argument is the command, like cat or echo,
-// the second is the list of args to pass to it
-type CommandExecuter interface {
-	Exec(string, []string, []byte) ([]byte, error)
-}
-
-type Runner struct{}
-
-// ExecuteCommand is used to execute a linux command line command and return the output of the command with an error if it exists.
-func (r Runner) Exec(cmdName string, args []string, input []byte) ([]byte, error) {
-	var out bytes.Buffer
-	stdInputBuffer := bytes.NewBuffer(input)
-	cmd := exec.Command(cmdName, args...)
-	cmd.Stdin = stdInputBuffer
-	cmd.Stdout = &out
-	err := cmd.Run()
-	if err != nil {
-		return nil, errors.Wrapf(err, "Error while running command: %s", cmdName)
-	}
-	return out.Bytes(), nil
-}

vendor/github.com/containers/ocicrypt/utils/keyprovider/keyprovider.pb.go

@@ -1,243 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// source: keyprovider.proto
-
-package keyprovider
-
-import (
-	context "context"
-	fmt "fmt"
-	proto "github.com/golang/protobuf/proto"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
-
-type KeyProviderKeyWrapProtocolInput struct {
-	KeyProviderKeyWrapProtocolInput []byte   `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolInput,proto3" json:"KeyProviderKeyWrapProtocolInput,omitempty"`
-	XXX_NoUnkeyedLiteral            struct{} `json:"-"`
-	XXX_unrecognized                []byte   `json:"-"`
-	XXX_sizecache                   int32    `json:"-"`
-}
-
-func (m *KeyProviderKeyWrapProtocolInput) Reset()         { *m = KeyProviderKeyWrapProtocolInput{} }
-func (m *KeyProviderKeyWrapProtocolInput) String() string { return proto.CompactTextString(m) }
-func (*KeyProviderKeyWrapProtocolInput) ProtoMessage()    {}
-func (*KeyProviderKeyWrapProtocolInput) Descriptor() ([]byte, []int) {
-	return fileDescriptor_da74c8e785ad390c, []int{0}
-}
-
-func (m *KeyProviderKeyWrapProtocolInput) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Unmarshal(m, b)
-}
-func (m *KeyProviderKeyWrapProtocolInput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Marshal(b, m, deterministic)
-}
-func (m *KeyProviderKeyWrapProtocolInput) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Merge(m, src)
-}
-func (m *KeyProviderKeyWrapProtocolInput) XXX_Size() int {
-	return xxx_messageInfo_KeyProviderKeyWrapProtocolInput.Size(m)
-}
-func (m *KeyProviderKeyWrapProtocolInput) XXX_DiscardUnknown() {
-	xxx_messageInfo_KeyProviderKeyWrapProtocolInput.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_KeyProviderKeyWrapProtocolInput proto.InternalMessageInfo
-
-func (m *KeyProviderKeyWrapProtocolInput) GetKeyProviderKeyWrapProtocolInput() []byte {
-	if m != nil {
-		return m.KeyProviderKeyWrapProtocolInput
-	}
-	return nil
-}
-
-type KeyProviderKeyWrapProtocolOutput struct {
-	KeyProviderKeyWrapProtocolOutput []byte   `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolOutput,proto3" json:"KeyProviderKeyWrapProtocolOutput,omitempty"`
-	XXX_NoUnkeyedLiteral             struct{} `json:"-"`
-	XXX_unrecognized                 []byte   `json:"-"`
-	XXX_sizecache                    int32    `json:"-"`
-}
-
-func (m *KeyProviderKeyWrapProtocolOutput) Reset()         { *m = KeyProviderKeyWrapProtocolOutput{} }
-func (m *KeyProviderKeyWrapProtocolOutput) String() string { return proto.CompactTextString(m) }
-func (*KeyProviderKeyWrapProtocolOutput) ProtoMessage()    {}
-func (*KeyProviderKeyWrapProtocolOutput) Descriptor() ([]byte, []int) {
-	return fileDescriptor_da74c8e785ad390c, []int{1}
-}
-
-func (m *KeyProviderKeyWrapProtocolOutput) XXX_Unmarshal(b []byte) error {
-	return xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Unmarshal(m, b)
-}
-func (m *KeyProviderKeyWrapProtocolOutput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	return xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Marshal(b, m, deterministic)
-}
-func (m *KeyProviderKeyWrapProtocolOutput) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Merge(m, src)
-}
-func (m *KeyProviderKeyWrapProtocolOutput) XXX_Size() int {
-	return xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.Size(m)
-}
-func (m *KeyProviderKeyWrapProtocolOutput) XXX_DiscardUnknown() {
-	xxx_messageInfo_KeyProviderKeyWrapProtocolOutput.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_KeyProviderKeyWrapProtocolOutput proto.InternalMessageInfo
-
-func (m *KeyProviderKeyWrapProtocolOutput) GetKeyProviderKeyWrapProtocolOutput() []byte {
-	if m != nil {
-		return m.KeyProviderKeyWrapProtocolOutput
-	}
-	return nil
-}
-
-func init() {
-	proto.RegisterType((*KeyProviderKeyWrapProtocolInput)(nil), "keyprovider.keyProviderKeyWrapProtocolInput")
-	proto.RegisterType((*KeyProviderKeyWrapProtocolOutput)(nil), "keyprovider.keyProviderKeyWrapProtocolOutput")
-}
-
-func init() {
-	proto.RegisterFile("keyprovider.proto", fileDescriptor_da74c8e785ad390c)
-}
-
-var fileDescriptor_da74c8e785ad390c = []byte{
-	// 169 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0x12, 0xcc, 0x4e, 0xad, 0x2c,
-	0x28, 0xca, 0x2f, 0xcb, 0x4c, 0x49, 0x2d, 0xd2, 0x03, 0x32, 0x4a, 0xf2, 0x85, 0xb8, 0x91, 0x84,
-	0x94, 0xb2, 0xb9, 0xe4, 0x81, 0xdc, 0x00, 0x28, 0xd7, 0x3b, 0xb5, 0x32, 0xbc, 0x28, 0xb1, 0x20,
-	0x00, 0xa4, 0x2e, 0x39, 0x3f, 0xc7, 0x33, 0xaf, 0xa0, 0xb4, 0x44, 0xc8, 0x83, 0x4b, 0xde, 0x1b,
-	0xbf, 0x12, 0x09, 0x46, 0x05, 0x46, 0x0d, 0x9e, 0x20, 0x42, 0xca, 0x94, 0xf2, 0xb8, 0x14, 0x70,
-	0x5b, 0xe6, 0x5f, 0x5a, 0x02, 0xb2, 0xcd, 0x8b, 0x4b, 0xc1, 0x9b, 0x80, 0x1a, 0xa8, 0x75, 0x04,
-	0xd5, 0x19, 0xbd, 0x62, 0xe4, 0x12, 0x42, 0x52, 0x14, 0x9c, 0x5a, 0x54, 0x96, 0x99, 0x9c, 0x2a,
-	0x94, 0xc1, 0xc5, 0x0e, 0x52, 0x0c, 0x94, 0x11, 0xd2, 0xd1, 0x43, 0x0e, 0x1f, 0x02, 0x21, 0x21,
-	0xa5, 0x4b, 0xa4, 0x6a, 0x88, 0xf5, 0x4a, 0x0c, 0x42, 0x59, 0x5c, 0x9c, 0xa1, 0x79, 0xf4, 0xb1,
-	0xcb, 0x89, 0x37, 0x0a, 0x39, 0x62, 0x93, 0xd8, 0xc0, 0x91, 0x6d, 0x0c, 0x08, 0x00, 0x00, 0xff,
-	0xff, 0x9a, 0x10, 0xcb, 0xf9, 0x01, 0x02, 0x00, 0x00,
-}
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ context.Context
-var _ grpc.ClientConnInterface
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
-
-// KeyProviderServiceClient is the client API for KeyProviderService service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
-type KeyProviderServiceClient interface {
-	WrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error)
-	UnWrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error)
-}
-
-type keyProviderServiceClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewKeyProviderServiceClient(cc grpc.ClientConnInterface) KeyProviderServiceClient {
-	return &keyProviderServiceClient{cc}
-}
-
-func (c *keyProviderServiceClient) WrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error) {
-	out := new(KeyProviderKeyWrapProtocolOutput)
-	err := c.cc.Invoke(ctx, "/keyprovider.KeyProviderService/WrapKey", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *keyProviderServiceClient) UnWrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error) {
-	out := new(KeyProviderKeyWrapProtocolOutput)
-	err := c.cc.Invoke(ctx, "/keyprovider.KeyProviderService/UnWrapKey", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// KeyProviderServiceServer is the server API for KeyProviderService service.
-type KeyProviderServiceServer interface {
-	WrapKey(context.Context, *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
-	UnWrapKey(context.Context, *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
-}
-
-// UnimplementedKeyProviderServiceServer can be embedded to have forward compatible implementations.
-type UnimplementedKeyProviderServiceServer struct {
-}
-
-func (*UnimplementedKeyProviderServiceServer) WrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method WrapKey not implemented")
-}
-func (*UnimplementedKeyProviderServiceServer) UnWrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UnWrapKey not implemented")
-}
-
-func RegisterKeyProviderServiceServer(s *grpc.Server, srv KeyProviderServiceServer) {
-	s.RegisterService(&_KeyProviderService_serviceDesc, srv)
-}
-
-func _KeyProviderService_WrapKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(KeyProviderKeyWrapProtocolInput)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyProviderServiceServer).WrapKey(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/keyprovider.KeyProviderService/WrapKey",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyProviderServiceServer).WrapKey(ctx, req.(*KeyProviderKeyWrapProtocolInput))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _KeyProviderService_UnWrapKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(KeyProviderKeyWrapProtocolInput)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(KeyProviderServiceServer).UnWrapKey(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/keyprovider.KeyProviderService/UnWrapKey",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(KeyProviderServiceServer).UnWrapKey(ctx, req.(*KeyProviderKeyWrapProtocolInput))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-var _KeyProviderService_serviceDesc = grpc.ServiceDesc{
-	ServiceName: "keyprovider.KeyProviderService",
-	HandlerType: (*KeyProviderServiceServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "WrapKey",
-			Handler:    _KeyProviderService_WrapKey_Handler,
-		},
-		{
-			MethodName: "UnWrapKey",
-			Handler:    _KeyProviderService_UnWrapKey_Handler,
-		},
-	},
-	Streams:  []grpc.StreamDesc{},
-	Metadata: "keyprovider.proto",
-}

vendor/github.com/containers/ocicrypt/utils/keyprovider/keyprovider.proto

@@ -1,17 +0,0 @@
-syntax = "proto3";
-
-package keyprovider;
-option go_package = "keyprovider";
-
-message keyProviderKeyWrapProtocolInput {
-    bytes KeyProviderKeyWrapProtocolInput = 1;
-}
-
-message keyProviderKeyWrapProtocolOutput {
-    bytes KeyProviderKeyWrapProtocolOutput = 1;
-}
-
-service KeyProviderService {
-    rpc WrapKey(keyProviderKeyWrapProtocolInput) returns (keyProviderKeyWrapProtocolOutput) {};
-    rpc UnWrapKey(keyProviderKeyWrapProtocolInput) returns (keyProviderKeyWrapProtocolOutput) {};
-}

vendor/github.com/containers/ocicrypt/utils/testing.go

@@ -1,166 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package utils
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"math/big"
-	"time"
-
-	"github.com/pkg/errors"
-)
-
-// CreateRSAKey creates an RSA key
-func CreateRSAKey(bits int) (*rsa.PrivateKey, error) {
-	key, err := rsa.GenerateKey(rand.Reader, bits)
-	if err != nil {
-		return nil, errors.Wrap(err, "rsa.GenerateKey failed")
-	}
-	return key, nil
-}
-
-// CreateRSATestKey creates an RSA key of the given size and returns
-// the public and private key in PEM or DER format
-func CreateRSATestKey(bits int, password []byte, pemencode bool) ([]byte, []byte, error) {
-	key, err := CreateRSAKey(bits)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "x509.MarshalPKIXPublicKey failed")
-	}
-	privData := x509.MarshalPKCS1PrivateKey(key)
-
-	// no more encoding needed for DER
-	if !pemencode {
-		return pubData, privData, nil
-	}
-
-	publicKey := pem.EncodeToMemory(&pem.Block{
-		Type:  "PUBLIC KEY",
-		Bytes: pubData,
-	})
-
-	var block *pem.Block
-
-	typ := "RSA PRIVATE KEY"
-	if len(password) > 0 {
-		block, err = x509.EncryptPEMBlock(rand.Reader, typ, privData, password, x509.PEMCipherAES256) //nolint:staticcheck // ignore SA1019, which is kept for backward compatibility
-		if err != nil {
-			return nil, nil, errors.Wrap(err, "x509.EncryptPEMBlock failed")
-		}
-	} else {
-		block = &pem.Block{
-			Type:  typ,
-			Bytes: privData,
-		}
-	}
-
-	privateKey := pem.EncodeToMemory(block)
-
-	return publicKey, privateKey, nil
-}
-
-// CreateECDSATestKey creates and elliptic curve key for the given curve and returns
-// the public and private key in DER format
-func CreateECDSATestKey(curve elliptic.Curve) ([]byte, []byte, error) {
-	key, err := ecdsa.GenerateKey(curve, rand.Reader)
-	if err != nil {
-		return nil, nil, errors.Wrapf(err, "ecdsa.GenerateKey failed")
-	}
-
-	pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
-	if err != nil {
-		return nil, nil, errors.Wrapf(err, "x509.MarshalPKIXPublicKey failed")
-	}
-
-	privData, err := x509.MarshalECPrivateKey(key)
-	if err != nil {
-		return nil, nil, errors.Wrapf(err, "x509.MarshalECPrivateKey failed")
-	}
-
-	return pubData, privData, nil
-}
-
-// CreateTestCA creates a root CA for testing
-func CreateTestCA() (*rsa.PrivateKey, *x509.Certificate, error) {
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "rsa.GenerateKey failed")
-	}
-
-	ca := &x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject: pkix.Name{
-			CommonName: "test-ca",
-		},
-		NotBefore:             time.Now(),
-		NotAfter:              time.Now().AddDate(1, 0, 0),
-		IsCA:                  true,
-		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		BasicConstraintsValid: true,
-	}
-	caCert, err := certifyKey(&key.PublicKey, ca, key, ca)
-
-	return key, caCert, err
-}
-
-// CertifyKey certifies a public key using the given CA's private key and cert;
-// The certificate template for the public key is optional
-func CertifyKey(pubbytes []byte, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
-	pubKey, err := ParsePublicKey(pubbytes, "CertifyKey")
-	if err != nil {
-		return nil, err
-	}
-	return certifyKey(pubKey, template, caKey, caCert)
-}
-
-func certifyKey(pub interface{}, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
-	if template == nil {
-		template = &x509.Certificate{
-			SerialNumber: big.NewInt(1),
-			Subject: pkix.Name{
-				CommonName: "testkey",
-			},
-			NotBefore:             time.Now(),
-			NotAfter:              time.Now().Add(time.Hour),
-			IsCA:                  false,
-			KeyUsage:              x509.KeyUsageDigitalSignature,
-			BasicConstraintsValid: true,
-		}
-	}
-
-	certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, pub, caKey)
-	if err != nil {
-		return nil, errors.Wrap(err, "x509.CreateCertificate failed")
-	}
-
-	cert, err := x509.ParseCertificate(certDER)
-	if err != nil {
-		return nil, errors.Wrap(err, "x509.ParseCertificate failed")
-	}
-
-	return cert, nil
-}

vendor/github.com/containers/ocicrypt/utils/utils.go

@@ -1,250 +0,0 @@
-/*
-   Copyright The ocicrypt Authors.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package utils
-
-import (
-	"bytes"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/pem"
-	"fmt"
-	"strings"
-
-	"github.com/containers/ocicrypt/crypto/pkcs11"
-
-	"github.com/pkg/errors"
-	"golang.org/x/crypto/openpgp"
-	json "gopkg.in/square/go-jose.v2"
-)
-
-// parseJWKPrivateKey parses the input byte array as a JWK and makes sure it's a private key
-func parseJWKPrivateKey(privKey []byte, prefix string) (interface{}, error) {
-	jwk := json.JSONWebKey{}
-	err := jwk.UnmarshalJSON(privKey)
-	if err != nil {
-		return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
-	}
-	if jwk.IsPublic() {
-		return nil, fmt.Errorf("%s: JWK is not a private key", prefix)
-	}
-	return &jwk, nil
-}
-
-// parseJWKPublicKey parses the input byte array as a JWK
-func parseJWKPublicKey(privKey []byte, prefix string) (interface{}, error) {
-	jwk := json.JSONWebKey{}
-	err := jwk.UnmarshalJSON(privKey)
-	if err != nil {
-		return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
-	}
-	if !jwk.IsPublic() {
-		return nil, fmt.Errorf("%s: JWK is not a public key", prefix)
-	}
-	return &jwk, nil
-}
-
-// parsePkcs11PrivateKeyYaml parses the input byte array as pkcs11 key file yaml format)
-func parsePkcs11PrivateKeyYaml(yaml []byte, prefix string) (*pkcs11.Pkcs11KeyFileObject, error) {
-	// if the URI does not have enough attributes, we will throw an error when decrypting
-	return pkcs11.ParsePkcs11KeyFile(yaml)
-}
-
-// parsePkcs11URIPublicKey parses the input byte array as a pkcs11 key file yaml
-func parsePkcs11PublicKeyYaml(yaml []byte, prefix string) (*pkcs11.Pkcs11KeyFileObject, error) {
-	// if the URI does not have enough attributes, we will throw an error when decrypting
-	return pkcs11.ParsePkcs11KeyFile(yaml)
-}
-
-// IsPasswordError checks whether an error is related to a missing or wrong
-// password
-func IsPasswordError(err error) bool {
-	if err == nil {
-		return false
-	}
-	msg := strings.ToLower(err.Error())
-
-	return strings.Contains(msg, "password") &&
-		(strings.Contains(msg, "missing") || strings.Contains(msg, "wrong"))
-}
-
-// ParsePrivateKey tries to parse a private key in DER format first and
-// PEM format after, returning an error if the parsing failed
-func ParsePrivateKey(privKey, privKeyPassword []byte, prefix string) (interface{}, error) {
-	key, err := x509.ParsePKCS8PrivateKey(privKey)
-	if err != nil {
-		key, err = x509.ParsePKCS1PrivateKey(privKey)
-		if err != nil {
-			key, err = x509.ParseECPrivateKey(privKey)
-		}
-	}
-	if err != nil {
-		block, _ := pem.Decode(privKey)
-		if block != nil {
-			var der []byte
-			if x509.IsEncryptedPEMBlock(block) { //nolint:staticcheck // ignore SA1019, which is kept for backward compatibility
-				if privKeyPassword == nil {
-					return nil, errors.Errorf("%s: Missing password for encrypted private key", prefix)
-				}
-				der, err = x509.DecryptPEMBlock(block, privKeyPassword) //nolint:staticcheck // ignore SA1019, which is kept for backward compatibility
-				if err != nil {
-					return nil, errors.Errorf("%s: Wrong password: could not decrypt private key", prefix)
-				}
-			} else {
-				der = block.Bytes
-			}
-
-			key, err = x509.ParsePKCS8PrivateKey(der)
-			if err != nil {
-				key, err = x509.ParsePKCS1PrivateKey(der)
-				if err != nil {
-					return nil, errors.Wrapf(err, "%s: Could not parse private key", prefix)
-				}
-			}
-		} else {
-			key, err = parseJWKPrivateKey(privKey, prefix)
-			if err != nil {
-				key, err = parsePkcs11PrivateKeyYaml(privKey, prefix)
-			}
-		}
-	}
-	return key, err
-}
-
-// IsPrivateKey returns true in case the given byte array represents a private key
-// It returns an error if for example the password is wrong
-func IsPrivateKey(data []byte, password []byte) (bool, error) {
-	_, err := ParsePrivateKey(data, password, "")
-	return err == nil, err
-}
-
-// IsPkcs11PrivateKey returns true in case the given byte array represents a pkcs11 private key
-func IsPkcs11PrivateKey(data []byte) bool {
-	return pkcs11.IsPkcs11PrivateKey(data)
-}
-
-// ParsePublicKey tries to parse a public key in DER format first and
-// PEM format after, returning an error if the parsing failed
-func ParsePublicKey(pubKey []byte, prefix string) (interface{}, error) {
-	key, err := x509.ParsePKIXPublicKey(pubKey)
-	if err != nil {
-		block, _ := pem.Decode(pubKey)
-		if block != nil {
-			key, err = x509.ParsePKIXPublicKey(block.Bytes)
-			if err != nil {
-				return nil, errors.Wrapf(err, "%s: Could not parse public key", prefix)
-			}
-		} else {
-			key, err = parseJWKPublicKey(pubKey, prefix)
-			if err != nil {
-				key, err = parsePkcs11PublicKeyYaml(pubKey, prefix)
-			}
-		}
-	}
-	return key, err
-}
-
-// IsPublicKey returns true in case the given byte array represents a public key
-func IsPublicKey(data []byte) bool {
-	_, err := ParsePublicKey(data, "")
-	return err == nil
-}
-
-// IsPkcs11PublicKey returns true in case the given byte array represents a pkcs11 public key
-func IsPkcs11PublicKey(data []byte) bool {
-	return pkcs11.IsPkcs11PublicKey(data)
-}
-
-// ParseCertificate tries to parse a public key in DER format first and
-// PEM format after, returning an error if the parsing failed
-func ParseCertificate(certBytes []byte, prefix string) (*x509.Certificate, error) {
-	x509Cert, err := x509.ParseCertificate(certBytes)
-	if err != nil {
-		block, _ := pem.Decode(certBytes)
-		if block == nil {
-			return nil, fmt.Errorf("%s: Could not PEM decode x509 certificate", prefix)
-		}
-		x509Cert, err = x509.ParseCertificate(block.Bytes)
-		if err != nil {
-			return nil, errors.Wrapf(err, "%s: Could not parse x509 certificate", prefix)
-		}
-	}
-	return x509Cert, err
-}
-
-// IsCertificate returns true in case the given byte array represents an x.509 certificate
-func IsCertificate(data []byte) bool {
-	_, err := ParseCertificate(data, "")
-	return err == nil
-}
-
-// IsGPGPrivateKeyRing returns true in case the given byte array represents a GPG private key ring file
-func IsGPGPrivateKeyRing(data []byte) bool {
-	r := bytes.NewBuffer(data)
-	_, err := openpgp.ReadKeyRing(r)
-	return err == nil
-}
-
-// SortDecryptionKeys parses a list of comma separated base64 entries and sorts the data into
-// a map. Each entry in the list may be either a GPG private key ring, private key, or x.509
-// certificate
-func SortDecryptionKeys(b64ItemList string) (map[string][][]byte, error) {
-	dcparameters := make(map[string][][]byte)
-
-	for _, b64Item := range strings.Split(b64ItemList, ",") {
-		var password []byte
-		b64Data := strings.Split(b64Item, ":")
-		keyData, err := base64.StdEncoding.DecodeString(b64Data[0])
-		if err != nil {
-			return nil, errors.New("Could not base64 decode a passed decryption key")
-		}
-		if len(b64Data) == 2 {
-			password, err = base64.StdEncoding.DecodeString(b64Data[1])
-			if err != nil {
-				return nil, errors.New("Could not base64 decode a passed decryption key password")
-			}
-		}
-		var key string
-		isPrivKey, err := IsPrivateKey(keyData, password)
-		if IsPasswordError(err) {
-			return nil, err
-		}
-		if isPrivKey {
-			key = "privkeys"
-			if _, ok := dcparameters["privkeys-passwords"]; !ok {
-				dcparameters["privkeys-passwords"] = [][]byte{password}
-			} else {
-				dcparameters["privkeys-passwords"] = append(dcparameters["privkeys-passwords"], password)
-			}
-		} else if IsCertificate(keyData) {
-			key = "x509s"
-		} else if IsGPGPrivateKeyRing(keyData) {
-			key = "gpg-privatekeys"
-		}
-		if key != "" {
-			values := dcparameters[key]
-			if values == nil {
-				dcparameters[key] = [][]byte{keyData}
-			} else {
-				dcparameters[key] = append(dcparameters[key], keyData)
-			}
-		} else {
-			return nil, errors.New("Unknown decryption key type")
-		}
-	}
-
-	return dcparameters, nil
-}

vendor/github.com/gogo/protobuf/types/any.go

@@ -1,140 +0,0 @@
-// Go support for Protocol Buffers - Google's data interchange format
-//
-// Copyright 2016 The Go Authors.  All rights reserved.
-// https://github.com/golang/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-package types
-
-// This file implements functions to marshal proto.Message to/from
-// google.protobuf.Any message.
-
-import (
-	"fmt"
-	"reflect"
-	"strings"
-
-	"github.com/gogo/protobuf/proto"
-)
-
-const googleApis = "type.googleapis.com/"
-
-// AnyMessageName returns the name of the message contained in a google.protobuf.Any message.
-//
-// Note that regular type assertions should be done using the Is
-// function. AnyMessageName is provided for less common use cases like filtering a
-// sequence of Any messages based on a set of allowed message type names.
-func AnyMessageName(any *Any) (string, error) {
-	if any == nil {
-		return "", fmt.Errorf("message is nil")
-	}
-	slash := strings.LastIndex(any.TypeUrl, "/")
-	if slash < 0 {
-		return "", fmt.Errorf("message type url %q is invalid", any.TypeUrl)
-	}
-	return any.TypeUrl[slash+1:], nil
-}
-
-// MarshalAny takes the protocol buffer and encodes it into google.protobuf.Any.
-func MarshalAny(pb proto.Message) (*Any, error) {
-	value, err := proto.Marshal(pb)
-	if err != nil {
-		return nil, err
-	}
-	return &Any{TypeUrl: googleApis + proto.MessageName(pb), Value: value}, nil
-}
-
-// DynamicAny is a value that can be passed to UnmarshalAny to automatically
-// allocate a proto.Message for the type specified in a google.protobuf.Any
-// message. The allocated message is stored in the embedded proto.Message.
-//
-// Example:
-//
-//   var x ptypes.DynamicAny
-//   if err := ptypes.UnmarshalAny(a, &x); err != nil { ... }
-//   fmt.Printf("unmarshaled message: %v", x.Message)
-type DynamicAny struct {
-	proto.Message
-}
-
-// Empty returns a new proto.Message of the type specified in a
-// google.protobuf.Any message. It returns an error if corresponding message
-// type isn't linked in.
-func EmptyAny(any *Any) (proto.Message, error) {
-	aname, err := AnyMessageName(any)
-	if err != nil {
-		return nil, err
-	}
-
-	t := proto.MessageType(aname)
-	if t == nil {
-		return nil, fmt.Errorf("any: message type %q isn't linked in", aname)
-	}
-	return reflect.New(t.Elem()).Interface().(proto.Message), nil
-}
-
-// UnmarshalAny parses the protocol buffer representation in a google.protobuf.Any
-// message and places the decoded result in pb. It returns an error if type of
-// contents of Any message does not match type of pb message.
-//
-// pb can be a proto.Message, or a *DynamicAny.
-func UnmarshalAny(any *Any, pb proto.Message) error {
-	if d, ok := pb.(*DynamicAny); ok {
-		if d.Message == nil {
-			var err error
-			d.Message, err = EmptyAny(any)
-			if err != nil {
-				return err
-			}
-		}
-		return UnmarshalAny(any, d.Message)
-	}
-
-	aname, err := AnyMessageName(any)
-	if err != nil {
-		return err
-	}
-
-	mname := proto.MessageName(pb)
-	if aname != mname {
-		return fmt.Errorf("mismatched message type: got %q want %q", aname, mname)
-	}
-	return proto.Unmarshal(any.Value, pb)
-}
-
-// Is returns true if any value contains a given message type.
-func Is(any *Any, pb proto.Message) bool {
-	// The following is equivalent to AnyMessageName(any) == proto.MessageName(pb),
-	// but it avoids scanning TypeUrl for the slash.
-	if any == nil {
-		return false
-	}
-	name := proto.MessageName(pb)
-	prefix := len(any.TypeUrl) - len(name)
-	return prefix >= 1 && any.TypeUrl[prefix-1] == '/' && any.TypeUrl[prefix:] == name
-}

vendor/github.com/gogo/protobuf/types/any.pb.go

@@ -1,694 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: google/protobuf/any.proto
-
-package types
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	io "io"
-	math "math"
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
-
-// `Any` contains an arbitrary serialized protocol buffer message along with a
-// URL that describes the type of the serialized message.
-//
-// Protobuf library provides support to pack/unpack Any values in the form
-// of utility functions or additional generated methods of the Any type.
-//
-// Example 1: Pack and unpack a message in C++.
-//
-//     Foo foo = ...;
-//     Any any;
-//     any.PackFrom(foo);
-//     ...
-//     if (any.UnpackTo(&foo)) {
-//       ...
-//     }
-//
-// Example 2: Pack and unpack a message in Java.
-//
-//     Foo foo = ...;
-//     Any any = Any.pack(foo);
-//     ...
-//     if (any.is(Foo.class)) {
-//       foo = any.unpack(Foo.class);
-//     }
-//
-//  Example 3: Pack and unpack a message in Python.
-//
-//     foo = Foo(...)
-//     any = Any()
-//     any.Pack(foo)
-//     ...
-//     if any.Is(Foo.DESCRIPTOR):
-//       any.Unpack(foo)
-//       ...
-//
-//  Example 4: Pack and unpack a message in Go
-//
-//      foo := &pb.Foo{...}
-//      any, err := ptypes.MarshalAny(foo)
-//      ...
-//      foo := &pb.Foo{}
-//      if err := ptypes.UnmarshalAny(any, foo); err != nil {
-//        ...
-//      }
-//
-// The pack methods provided by protobuf library will by default use
-// 'type.googleapis.com/full.type.name' as the type URL and the unpack
-// methods only use the fully qualified type name after the last '/'
-// in the type URL, for example "foo.bar.com/x/y.z" will yield type
-// name "y.z".
-//
-//
-// JSON
-// ====
-// The JSON representation of an `Any` value uses the regular
-// representation of the deserialized, embedded message, with an
-// additional field `@type` which contains the type URL. Example:
-//
-//     package google.profile;
-//     message Person {
-//       string first_name = 1;
-//       string last_name = 2;
-//     }
-//
-//     {
-//       "@type": "type.googleapis.com/google.profile.Person",
-//       "firstName": <string>,
-//       "lastName": <string>
-//     }
-//
-// If the embedded message type is well-known and has a custom JSON
-// representation, that representation will be embedded adding a field
-// `value` which holds the custom JSON in addition to the `@type`
-// field. Example (for message [google.protobuf.Duration][]):
-//
-//     {
-//       "@type": "type.googleapis.com/google.protobuf.Duration",
-//       "value": "1.212s"
-//     }
-//
-type Any struct {
-	// A URL/resource name that uniquely identifies the type of the serialized
-	// protocol buffer message. This string must contain at least
-	// one "/" character. The last segment of the URL's path must represent
-	// the fully qualified name of the type (as in
-	// `path/google.protobuf.Duration`). The name should be in a canonical form
-	// (e.g., leading "." is not accepted).
-	//
-	// In practice, teams usually precompile into the binary all types that they
-	// expect it to use in the context of Any. However, for URLs which use the
-	// scheme `http`, `https`, or no scheme, one can optionally set up a type
-	// server that maps type URLs to message definitions as follows:
-	//
-	// * If no scheme is provided, `https` is assumed.
-	// * An HTTP GET on the URL must yield a [google.protobuf.Type][]
-	//   value in binary format, or produce an error.
-	// * Applications are allowed to cache lookup results based on the
-	//   URL, or have them precompiled into a binary to avoid any
-	//   lookup. Therefore, binary compatibility needs to be preserved
-	//   on changes to types. (Use versioned type names to manage
-	//   breaking changes.)
-	//
-	// Note: this functionality is not currently available in the official
-	// protobuf release, and it is not used for type URLs beginning with
-	// type.googleapis.com.
-	//
-	// Schemes other than `http`, `https` (or the empty scheme) might be
-	// used with implementation specific semantics.
-	//
-	TypeUrl string `protobuf:"bytes,1,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
-	// Must be a valid serialized protocol buffer of the above specified type.
-	Value                []byte   `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Any) Reset()      { *m = Any{} }
-func (*Any) ProtoMessage() {}
-func (*Any) Descriptor() ([]byte, []int) {
-	return fileDescriptor_b53526c13ae22eb4, []int{0}
-}
-func (*Any) XXX_WellKnownType() string { return "Any" }
-func (m *Any) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *Any) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Any.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *Any) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Any.Merge(m, src)
-}
-func (m *Any) XXX_Size() int {
-	return m.Size()
-}
-func (m *Any) XXX_DiscardUnknown() {
-	xxx_messageInfo_Any.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Any proto.InternalMessageInfo
-
-func (m *Any) GetTypeUrl() string {
-	if m != nil {
-		return m.TypeUrl
-	}
-	return ""
-}
-
-func (m *Any) GetValue() []byte {
-	if m != nil {
-		return m.Value
-	}
-	return nil
-}
-
-func (*Any) XXX_MessageName() string {
-	return "google.protobuf.Any"
-}
-func init() {
-	proto.RegisterType((*Any)(nil), "google.protobuf.Any")
-}
-
-func init() { proto.RegisterFile("google/protobuf/any.proto", fileDescriptor_b53526c13ae22eb4) }
-
-var fileDescriptor_b53526c13ae22eb4 = []byte{
-	// 211 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4c, 0xcf, 0xcf, 0x4f,
-	0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcc, 0xab, 0xd4,
-	0x03, 0x73, 0x84, 0xf8, 0x21, 0x52, 0x7a, 0x30, 0x29, 0x25, 0x33, 0x2e, 0x66, 0xc7, 0xbc, 0x4a,
-	0x21, 0x49, 0x2e, 0x8e, 0x92, 0xca, 0x82, 0xd4, 0xf8, 0xd2, 0xa2, 0x1c, 0x09, 0x46, 0x05, 0x46,
-	0x0d, 0xce, 0x20, 0x76, 0x10, 0x3f, 0xb4, 0x28, 0x47, 0x48, 0x84, 0x8b, 0xb5, 0x2c, 0x31, 0xa7,
-	0x34, 0x55, 0x82, 0x49, 0x81, 0x51, 0x83, 0x27, 0x08, 0xc2, 0x71, 0xaa, 0xbf, 0xf1, 0x50, 0x8e,
-	0xe1, 0xc3, 0x43, 0x39, 0xc6, 0x1f, 0x0f, 0xe5, 0x18, 0x1b, 0x1e, 0xc9, 0x31, 0xae, 0x78, 0x24,
-	0xc7, 0x78, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0xbe, 0x78,
-	0x24, 0xc7, 0xf0, 0x01, 0x24, 0xfe, 0x58, 0x8e, 0xf1, 0xc4, 0x63, 0x39, 0x46, 0x2e, 0xe1, 0xe4,
-	0xfc, 0x5c, 0x3d, 0x34, 0xeb, 0x9d, 0x38, 0x1c, 0xf3, 0x2a, 0x03, 0x40, 0x9c, 0x00, 0xc6, 0x28,
-	0x56, 0x90, 0x8d, 0xc5, 0x8b, 0x98, 0x98, 0xdd, 0x03, 0x9c, 0x56, 0x31, 0xc9, 0xb9, 0x43, 0x94,
-	0x06, 0x40, 0x95, 0xea, 0x85, 0xa7, 0xe6, 0xe4, 0x78, 0xe7, 0xe5, 0x97, 0xe7, 0x85, 0x80, 0x94,
-	0x25, 0xb1, 0x81, 0xcd, 0x30, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0xb7, 0x81, 0x82, 0xd3, 0xed,
-	0x00, 0x00, 0x00,
-}
-
-func (this *Any) Compare(that interface{}) int {
-	if that == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	}
-
-	that1, ok := that.(*Any)
-	if !ok {
-		that2, ok := that.(Any)
-		if ok {
-			that1 = &that2
-		} else {
-			return 1
-		}
-	}
-	if that1 == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	} else if this == nil {
-		return -1
-	}
-	if this.TypeUrl != that1.TypeUrl {
-		if this.TypeUrl < that1.TypeUrl {
-			return -1
-		}
-		return 1
-	}
-	if c := bytes.Compare(this.Value, that1.Value); c != 0 {
-		return c
-	}
-	if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
-		return c
-	}
-	return 0
-}
-func (this *Any) Equal(that interface{}) bool {
-	if that == nil {
-		return this == nil
-	}
-
-	that1, ok := that.(*Any)
-	if !ok {
-		that2, ok := that.(Any)
-		if ok {
-			that1 = &that2
-		} else {
-			return false
-		}
-	}
-	if that1 == nil {
-		return this == nil
-	} else if this == nil {
-		return false
-	}
-	if this.TypeUrl != that1.TypeUrl {
-		return false
-	}
-	if !bytes.Equal(this.Value, that1.Value) {
-		return false
-	}
-	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
-		return false
-	}
-	return true
-}
-func (this *Any) GoString() string {
-	if this == nil {
-		return "nil"
-	}
-	s := make([]string, 0, 6)
-	s = append(s, "&types.Any{")
-	s = append(s, "TypeUrl: "+fmt.Sprintf("%#v", this.TypeUrl)+",\n")
-	s = append(s, "Value: "+fmt.Sprintf("%#v", this.Value)+",\n")
-	if this.XXX_unrecognized != nil {
-		s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
-	}
-	s = append(s, "}")
-	return strings.Join(s, "")
-}
-func valueToGoStringAny(v interface{}, typ string) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
-}
-func (m *Any) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Any) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Any) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.Value) > 0 {
-		i -= len(m.Value)
-		copy(dAtA[i:], m.Value)
-		i = encodeVarintAny(dAtA, i, uint64(len(m.Value)))
-		i--
-		dAtA[i] = 0x12
-	}
-	if len(m.TypeUrl) > 0 {
-		i -= len(m.TypeUrl)
-		copy(dAtA[i:], m.TypeUrl)
-		i = encodeVarintAny(dAtA, i, uint64(len(m.TypeUrl)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintAny(dAtA []byte, offset int, v uint64) int {
-	offset -= sovAny(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func NewPopulatedAny(r randyAny, easy bool) *Any {
-	this := &Any{}
-	this.TypeUrl = string(randStringAny(r))
-	v1 := r.Intn(100)
-	this.Value = make([]byte, v1)
-	for i := 0; i < v1; i++ {
-		this.Value[i] = byte(r.Intn(256))
-	}
-	if !easy && r.Intn(10) != 0 {
-		this.XXX_unrecognized = randUnrecognizedAny(r, 3)
-	}
-	return this
-}
-
-type randyAny interface {
-	Float32() float32
-	Float64() float64
-	Int63() int64
-	Int31() int32
-	Uint32() uint32
-	Intn(n int) int
-}
-
-func randUTF8RuneAny(r randyAny) rune {
-	ru := r.Intn(62)
-	if ru < 10 {
-		return rune(ru + 48)
-	} else if ru < 36 {
-		return rune(ru + 55)
-	}
-	return rune(ru + 61)
-}
-func randStringAny(r randyAny) string {
-	v2 := r.Intn(100)
-	tmps := make([]rune, v2)
-	for i := 0; i < v2; i++ {
-		tmps[i] = randUTF8RuneAny(r)
-	}
-	return string(tmps)
-}
-func randUnrecognizedAny(r randyAny, maxFieldNumber int) (dAtA []byte) {
-	l := r.Intn(5)
-	for i := 0; i < l; i++ {
-		wire := r.Intn(4)
-		if wire == 3 {
-			wire = 5
-		}
-		fieldNumber := maxFieldNumber + r.Intn(100)
-		dAtA = randFieldAny(dAtA, r, fieldNumber, wire)
-	}
-	return dAtA
-}
-func randFieldAny(dAtA []byte, r randyAny, fieldNumber int, wire int) []byte {
-	key := uint32(fieldNumber)<<3 | uint32(wire)
-	switch wire {
-	case 0:
-		dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
-		v3 := r.Int63()
-		if r.Intn(2) == 0 {
-			v3 *= -1
-		}
-		dAtA = encodeVarintPopulateAny(dAtA, uint64(v3))
-	case 1:
-		dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	case 2:
-		dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
-		ll := r.Intn(100)
-		dAtA = encodeVarintPopulateAny(dAtA, uint64(ll))
-		for j := 0; j < ll; j++ {
-			dAtA = append(dAtA, byte(r.Intn(256)))
-		}
-	default:
-		dAtA = encodeVarintPopulateAny(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	}
-	return dAtA
-}
-func encodeVarintPopulateAny(dAtA []byte, v uint64) []byte {
-	for v >= 1<<7 {
-		dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
-		v >>= 7
-	}
-	dAtA = append(dAtA, uint8(v))
-	return dAtA
-}
-func (m *Any) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.TypeUrl)
-	if l > 0 {
-		n += 1 + l + sovAny(uint64(l))
-	}
-	l = len(m.Value)
-	if l > 0 {
-		n += 1 + l + sovAny(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func sovAny(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozAny(x uint64) (n int) {
-	return sovAny(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (this *Any) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&Any{`,
-		`TypeUrl:` + fmt.Sprintf("%v", this.TypeUrl) + `,`,
-		`Value:` + fmt.Sprintf("%v", this.Value) + `,`,
-		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringAny(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
-}
-func (m *Any) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowAny
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Any: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Any: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TypeUrl", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAny
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthAny
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAny
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.TypeUrl = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
-			}
-			var byteLen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowAny
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				byteLen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if byteLen < 0 {
-				return ErrInvalidLengthAny
-			}
-			postIndex := iNdEx + byteLen
-			if postIndex < 0 {
-				return ErrInvalidLengthAny
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Value = append(m.Value[:0], dAtA[iNdEx:postIndex]...)
-			if m.Value == nil {
-				m.Value = []byte{}
-			}
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipAny(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthAny
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipAny(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowAny
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowAny
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowAny
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthAny
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupAny
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthAny
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthAny        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowAny          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupAny = fmt.Errorf("proto: unexpected end of group")
-)

vendor/github.com/gogo/protobuf/types/doc.go

@@ -1,35 +0,0 @@
-// Go support for Protocol Buffers - Google's data interchange format
-//
-// Copyright 2016 The Go Authors.  All rights reserved.
-// https://github.com/golang/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-/*
-Package types contains code for interacting with well-known types.
-*/
-package types

vendor/github.com/gogo/protobuf/types/duration.go

@@ -1,100 +0,0 @@
-// Go support for Protocol Buffers - Google's data interchange format
-//
-// Copyright 2016 The Go Authors.  All rights reserved.
-// https://github.com/golang/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-package types
-
-// This file implements conversions between google.protobuf.Duration
-// and time.Duration.
-
-import (
-	"errors"
-	"fmt"
-	"time"
-)
-
-const (
-	// Range of a Duration in seconds, as specified in
-	// google/protobuf/duration.proto. This is about 10,000 years in seconds.
-	maxSeconds = int64(10000 * 365.25 * 24 * 60 * 60)
-	minSeconds = -maxSeconds
-)
-
-// validateDuration determines whether the Duration is valid according to the
-// definition in google/protobuf/duration.proto. A valid Duration
-// may still be too large to fit into a time.Duration (the range of Duration
-// is about 10,000 years, and the range of time.Duration is about 290).
-func validateDuration(d *Duration) error {
-	if d == nil {
-		return errors.New("duration: nil Duration")
-	}
-	if d.Seconds < minSeconds || d.Seconds > maxSeconds {
-		return fmt.Errorf("duration: %#v: seconds out of range", d)
-	}
-	if d.Nanos <= -1e9 || d.Nanos >= 1e9 {
-		return fmt.Errorf("duration: %#v: nanos out of range", d)
-	}
-	// Seconds and Nanos must have the same sign, unless d.Nanos is zero.
-	if (d.Seconds < 0 && d.Nanos > 0) || (d.Seconds > 0 && d.Nanos < 0) {
-		return fmt.Errorf("duration: %#v: seconds and nanos have different signs", d)
-	}
-	return nil
-}
-
-// DurationFromProto converts a Duration to a time.Duration. DurationFromProto
-// returns an error if the Duration is invalid or is too large to be
-// represented in a time.Duration.
-func DurationFromProto(p *Duration) (time.Duration, error) {
-	if err := validateDuration(p); err != nil {
-		return 0, err
-	}
-	d := time.Duration(p.Seconds) * time.Second
-	if int64(d/time.Second) != p.Seconds {
-		return 0, fmt.Errorf("duration: %#v is out of range for time.Duration", p)
-	}
-	if p.Nanos != 0 {
-		d += time.Duration(p.Nanos) * time.Nanosecond
-		if (d < 0) != (p.Nanos < 0) {
-			return 0, fmt.Errorf("duration: %#v is out of range for time.Duration", p)
-		}
-	}
-	return d, nil
-}
-
-// DurationProto converts a time.Duration to a Duration.
-func DurationProto(d time.Duration) *Duration {
-	nanos := d.Nanoseconds()
-	secs := nanos / 1e9
-	nanos -= secs * 1e9
-	return &Duration{
-		Seconds: secs,
-		Nanos:   int32(nanos),
-	}
-}

vendor/github.com/gogo/protobuf/types/duration.pb.go

@@ -1,517 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: google/protobuf/duration.proto
-
-package types
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	io "io"
-	math "math"
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
-
-// A Duration represents a signed, fixed-length span of time represented
-// as a count of seconds and fractions of seconds at nanosecond
-// resolution. It is independent of any calendar and concepts like "day"
-// or "month". It is related to Timestamp in that the difference between
-// two Timestamp values is a Duration and it can be added or subtracted
-// from a Timestamp. Range is approximately +-10,000 years.
-//
-// # Examples
-//
-// Example 1: Compute Duration from two Timestamps in pseudo code.
-//
-//     Timestamp start = ...;
-//     Timestamp end = ...;
-//     Duration duration = ...;
-//
-//     duration.seconds = end.seconds - start.seconds;
-//     duration.nanos = end.nanos - start.nanos;
-//
-//     if (duration.seconds < 0 && duration.nanos > 0) {
-//       duration.seconds += 1;
-//       duration.nanos -= 1000000000;
-//     } else if (durations.seconds > 0 && duration.nanos < 0) {
-//       duration.seconds -= 1;
-//       duration.nanos += 1000000000;
-//     }
-//
-// Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
-//
-//     Timestamp start = ...;
-//     Duration duration = ...;
-//     Timestamp end = ...;
-//
-//     end.seconds = start.seconds + duration.seconds;
-//     end.nanos = start.nanos + duration.nanos;
-//
-//     if (end.nanos < 0) {
-//       end.seconds -= 1;
-//       end.nanos += 1000000000;
-//     } else if (end.nanos >= 1000000000) {
-//       end.seconds += 1;
-//       end.nanos -= 1000000000;
-//     }
-//
-// Example 3: Compute Duration from datetime.timedelta in Python.
-//
-//     td = datetime.timedelta(days=3, minutes=10)
-//     duration = Duration()
-//     duration.FromTimedelta(td)
-//
-// # JSON Mapping
-//
-// In JSON format, the Duration type is encoded as a string rather than an
-// object, where the string ends in the suffix "s" (indicating seconds) and
-// is preceded by the number of seconds, with nanoseconds expressed as
-// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
-// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
-// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
-// microsecond should be expressed in JSON format as "3.000001s".
-//
-//
-type Duration struct {
-	// Signed seconds of the span of time. Must be from -315,576,000,000
-	// to +315,576,000,000 inclusive. Note: these bounds are computed from:
-	// 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
-	Seconds int64 `protobuf:"varint,1,opt,name=seconds,proto3" json:"seconds,omitempty"`
-	// Signed fractions of a second at nanosecond resolution of the span
-	// of time. Durations less than one second are represented with a 0
-	// `seconds` field and a positive or negative `nanos` field. For durations
-	// of one second or more, a non-zero value for the `nanos` field must be
-	// of the same sign as the `seconds` field. Must be from -999,999,999
-	// to +999,999,999 inclusive.
-	Nanos                int32    `protobuf:"varint,2,opt,name=nanos,proto3" json:"nanos,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Duration) Reset()      { *m = Duration{} }
-func (*Duration) ProtoMessage() {}
-func (*Duration) Descriptor() ([]byte, []int) {
-	return fileDescriptor_23597b2ebd7ac6c5, []int{0}
-}
-func (*Duration) XXX_WellKnownType() string { return "Duration" }
-func (m *Duration) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *Duration) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Duration.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *Duration) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Duration.Merge(m, src)
-}
-func (m *Duration) XXX_Size() int {
-	return m.Size()
-}
-func (m *Duration) XXX_DiscardUnknown() {
-	xxx_messageInfo_Duration.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Duration proto.InternalMessageInfo
-
-func (m *Duration) GetSeconds() int64 {
-	if m != nil {
-		return m.Seconds
-	}
-	return 0
-}
-
-func (m *Duration) GetNanos() int32 {
-	if m != nil {
-		return m.Nanos
-	}
-	return 0
-}
-
-func (*Duration) XXX_MessageName() string {
-	return "google.protobuf.Duration"
-}
-func init() {
-	proto.RegisterType((*Duration)(nil), "google.protobuf.Duration")
-}
-
-func init() { proto.RegisterFile("google/protobuf/duration.proto", fileDescriptor_23597b2ebd7ac6c5) }
-
-var fileDescriptor_23597b2ebd7ac6c5 = []byte{
-	// 209 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4b, 0xcf, 0xcf, 0x4f,
-	0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0x29, 0x2d, 0x4a,
-	0x2c, 0xc9, 0xcc, 0xcf, 0xd3, 0x03, 0x8b, 0x08, 0xf1, 0x43, 0xe4, 0xf5, 0x60, 0xf2, 0x4a, 0x56,
-	0x5c, 0x1c, 0x2e, 0x50, 0x25, 0x42, 0x12, 0x5c, 0xec, 0xc5, 0xa9, 0xc9, 0xf9, 0x79, 0x29, 0xc5,
-	0x12, 0x8c, 0x0a, 0x8c, 0x1a, 0xcc, 0x41, 0x30, 0xae, 0x90, 0x08, 0x17, 0x6b, 0x5e, 0x62, 0x5e,
-	0x7e, 0xb1, 0x04, 0x93, 0x02, 0xa3, 0x06, 0x6b, 0x10, 0x84, 0xe3, 0x54, 0x7f, 0xe3, 0xa1, 0x1c,
-	0xc3, 0x87, 0x87, 0x72, 0x8c, 0x2b, 0x1e, 0xc9, 0x31, 0x9e, 0x78, 0x24, 0xc7, 0x78, 0xe1, 0x91,
-	0x1c, 0xe3, 0x83, 0x47, 0x72, 0x8c, 0x2f, 0x1e, 0xc9, 0x31, 0x7c, 0x78, 0x24, 0xc7, 0xb8, 0xe2,
-	0xb1, 0x1c, 0xe3, 0x89, 0xc7, 0x72, 0x8c, 0x5c, 0xc2, 0xc9, 0xf9, 0xb9, 0x7a, 0x68, 0x56, 0x3b,
-	0xf1, 0xc2, 0x2c, 0x0e, 0x00, 0x89, 0x04, 0x30, 0x46, 0xb1, 0x96, 0x54, 0x16, 0xa4, 0x16, 0xff,
-	0x60, 0x64, 0x5c, 0xc4, 0xc4, 0xec, 0x1e, 0xe0, 0xb4, 0x8a, 0x49, 0xce, 0x1d, 0xa2, 0x25, 0x00,
-	0xaa, 0x45, 0x2f, 0x3c, 0x35, 0x27, 0xc7, 0x3b, 0x2f, 0xbf, 0x3c, 0x2f, 0x04, 0xa4, 0x32, 0x89,
-	0x0d, 0x6c, 0x96, 0x31, 0x20, 0x00, 0x00, 0xff, 0xff, 0x8a, 0x1c, 0x64, 0x4e, 0xf6, 0x00, 0x00,
-	0x00,
-}
-
-func (this *Duration) Compare(that interface{}) int {
-	if that == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	}
-
-	that1, ok := that.(*Duration)
-	if !ok {
-		that2, ok := that.(Duration)
-		if ok {
-			that1 = &that2
-		} else {
-			return 1
-		}
-	}
-	if that1 == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	} else if this == nil {
-		return -1
-	}
-	if this.Seconds != that1.Seconds {
-		if this.Seconds < that1.Seconds {
-			return -1
-		}
-		return 1
-	}
-	if this.Nanos != that1.Nanos {
-		if this.Nanos < that1.Nanos {
-			return -1
-		}
-		return 1
-	}
-	if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
-		return c
-	}
-	return 0
-}
-func (this *Duration) Equal(that interface{}) bool {
-	if that == nil {
-		return this == nil
-	}
-
-	that1, ok := that.(*Duration)
-	if !ok {
-		that2, ok := that.(Duration)
-		if ok {
-			that1 = &that2
-		} else {
-			return false
-		}
-	}
-	if that1 == nil {
-		return this == nil
-	} else if this == nil {
-		return false
-	}
-	if this.Seconds != that1.Seconds {
-		return false
-	}
-	if this.Nanos != that1.Nanos {
-		return false
-	}
-	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
-		return false
-	}
-	return true
-}
-func (this *Duration) GoString() string {
-	if this == nil {
-		return "nil"
-	}
-	s := make([]string, 0, 6)
-	s = append(s, "&types.Duration{")
-	s = append(s, "Seconds: "+fmt.Sprintf("%#v", this.Seconds)+",\n")
-	s = append(s, "Nanos: "+fmt.Sprintf("%#v", this.Nanos)+",\n")
-	if this.XXX_unrecognized != nil {
-		s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
-	}
-	s = append(s, "}")
-	return strings.Join(s, "")
-}
-func valueToGoStringDuration(v interface{}, typ string) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
-}
-func (m *Duration) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Duration) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Duration) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if m.Nanos != 0 {
-		i = encodeVarintDuration(dAtA, i, uint64(m.Nanos))
-		i--
-		dAtA[i] = 0x10
-	}
-	if m.Seconds != 0 {
-		i = encodeVarintDuration(dAtA, i, uint64(m.Seconds))
-		i--
-		dAtA[i] = 0x8
-	}
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintDuration(dAtA []byte, offset int, v uint64) int {
-	offset -= sovDuration(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func (m *Duration) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.Seconds != 0 {
-		n += 1 + sovDuration(uint64(m.Seconds))
-	}
-	if m.Nanos != 0 {
-		n += 1 + sovDuration(uint64(m.Nanos))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func sovDuration(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozDuration(x uint64) (n int) {
-	return sovDuration(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (m *Duration) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowDuration
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Duration: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Duration: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Seconds", wireType)
-			}
-			m.Seconds = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowDuration
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Seconds |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Nanos", wireType)
-			}
-			m.Nanos = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowDuration
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Nanos |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipDuration(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthDuration
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipDuration(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowDuration
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowDuration
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowDuration
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthDuration
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupDuration
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthDuration
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthDuration        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowDuration          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupDuration = fmt.Errorf("proto: unexpected end of group")
-)

vendor/github.com/gogo/protobuf/types/duration_gogo.go

@@ -1,100 +0,0 @@
-// Protocol Buffers for Go with Gadgets
-//
-// Copyright (c) 2016, The GoGo Authors. All rights reserved.
-// http://github.com/gogo/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-package types
-
-import (
-	"fmt"
-	"time"
-)
-
-func NewPopulatedDuration(r interface {
-	Int63() int64
-}, easy bool) *Duration {
-	this := &Duration{}
-	maxSecs := time.Hour.Nanoseconds() / 1e9
-	max := 2 * maxSecs
-	s := int64(r.Int63()) % max
-	s -= maxSecs
-	neg := int64(1)
-	if s < 0 {
-		neg = -1
-	}
-	this.Seconds = s
-	this.Nanos = int32(neg * (r.Int63() % 1e9))
-	return this
-}
-
-func (d *Duration) String() string {
-	td, err := DurationFromProto(d)
-	if err != nil {
-		return fmt.Sprintf("(%v)", err)
-	}
-	return td.String()
-}
-
-func NewPopulatedStdDuration(r interface {
-	Int63() int64
-}, easy bool) *time.Duration {
-	dur := NewPopulatedDuration(r, easy)
-	d, err := DurationFromProto(dur)
-	if err != nil {
-		return nil
-	}
-	return &d
-}
-
-func SizeOfStdDuration(d time.Duration) int {
-	dur := DurationProto(d)
-	return dur.Size()
-}
-
-func StdDurationMarshal(d time.Duration) ([]byte, error) {
-	size := SizeOfStdDuration(d)
-	buf := make([]byte, size)
-	_, err := StdDurationMarshalTo(d, buf)
-	return buf, err
-}
-
-func StdDurationMarshalTo(d time.Duration, data []byte) (int, error) {
-	dur := DurationProto(d)
-	return dur.MarshalTo(data)
-}
-
-func StdDurationUnmarshal(d *time.Duration, data []byte) error {
-	dur := &Duration{}
-	if err := dur.Unmarshal(data); err != nil {
-		return err
-	}
-	dd, err := DurationFromProto(dur)
-	if err != nil {
-		return err
-	}
-	*d = dd
-	return nil
-}

vendor/github.com/gogo/protobuf/types/empty.pb.go

@@ -1,462 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: google/protobuf/empty.proto
-
-package types
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	io "io"
-	math "math"
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
-
-// A generic empty message that you can re-use to avoid defining duplicated
-// empty messages in your APIs. A typical example is to use it as the request
-// or the response type of an API method. For instance:
-//
-//     service Foo {
-//       rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
-//     }
-//
-// The JSON representation for `Empty` is empty JSON object `{}`.
-type Empty struct {
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Empty) Reset()      { *m = Empty{} }
-func (*Empty) ProtoMessage() {}
-func (*Empty) Descriptor() ([]byte, []int) {
-	return fileDescriptor_900544acb223d5b8, []int{0}
-}
-func (*Empty) XXX_WellKnownType() string { return "Empty" }
-func (m *Empty) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *Empty) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Empty.Merge(m, src)
-}
-func (m *Empty) XXX_Size() int {
-	return m.Size()
-}
-func (m *Empty) XXX_DiscardUnknown() {
-	xxx_messageInfo_Empty.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Empty proto.InternalMessageInfo
-
-func (*Empty) XXX_MessageName() string {
-	return "google.protobuf.Empty"
-}
-func init() {
-	proto.RegisterType((*Empty)(nil), "google.protobuf.Empty")
-}
-
-func init() { proto.RegisterFile("google/protobuf/empty.proto", fileDescriptor_900544acb223d5b8) }
-
-var fileDescriptor_900544acb223d5b8 = []byte{
-	// 176 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4e, 0xcf, 0xcf, 0x4f,
-	0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcd, 0x2d, 0x28,
-	0xa9, 0xd4, 0x03, 0x73, 0x85, 0xf8, 0x21, 0x92, 0x7a, 0x30, 0x49, 0x25, 0x76, 0x2e, 0x56, 0x57,
-	0x90, 0xbc, 0x53, 0x0b, 0xe3, 0x8d, 0x87, 0x72, 0x0c, 0x1f, 0x1e, 0xca, 0x31, 0xfe, 0x78, 0x28,
-	0xc7, 0xd8, 0xf0, 0x48, 0x8e, 0x71, 0xc5, 0x23, 0x39, 0xc6, 0x13, 0x8f, 0xe4, 0x18, 0x2f, 0x3c,
-	0x92, 0x63, 0x7c, 0xf0, 0x48, 0x8e, 0xf1, 0xc5, 0x23, 0x39, 0x86, 0x0f, 0x20, 0xf1, 0xc7, 0x72,
-	0x8c, 0x27, 0x1e, 0xcb, 0x31, 0x72, 0x09, 0x27, 0xe7, 0xe7, 0xea, 0xa1, 0x19, 0xe8, 0xc4, 0x05,
-	0x36, 0x2e, 0x00, 0xc4, 0x0d, 0x60, 0x8c, 0x62, 0x2d, 0xa9, 0x2c, 0x48, 0x2d, 0xfe, 0xc1, 0xc8,
-	0xb8, 0x88, 0x89, 0xd9, 0x3d, 0xc0, 0x69, 0x15, 0x93, 0x9c, 0x3b, 0x44, 0x7d, 0x00, 0x54, 0xbd,
-	0x5e, 0x78, 0x6a, 0x4e, 0x8e, 0x77, 0x5e, 0x7e, 0x79, 0x5e, 0x08, 0x48, 0x65, 0x12, 0x1b, 0xd8,
-	0x20, 0x63, 0x40, 0x00, 0x00, 0x00, 0xff, 0xff, 0x21, 0xbe, 0xb6, 0x31, 0xc6, 0x00, 0x00, 0x00,
-}
-
-func (this *Empty) Compare(that interface{}) int {
-	if that == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	}
-
-	that1, ok := that.(*Empty)
-	if !ok {
-		that2, ok := that.(Empty)
-		if ok {
-			that1 = &that2
-		} else {
-			return 1
-		}
-	}
-	if that1 == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	} else if this == nil {
-		return -1
-	}
-	if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
-		return c
-	}
-	return 0
-}
-func (this *Empty) Equal(that interface{}) bool {
-	if that == nil {
-		return this == nil
-	}
-
-	that1, ok := that.(*Empty)
-	if !ok {
-		that2, ok := that.(Empty)
-		if ok {
-			that1 = &that2
-		} else {
-			return false
-		}
-	}
-	if that1 == nil {
-		return this == nil
-	} else if this == nil {
-		return false
-	}
-	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
-		return false
-	}
-	return true
-}
-func (this *Empty) GoString() string {
-	if this == nil {
-		return "nil"
-	}
-	s := make([]string, 0, 4)
-	s = append(s, "&types.Empty{")
-	if this.XXX_unrecognized != nil {
-		s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
-	}
-	s = append(s, "}")
-	return strings.Join(s, "")
-}
-func valueToGoStringEmpty(v interface{}, typ string) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
-}
-func (m *Empty) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Empty) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Empty) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintEmpty(dAtA []byte, offset int, v uint64) int {
-	offset -= sovEmpty(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func NewPopulatedEmpty(r randyEmpty, easy bool) *Empty {
-	this := &Empty{}
-	if !easy && r.Intn(10) != 0 {
-		this.XXX_unrecognized = randUnrecognizedEmpty(r, 1)
-	}
-	return this
-}
-
-type randyEmpty interface {
-	Float32() float32
-	Float64() float64
-	Int63() int64
-	Int31() int32
-	Uint32() uint32
-	Intn(n int) int
-}
-
-func randUTF8RuneEmpty(r randyEmpty) rune {
-	ru := r.Intn(62)
-	if ru < 10 {
-		return rune(ru + 48)
-	} else if ru < 36 {
-		return rune(ru + 55)
-	}
-	return rune(ru + 61)
-}
-func randStringEmpty(r randyEmpty) string {
-	v1 := r.Intn(100)
-	tmps := make([]rune, v1)
-	for i := 0; i < v1; i++ {
-		tmps[i] = randUTF8RuneEmpty(r)
-	}
-	return string(tmps)
-}
-func randUnrecognizedEmpty(r randyEmpty, maxFieldNumber int) (dAtA []byte) {
-	l := r.Intn(5)
-	for i := 0; i < l; i++ {
-		wire := r.Intn(4)
-		if wire == 3 {
-			wire = 5
-		}
-		fieldNumber := maxFieldNumber + r.Intn(100)
-		dAtA = randFieldEmpty(dAtA, r, fieldNumber, wire)
-	}
-	return dAtA
-}
-func randFieldEmpty(dAtA []byte, r randyEmpty, fieldNumber int, wire int) []byte {
-	key := uint32(fieldNumber)<<3 | uint32(wire)
-	switch wire {
-	case 0:
-		dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
-		v2 := r.Int63()
-		if r.Intn(2) == 0 {
-			v2 *= -1
-		}
-		dAtA = encodeVarintPopulateEmpty(dAtA, uint64(v2))
-	case 1:
-		dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	case 2:
-		dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
-		ll := r.Intn(100)
-		dAtA = encodeVarintPopulateEmpty(dAtA, uint64(ll))
-		for j := 0; j < ll; j++ {
-			dAtA = append(dAtA, byte(r.Intn(256)))
-		}
-	default:
-		dAtA = encodeVarintPopulateEmpty(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	}
-	return dAtA
-}
-func encodeVarintPopulateEmpty(dAtA []byte, v uint64) []byte {
-	for v >= 1<<7 {
-		dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
-		v >>= 7
-	}
-	dAtA = append(dAtA, uint8(v))
-	return dAtA
-}
-func (m *Empty) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func sovEmpty(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozEmpty(x uint64) (n int) {
-	return sovEmpty(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (this *Empty) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&Empty{`,
-		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringEmpty(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
-}
-func (m *Empty) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowEmpty
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Empty: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Empty: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		default:
-			iNdEx = preIndex
-			skippy, err := skipEmpty(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthEmpty
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipEmpty(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowEmpty
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowEmpty
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowEmpty
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthEmpty
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupEmpty
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthEmpty
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthEmpty        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowEmpty          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupEmpty = fmt.Errorf("proto: unexpected end of group")
-)

vendor/github.com/gogo/protobuf/types/field_mask.pb.go

@@ -1,738 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: google/protobuf/field_mask.proto
-
-package types
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	io "io"
-	math "math"
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
-
-// `FieldMask` represents a set of symbolic field paths, for example:
-//
-//     paths: "f.a"
-//     paths: "f.b.d"
-//
-// Here `f` represents a field in some root message, `a` and `b`
-// fields in the message found in `f`, and `d` a field found in the
-// message in `f.b`.
-//
-// Field masks are used to specify a subset of fields that should be
-// returned by a get operation or modified by an update operation.
-// Field masks also have a custom JSON encoding (see below).
-//
-// # Field Masks in Projections
-//
-// When used in the context of a projection, a response message or
-// sub-message is filtered by the API to only contain those fields as
-// specified in the mask. For example, if the mask in the previous
-// example is applied to a response message as follows:
-//
-//     f {
-//       a : 22
-//       b {
-//         d : 1
-//         x : 2
-//       }
-//       y : 13
-//     }
-//     z: 8
-//
-// The result will not contain specific values for fields x,y and z
-// (their value will be set to the default, and omitted in proto text
-// output):
-//
-//
-//     f {
-//       a : 22
-//       b {
-//         d : 1
-//       }
-//     }
-//
-// A repeated field is not allowed except at the last position of a
-// paths string.
-//
-// If a FieldMask object is not present in a get operation, the
-// operation applies to all fields (as if a FieldMask of all fields
-// had been specified).
-//
-// Note that a field mask does not necessarily apply to the
-// top-level response message. In case of a REST get operation, the
-// field mask applies directly to the response, but in case of a REST
-// list operation, the mask instead applies to each individual message
-// in the returned resource list. In case of a REST custom method,
-// other definitions may be used. Where the mask applies will be
-// clearly documented together with its declaration in the API.  In
-// any case, the effect on the returned resource/resources is required
-// behavior for APIs.
-//
-// # Field Masks in Update Operations
-//
-// A field mask in update operations specifies which fields of the
-// targeted resource are going to be updated. The API is required
-// to only change the values of the fields as specified in the mask
-// and leave the others untouched. If a resource is passed in to
-// describe the updated values, the API ignores the values of all
-// fields not covered by the mask.
-//
-// If a repeated field is specified for an update operation, new values will
-// be appended to the existing repeated field in the target resource. Note that
-// a repeated field is only allowed in the last position of a `paths` string.
-//
-// If a sub-message is specified in the last position of the field mask for an
-// update operation, then new value will be merged into the existing sub-message
-// in the target resource.
-//
-// For example, given the target message:
-//
-//     f {
-//       b {
-//         d: 1
-//         x: 2
-//       }
-//       c: [1]
-//     }
-//
-// And an update message:
-//
-//     f {
-//       b {
-//         d: 10
-//       }
-//       c: [2]
-//     }
-//
-// then if the field mask is:
-//
-//  paths: ["f.b", "f.c"]
-//
-// then the result will be:
-//
-//     f {
-//       b {
-//         d: 10
-//         x: 2
-//       }
-//       c: [1, 2]
-//     }
-//
-// An implementation may provide options to override this default behavior for
-// repeated and message fields.
-//
-// In order to reset a field's value to the default, the field must
-// be in the mask and set to the default value in the provided resource.
-// Hence, in order to reset all fields of a resource, provide a default
-// instance of the resource and set all fields in the mask, or do
-// not provide a mask as described below.
-//
-// If a field mask is not present on update, the operation applies to
-// all fields (as if a field mask of all fields has been specified).
-// Note that in the presence of schema evolution, this may mean that
-// fields the client does not know and has therefore not filled into
-// the request will be reset to their default. If this is unwanted
-// behavior, a specific service may require a client to always specify
-// a field mask, producing an error if not.
-//
-// As with get operations, the location of the resource which
-// describes the updated values in the request message depends on the
-// operation kind. In any case, the effect of the field mask is
-// required to be honored by the API.
-//
-// ## Considerations for HTTP REST
-//
-// The HTTP kind of an update operation which uses a field mask must
-// be set to PATCH instead of PUT in order to satisfy HTTP semantics
-// (PUT must only be used for full updates).
-//
-// # JSON Encoding of Field Masks
-//
-// In JSON, a field mask is encoded as a single string where paths are
-// separated by a comma. Fields name in each path are converted
-// to/from lower-camel naming conventions.
-//
-// As an example, consider the following message declarations:
-//
-//     message Profile {
-//       User user = 1;
-//       Photo photo = 2;
-//     }
-//     message User {
-//       string display_name = 1;
-//       string address = 2;
-//     }
-//
-// In proto a field mask for `Profile` may look as such:
-//
-//     mask {
-//       paths: "user.display_name"
-//       paths: "photo"
-//     }
-//
-// In JSON, the same mask is represented as below:
-//
-//     {
-//       mask: "user.displayName,photo"
-//     }
-//
-// # Field Masks and Oneof Fields
-//
-// Field masks treat fields in oneofs just as regular fields. Consider the
-// following message:
-//
-//     message SampleMessage {
-//       oneof test_oneof {
-//         string name = 4;
-//         SubMessage sub_message = 9;
-//       }
-//     }
-//
-// The field mask can be:
-//
-//     mask {
-//       paths: "name"
-//     }
-//
-// Or:
-//
-//     mask {
-//       paths: "sub_message"
-//     }
-//
-// Note that oneof type names ("test_oneof" in this case) cannot be used in
-// paths.
-//
-// ## Field Mask Verification
-//
-// The implementation of any API method which has a FieldMask type field in the
-// request should verify the included field paths, and return an
-// `INVALID_ARGUMENT` error if any path is duplicated or unmappable.
-type FieldMask struct {
-	// The set of field mask paths.
-	Paths                []string `protobuf:"bytes,1,rep,name=paths,proto3" json:"paths,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *FieldMask) Reset()      { *m = FieldMask{} }
-func (*FieldMask) ProtoMessage() {}
-func (*FieldMask) Descriptor() ([]byte, []int) {
-	return fileDescriptor_5158202634f0da48, []int{0}
-}
-func (m *FieldMask) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *FieldMask) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_FieldMask.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *FieldMask) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_FieldMask.Merge(m, src)
-}
-func (m *FieldMask) XXX_Size() int {
-	return m.Size()
-}
-func (m *FieldMask) XXX_DiscardUnknown() {
-	xxx_messageInfo_FieldMask.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_FieldMask proto.InternalMessageInfo
-
-func (m *FieldMask) GetPaths() []string {
-	if m != nil {
-		return m.Paths
-	}
-	return nil
-}
-
-func (*FieldMask) XXX_MessageName() string {
-	return "google.protobuf.FieldMask"
-}
-func init() {
-	proto.RegisterType((*FieldMask)(nil), "google.protobuf.FieldMask")
-}
-
-func init() { proto.RegisterFile("google/protobuf/field_mask.proto", fileDescriptor_5158202634f0da48) }
-
-var fileDescriptor_5158202634f0da48 = []byte{
-	// 203 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0x48, 0xcf, 0xcf, 0x4f,
-	0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x4f, 0xcb, 0x4c, 0xcd,
-	0x49, 0x89, 0xcf, 0x4d, 0x2c, 0xce, 0xd6, 0x03, 0x8b, 0x09, 0xf1, 0x43, 0x54, 0xe8, 0xc1, 0x54,
-	0x28, 0x29, 0x72, 0x71, 0xba, 0x81, 0x14, 0xf9, 0x26, 0x16, 0x67, 0x0b, 0x89, 0x70, 0xb1, 0x16,
-	0x24, 0x96, 0x64, 0x14, 0x4b, 0x30, 0x2a, 0x30, 0x6b, 0x70, 0x06, 0x41, 0x38, 0x4e, 0x1d, 0x8c,
-	0x37, 0x1e, 0xca, 0x31, 0x7c, 0x78, 0x28, 0xc7, 0xf8, 0xe3, 0xa1, 0x1c, 0x63, 0xc3, 0x23, 0x39,
-	0xc6, 0x15, 0x8f, 0xe4, 0x18, 0x4f, 0x3c, 0x92, 0x63, 0xbc, 0xf0, 0x48, 0x8e, 0xf1, 0xc1, 0x23,
-	0x39, 0xc6, 0x17, 0x8f, 0xe4, 0x18, 0x3e, 0x80, 0xc4, 0x1f, 0xcb, 0x31, 0x9e, 0x78, 0x2c, 0xc7,
-	0xc8, 0x25, 0x9c, 0x9c, 0x9f, 0xab, 0x87, 0x66, 0x95, 0x13, 0x1f, 0xdc, 0xa2, 0x00, 0x90, 0x50,
-	0x00, 0x63, 0x14, 0x6b, 0x49, 0x65, 0x41, 0x6a, 0xf1, 0x0f, 0x46, 0xc6, 0x45, 0x4c, 0xcc, 0xee,
-	0x01, 0x4e, 0xab, 0x98, 0xe4, 0xdc, 0x21, 0x7a, 0x02, 0xa0, 0x7a, 0xf4, 0xc2, 0x53, 0x73, 0x72,
-	0xbc, 0xf3, 0xf2, 0xcb, 0xf3, 0x42, 0x40, 0x2a, 0x93, 0xd8, 0xc0, 0x86, 0x19, 0x03, 0x02, 0x00,
-	0x00, 0xff, 0xff, 0x43, 0xa0, 0x83, 0xd0, 0xe9, 0x00, 0x00, 0x00,
-}
-
-func (this *FieldMask) Compare(that interface{}) int {
-	if that == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	}
-
-	that1, ok := that.(*FieldMask)
-	if !ok {
-		that2, ok := that.(FieldMask)
-		if ok {
-			that1 = &that2
-		} else {
-			return 1
-		}
-	}
-	if that1 == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	} else if this == nil {
-		return -1
-	}
-	if len(this.Paths) != len(that1.Paths) {
-		if len(this.Paths) < len(that1.Paths) {
-			return -1
-		}
-		return 1
-	}
-	for i := range this.Paths {
-		if this.Paths[i] != that1.Paths[i] {
-			if this.Paths[i] < that1.Paths[i] {
-				return -1
-			}
-			return 1
-		}
-	}
-	if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
-		return c
-	}
-	return 0
-}
-func (this *FieldMask) Equal(that interface{}) bool {
-	if that == nil {
-		return this == nil
-	}
-
-	that1, ok := that.(*FieldMask)
-	if !ok {
-		that2, ok := that.(FieldMask)
-		if ok {
-			that1 = &that2
-		} else {
-			return false
-		}
-	}
-	if that1 == nil {
-		return this == nil
-	} else if this == nil {
-		return false
-	}
-	if len(this.Paths) != len(that1.Paths) {
-		return false
-	}
-	for i := range this.Paths {
-		if this.Paths[i] != that1.Paths[i] {
-			return false
-		}
-	}
-	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
-		return false
-	}
-	return true
-}
-func (this *FieldMask) GoString() string {
-	if this == nil {
-		return "nil"
-	}
-	s := make([]string, 0, 5)
-	s = append(s, "&types.FieldMask{")
-	s = append(s, "Paths: "+fmt.Sprintf("%#v", this.Paths)+",\n")
-	if this.XXX_unrecognized != nil {
-		s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
-	}
-	s = append(s, "}")
-	return strings.Join(s, "")
-}
-func valueToGoStringFieldMask(v interface{}, typ string) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
-}
-func (m *FieldMask) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *FieldMask) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *FieldMask) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.Paths) > 0 {
-		for iNdEx := len(m.Paths) - 1; iNdEx >= 0; iNdEx-- {
-			i -= len(m.Paths[iNdEx])
-			copy(dAtA[i:], m.Paths[iNdEx])
-			i = encodeVarintFieldMask(dAtA, i, uint64(len(m.Paths[iNdEx])))
-			i--
-			dAtA[i] = 0xa
-		}
-	}
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintFieldMask(dAtA []byte, offset int, v uint64) int {
-	offset -= sovFieldMask(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func NewPopulatedFieldMask(r randyFieldMask, easy bool) *FieldMask {
-	this := &FieldMask{}
-	v1 := r.Intn(10)
-	this.Paths = make([]string, v1)
-	for i := 0; i < v1; i++ {
-		this.Paths[i] = string(randStringFieldMask(r))
-	}
-	if !easy && r.Intn(10) != 0 {
-		this.XXX_unrecognized = randUnrecognizedFieldMask(r, 2)
-	}
-	return this
-}
-
-type randyFieldMask interface {
-	Float32() float32
-	Float64() float64
-	Int63() int64
-	Int31() int32
-	Uint32() uint32
-	Intn(n int) int
-}
-
-func randUTF8RuneFieldMask(r randyFieldMask) rune {
-	ru := r.Intn(62)
-	if ru < 10 {
-		return rune(ru + 48)
-	} else if ru < 36 {
-		return rune(ru + 55)
-	}
-	return rune(ru + 61)
-}
-func randStringFieldMask(r randyFieldMask) string {
-	v2 := r.Intn(100)
-	tmps := make([]rune, v2)
-	for i := 0; i < v2; i++ {
-		tmps[i] = randUTF8RuneFieldMask(r)
-	}
-	return string(tmps)
-}
-func randUnrecognizedFieldMask(r randyFieldMask, maxFieldNumber int) (dAtA []byte) {
-	l := r.Intn(5)
-	for i := 0; i < l; i++ {
-		wire := r.Intn(4)
-		if wire == 3 {
-			wire = 5
-		}
-		fieldNumber := maxFieldNumber + r.Intn(100)
-		dAtA = randFieldFieldMask(dAtA, r, fieldNumber, wire)
-	}
-	return dAtA
-}
-func randFieldFieldMask(dAtA []byte, r randyFieldMask, fieldNumber int, wire int) []byte {
-	key := uint32(fieldNumber)<<3 | uint32(wire)
-	switch wire {
-	case 0:
-		dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
-		v3 := r.Int63()
-		if r.Intn(2) == 0 {
-			v3 *= -1
-		}
-		dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(v3))
-	case 1:
-		dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	case 2:
-		dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
-		ll := r.Intn(100)
-		dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(ll))
-		for j := 0; j < ll; j++ {
-			dAtA = append(dAtA, byte(r.Intn(256)))
-		}
-	default:
-		dAtA = encodeVarintPopulateFieldMask(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	}
-	return dAtA
-}
-func encodeVarintPopulateFieldMask(dAtA []byte, v uint64) []byte {
-	for v >= 1<<7 {
-		dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
-		v >>= 7
-	}
-	dAtA = append(dAtA, uint8(v))
-	return dAtA
-}
-func (m *FieldMask) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if len(m.Paths) > 0 {
-		for _, s := range m.Paths {
-			l = len(s)
-			n += 1 + l + sovFieldMask(uint64(l))
-		}
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func sovFieldMask(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozFieldMask(x uint64) (n int) {
-	return sovFieldMask(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (this *FieldMask) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&FieldMask{`,
-		`Paths:` + fmt.Sprintf("%v", this.Paths) + `,`,
-		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringFieldMask(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
-}
-func (m *FieldMask) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowFieldMask
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: FieldMask: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: FieldMask: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Paths", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowFieldMask
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthFieldMask
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthFieldMask
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Paths = append(m.Paths, string(dAtA[iNdEx:postIndex]))
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipFieldMask(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthFieldMask
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipFieldMask(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowFieldMask
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowFieldMask
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowFieldMask
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthFieldMask
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupFieldMask
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthFieldMask
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthFieldMask        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowFieldMask          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupFieldMask = fmt.Errorf("proto: unexpected end of group")
-)

vendor/github.com/gogo/protobuf/types/protosize.go

@@ -1,34 +0,0 @@
-package types
-
-func (m *Any) ProtoSize() (n int)               { return m.Size() }
-func (m *Api) ProtoSize() (n int)               { return m.Size() }
-func (m *Method) ProtoSize() (n int)            { return m.Size() }
-func (m *Mixin) ProtoSize() (n int)             { return m.Size() }
-func (m *Duration) ProtoSize() (n int)          { return m.Size() }
-func (m *Empty) ProtoSize() (n int)             { return m.Size() }
-func (m *FieldMask) ProtoSize() (n int)         { return m.Size() }
-func (m *SourceContext) ProtoSize() (n int)     { return m.Size() }
-func (m *Struct) ProtoSize() (n int)            { return m.Size() }
-func (m *Value) ProtoSize() (n int)             { return m.Size() }
-func (m *Value_NullValue) ProtoSize() (n int)   { return m.Size() }
-func (m *Value_NumberValue) ProtoSize() (n int) { return m.Size() }
-func (m *Value_StringValue) ProtoSize() (n int) { return m.Size() }
-func (m *Value_BoolValue) ProtoSize() (n int)   { return m.Size() }
-func (m *Value_StructValue) ProtoSize() (n int) { return m.Size() }
-func (m *Value_ListValue) ProtoSize() (n int)   { return m.Size() }
-func (m *ListValue) ProtoSize() (n int)         { return m.Size() }
-func (m *Timestamp) ProtoSize() (n int)         { return m.Size() }
-func (m *Type) ProtoSize() (n int)              { return m.Size() }
-func (m *Field) ProtoSize() (n int)             { return m.Size() }
-func (m *Enum) ProtoSize() (n int)              { return m.Size() }
-func (m *EnumValue) ProtoSize() (n int)         { return m.Size() }
-func (m *Option) ProtoSize() (n int)            { return m.Size() }
-func (m *DoubleValue) ProtoSize() (n int)       { return m.Size() }
-func (m *FloatValue) ProtoSize() (n int)        { return m.Size() }
-func (m *Int64Value) ProtoSize() (n int)        { return m.Size() }
-func (m *UInt64Value) ProtoSize() (n int)       { return m.Size() }
-func (m *Int32Value) ProtoSize() (n int)        { return m.Size() }
-func (m *UInt32Value) ProtoSize() (n int)       { return m.Size() }
-func (m *BoolValue) ProtoSize() (n int)         { return m.Size() }
-func (m *StringValue) ProtoSize() (n int)       { return m.Size() }
-func (m *BytesValue) ProtoSize() (n int)        { return m.Size() }

vendor/github.com/gogo/protobuf/types/source_context.pb.go

@@ -1,524 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: google/protobuf/source_context.proto
-
-package types
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	io "io"
-	math "math"
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
-
-// `SourceContext` represents information about the source of a
-// protobuf element, like the file in which it is defined.
-type SourceContext struct {
-	// The path-qualified name of the .proto file that contained the associated
-	// protobuf element.  For example: `"google/protobuf/source_context.proto"`.
-	FileName             string   `protobuf:"bytes,1,opt,name=file_name,json=fileName,proto3" json:"file_name,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *SourceContext) Reset()      { *m = SourceContext{} }
-func (*SourceContext) ProtoMessage() {}
-func (*SourceContext) Descriptor() ([]byte, []int) {
-	return fileDescriptor_b686cdb126d509db, []int{0}
-}
-func (m *SourceContext) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *SourceContext) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_SourceContext.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *SourceContext) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_SourceContext.Merge(m, src)
-}
-func (m *SourceContext) XXX_Size() int {
-	return m.Size()
-}
-func (m *SourceContext) XXX_DiscardUnknown() {
-	xxx_messageInfo_SourceContext.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_SourceContext proto.InternalMessageInfo
-
-func (m *SourceContext) GetFileName() string {
-	if m != nil {
-		return m.FileName
-	}
-	return ""
-}
-
-func (*SourceContext) XXX_MessageName() string {
-	return "google.protobuf.SourceContext"
-}
-func init() {
-	proto.RegisterType((*SourceContext)(nil), "google.protobuf.SourceContext")
-}
-
-func init() {
-	proto.RegisterFile("google/protobuf/source_context.proto", fileDescriptor_b686cdb126d509db)
-}
-
-var fileDescriptor_b686cdb126d509db = []byte{
-	// 212 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0x49, 0xcf, 0xcf, 0x4f,
-	0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0xce, 0x2f, 0x2d,
-	0x4a, 0x4e, 0x8d, 0x4f, 0xce, 0xcf, 0x2b, 0x49, 0xad, 0x28, 0xd1, 0x03, 0x8b, 0x0b, 0xf1, 0x43,
-	0x54, 0xe9, 0xc1, 0x54, 0x29, 0xe9, 0x70, 0xf1, 0x06, 0x83, 0x15, 0x3a, 0x43, 0xd4, 0x09, 0x49,
-	0x73, 0x71, 0xa6, 0x65, 0xe6, 0xa4, 0xc6, 0xe7, 0x25, 0xe6, 0xa6, 0x4a, 0x30, 0x2a, 0x30, 0x6a,
-	0x70, 0x06, 0x71, 0x80, 0x04, 0xfc, 0x12, 0x73, 0x53, 0x9d, 0x3a, 0x19, 0x6f, 0x3c, 0x94, 0x63,
-	0xf8, 0xf0, 0x50, 0x8e, 0xf1, 0xc7, 0x43, 0x39, 0xc6, 0x86, 0x47, 0x72, 0x8c, 0x2b, 0x1e, 0xc9,
-	0x31, 0x9e, 0x78, 0x24, 0xc7, 0x78, 0xe1, 0x91, 0x1c, 0xe3, 0x83, 0x47, 0x72, 0x8c, 0x2f, 0x1e,
-	0xc9, 0x31, 0x7c, 0x00, 0x89, 0x3f, 0x96, 0x63, 0x3c, 0xf1, 0x58, 0x8e, 0x91, 0x4b, 0x38, 0x39,
-	0x3f, 0x57, 0x0f, 0xcd, 0x56, 0x27, 0x21, 0x14, 0x3b, 0x03, 0x40, 0xc2, 0x01, 0x8c, 0x51, 0xac,
-	0x25, 0x95, 0x05, 0xa9, 0xc5, 0x8b, 0x98, 0x98, 0xdd, 0x03, 0x9c, 0x56, 0x31, 0xc9, 0xb9, 0x43,
-	0x34, 0x05, 0x40, 0x35, 0xe9, 0x85, 0xa7, 0xe6, 0xe4, 0x78, 0xe7, 0xe5, 0x97, 0xe7, 0x85, 0x80,
-	0x94, 0x25, 0xb1, 0x81, 0x4d, 0x33, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0xb8, 0x37, 0x2a, 0xa1,
-	0xf9, 0x00, 0x00, 0x00,
-}
-
-func (this *SourceContext) Compare(that interface{}) int {
-	if that == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	}
-
-	that1, ok := that.(*SourceContext)
-	if !ok {
-		that2, ok := that.(SourceContext)
-		if ok {
-			that1 = &that2
-		} else {
-			return 1
-		}
-	}
-	if that1 == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	} else if this == nil {
-		return -1
-	}
-	if this.FileName != that1.FileName {
-		if this.FileName < that1.FileName {
-			return -1
-		}
-		return 1
-	}
-	if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
-		return c
-	}
-	return 0
-}
-func (this *SourceContext) Equal(that interface{}) bool {
-	if that == nil {
-		return this == nil
-	}
-
-	that1, ok := that.(*SourceContext)
-	if !ok {
-		that2, ok := that.(SourceContext)
-		if ok {
-			that1 = &that2
-		} else {
-			return false
-		}
-	}
-	if that1 == nil {
-		return this == nil
-	} else if this == nil {
-		return false
-	}
-	if this.FileName != that1.FileName {
-		return false
-	}
-	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
-		return false
-	}
-	return true
-}
-func (this *SourceContext) GoString() string {
-	if this == nil {
-		return "nil"
-	}
-	s := make([]string, 0, 5)
-	s = append(s, "&types.SourceContext{")
-	s = append(s, "FileName: "+fmt.Sprintf("%#v", this.FileName)+",\n")
-	if this.XXX_unrecognized != nil {
-		s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
-	}
-	s = append(s, "}")
-	return strings.Join(s, "")
-}
-func valueToGoStringSourceContext(v interface{}, typ string) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
-}
-func (m *SourceContext) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *SourceContext) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *SourceContext) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.FileName) > 0 {
-		i -= len(m.FileName)
-		copy(dAtA[i:], m.FileName)
-		i = encodeVarintSourceContext(dAtA, i, uint64(len(m.FileName)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintSourceContext(dAtA []byte, offset int, v uint64) int {
-	offset -= sovSourceContext(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func NewPopulatedSourceContext(r randySourceContext, easy bool) *SourceContext {
-	this := &SourceContext{}
-	this.FileName = string(randStringSourceContext(r))
-	if !easy && r.Intn(10) != 0 {
-		this.XXX_unrecognized = randUnrecognizedSourceContext(r, 2)
-	}
-	return this
-}
-
-type randySourceContext interface {
-	Float32() float32
-	Float64() float64
-	Int63() int64
-	Int31() int32
-	Uint32() uint32
-	Intn(n int) int
-}
-
-func randUTF8RuneSourceContext(r randySourceContext) rune {
-	ru := r.Intn(62)
-	if ru < 10 {
-		return rune(ru + 48)
-	} else if ru < 36 {
-		return rune(ru + 55)
-	}
-	return rune(ru + 61)
-}
-func randStringSourceContext(r randySourceContext) string {
-	v1 := r.Intn(100)
-	tmps := make([]rune, v1)
-	for i := 0; i < v1; i++ {
-		tmps[i] = randUTF8RuneSourceContext(r)
-	}
-	return string(tmps)
-}
-func randUnrecognizedSourceContext(r randySourceContext, maxFieldNumber int) (dAtA []byte) {
-	l := r.Intn(5)
-	for i := 0; i < l; i++ {
-		wire := r.Intn(4)
-		if wire == 3 {
-			wire = 5
-		}
-		fieldNumber := maxFieldNumber + r.Intn(100)
-		dAtA = randFieldSourceContext(dAtA, r, fieldNumber, wire)
-	}
-	return dAtA
-}
-func randFieldSourceContext(dAtA []byte, r randySourceContext, fieldNumber int, wire int) []byte {
-	key := uint32(fieldNumber)<<3 | uint32(wire)
-	switch wire {
-	case 0:
-		dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
-		v2 := r.Int63()
-		if r.Intn(2) == 0 {
-			v2 *= -1
-		}
-		dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(v2))
-	case 1:
-		dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	case 2:
-		dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
-		ll := r.Intn(100)
-		dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(ll))
-		for j := 0; j < ll; j++ {
-			dAtA = append(dAtA, byte(r.Intn(256)))
-		}
-	default:
-		dAtA = encodeVarintPopulateSourceContext(dAtA, uint64(key))
-		dAtA = append(dAtA, byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)), byte(r.Intn(256)))
-	}
-	return dAtA
-}
-func encodeVarintPopulateSourceContext(dAtA []byte, v uint64) []byte {
-	for v >= 1<<7 {
-		dAtA = append(dAtA, uint8(uint64(v)&0x7f|0x80))
-		v >>= 7
-	}
-	dAtA = append(dAtA, uint8(v))
-	return dAtA
-}
-func (m *SourceContext) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.FileName)
-	if l > 0 {
-		n += 1 + l + sovSourceContext(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func sovSourceContext(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozSourceContext(x uint64) (n int) {
-	return sovSourceContext(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (this *SourceContext) String() string {
-	if this == nil {
-		return "nil"
-	}
-	s := strings.Join([]string{`&SourceContext{`,
-		`FileName:` + fmt.Sprintf("%v", this.FileName) + `,`,
-		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,
-		`}`,
-	}, "")
-	return s
-}
-func valueToStringSourceContext(v interface{}) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("*%v", pv)
-}
-func (m *SourceContext) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowSourceContext
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: SourceContext: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: SourceContext: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field FileName", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowSourceContext
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthSourceContext
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthSourceContext
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.FileName = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipSourceContext(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthSourceContext
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipSourceContext(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowSourceContext
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowSourceContext
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowSourceContext
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthSourceContext
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupSourceContext
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthSourceContext
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthSourceContext        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowSourceContext          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupSourceContext = fmt.Errorf("proto: unexpected end of group")
-)

vendor/github.com/gogo/protobuf/types/timestamp.go

@@ -1,130 +0,0 @@
-// Go support for Protocol Buffers - Google's data interchange format
-//
-// Copyright 2016 The Go Authors.  All rights reserved.
-// https://github.com/golang/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-package types
-
-// This file implements operations on google.protobuf.Timestamp.
-
-import (
-	"errors"
-	"fmt"
-	"time"
-)
-
-const (
-	// Seconds field of the earliest valid Timestamp.
-	// This is time.Date(1, 1, 1, 0, 0, 0, 0, time.UTC).Unix().
-	minValidSeconds = -62135596800
-	// Seconds field just after the latest valid Timestamp.
-	// This is time.Date(10000, 1, 1, 0, 0, 0, 0, time.UTC).Unix().
-	maxValidSeconds = 253402300800
-)
-
-// validateTimestamp determines whether a Timestamp is valid.
-// A valid timestamp represents a time in the range
-// [0001-01-01, 10000-01-01) and has a Nanos field
-// in the range [0, 1e9).
-//
-// If the Timestamp is valid, validateTimestamp returns nil.
-// Otherwise, it returns an error that describes
-// the problem.
-//
-// Every valid Timestamp can be represented by a time.Time, but the converse is not true.
-func validateTimestamp(ts *Timestamp) error {
-	if ts == nil {
-		return errors.New("timestamp: nil Timestamp")
-	}
-	if ts.Seconds < minValidSeconds {
-		return fmt.Errorf("timestamp: %#v before 0001-01-01", ts)
-	}
-	if ts.Seconds >= maxValidSeconds {
-		return fmt.Errorf("timestamp: %#v after 10000-01-01", ts)
-	}
-	if ts.Nanos < 0 || ts.Nanos >= 1e9 {
-		return fmt.Errorf("timestamp: %#v: nanos not in range [0, 1e9)", ts)
-	}
-	return nil
-}
-
-// TimestampFromProto converts a google.protobuf.Timestamp proto to a time.Time.
-// It returns an error if the argument is invalid.
-//
-// Unlike most Go functions, if Timestamp returns an error, the first return value
-// is not the zero time.Time. Instead, it is the value obtained from the
-// time.Unix function when passed the contents of the Timestamp, in the UTC
-// locale. This may or may not be a meaningful time; many invalid Timestamps
-// do map to valid time.Times.
-//
-// A nil Timestamp returns an error. The first return value in that case is
-// undefined.
-func TimestampFromProto(ts *Timestamp) (time.Time, error) {
-	// Don't return the zero value on error, because corresponds to a valid
-	// timestamp. Instead return whatever time.Unix gives us.
-	var t time.Time
-	if ts == nil {
-		t = time.Unix(0, 0).UTC() // treat nil like the empty Timestamp
-	} else {
-		t = time.Unix(ts.Seconds, int64(ts.Nanos)).UTC()
-	}
-	return t, validateTimestamp(ts)
-}
-
-// TimestampNow returns a google.protobuf.Timestamp for the current time.
-func TimestampNow() *Timestamp {
-	ts, err := TimestampProto(time.Now())
-	if err != nil {
-		panic("ptypes: time.Now() out of Timestamp range")
-	}
-	return ts
-}
-
-// TimestampProto converts the time.Time to a google.protobuf.Timestamp proto.
-// It returns an error if the resulting Timestamp is invalid.
-func TimestampProto(t time.Time) (*Timestamp, error) {
-	ts := &Timestamp{
-		Seconds: t.Unix(),
-		Nanos:   int32(t.Nanosecond()),
-	}
-	if err := validateTimestamp(ts); err != nil {
-		return nil, err
-	}
-	return ts, nil
-}
-
-// TimestampString returns the RFC 3339 string for valid Timestamps. For invalid
-// Timestamps, it returns an error message in parentheses.
-func TimestampString(ts *Timestamp) string {
-	t, err := TimestampFromProto(ts)
-	if err != nil {
-		return fmt.Sprintf("(%v)", err)
-	}
-	return t.Format(time.RFC3339Nano)
-}

vendor/github.com/gogo/protobuf/types/timestamp.pb.go

@@ -1,539 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: google/protobuf/timestamp.proto
-
-package types
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	io "io"
-	math "math"
-	math_bits "math/bits"
-	reflect "reflect"
-	strings "strings"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the proto package it is being compiled against.
-// A compilation error at this line likely means your copy of the
-// proto package needs to be updated.
-const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
-
-// A Timestamp represents a point in time independent of any time zone or local
-// calendar, encoded as a count of seconds and fractions of seconds at
-// nanosecond resolution. The count is relative to an epoch at UTC midnight on
-// January 1, 1970, in the proleptic Gregorian calendar which extends the
-// Gregorian calendar backwards to year one.
-//
-// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
-// second table is needed for interpretation, using a [24-hour linear
-// smear](https://developers.google.com/time/smear).
-//
-// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
-// restricting to that range, we ensure that we can convert to and from [RFC
-// 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
-//
-// # Examples
-//
-// Example 1: Compute Timestamp from POSIX `time()`.
-//
-//     Timestamp timestamp;
-//     timestamp.set_seconds(time(NULL));
-//     timestamp.set_nanos(0);
-//
-// Example 2: Compute Timestamp from POSIX `gettimeofday()`.
-//
-//     struct timeval tv;
-//     gettimeofday(&tv, NULL);
-//
-//     Timestamp timestamp;
-//     timestamp.set_seconds(tv.tv_sec);
-//     timestamp.set_nanos(tv.tv_usec * 1000);
-//
-// Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
-//
-//     FILETIME ft;
-//     GetSystemTimeAsFileTime(&ft);
-//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
-//
-//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
-//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
-//     Timestamp timestamp;
-//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
-//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
-//
-// Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
-//
-//     long millis = System.currentTimeMillis();
-//
-//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
-//         .setNanos((int) ((millis % 1000) * 1000000)).build();
-//
-//
-// Example 5: Compute Timestamp from current time in Python.
-//
-//     timestamp = Timestamp()
-//     timestamp.GetCurrentTime()
-//
-// # JSON Mapping
-//
-// In JSON format, the Timestamp type is encoded as a string in the
-// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
-// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
-// where {year} is always expressed using four digits while {month}, {day},
-// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
-// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
-// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
-// is required. A proto3 JSON serializer should always use UTC (as indicated by
-// "Z") when printing the Timestamp type and a proto3 JSON parser should be
-// able to accept both UTC and other timezones (as indicated by an offset).
-//
-// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
-// 01:30 UTC on January 15, 2017.
-//
-// In JavaScript, one can convert a Date object to this format using the
-// standard
-// [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
-// method. In Python, a standard `datetime.datetime` object can be converted
-// to this format using
-// [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
-// the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
-// the Joda Time's [`ISODateTimeFormat.dateTime()`](
-// http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D
-// ) to obtain a formatter capable of generating timestamps in this format.
-//
-//
-type Timestamp struct {
-	// Represents seconds of UTC time since Unix epoch
-	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
-	// 9999-12-31T23:59:59Z inclusive.
-	Seconds int64 `protobuf:"varint,1,opt,name=seconds,proto3" json:"seconds,omitempty"`
-	// Non-negative fractions of a second at nanosecond resolution. Negative
-	// second values with fractions must still have non-negative nanos values
-	// that count forward in time. Must be from 0 to 999,999,999
-	// inclusive.
-	Nanos                int32    `protobuf:"varint,2,opt,name=nanos,proto3" json:"nanos,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *Timestamp) Reset()      { *m = Timestamp{} }
-func (*Timestamp) ProtoMessage() {}
-func (*Timestamp) Descriptor() ([]byte, []int) {
-	return fileDescriptor_292007bbfe81227e, []int{0}
-}
-func (*Timestamp) XXX_WellKnownType() string { return "Timestamp" }
-func (m *Timestamp) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *Timestamp) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_Timestamp.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *Timestamp) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Timestamp.Merge(m, src)
-}
-func (m *Timestamp) XXX_Size() int {
-	return m.Size()
-}
-func (m *Timestamp) XXX_DiscardUnknown() {
-	xxx_messageInfo_Timestamp.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_Timestamp proto.InternalMessageInfo
-
-func (m *Timestamp) GetSeconds() int64 {
-	if m != nil {
-		return m.Seconds
-	}
-	return 0
-}
-
-func (m *Timestamp) GetNanos() int32 {
-	if m != nil {
-		return m.Nanos
-	}
-	return 0
-}
-
-func (*Timestamp) XXX_MessageName() string {
-	return "google.protobuf.Timestamp"
-}
-func init() {
-	proto.RegisterType((*Timestamp)(nil), "google.protobuf.Timestamp")
-}
-
-func init() { proto.RegisterFile("google/protobuf/timestamp.proto", fileDescriptor_292007bbfe81227e) }
-
-var fileDescriptor_292007bbfe81227e = []byte{
-	// 212 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x4f, 0xcf, 0xcf, 0x4f,
-	0xcf, 0x49, 0xd5, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0x2a, 0x4d, 0xd3, 0x2f, 0xc9, 0xcc, 0x4d,
-	0x2d, 0x2e, 0x49, 0xcc, 0x2d, 0xd0, 0x03, 0x0b, 0x09, 0xf1, 0x43, 0x14, 0xe8, 0xc1, 0x14, 0x28,
-	0x59, 0x73, 0x71, 0x86, 0xc0, 0xd4, 0x08, 0x49, 0x70, 0xb1, 0x17, 0xa7, 0x26, 0xe7, 0xe7, 0xa5,
-	0x14, 0x4b, 0x30, 0x2a, 0x30, 0x6a, 0x30, 0x07, 0xc1, 0xb8, 0x42, 0x22, 0x5c, 0xac, 0x79, 0x89,
-	0x79, 0xf9, 0xc5, 0x12, 0x4c, 0x0a, 0x8c, 0x1a, 0xac, 0x41, 0x10, 0x8e, 0x53, 0x03, 0xe3, 0x8d,
-	0x87, 0x72, 0x0c, 0x1f, 0x1e, 0xca, 0x31, 0xae, 0x78, 0x24, 0xc7, 0x78, 0xe2, 0x91, 0x1c, 0xe3,
-	0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0xbe, 0x78, 0x24, 0xc7, 0xf0, 0xe1, 0x91, 0x1c,
-	0xe3, 0x8a, 0xc7, 0x72, 0x8c, 0x27, 0x1e, 0xcb, 0x31, 0x72, 0x09, 0x27, 0xe7, 0xe7, 0xea, 0xa1,
-	0x59, 0xee, 0xc4, 0x07, 0xb7, 0x3a, 0x00, 0x24, 0x14, 0xc0, 0x18, 0xc5, 0x5a, 0x52, 0x59, 0x90,
-	0x5a, 0xfc, 0x83, 0x91, 0x71, 0x11, 0x13, 0xb3, 0x7b, 0x80, 0xd3, 0x2a, 0x26, 0x39, 0x77, 0x88,
-	0x9e, 0x00, 0xa8, 0x1e, 0xbd, 0xf0, 0xd4, 0x9c, 0x1c, 0xef, 0xbc, 0xfc, 0xf2, 0xbc, 0x10, 0x90,
-	0xca, 0x24, 0x36, 0xb0, 0x61, 0xc6, 0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0x0b, 0x23, 0x83, 0xdd,
-	0xfa, 0x00, 0x00, 0x00,
-}
-
-func (this *Timestamp) Compare(that interface{}) int {
-	if that == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	}
-
-	that1, ok := that.(*Timestamp)
-	if !ok {
-		that2, ok := that.(Timestamp)
-		if ok {
-			that1 = &that2
-		} else {
-			return 1
-		}
-	}
-	if that1 == nil {
-		if this == nil {
-			return 0
-		}
-		return 1
-	} else if this == nil {
-		return -1
-	}
-	if this.Seconds != that1.Seconds {
-		if this.Seconds < that1.Seconds {
-			return -1
-		}
-		return 1
-	}
-	if this.Nanos != that1.Nanos {
-		if this.Nanos < that1.Nanos {
-			return -1
-		}
-		return 1
-	}
-	if c := bytes.Compare(this.XXX_unrecognized, that1.XXX_unrecognized); c != 0 {
-		return c
-	}
-	return 0
-}
-func (this *Timestamp) Equal(that interface{}) bool {
-	if that == nil {
-		return this == nil
-	}
-
-	that1, ok := that.(*Timestamp)
-	if !ok {
-		that2, ok := that.(Timestamp)
-		if ok {
-			that1 = &that2
-		} else {
-			return false
-		}
-	}
-	if that1 == nil {
-		return this == nil
-	} else if this == nil {
-		return false
-	}
-	if this.Seconds != that1.Seconds {
-		return false
-	}
-	if this.Nanos != that1.Nanos {
-		return false
-	}
-	if !bytes.Equal(this.XXX_unrecognized, that1.XXX_unrecognized) {
-		return false
-	}
-	return true
-}
-func (this *Timestamp) GoString() string {
-	if this == nil {
-		return "nil"
-	}
-	s := make([]string, 0, 6)
-	s = append(s, "&types.Timestamp{")
-	s = append(s, "Seconds: "+fmt.Sprintf("%#v", this.Seconds)+",\n")
-	s = append(s, "Nanos: "+fmt.Sprintf("%#v", this.Nanos)+",\n")
-	if this.XXX_unrecognized != nil {
-		s = append(s, "XXX_unrecognized:"+fmt.Sprintf("%#v", this.XXX_unrecognized)+",\n")
-	}
-	s = append(s, "}")
-	return strings.Join(s, "")
-}
-func valueToGoStringTimestamp(v interface{}, typ string) string {
-	rv := reflect.ValueOf(v)
-	if rv.IsNil() {
-		return "nil"
-	}
-	pv := reflect.Indirect(rv).Interface()
-	return fmt.Sprintf("func(v %v) *%v { return &v } ( %#v )", typ, typ, pv)
-}
-func (m *Timestamp) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Timestamp) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *Timestamp) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if m.Nanos != 0 {
-		i = encodeVarintTimestamp(dAtA, i, uint64(m.Nanos))
-		i--
-		dAtA[i] = 0x10
-	}
-	if m.Seconds != 0 {
-		i = encodeVarintTimestamp(dAtA, i, uint64(m.Seconds))
-		i--
-		dAtA[i] = 0x8
-	}
-	return len(dAtA) - i, nil
-}
-
-func encodeVarintTimestamp(dAtA []byte, offset int, v uint64) int {
-	offset -= sovTimestamp(v)
-	base := offset
-	for v >= 1<<7 {
-		dAtA[offset] = uint8(v&0x7f | 0x80)
-		v >>= 7
-		offset++
-	}
-	dAtA[offset] = uint8(v)
-	return base
-}
-func (m *Timestamp) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	if m.Seconds != 0 {
-		n += 1 + sovTimestamp(uint64(m.Seconds))
-	}
-	if m.Nanos != 0 {
-		n += 1 + sovTimestamp(uint64(m.Nanos))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
-func sovTimestamp(x uint64) (n int) {
-	return (math_bits.Len64(x|1) + 6) / 7
-}
-func sozTimestamp(x uint64) (n int) {
-	return sovTimestamp(uint64((x << 1) ^ uint64((int64(x) >> 63))))
-}
-func (m *Timestamp) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowTimestamp
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Timestamp: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Timestamp: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Seconds", wireType)
-			}
-			m.Seconds = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTimestamp
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Seconds |= int64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		case 2:
-			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Nanos", wireType)
-			}
-			m.Nanos = 0
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowTimestamp
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				m.Nanos |= int32(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-		default:
-			iNdEx = preIndex
-			skippy, err := skipTimestamp(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthTimestamp
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func skipTimestamp(dAtA []byte) (n int, err error) {
-	l := len(dAtA)
-	iNdEx := 0
-	depth := 0
-	for iNdEx < l {
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return 0, ErrIntOverflowTimestamp
-			}
-			if iNdEx >= l {
-				return 0, io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		wireType := int(wire & 0x7)
-		switch wireType {
-		case 0:
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowTimestamp
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				iNdEx++
-				if dAtA[iNdEx-1] < 0x80 {
-					break
-				}
-			}
-		case 1:
-			iNdEx += 8
-		case 2:
-			var length int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return 0, ErrIntOverflowTimestamp
-				}
-				if iNdEx >= l {
-					return 0, io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				length |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if length < 0 {
-				return 0, ErrInvalidLengthTimestamp
-			}
-			iNdEx += length
-		case 3:
-			depth++
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupTimestamp
-			}
-			depth--
-		case 5:
-			iNdEx += 4
-		default:
-			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
-		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthTimestamp
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
-	}
-	return 0, io.ErrUnexpectedEOF
-}
-
-var (
-	ErrInvalidLengthTimestamp        = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowTimestamp          = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupTimestamp = fmt.Errorf("proto: unexpected end of group")
-)

vendor/github.com/gogo/protobuf/types/timestamp_gogo.go

@@ -1,94 +0,0 @@
-// Protocol Buffers for Go with Gadgets
-//
-// Copyright (c) 2016, The GoGo Authors. All rights reserved.
-// http://github.com/gogo/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-package types
-
-import (
-	"time"
-)
-
-func NewPopulatedTimestamp(r interface {
-	Int63() int64
-}, easy bool) *Timestamp {
-	this := &Timestamp{}
-	ns := int64(r.Int63())
-	this.Seconds = ns / 1e9
-	this.Nanos = int32(ns % 1e9)
-	return this
-}
-
-func (ts *Timestamp) String() string {
-	return TimestampString(ts)
-}
-
-func NewPopulatedStdTime(r interface {
-	Int63() int64
-}, easy bool) *time.Time {
-	timestamp := NewPopulatedTimestamp(r, easy)
-	t, err := TimestampFromProto(timestamp)
-	if err != nil {
-		return nil
-	}
-	return &t
-}
-
-func SizeOfStdTime(t time.Time) int {
-	ts, err := TimestampProto(t)
-	if err != nil {
-		return 0
-	}
-	return ts.Size()
-}
-
-func StdTimeMarshal(t time.Time) ([]byte, error) {
-	size := SizeOfStdTime(t)
-	buf := make([]byte, size)
-	_, err := StdTimeMarshalTo(t, buf)
-	return buf, err
-}
-
-func StdTimeMarshalTo(t time.Time, data []byte) (int, error) {
-	ts, err := TimestampProto(t)
-	if err != nil {
-		return 0, err
-	}
-	return ts.MarshalTo(data)
-}
-
-func StdTimeUnmarshal(t *time.Time, data []byte) error {
-	ts := &Timestamp{}
-	if err := ts.Unmarshal(data); err != nil {
-		return err
-	}
-	tt, err := TimestampFromProto(ts)
-	if err != nil {
-		return err
-	}
-	*t = tt
-	return nil
-}

vendor/github.com/gogo/protobuf/types/wrappers_gogo.go

@@ -1,300 +0,0 @@
-// Protocol Buffers for Go with Gadgets
-//
-// Copyright (c) 2018, The GoGo Authors. All rights reserved.
-// http://github.com/gogo/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-package types
-
-func NewPopulatedStdDouble(r randyWrappers, easy bool) *float64 {
-	v := NewPopulatedDoubleValue(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdDouble(v float64) int {
-	pv := &DoubleValue{Value: v}
-	return pv.Size()
-}
-
-func StdDoubleMarshal(v float64) ([]byte, error) {
-	size := SizeOfStdDouble(v)
-	buf := make([]byte, size)
-	_, err := StdDoubleMarshalTo(v, buf)
-	return buf, err
-}
-
-func StdDoubleMarshalTo(v float64, data []byte) (int, error) {
-	pv := &DoubleValue{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdDoubleUnmarshal(v *float64, data []byte) error {
-	pv := &DoubleValue{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdFloat(r randyWrappers, easy bool) *float32 {
-	v := NewPopulatedFloatValue(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdFloat(v float32) int {
-	pv := &FloatValue{Value: v}
-	return pv.Size()
-}
-
-func StdFloatMarshal(v float32) ([]byte, error) {
-	size := SizeOfStdFloat(v)
-	buf := make([]byte, size)
-	_, err := StdFloatMarshalTo(v, buf)
-	return buf, err
-}
-
-func StdFloatMarshalTo(v float32, data []byte) (int, error) {
-	pv := &FloatValue{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdFloatUnmarshal(v *float32, data []byte) error {
-	pv := &FloatValue{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdInt64(r randyWrappers, easy bool) *int64 {
-	v := NewPopulatedInt64Value(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdInt64(v int64) int {
-	pv := &Int64Value{Value: v}
-	return pv.Size()
-}
-
-func StdInt64Marshal(v int64) ([]byte, error) {
-	size := SizeOfStdInt64(v)
-	buf := make([]byte, size)
-	_, err := StdInt64MarshalTo(v, buf)
-	return buf, err
-}
-
-func StdInt64MarshalTo(v int64, data []byte) (int, error) {
-	pv := &Int64Value{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdInt64Unmarshal(v *int64, data []byte) error {
-	pv := &Int64Value{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdUInt64(r randyWrappers, easy bool) *uint64 {
-	v := NewPopulatedUInt64Value(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdUInt64(v uint64) int {
-	pv := &UInt64Value{Value: v}
-	return pv.Size()
-}
-
-func StdUInt64Marshal(v uint64) ([]byte, error) {
-	size := SizeOfStdUInt64(v)
-	buf := make([]byte, size)
-	_, err := StdUInt64MarshalTo(v, buf)
-	return buf, err
-}
-
-func StdUInt64MarshalTo(v uint64, data []byte) (int, error) {
-	pv := &UInt64Value{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdUInt64Unmarshal(v *uint64, data []byte) error {
-	pv := &UInt64Value{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdInt32(r randyWrappers, easy bool) *int32 {
-	v := NewPopulatedInt32Value(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdInt32(v int32) int {
-	pv := &Int32Value{Value: v}
-	return pv.Size()
-}
-
-func StdInt32Marshal(v int32) ([]byte, error) {
-	size := SizeOfStdInt32(v)
-	buf := make([]byte, size)
-	_, err := StdInt32MarshalTo(v, buf)
-	return buf, err
-}
-
-func StdInt32MarshalTo(v int32, data []byte) (int, error) {
-	pv := &Int32Value{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdInt32Unmarshal(v *int32, data []byte) error {
-	pv := &Int32Value{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdUInt32(r randyWrappers, easy bool) *uint32 {
-	v := NewPopulatedUInt32Value(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdUInt32(v uint32) int {
-	pv := &UInt32Value{Value: v}
-	return pv.Size()
-}
-
-func StdUInt32Marshal(v uint32) ([]byte, error) {
-	size := SizeOfStdUInt32(v)
-	buf := make([]byte, size)
-	_, err := StdUInt32MarshalTo(v, buf)
-	return buf, err
-}
-
-func StdUInt32MarshalTo(v uint32, data []byte) (int, error) {
-	pv := &UInt32Value{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdUInt32Unmarshal(v *uint32, data []byte) error {
-	pv := &UInt32Value{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdBool(r randyWrappers, easy bool) *bool {
-	v := NewPopulatedBoolValue(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdBool(v bool) int {
-	pv := &BoolValue{Value: v}
-	return pv.Size()
-}
-
-func StdBoolMarshal(v bool) ([]byte, error) {
-	size := SizeOfStdBool(v)
-	buf := make([]byte, size)
-	_, err := StdBoolMarshalTo(v, buf)
-	return buf, err
-}
-
-func StdBoolMarshalTo(v bool, data []byte) (int, error) {
-	pv := &BoolValue{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdBoolUnmarshal(v *bool, data []byte) error {
-	pv := &BoolValue{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdString(r randyWrappers, easy bool) *string {
-	v := NewPopulatedStringValue(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdString(v string) int {
-	pv := &StringValue{Value: v}
-	return pv.Size()
-}
-
-func StdStringMarshal(v string) ([]byte, error) {
-	size := SizeOfStdString(v)
-	buf := make([]byte, size)
-	_, err := StdStringMarshalTo(v, buf)
-	return buf, err
-}
-
-func StdStringMarshalTo(v string, data []byte) (int, error) {
-	pv := &StringValue{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdStringUnmarshal(v *string, data []byte) error {
-	pv := &StringValue{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}
-func NewPopulatedStdBytes(r randyWrappers, easy bool) *[]byte {
-	v := NewPopulatedBytesValue(r, easy)
-	return &v.Value
-}
-
-func SizeOfStdBytes(v []byte) int {
-	pv := &BytesValue{Value: v}
-	return pv.Size()
-}
-
-func StdBytesMarshal(v []byte) ([]byte, error) {
-	size := SizeOfStdBytes(v)
-	buf := make([]byte, size)
-	_, err := StdBytesMarshalTo(v, buf)
-	return buf, err
-}
-
-func StdBytesMarshalTo(v []byte, data []byte) (int, error) {
-	pv := &BytesValue{Value: v}
-	return pv.MarshalTo(data)
-}
-
-func StdBytesUnmarshal(v *[]byte, data []byte) error {
-	pv := &BytesValue{}
-	if err := pv.Unmarshal(data); err != nil {
-		return err
-	}
-	*v = pv.Value
-	return nil
-}

vendor/github.com/miekg/pkcs11/.gitignore

@@ -1,3 +0,0 @@
-tags
-test_db/*/generation
-test_db/*/*.lock

vendor/github.com/miekg/pkcs11/LICENSE

@@ -1,27 +0,0 @@
-Copyright (c) 2013 Miek Gieben. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Miek Gieben nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/miekg/pkcs11/Makefile.release

@@ -1,57 +0,0 @@
-# Makefile for releasing.
-#
-# The release is controlled from version.go. The version found there is
-# used to tag the git repo, we're not building any artifects so there is nothing
-# to upload to github.
-#
-# * Up the version in version.go
-# * Run: make -f Makefile.release release
-#   * will *commit* your change with 'Release $VERSION'
-#   * push to github
-#
-
-define GO
-//+build ignore
-
-package main
-
-import (
-	"fmt"
-
-	"github.com/miekg/pkcs11"
-)
-
-func main() {
-	fmt.Println(pkcs11.Release.String())
-}
-endef
-
-$(file > version_release.go,$(GO))
-VERSION:=$(shell go run -tags release version_release.go)
-TAG="v$(VERSION)"
-
-all:
-	rm -f version_release.go
-	@echo Use the \'release\' target to start a release $(VERSION)
-
-.PHONY: run
-run:
-	rm -f version_release.go
-	@echo $(VERSION)
-
-.PHONY: release
-release: commit push
-	@echo Released $(VERSION)
-
-.PHONY: commit
-commit:
-	rm -f version_release.go
-	@echo Committing release $(VERSION)
-	git commit -am"Release $(VERSION)"
-	git tag $(TAG)
-
-.PHONY: push
-push:
-	@echo Pushing release $(VERSION) to master
-	git push --tags
-	git push

vendor/github.com/miekg/pkcs11/README.md

@@ -1,68 +0,0 @@
-# PKCS#11
-
-This is a Go implementation of the PKCS#11 API. It wraps the library closely, but uses Go idiom where
-it makes sense. It has been tested with SoftHSM.
-
-## SoftHSM
-
- *  Make it use a custom configuration file `export SOFTHSM_CONF=$PWD/softhsm.conf`
-
- *  Then use `softhsm` to init it
-
-    ~~~
-    softhsm --init-token --slot 0 --label test --pin 1234
-    ~~~
-
- *  Then use `libsofthsm2.so` as the pkcs11 module:
-
-    ~~~ go
-    p := pkcs11.New("/usr/lib/softhsm/libsofthsm2.so")
-    ~~~
-
-## Examples
-
-A skeleton program would look somewhat like this (yes, pkcs#11 is verbose):
-
-~~~ go
-p := pkcs11.New("/usr/lib/softhsm/libsofthsm2.so")
-err := p.Initialize()
-if err != nil {
-    panic(err)
-}
-
-defer p.Destroy()
-defer p.Finalize()
-
-slots, err := p.GetSlotList(true)
-if err != nil {
-    panic(err)
-}
-
-session, err := p.OpenSession(slots[0], pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
-if err != nil {
-    panic(err)
-}
-defer p.CloseSession(session)
-
-err = p.Login(session, pkcs11.CKU_USER, "1234")
-if err != nil {
-    panic(err)
-}
-defer p.Logout(session)
-
-p.DigestInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_SHA_1, nil)})
-hash, err := p.Digest(session, []byte("this is a string"))
-if err != nil {
-    panic(err)
-}
-
-for _, d := range hash {
-        fmt.Printf("%x", d)
-}
-fmt.Println()
-~~~
-
-Further examples are included in the tests.
-
-To expose PKCS#11 keys using the [crypto.Signer interface](https://golang.org/pkg/crypto/#Signer),
-please see [github.com/thalesignite/crypto11](https://github.com/thalesignite/crypto11).

vendor/github.com/miekg/pkcs11/error.go

@@ -1,98 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs11
-
-// awk '/#define CKR_/{ print $3":\""$2"\"," }' pkcs11t.h
-
-var strerror = map[uint]string{
-	0x00000000: "CKR_OK",
-	0x00000001: "CKR_CANCEL",
-	0x00000002: "CKR_HOST_MEMORY",
-	0x00000003: "CKR_SLOT_ID_INVALID",
-	0x00000005: "CKR_GENERAL_ERROR",
-	0x00000006: "CKR_FUNCTION_FAILED",
-	0x00000007: "CKR_ARGUMENTS_BAD",
-	0x00000008: "CKR_NO_EVENT",
-	0x00000009: "CKR_NEED_TO_CREATE_THREADS",
-	0x0000000A: "CKR_CANT_LOCK",
-	0x00000010: "CKR_ATTRIBUTE_READ_ONLY",
-	0x00000011: "CKR_ATTRIBUTE_SENSITIVE",
-	0x00000012: "CKR_ATTRIBUTE_TYPE_INVALID",
-	0x00000013: "CKR_ATTRIBUTE_VALUE_INVALID",
-	0x00000020: "CKR_DATA_INVALID",
-	0x00000021: "CKR_DATA_LEN_RANGE",
-	0x00000030: "CKR_DEVICE_ERROR",
-	0x00000031: "CKR_DEVICE_MEMORY",
-	0x00000032: "CKR_DEVICE_REMOVED",
-	0x00000040: "CKR_ENCRYPTED_DATA_INVALID",
-	0x00000041: "CKR_ENCRYPTED_DATA_LEN_RANGE",
-	0x00000050: "CKR_FUNCTION_CANCELED",
-	0x00000051: "CKR_FUNCTION_NOT_PARALLEL",
-	0x00000054: "CKR_FUNCTION_NOT_SUPPORTED",
-	0x00000060: "CKR_KEY_HANDLE_INVALID",
-	0x00000062: "CKR_KEY_SIZE_RANGE",
-	0x00000063: "CKR_KEY_TYPE_INCONSISTENT",
-	0x00000064: "CKR_KEY_NOT_NEEDED",
-	0x00000065: "CKR_KEY_CHANGED",
-	0x00000066: "CKR_KEY_NEEDED",
-	0x00000067: "CKR_KEY_INDIGESTIBLE",
-	0x00000068: "CKR_KEY_FUNCTION_NOT_PERMITTED",
-	0x00000069: "CKR_KEY_NOT_WRAPPABLE",
-	0x0000006A: "CKR_KEY_UNEXTRACTABLE",
-	0x00000070: "CKR_MECHANISM_INVALID",
-	0x00000071: "CKR_MECHANISM_PARAM_INVALID",
-	0x00000082: "CKR_OBJECT_HANDLE_INVALID",
-	0x00000090: "CKR_OPERATION_ACTIVE",
-	0x00000091: "CKR_OPERATION_NOT_INITIALIZED",
-	0x000000A0: "CKR_PIN_INCORRECT",
-	0x000000A1: "CKR_PIN_INVALID",
-	0x000000A2: "CKR_PIN_LEN_RANGE",
-	0x000000A3: "CKR_PIN_EXPIRED",
-	0x000000A4: "CKR_PIN_LOCKED",
-	0x000000B0: "CKR_SESSION_CLOSED",
-	0x000000B1: "CKR_SESSION_COUNT",
-	0x000000B3: "CKR_SESSION_HANDLE_INVALID",
-	0x000000B4: "CKR_SESSION_PARALLEL_NOT_SUPPORTED",
-	0x000000B5: "CKR_SESSION_READ_ONLY",
-	0x000000B6: "CKR_SESSION_EXISTS",
-	0x000000B7: "CKR_SESSION_READ_ONLY_EXISTS",
-	0x000000B8: "CKR_SESSION_READ_WRITE_SO_EXISTS",
-	0x000000C0: "CKR_SIGNATURE_INVALID",
-	0x000000C1: "CKR_SIGNATURE_LEN_RANGE",
-	0x000000D0: "CKR_TEMPLATE_INCOMPLETE",
-	0x000000D1: "CKR_TEMPLATE_INCONSISTENT",
-	0x000000E0: "CKR_TOKEN_NOT_PRESENT",
-	0x000000E1: "CKR_TOKEN_NOT_RECOGNIZED",
-	0x000000E2: "CKR_TOKEN_WRITE_PROTECTED",
-	0x000000F0: "CKR_UNWRAPPING_KEY_HANDLE_INVALID",
-	0x000000F1: "CKR_UNWRAPPING_KEY_SIZE_RANGE",
-	0x000000F2: "CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT",
-	0x00000100: "CKR_USER_ALREADY_LOGGED_IN",
-	0x00000101: "CKR_USER_NOT_LOGGED_IN",
-	0x00000102: "CKR_USER_PIN_NOT_INITIALIZED",
-	0x00000103: "CKR_USER_TYPE_INVALID",
-	0x00000104: "CKR_USER_ANOTHER_ALREADY_LOGGED_IN",
-	0x00000105: "CKR_USER_TOO_MANY_TYPES",
-	0x00000110: "CKR_WRAPPED_KEY_INVALID",
-	0x00000112: "CKR_WRAPPED_KEY_LEN_RANGE",
-	0x00000113: "CKR_WRAPPING_KEY_HANDLE_INVALID",
-	0x00000114: "CKR_WRAPPING_KEY_SIZE_RANGE",
-	0x00000115: "CKR_WRAPPING_KEY_TYPE_INCONSISTENT",
-	0x00000120: "CKR_RANDOM_SEED_NOT_SUPPORTED",
-	0x00000121: "CKR_RANDOM_NO_RNG",
-	0x00000130: "CKR_DOMAIN_PARAMS_INVALID",
-	0x00000150: "CKR_BUFFER_TOO_SMALL",
-	0x00000160: "CKR_SAVED_STATE_INVALID",
-	0x00000170: "CKR_INFORMATION_SENSITIVE",
-	0x00000180: "CKR_STATE_UNSAVEABLE",
-	0x00000190: "CKR_CRYPTOKI_NOT_INITIALIZED",
-	0x00000191: "CKR_CRYPTOKI_ALREADY_INITIALIZED",
-	0x000001A0: "CKR_MUTEX_BAD",
-	0x000001A1: "CKR_MUTEX_NOT_LOCKED",
-	0x000001B0: "CKR_NEW_PIN_MODE",
-	0x000001B1: "CKR_NEXT_OTP",
-	0x00000200: "CKR_FUNCTION_REJECTED",
-	0x80000000: "CKR_VENDOR_DEFINED",
-}

vendor/github.com/miekg/pkcs11/params.go

@@ -1,190 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs11
-
-/*
-#include <stdlib.h>
-#include <string.h>
-#include "pkcs11go.h"
-
-static inline void putOAEPParams(CK_RSA_PKCS_OAEP_PARAMS_PTR params, CK_VOID_PTR pSourceData, CK_ULONG ulSourceDataLen)
-{
-	params->pSourceData = pSourceData;
-	params->ulSourceDataLen = ulSourceDataLen;
-}
-
-static inline void putECDH1SharedParams(CK_ECDH1_DERIVE_PARAMS_PTR params, CK_VOID_PTR pSharedData, CK_ULONG ulSharedDataLen)
-{
-	params->pSharedData = pSharedData;
-	params->ulSharedDataLen = ulSharedDataLen;
-}
-
-static inline void putECDH1PublicParams(CK_ECDH1_DERIVE_PARAMS_PTR params, CK_VOID_PTR pPublicData, CK_ULONG ulPublicDataLen)
-{
-	params->pPublicData = pPublicData;
-	params->ulPublicDataLen = ulPublicDataLen;
-}
-*/
-import "C"
-import "unsafe"
-
-// GCMParams represents the parameters for the AES-GCM mechanism.
-type GCMParams struct {
-	arena
-	params  *C.CK_GCM_PARAMS
-	iv      []byte
-	aad     []byte
-	tagSize int
-}
-
-// NewGCMParams returns a pointer to AES-GCM parameters that can be used with the CKM_AES_GCM mechanism.
-// The Free() method must be called after the operation is complete.
-//
-// Note that some HSMs, like CloudHSM, will ignore the IV you pass in and write their
-// own. As a result, to support all libraries, memory is not freed
-// automatically, so that after the EncryptInit/Encrypt operation the HSM's IV
-// can be read back out. It is up to the caller to ensure that Free() is called
-// on the GCMParams object at an appropriate time, which is after
-//
-// Encrypt/Decrypt. As an example:
-//
-//    gcmParams := pkcs11.NewGCMParams(make([]byte, 12), nil, 128)
-//    p.ctx.EncryptInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_AES_GCM, gcmParams)},
-//			aesObjHandle)
-//    ct, _ := p.ctx.Encrypt(session, pt)
-//    iv := gcmParams.IV()
-//    gcmParams.Free()
-//
-func NewGCMParams(iv, aad []byte, tagSize int) *GCMParams {
-	return &GCMParams{
-		iv:      iv,
-		aad:     aad,
-		tagSize: tagSize,
-	}
-}
-
-func cGCMParams(p *GCMParams) []byte {
-	params := C.CK_GCM_PARAMS{
-		ulTagBits: C.CK_ULONG(p.tagSize),
-	}
-	var arena arena
-	if len(p.iv) > 0 {
-		iv, ivLen := arena.Allocate(p.iv)
-		params.pIv = C.CK_BYTE_PTR(iv)
-		params.ulIvLen = ivLen
-		params.ulIvBits = ivLen * 8
-	}
-	if len(p.aad) > 0 {
-		aad, aadLen := arena.Allocate(p.aad)
-		params.pAAD = C.CK_BYTE_PTR(aad)
-		params.ulAADLen = aadLen
-	}
-	p.Free()
-	p.arena = arena
-	p.params = &params
-	return C.GoBytes(unsafe.Pointer(&params), C.int(unsafe.Sizeof(params)))
-}
-
-// IV returns a copy of the actual IV used for the operation.
-//
-// Some HSMs may ignore the user-specified IV and write their own at the end of
-// the encryption operation; this method allows you to retrieve it.
-func (p *GCMParams) IV() []byte {
-	if p == nil || p.params == nil {
-		return nil
-	}
-	newIv := C.GoBytes(unsafe.Pointer(p.params.pIv), C.int(p.params.ulIvLen))
-	iv := make([]byte, len(newIv))
-	copy(iv, newIv)
-	return iv
-}
-
-// Free deallocates the memory reserved for the HSM to write back the actual IV.
-//
-// This must be called after the entire operation is complete, i.e. after
-// Encrypt or EncryptFinal. It is safe to call Free multiple times.
-func (p *GCMParams) Free() {
-	if p == nil || p.arena == nil {
-		return
-	}
-	p.arena.Free()
-	p.params = nil
-	p.arena = nil
-}
-
-// NewPSSParams creates a CK_RSA_PKCS_PSS_PARAMS structure and returns it as a byte array for use with the CKM_RSA_PKCS_PSS mechanism.
-func NewPSSParams(hashAlg, mgf, saltLength uint) []byte {
-	p := C.CK_RSA_PKCS_PSS_PARAMS{
-		hashAlg: C.CK_MECHANISM_TYPE(hashAlg),
-		mgf:     C.CK_RSA_PKCS_MGF_TYPE(mgf),
-		sLen:    C.CK_ULONG(saltLength),
-	}
-	return C.GoBytes(unsafe.Pointer(&p), C.int(unsafe.Sizeof(p)))
-}
-
-// OAEPParams can be passed to NewMechanism to implement CKM_RSA_PKCS_OAEP.
-type OAEPParams struct {
-	HashAlg    uint
-	MGF        uint
-	SourceType uint
-	SourceData []byte
-}
-
-// NewOAEPParams creates a CK_RSA_PKCS_OAEP_PARAMS structure suitable for use with the CKM_RSA_PKCS_OAEP mechanism.
-func NewOAEPParams(hashAlg, mgf, sourceType uint, sourceData []byte) *OAEPParams {
-	return &OAEPParams{
-		HashAlg:    hashAlg,
-		MGF:        mgf,
-		SourceType: sourceType,
-		SourceData: sourceData,
-	}
-}
-
-func cOAEPParams(p *OAEPParams, arena arena) ([]byte, arena) {
-	params := C.CK_RSA_PKCS_OAEP_PARAMS{
-		hashAlg: C.CK_MECHANISM_TYPE(p.HashAlg),
-		mgf:     C.CK_RSA_PKCS_MGF_TYPE(p.MGF),
-		source:  C.CK_RSA_PKCS_OAEP_SOURCE_TYPE(p.SourceType),
-	}
-	if len(p.SourceData) != 0 {
-		buf, len := arena.Allocate(p.SourceData)
-		// field is unaligned on windows so this has to call into C
-		C.putOAEPParams(&params, buf, len)
-	}
-	return C.GoBytes(unsafe.Pointer(&params), C.int(unsafe.Sizeof(params))), arena
-}
-
-// ECDH1DeriveParams can be passed to NewMechanism to implement CK_ECDH1_DERIVE_PARAMS.
-type ECDH1DeriveParams struct {
-	KDF           uint
-	SharedData    []byte
-	PublicKeyData []byte
-}
-
-// NewECDH1DeriveParams creates a CK_ECDH1_DERIVE_PARAMS structure suitable for use with the CKM_ECDH1_DERIVE mechanism.
-func NewECDH1DeriveParams(kdf uint, sharedData []byte, publicKeyData []byte) *ECDH1DeriveParams {
-	return &ECDH1DeriveParams{
-		KDF:           kdf,
-		SharedData:    sharedData,
-		PublicKeyData: publicKeyData,
-	}
-}
-
-func cECDH1DeriveParams(p *ECDH1DeriveParams, arena arena) ([]byte, arena) {
-	params := C.CK_ECDH1_DERIVE_PARAMS{
-		kdf: C.CK_EC_KDF_TYPE(p.KDF),
-	}
-
-	// SharedData MUST be null if key derivation function (KDF) is CKD_NULL
-	if len(p.SharedData) != 0 {
-		sharedData, sharedDataLen := arena.Allocate(p.SharedData)
-		C.putECDH1SharedParams(&params, sharedData, sharedDataLen)
-	}
-
-	publicKeyData, publicKeyDataLen := arena.Allocate(p.PublicKeyData)
-	C.putECDH1PublicParams(&params, publicKeyData, publicKeyDataLen)
-
-	return C.GoBytes(unsafe.Pointer(&params), C.int(unsafe.Sizeof(params))), arena
-}

vendor/github.com/miekg/pkcs11/pkcs11.h

@@ -1,265 +0,0 @@
-/* Copyright (c) OASIS Open 2016. All Rights Reserved./
- * /Distributed under the terms of the OASIS IPR Policy,
- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
- */
-        
-/* Latest version of the specification:
- * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
- */
-
-#ifndef _PKCS11_H_
-#define _PKCS11_H_ 1
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* Before including this file (pkcs11.h) (or pkcs11t.h by
- * itself), 5 platform-specific macros must be defined.  These
- * macros are described below, and typical definitions for them
- * are also given.  Be advised that these definitions can depend
- * on both the platform and the compiler used (and possibly also
- * on whether a Cryptoki library is linked statically or
- * dynamically).
- *
- * In addition to defining these 5 macros, the packing convention
- * for Cryptoki structures should be set.  The Cryptoki
- * convention on packing is that structures should be 1-byte
- * aligned.
- *
- * If you're using Microsoft Developer Studio 5.0 to produce
- * Win32 stuff, this might be done by using the following
- * preprocessor directive before including pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(push, cryptoki, 1)
- *
- * and using the following preprocessor directive after including
- * pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(pop, cryptoki)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to produce Win16 stuff, this might be done by using
- * the following preprocessor directive before including
- * pkcs11.h or pkcs11t.h:
- *
- * #pragma pack(1)
- *
- * In a UNIX environment, you're on your own for this.  You might
- * not need to do (or be able to do!) anything.
- *
- *
- * Now for the macros:
- *
- *
- * 1. CK_PTR: The indirection string for making a pointer to an
- * object.  It can be used like this:
- *
- * typedef CK_BYTE CK_PTR CK_BYTE_PTR;
- *
- * If you're using Microsoft Developer Studio 5.0 to produce
- * Win32 stuff, it might be defined by:
- *
- * #define CK_PTR *
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to produce Win16 stuff, it might be defined by:
- *
- * #define CK_PTR far *
- *
- * In a typical UNIX environment, it might be defined by:
- *
- * #define CK_PTR *
- *
- *
- * 2. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
- * an importable Cryptoki library function declaration out of a
- * return type and a function name.  It should be used in the
- * following fashion:
- *
- * extern CK_DECLARE_FUNCTION(CK_RV, C_Initialize)(
- *   CK_VOID_PTR pReserved
- * );
- *
- * If you're using Microsoft Developer Studio 5.0 to declare a
- * function in a Win32 Cryptoki .dll, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType __declspec(dllimport) name
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to declare a function in a Win16 Cryptoki .dll, it
- * might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType __export _far _pascal name
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION(returnType, name) \
- *   returnType name
- *
- *
- * 3. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
- * which makes a Cryptoki API function pointer declaration or
- * function pointer type declaration out of a return type and a
- * function name.  It should be used in the following fashion:
- *
- * // Define funcPtr to be a pointer to a Cryptoki API function
- * // taking arguments args and returning CK_RV.
- * CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtr)(args);
- *
- * or
- *
- * // Define funcPtrType to be the type of a pointer to a
- * // Cryptoki API function taking arguments args and returning
- * // CK_RV, and then define funcPtr to be a variable of type
- * // funcPtrType.
- * typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, funcPtrType)(args);
- * funcPtrType funcPtr;
- *
- * If you're using Microsoft Developer Studio 5.0 to access
- * functions in a Win32 Cryptoki .dll, in might be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType __declspec(dllimport) (* name)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to access functions in a Win16 Cryptoki .dll, it might
- * be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType __export _far _pascal (* name)
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DECLARE_FUNCTION_POINTER(returnType, name) \
- *   returnType (* name)
- *
- *
- * 4. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
- * a function pointer type for an application callback out of
- * a return type for the callback and a name for the callback.
- * It should be used in the following fashion:
- *
- * CK_CALLBACK_FUNCTION(CK_RV, myCallback)(args);
- *
- * to declare a function pointer, myCallback, to a callback
- * which takes arguments args and returns a CK_RV.  It can also
- * be used like this:
- *
- * typedef CK_CALLBACK_FUNCTION(CK_RV, myCallbackType)(args);
- * myCallbackType myCallback;
- *
- * If you're using Microsoft Developer Studio 5.0 to do Win32
- * Cryptoki development, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType (* name)
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to do Win16 development, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType _far _pascal (* name)
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_CALLBACK_FUNCTION(returnType, name) \
- *   returnType (* name)
- *
- *
- * 5. NULL_PTR: This macro is the value of a NULL pointer.
- *
- * In any ANSI/ISO C environment (and in many others as well),
- * this should best be defined by
- *
- * #ifndef NULL_PTR
- * #define NULL_PTR 0
- * #endif
- */
-
-
-/* All the various Cryptoki types and #define'd values are in the
- * file pkcs11t.h.
- */
-#include "pkcs11t.h"
-
-#define __PASTE(x,y)      x##y
-
-
-/* ==============================================================
- * Define the "extern" form of all the entry points.
- * ==============================================================
- */
-
-#define CK_NEED_ARG_LIST  1
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  extern CK_DECLARE_FUNCTION(CK_RV, name)
-
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes.
- */
-#include "pkcs11f.h"
-
-#undef CK_NEED_ARG_LIST
-#undef CK_PKCS11_FUNCTION_INFO
-
-
-/* ==============================================================
- * Define the typedef form of all the entry points.  That is, for
- * each Cryptoki function C_XXX, define a type CK_C_XXX which is
- * a pointer to that kind of function.
- * ==============================================================
- */
-
-#define CK_NEED_ARG_LIST  1
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))
-
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes.
- */
-#include "pkcs11f.h"
-
-#undef CK_NEED_ARG_LIST
-#undef CK_PKCS11_FUNCTION_INFO
-
-
-/* ==============================================================
- * Define structed vector of entry points.  A CK_FUNCTION_LIST
- * contains a CK_VERSION indicating a library's Cryptoki version
- * and then a whole slew of function pointers to the routines in
- * the library.  This type was declared, but not defined, in
- * pkcs11t.h.
- * ==============================================================
- */
-
-#define CK_PKCS11_FUNCTION_INFO(name) \
-  __PASTE(CK_,name) name;
-
-struct CK_FUNCTION_LIST {
-
-  CK_VERSION    version;  /* Cryptoki version */
-
-/* Pile all the function pointers into the CK_FUNCTION_LIST. */
-/* pkcs11f.h has all the information about the Cryptoki
- * function prototypes.
- */
-#include "pkcs11f.h"
-
-};
-
-#undef CK_PKCS11_FUNCTION_INFO
-
-
-#undef __PASTE
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* _PKCS11_H_ */
-

vendor/github.com/miekg/pkcs11/pkcs11f.h

@@ -1,939 +0,0 @@
-/* Copyright (c) OASIS Open 2016. All Rights Reserved./
- * /Distributed under the terms of the OASIS IPR Policy,
- * [http://www.oasis-open.org/policies-guidelines/ipr], AS-IS, WITHOUT ANY
- * IMPLIED OR EXPRESS WARRANTY; there is no warranty of MERCHANTABILITY, FITNESS FOR A
- * PARTICULAR PURPOSE or NONINFRINGEMENT of the rights of others.
- */
-        
-/* Latest version of the specification:
- * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
- */
-
-/* This header file contains pretty much everything about all the
- * Cryptoki function prototypes.  Because this information is
- * used for more than just declaring function prototypes, the
- * order of the functions appearing herein is important, and
- * should not be altered.
- */
-
-/* General-purpose */
-
-/* C_Initialize initializes the Cryptoki library. */
-CK_PKCS11_FUNCTION_INFO(C_Initialize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_VOID_PTR   pInitArgs  /* if this is not NULL_PTR, it gets
-                            * cast to CK_C_INITIALIZE_ARGS_PTR
-                            * and dereferenced
-                            */
-);
-#endif
-
-
-/* C_Finalize indicates that an application is done with the
- * Cryptoki library.
- */
-CK_PKCS11_FUNCTION_INFO(C_Finalize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_VOID_PTR   pReserved  /* reserved.  Should be NULL_PTR */
-);
-#endif
-
-
-/* C_GetInfo returns general information about Cryptoki. */
-CK_PKCS11_FUNCTION_INFO(C_GetInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_INFO_PTR   pInfo  /* location that receives information */
-);
-#endif
-
-
-/* C_GetFunctionList returns the function list. */
-CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_FUNCTION_LIST_PTR_PTR ppFunctionList  /* receives pointer to
-                                            * function list
-                                            */
-);
-#endif
-
-
-
-/* Slot and token management */
-
-/* C_GetSlotList obtains a list of slots in the system. */
-CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_BBOOL       tokenPresent,  /* only slots with tokens */
-  CK_SLOT_ID_PTR pSlotList,     /* receives array of slot IDs */
-  CK_ULONG_PTR   pulCount       /* receives number of slots */
-);
-#endif
-
-
-/* C_GetSlotInfo obtains information about a particular slot in
- * the system.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID       slotID,  /* the ID of the slot */
-  CK_SLOT_INFO_PTR pInfo    /* receives the slot information */
-);
-#endif
-
-
-/* C_GetTokenInfo obtains information about a particular token
- * in the system.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID        slotID,  /* ID of the token's slot */
-  CK_TOKEN_INFO_PTR pInfo    /* receives the token information */
-);
-#endif
-
-
-/* C_GetMechanismList obtains a list of mechanism types
- * supported by a token.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,          /* ID of token's slot */
-  CK_MECHANISM_TYPE_PTR pMechanismList,  /* gets mech. array */
-  CK_ULONG_PTR          pulCount         /* gets # of mechs. */
-);
-#endif
-
-
-/* C_GetMechanismInfo obtains information about a particular
- * mechanism possibly supported by a token.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,  /* ID of the token's slot */
-  CK_MECHANISM_TYPE     type,    /* type of mechanism */
-  CK_MECHANISM_INFO_PTR pInfo    /* receives mechanism info */
-);
-#endif
-
-
-/* C_InitToken initializes a token. */
-CK_PKCS11_FUNCTION_INFO(C_InitToken)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID      slotID,    /* ID of the token's slot */
-  CK_UTF8CHAR_PTR pPin,      /* the SO's initial PIN */
-  CK_ULONG        ulPinLen,  /* length in bytes of the PIN */
-  CK_UTF8CHAR_PTR pLabel     /* 32-byte token label (blank padded) */
-);
-#endif
-
-
-/* C_InitPIN initializes the normal user's PIN. */
-CK_PKCS11_FUNCTION_INFO(C_InitPIN)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_UTF8CHAR_PTR   pPin,      /* the normal user's PIN */
-  CK_ULONG          ulPinLen   /* length in bytes of the PIN */
-);
-#endif
-
-
-/* C_SetPIN modifies the PIN of the user who is logged in. */
-CK_PKCS11_FUNCTION_INFO(C_SetPIN)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_UTF8CHAR_PTR   pOldPin,   /* the old PIN */
-  CK_ULONG          ulOldLen,  /* length of the old PIN */
-  CK_UTF8CHAR_PTR   pNewPin,   /* the new PIN */
-  CK_ULONG          ulNewLen   /* length of the new PIN */
-);
-#endif
-
-
-
-/* Session management */
-
-/* C_OpenSession opens a session between an application and a
- * token.
- */
-CK_PKCS11_FUNCTION_INFO(C_OpenSession)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID            slotID,        /* the slot's ID */
-  CK_FLAGS              flags,         /* from CK_SESSION_INFO */
-  CK_VOID_PTR           pApplication,  /* passed to callback */
-  CK_NOTIFY             Notify,        /* callback function */
-  CK_SESSION_HANDLE_PTR phSession      /* gets session handle */
-);
-#endif
-
-
-/* C_CloseSession closes a session between an application and a
- * token.
- */
-CK_PKCS11_FUNCTION_INFO(C_CloseSession)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_CloseAllSessions closes all sessions with a token. */
-CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SLOT_ID     slotID  /* the token's slot */
-);
-#endif
-
-
-/* C_GetSessionInfo obtains information about the session. */
-CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE   hSession,  /* the session's handle */
-  CK_SESSION_INFO_PTR pInfo      /* receives session info */
-);
-#endif
-
-
-/* C_GetOperationState obtains the state of the cryptographic operation
- * in a session.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,             /* session's handle */
-  CK_BYTE_PTR       pOperationState,      /* gets state */
-  CK_ULONG_PTR      pulOperationStateLen  /* gets state length */
-);
-#endif
-
-
-/* C_SetOperationState restores the state of the cryptographic
- * operation in a session.
- */
-CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR      pOperationState,      /* holds state */
-  CK_ULONG         ulOperationStateLen,  /* holds state length */
-  CK_OBJECT_HANDLE hEncryptionKey,       /* en/decryption key */
-  CK_OBJECT_HANDLE hAuthenticationKey    /* sign/verify key */
-);
-#endif
-
-
-/* C_Login logs a user into a token. */
-CK_PKCS11_FUNCTION_INFO(C_Login)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_USER_TYPE      userType,  /* the user type */
-  CK_UTF8CHAR_PTR   pPin,      /* the user's PIN */
-  CK_ULONG          ulPinLen   /* the length of the PIN */
-);
-#endif
-
-
-/* C_Logout logs a user out from a token. */
-CK_PKCS11_FUNCTION_INFO(C_Logout)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Object management */
-
-/* C_CreateObject creates a new object. */
-CK_PKCS11_FUNCTION_INFO(C_CreateObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,   /* the object's template */
-  CK_ULONG          ulCount,     /* attributes in template */
-  CK_OBJECT_HANDLE_PTR phObject  /* gets new object's handle. */
-);
-#endif
-
-
-/* C_CopyObject copies an object, creating a new object for the
- * copy.
- */
-CK_PKCS11_FUNCTION_INFO(C_CopyObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,    /* the session's handle */
-  CK_OBJECT_HANDLE     hObject,     /* the object's handle */
-  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new object */
-  CK_ULONG             ulCount,     /* attributes in template */
-  CK_OBJECT_HANDLE_PTR phNewObject  /* receives handle of copy */
-);
-#endif
-
-
-/* C_DestroyObject destroys an object. */
-CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hObject    /* the object's handle */
-);
-#endif
-
-
-/* C_GetObjectSize gets the size of an object in bytes. */
-CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,   /* the object's handle */
-  CK_ULONG_PTR      pulSize    /* receives size of object */
-);
-#endif
-
-
-/* C_GetAttributeValue obtains the value of one or more object
- * attributes.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs; gets vals */
-  CK_ULONG          ulCount     /* attributes in template */
-);
-#endif
-
-
-/* C_SetAttributeValue modifies the value of one or more object
- * attributes.
- */
-CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_OBJECT_HANDLE  hObject,    /* the object's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* specifies attrs and values */
-  CK_ULONG          ulCount     /* attributes in template */
-);
-#endif
-
-
-/* C_FindObjectsInit initializes a search for token and session
- * objects that match a template.
- */
-CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_ATTRIBUTE_PTR  pTemplate,  /* attribute values to match */
-  CK_ULONG          ulCount     /* attrs in search template */
-);
-#endif
-
-
-/* C_FindObjects continues a search for token and session
- * objects that match a template, obtaining additional object
- * handles.
- */
-CK_PKCS11_FUNCTION_INFO(C_FindObjects)
-#ifdef CK_NEED_ARG_LIST
-(
- CK_SESSION_HANDLE    hSession,          /* session's handle */
- CK_OBJECT_HANDLE_PTR phObject,          /* gets obj. handles */
- CK_ULONG             ulMaxObjectCount,  /* max handles to get */
- CK_ULONG_PTR         pulObjectCount     /* actual # returned */
-);
-#endif
-
-
-/* C_FindObjectsFinal finishes a search for token and session
- * objects.
- */
-CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-
-/* Encryption and decryption */
-
-/* C_EncryptInit initializes an encryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the encryption mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of encryption key */
-);
-#endif
-
-
-/* C_Encrypt encrypts single-part data. */
-CK_PKCS11_FUNCTION_INFO(C_Encrypt)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pData,               /* the plaintext data */
-  CK_ULONG          ulDataLen,           /* bytes of plaintext */
-  CK_BYTE_PTR       pEncryptedData,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedDataLen  /* gets c-text size */
-);
-#endif
-
-
-/* C_EncryptUpdate continues a multiple-part encryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,           /* session's handle */
-  CK_BYTE_PTR       pPart,              /* the plaintext data */
-  CK_ULONG          ulPartLen,          /* plaintext data len */
-  CK_BYTE_PTR       pEncryptedPart,     /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen /* gets c-text size */
-);
-#endif
-
-
-/* C_EncryptFinal finishes a multiple-part encryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,                /* session handle */
-  CK_BYTE_PTR       pLastEncryptedPart,      /* last c-text */
-  CK_ULONG_PTR      pulLastEncryptedPartLen  /* gets last size */
-);
-#endif
-
-
-/* C_DecryptInit initializes a decryption operation. */
-CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the decryption mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of decryption key */
-);
-#endif
-
-
-/* C_Decrypt decrypts encrypted data in a single part. */
-CK_PKCS11_FUNCTION_INFO(C_Decrypt)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,           /* session's handle */
-  CK_BYTE_PTR       pEncryptedData,     /* ciphertext */
-  CK_ULONG          ulEncryptedDataLen, /* ciphertext length */
-  CK_BYTE_PTR       pData,              /* gets plaintext */
-  CK_ULONG_PTR      pulDataLen          /* gets p-text size */
-);
-#endif
-
-
-/* C_DecryptUpdate continues a multiple-part decryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* encrypted data */
-  CK_ULONG          ulEncryptedPartLen,  /* input length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* p-text size */
-);
-#endif
-
-
-/* C_DecryptFinal finishes a multiple-part decryption
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pLastPart,      /* gets plaintext */
-  CK_ULONG_PTR      pulLastPartLen  /* p-text size */
-);
-#endif
-
-
-
-/* Message digesting */
-
-/* C_DigestInit initializes a message-digesting operation. */
-CK_PKCS11_FUNCTION_INFO(C_DigestInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism  /* the digesting mechanism */
-);
-#endif
-
-
-/* C_Digest digests data in a single part. */
-CK_PKCS11_FUNCTION_INFO(C_Digest)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_BYTE_PTR       pData,        /* data to be digested */
-  CK_ULONG          ulDataLen,    /* bytes of data to digest */
-  CK_BYTE_PTR       pDigest,      /* gets the message digest */
-  CK_ULONG_PTR      pulDigestLen  /* gets digest length */
-);
-#endif
-
-
-/* C_DigestUpdate continues a multiple-part message-digesting
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* data to be digested */
-  CK_ULONG          ulPartLen  /* bytes of data to be digested */
-);
-#endif
-
-
-/* C_DigestKey continues a multi-part message-digesting
- * operation, by digesting the value of a secret key as part of
- * the data already digested.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_OBJECT_HANDLE  hKey       /* secret key to digest */
-);
-#endif
-
-
-/* C_DigestFinal finishes a multiple-part message-digesting
- * operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,     /* the session's handle */
-  CK_BYTE_PTR       pDigest,      /* gets the message digest */
-  CK_ULONG_PTR      pulDigestLen  /* gets byte count of digest */
-);
-#endif
-
-
-
-/* Signing and MACing */
-
-/* C_SignInit initializes a signature (private key encryption)
- * operation, where the signature is (will be) an appendix to
- * the data, and plaintext cannot be recovered from the
- * signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the signature mechanism */
-  CK_OBJECT_HANDLE  hKey         /* handle of signature key */
-);
-#endif
-
-
-/* C_Sign signs (encrypts with private key) data in a single
- * part, where the signature is (will be) an appendix to the
- * data, and plaintext cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_Sign)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pData,           /* the data to sign */
-  CK_ULONG          ulDataLen,       /* count of bytes to sign */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-/* C_SignUpdate continues a multiple-part signature operation,
- * where the signature is (will be) an appendix to the data,
- * and plaintext cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* the data to sign */
-  CK_ULONG          ulPartLen  /* count of bytes to sign */
-);
-#endif
-
-
-/* C_SignFinal finishes a multiple-part signature operation,
- * returning the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-/* C_SignRecoverInit initializes a signature operation, where
- * the data can be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,   /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism, /* the signature mechanism */
-  CK_OBJECT_HANDLE  hKey        /* handle of the signature key */
-);
-#endif
-
-
-/* C_SignRecover signs data in a single operation, where the
- * data can be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignRecover)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pData,           /* the data to sign */
-  CK_ULONG          ulDataLen,       /* count of bytes to sign */
-  CK_BYTE_PTR       pSignature,      /* gets the signature */
-  CK_ULONG_PTR      pulSignatureLen  /* gets signature length */
-);
-#endif
-
-
-
-/* Verifying signatures and MACs */
-
-/* C_VerifyInit initializes a verification operation, where the
- * signature is an appendix to the data, and plaintext cannot
- * cannot be recovered from the signature (e.g. DSA).
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */
-);
-#endif
-
-
-/* C_Verify verifies a signature in a single-part operation,
- * where the signature is an appendix to the data, and plaintext
- * cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_Verify)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pData,          /* signed data */
-  CK_ULONG          ulDataLen,      /* length of signed data */
-  CK_BYTE_PTR       pSignature,     /* signature */
-  CK_ULONG          ulSignatureLen  /* signature length*/
-);
-#endif
-
-
-/* C_VerifyUpdate continues a multiple-part verification
- * operation, where the signature is an appendix to the data,
- * and plaintext cannot be recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pPart,     /* signed data */
-  CK_ULONG          ulPartLen  /* length of signed data */
-);
-#endif
-
-
-/* C_VerifyFinal finishes a multiple-part verification
- * operation, checking the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,       /* the session's handle */
-  CK_BYTE_PTR       pSignature,     /* signature to verify */
-  CK_ULONG          ulSignatureLen  /* signature length */
-);
-#endif
-
-
-/* C_VerifyRecoverInit initializes a signature verification
- * operation, where the data is recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */
-);
-#endif
-
-
-/* C_VerifyRecover verifies a signature in a single-part
- * operation, where the data is recovered from the signature.
- */
-CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_BYTE_PTR       pSignature,      /* signature to verify */
-  CK_ULONG          ulSignatureLen,  /* signature length */
-  CK_BYTE_PTR       pData,           /* gets signed data */
-  CK_ULONG_PTR      pulDataLen       /* gets signed data len */
-);
-#endif
-
-
-
-/* Dual-function cryptographic operations */
-
-/* C_DigestEncryptUpdate continues a multiple-part digesting
- * and encryption operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pPart,               /* the plaintext data */
-  CK_ULONG          ulPartLen,           /* plaintext length */
-  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
-);
-#endif
-
-
-/* C_DecryptDigestUpdate continues a multiple-part decryption and
- * digesting operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
-  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* gets plaintext len */
-);
-#endif
-
-
-/* C_SignEncryptUpdate continues a multiple-part signing and
- * encryption operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pPart,               /* the plaintext data */
-  CK_ULONG          ulPartLen,           /* plaintext length */
-  CK_BYTE_PTR       pEncryptedPart,      /* gets ciphertext */
-  CK_ULONG_PTR      pulEncryptedPartLen  /* gets c-text length */
-);
-#endif
-
-
-/* C_DecryptVerifyUpdate continues a multiple-part decryption and
- * verify operation.
- */
-CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,            /* session's handle */
-  CK_BYTE_PTR       pEncryptedPart,      /* ciphertext */
-  CK_ULONG          ulEncryptedPartLen,  /* ciphertext length */
-  CK_BYTE_PTR       pPart,               /* gets plaintext */
-  CK_ULONG_PTR      pulPartLen           /* gets p-text length */
-);
-#endif
-
-
-
-/* Key management */
-
-/* C_GenerateKey generates a secret key, creating a new key
- * object.
- */
-CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,    /* the session's handle */
-  CK_MECHANISM_PTR     pMechanism,  /* key generation mech. */
-  CK_ATTRIBUTE_PTR     pTemplate,   /* template for new key */
-  CK_ULONG             ulCount,     /* # of attrs in template */
-  CK_OBJECT_HANDLE_PTR phKey        /* gets handle of new key */
-);
-#endif
-
-
-/* C_GenerateKeyPair generates a public-key/private-key pair,
- * creating new key objects.
- */
-CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,                    /* session handle */
-  CK_MECHANISM_PTR     pMechanism,                  /* key-gen mech. */
-  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template for pub. key */
-  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub. attrs. */
-  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template for priv. key */
-  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.  attrs. */
-  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub. key handle */
-  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets priv. key handle */
-);
-#endif
-
-
-/* C_WrapKey wraps (i.e., encrypts) a key. */
-CK_PKCS11_FUNCTION_INFO(C_WrapKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,        /* the session's handle */
-  CK_MECHANISM_PTR  pMechanism,      /* the wrapping mechanism */
-  CK_OBJECT_HANDLE  hWrappingKey,    /* wrapping key */
-  CK_OBJECT_HANDLE  hKey,            /* key to be wrapped */
-  CK_BYTE_PTR       pWrappedKey,     /* gets wrapped key */
-  CK_ULONG_PTR      pulWrappedKeyLen /* gets wrapped key size */
-);
-#endif
-
-
-/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
- * key object.
- */
-CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,          /* session's handle */
-  CK_MECHANISM_PTR     pMechanism,        /* unwrapping mech. */
-  CK_OBJECT_HANDLE     hUnwrappingKey,    /* unwrapping key */
-  CK_BYTE_PTR          pWrappedKey,       /* the wrapped key */
-  CK_ULONG             ulWrappedKeyLen,   /* wrapped key len */
-  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
-  CK_ULONG             ulAttributeCount,  /* template length */
-  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
-);
-#endif
-
-
-/* C_DeriveKey derives a key from a base key, creating a new key
- * object.
- */
-CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE    hSession,          /* session's handle */
-  CK_MECHANISM_PTR     pMechanism,        /* key deriv. mech. */
-  CK_OBJECT_HANDLE     hBaseKey,          /* base key */
-  CK_ATTRIBUTE_PTR     pTemplate,         /* new key template */
-  CK_ULONG             ulAttributeCount,  /* template length */
-  CK_OBJECT_HANDLE_PTR phKey              /* gets new handle */
-);
-#endif
-
-
-
-/* Random number generation */
-
-/* C_SeedRandom mixes additional seed material into the token's
- * random number generator.
- */
-CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,  /* the session's handle */
-  CK_BYTE_PTR       pSeed,     /* the seed material */
-  CK_ULONG          ulSeedLen  /* length of seed material */
-);
-#endif
-
-
-/* C_GenerateRandom generates random data. */
-CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession,    /* the session's handle */
-  CK_BYTE_PTR       RandomData,  /* receives the random data */
-  CK_ULONG          ulRandomLen  /* # of bytes to generate */
-);
-#endif
-
-
-
-/* Parallel function management */
-
-/* C_GetFunctionStatus is a legacy function; it obtains an
- * updated status of a function running in parallel with an
- * application.
- */
-CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_CancelFunction is a legacy function; it cancels a function
- * running in parallel.
- */
-CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_SESSION_HANDLE hSession  /* the session's handle */
-);
-#endif
-
-
-/* C_WaitForSlotEvent waits for a slot event (token insertion,
- * removal, etc.) to occur.
- */
-CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
-#ifdef CK_NEED_ARG_LIST
-(
-  CK_FLAGS flags,        /* blocking/nonblocking flag */
-  CK_SLOT_ID_PTR pSlot,  /* location that receives the slot ID */
-  CK_VOID_PTR pRserved   /* reserved.  Should be NULL_PTR */
-);
-#endif
-

vendor/github.com/miekg/pkcs11/pkcs11go.h

@@ -1,33 +0,0 @@
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-//
-
-#define CK_PTR *
-#ifndef NULL_PTR
-#define NULL_PTR 0
-#endif
-#define CK_DEFINE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION(returnType, name) returnType name
-#define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType (* name)
-#define CK_CALLBACK_FUNCTION(returnType, name) returnType (* name)
-
-#include <unistd.h>
-#ifdef PACKED_STRUCTURES
-# pragma pack(push, 1)
-# include "pkcs11.h"
-# pragma pack(pop)
-#else
-# include "pkcs11.h"
-#endif
-
-// Copy of CK_INFO but with default alignment (not packed). Go hides unaligned
-// struct fields so copying to an aligned struct is necessary to read CK_INFO
-// from Go on Windows where packing is required.
-typedef struct ckInfo {
-	CK_VERSION cryptokiVersion;
-	CK_UTF8CHAR manufacturerID[32];
-	CK_FLAGS flags;
-	CK_UTF8CHAR libraryDescription[32];
-	CK_VERSION libraryVersion;
-} ckInfo, *ckInfoPtr;

vendor/github.com/miekg/pkcs11/release.go

@@ -1,18 +0,0 @@
-//go:build release
-// +build release
-
-package pkcs11
-
-import "fmt"
-
-// Release is current version of the pkcs11 library.
-var Release = R{1, 1, 1}
-
-// R holds the version of this library.
-type R struct {
-	Major, Minor, Patch int
-}
-
-func (r R) String() string {
-	return fmt.Sprintf("%d.%d.%d", r.Major, r.Minor, r.Patch)
-}

vendor/github.com/miekg/pkcs11/softhsm.conf

@@ -1 +0,0 @@
-0:hsm.db

vendor/github.com/miekg/pkcs11/softhsm2.conf

@@ -1,4 +0,0 @@
-log.level = INFO
-objectstore.backend = file
-directories.tokendir = test_data
-slots.removable = false

vendor/github.com/miekg/pkcs11/types.go

@@ -1,315 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs11
-
-/*
-#include <stdlib.h>
-#include <string.h>
-#include "pkcs11go.h"
-
-CK_ULONG Index(CK_ULONG_PTR array, CK_ULONG i)
-{
-	return array[i];
-}
-
-static inline void putAttributePval(CK_ATTRIBUTE_PTR a, CK_VOID_PTR pValue)
-{
-	a->pValue = pValue;
-}
-
-static inline void putMechanismParam(CK_MECHANISM_PTR m, CK_VOID_PTR pParameter)
-{
-	m->pParameter = pParameter;
-}
-*/
-import "C"
-
-import (
-	"fmt"
-	"time"
-	"unsafe"
-)
-
-type arena []unsafe.Pointer
-
-func (a *arena) Allocate(obj []byte) (C.CK_VOID_PTR, C.CK_ULONG) {
-	cobj := C.calloc(C.size_t(len(obj)), 1)
-	*a = append(*a, cobj)
-	C.memmove(cobj, unsafe.Pointer(&obj[0]), C.size_t(len(obj)))
-	return C.CK_VOID_PTR(cobj), C.CK_ULONG(len(obj))
-}
-
-func (a arena) Free() {
-	for _, p := range a {
-		C.free(p)
-	}
-}
-
-// toList converts from a C style array to a []uint.
-func toList(clist C.CK_ULONG_PTR, size C.CK_ULONG) []uint {
-	l := make([]uint, int(size))
-	for i := 0; i < len(l); i++ {
-		l[i] = uint(C.Index(clist, C.CK_ULONG(i)))
-	}
-	defer C.free(unsafe.Pointer(clist))
-	return l
-}
-
-// cBBool converts a bool to a CK_BBOOL.
-func cBBool(x bool) C.CK_BBOOL {
-	if x {
-		return C.CK_BBOOL(C.CK_TRUE)
-	}
-	return C.CK_BBOOL(C.CK_FALSE)
-}
-
-func uintToBytes(x uint64) []byte {
-	ul := C.CK_ULONG(x)
-	return C.GoBytes(unsafe.Pointer(&ul), C.int(unsafe.Sizeof(ul)))
-}
-
-// Error represents an PKCS#11 error.
-type Error uint
-
-func (e Error) Error() string {
-	return fmt.Sprintf("pkcs11: 0x%X: %s", uint(e), strerror[uint(e)])
-}
-
-func toError(e C.CK_RV) error {
-	if e == C.CKR_OK {
-		return nil
-	}
-	return Error(e)
-}
-
-// SessionHandle is a Cryptoki-assigned value that identifies a session.
-type SessionHandle uint
-
-// ObjectHandle is a token-specific identifier for an object.
-type ObjectHandle uint
-
-// Version represents any version information from the library.
-type Version struct {
-	Major byte
-	Minor byte
-}
-
-func toVersion(version C.CK_VERSION) Version {
-	return Version{byte(version.major), byte(version.minor)}
-}
-
-// SlotEvent holds the SlotID which for which an slot event (token insertion,
-// removal, etc.) occurred.
-type SlotEvent struct {
-	SlotID uint
-}
-
-// Info provides information about the library and hardware used.
-type Info struct {
-	CryptokiVersion    Version
-	ManufacturerID     string
-	Flags              uint
-	LibraryDescription string
-	LibraryVersion     Version
-}
-
-// SlotInfo provides information about a slot.
-type SlotInfo struct {
-	SlotDescription string // 64 bytes.
-	ManufacturerID  string // 32 bytes.
-	Flags           uint
-	HardwareVersion Version
-	FirmwareVersion Version
-}
-
-// TokenInfo provides information about a token.
-type TokenInfo struct {
-	Label              string
-	ManufacturerID     string
-	Model              string
-	SerialNumber       string
-	Flags              uint
-	MaxSessionCount    uint
-	SessionCount       uint
-	MaxRwSessionCount  uint
-	RwSessionCount     uint
-	MaxPinLen          uint
-	MinPinLen          uint
-	TotalPublicMemory  uint
-	FreePublicMemory   uint
-	TotalPrivateMemory uint
-	FreePrivateMemory  uint
-	HardwareVersion    Version
-	FirmwareVersion    Version
-	UTCTime            string
-}
-
-// SessionInfo provides information about a session.
-type SessionInfo struct {
-	SlotID      uint
-	State       uint
-	Flags       uint
-	DeviceError uint
-}
-
-// Attribute holds an attribute type/value combination.
-type Attribute struct {
-	Type  uint
-	Value []byte
-}
-
-// NewAttribute allocates a Attribute and returns a pointer to it.
-// Note that this is merely a convenience function, as values returned
-// from the HSM are not converted back to Go values, those are just raw
-// byte slices.
-func NewAttribute(typ uint, x interface{}) *Attribute {
-	// This function nicely transforms *to* an attribute, but there is
-	// no corresponding function that transform back *from* an attribute,
-	// which in PKCS#11 is just an byte array.
-	a := new(Attribute)
-	a.Type = typ
-	if x == nil {
-		return a
-	}
-	switch v := x.(type) {
-	case bool:
-		if v {
-			a.Value = []byte{1}
-		} else {
-			a.Value = []byte{0}
-		}
-	case int:
-		a.Value = uintToBytes(uint64(v))
-	case int16:
-		a.Value = uintToBytes(uint64(v))
-	case int32:
-		a.Value = uintToBytes(uint64(v))
-	case int64:
-		a.Value = uintToBytes(uint64(v))
-	case uint:
-		a.Value = uintToBytes(uint64(v))
-	case uint16:
-		a.Value = uintToBytes(uint64(v))
-	case uint32:
-		a.Value = uintToBytes(uint64(v))
-	case uint64:
-		a.Value = uintToBytes(uint64(v))
-	case string:
-		a.Value = []byte(v)
-	case []byte:
-		a.Value = v
-	case time.Time: // for CKA_DATE
-		a.Value = cDate(v)
-	default:
-		panic("pkcs11: unhandled attribute type")
-	}
-	return a
-}
-
-// cAttribute returns the start address and the length of an attribute list.
-func cAttributeList(a []*Attribute) (arena, C.CK_ATTRIBUTE_PTR, C.CK_ULONG) {
-	var arena arena
-	if len(a) == 0 {
-		return nil, nil, 0
-	}
-	pa := make([]C.CK_ATTRIBUTE, len(a))
-	for i, attr := range a {
-		pa[i]._type = C.CK_ATTRIBUTE_TYPE(attr.Type)
-		if len(attr.Value) != 0 {
-			buf, len := arena.Allocate(attr.Value)
-			// field is unaligned on windows so this has to call into C
-			C.putAttributePval(&pa[i], buf)
-			pa[i].ulValueLen = len
-		}
-	}
-	return arena, &pa[0], C.CK_ULONG(len(a))
-}
-
-func cDate(t time.Time) []byte {
-	b := make([]byte, 8)
-	year, month, day := t.Date()
-	y := fmt.Sprintf("%4d", year)
-	m := fmt.Sprintf("%02d", month)
-	d1 := fmt.Sprintf("%02d", day)
-	b[0], b[1], b[2], b[3] = y[0], y[1], y[2], y[3]
-	b[4], b[5] = m[0], m[1]
-	b[6], b[7] = d1[0], d1[1]
-	return b
-}
-
-// Mechanism holds an mechanism type/value combination.
-type Mechanism struct {
-	Mechanism uint
-	Parameter []byte
-	generator interface{}
-}
-
-// NewMechanism returns a pointer to an initialized Mechanism.
-func NewMechanism(mech uint, x interface{}) *Mechanism {
-	m := new(Mechanism)
-	m.Mechanism = mech
-	if x == nil {
-		return m
-	}
-
-	switch p := x.(type) {
-	case *GCMParams, *OAEPParams, *ECDH1DeriveParams:
-		// contains pointers; defer serialization until cMechanism
-		m.generator = p
-	case []byte:
-		m.Parameter = p
-	default:
-		panic("parameter must be one of type: []byte, *GCMParams, *OAEPParams, *ECDH1DeriveParams")
-	}
-
-	return m
-}
-
-func cMechanism(mechList []*Mechanism) (arena, *C.CK_MECHANISM) {
-	if len(mechList) != 1 {
-		panic("expected exactly one mechanism")
-	}
-	mech := mechList[0]
-	cmech := &C.CK_MECHANISM{mechanism: C.CK_MECHANISM_TYPE(mech.Mechanism)}
-	// params that contain pointers are allocated here
-	param := mech.Parameter
-	var arena arena
-	switch p := mech.generator.(type) {
-	case *GCMParams:
-		// uses its own arena because it has to outlive this function call (yuck)
-		param = cGCMParams(p)
-	case *OAEPParams:
-		param, arena = cOAEPParams(p, arena)
-	case *ECDH1DeriveParams:
-		param, arena = cECDH1DeriveParams(p, arena)
-	}
-	if len(param) != 0 {
-		buf, len := arena.Allocate(param)
-		// field is unaligned on windows so this has to call into C
-		C.putMechanismParam(cmech, buf)
-		cmech.ulParameterLen = len
-	}
-	return arena, cmech
-}
-
-// MechanismInfo provides information about a particular mechanism.
-type MechanismInfo struct {
-	MinKeySize uint
-	MaxKeySize uint
-	Flags      uint
-}
-
-// stubData is a persistent nonempty byte array used by cMessage.
-var stubData = []byte{0}
-
-// cMessage returns the pointer/length pair corresponding to data.
-func cMessage(data []byte) (dataPtr C.CK_BYTE_PTR) {
-	l := len(data)
-	if l == 0 {
-		// &data[0] is forbidden in this case, so use a nontrivial array instead.
-		data = stubData
-	}
-	return C.CK_BYTE_PTR(unsafe.Pointer(&data[0]))
-}

vendor/github.com/miekg/pkcs11/vendor.go

@@ -1,127 +0,0 @@
-package pkcs11
-
-// Vendor specific range for Ncipher network HSM.
-const (
-	NFCK_VENDOR_NCIPHER = 0xde436972
-	CKA_NCIPHER         = NFCK_VENDOR_NCIPHER
-	CKM_NCIPHER         = NFCK_VENDOR_NCIPHER
-	CKK_NCIPHER         = NFCK_VENDOR_NCIPHER
-)
-
-// Vendor specific mechanisms for HMAC on Ncipher HSMs where Ncipher does not allow use of generic_secret keys.
-const (
-	CKM_NC_SHA_1_HMAC_KEY_GEN  = CKM_NCIPHER + 0x3  /* no params */
-	CKM_NC_MD5_HMAC_KEY_GEN    = CKM_NCIPHER + 0x6  /* no params */
-	CKM_NC_SHA224_HMAC_KEY_GEN = CKM_NCIPHER + 0x24 /* no params */
-	CKM_NC_SHA256_HMAC_KEY_GEN = CKM_NCIPHER + 0x25 /* no params */
-	CKM_NC_SHA384_HMAC_KEY_GEN = CKM_NCIPHER + 0x26 /* no params */
-	CKM_NC_SHA512_HMAC_KEY_GEN = CKM_NCIPHER + 0x27 /* no params */
-)
-
-// Vendor specific range for Mozilla NSS.
-const (
-	NSSCK_VENDOR_NSS   = 0x4E534350
-	CKO_NSS            = CKO_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-	CKK_NSS            = CKK_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-	CKC_NSS            = CKC_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-	CKA_NSS            = CKA_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-	CKA_TRUST          = CKA_NSS + 0x2000
-	CKM_NSS            = CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-	CKR_NSS            = CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-	CKT_VENDOR_DEFINED = 0x80000000
-	CKT_NSS            = CKT_VENDOR_DEFINED | NSSCK_VENDOR_NSS
-)
-
-// Vendor specific values for Mozilla NSS.
-const (
-	CKO_NSS_CRL                               = CKO_NSS + 1
-	CKO_NSS_SMIME                             = CKO_NSS + 2
-	CKO_NSS_TRUST                             = CKO_NSS + 3
-	CKO_NSS_BUILTIN_ROOT_LIST                 = CKO_NSS + 4
-	CKO_NSS_NEWSLOT                           = CKO_NSS + 5
-	CKO_NSS_DELSLOT                           = CKO_NSS + 6
-	CKK_NSS_PKCS8                             = CKK_NSS + 1
-	CKK_NSS_JPAKE_ROUND1                      = CKK_NSS + 2
-	CKK_NSS_JPAKE_ROUND2                      = CKK_NSS + 3
-	CKK_NSS_CHACHA20                          = CKK_NSS + 4
-	CKA_NSS_URL                               = CKA_NSS + 1
-	CKA_NSS_EMAIL                             = CKA_NSS + 2
-	CKA_NSS_SMIME_INFO                        = CKA_NSS + 3
-	CKA_NSS_SMIME_TIMESTAMP                   = CKA_NSS + 4
-	CKA_NSS_PKCS8_SALT                        = CKA_NSS + 5
-	CKA_NSS_PASSWORD_CHECK                    = CKA_NSS + 6
-	CKA_NSS_EXPIRES                           = CKA_NSS + 7
-	CKA_NSS_KRL                               = CKA_NSS + 8
-	CKA_NSS_PQG_COUNTER                       = CKA_NSS + 20
-	CKA_NSS_PQG_SEED                          = CKA_NSS + 21
-	CKA_NSS_PQG_H                             = CKA_NSS + 22
-	CKA_NSS_PQG_SEED_BITS                     = CKA_NSS + 23
-	CKA_NSS_MODULE_SPEC                       = CKA_NSS + 24
-	CKA_NSS_OVERRIDE_EXTENSIONS               = CKA_NSS + 25
-	CKA_NSS_JPAKE_SIGNERID                    = CKA_NSS + 26
-	CKA_NSS_JPAKE_PEERID                      = CKA_NSS + 27
-	CKA_NSS_JPAKE_GX1                         = CKA_NSS + 28
-	CKA_NSS_JPAKE_GX2                         = CKA_NSS + 29
-	CKA_NSS_JPAKE_GX3                         = CKA_NSS + 30
-	CKA_NSS_JPAKE_GX4                         = CKA_NSS + 31
-	CKA_NSS_JPAKE_X2                          = CKA_NSS + 32
-	CKA_NSS_JPAKE_X2S                         = CKA_NSS + 33
-	CKA_NSS_MOZILLA_CA_POLICY                 = CKA_NSS + 34
-	CKA_TRUST_DIGITAL_SIGNATURE               = CKA_TRUST + 1
-	CKA_TRUST_NON_REPUDIATION                 = CKA_TRUST + 2
-	CKA_TRUST_KEY_ENCIPHERMENT                = CKA_TRUST + 3
-	CKA_TRUST_DATA_ENCIPHERMENT               = CKA_TRUST + 4
-	CKA_TRUST_KEY_AGREEMENT                   = CKA_TRUST + 5
-	CKA_TRUST_KEY_CERT_SIGN                   = CKA_TRUST + 6
-	CKA_TRUST_CRL_SIGN                        = CKA_TRUST + 7
-	CKA_TRUST_SERVER_AUTH                     = CKA_TRUST + 8
-	CKA_TRUST_CLIENT_AUTH                     = CKA_TRUST + 9
-	CKA_TRUST_CODE_SIGNING                    = CKA_TRUST + 10
-	CKA_TRUST_EMAIL_PROTECTION                = CKA_TRUST + 11
-	CKA_TRUST_IPSEC_END_SYSTEM                = CKA_TRUST + 12
-	CKA_TRUST_IPSEC_TUNNEL                    = CKA_TRUST + 13
-	CKA_TRUST_IPSEC_USER                      = CKA_TRUST + 14
-	CKA_TRUST_TIME_STAMPING                   = CKA_TRUST + 15
-	CKA_TRUST_STEP_UP_APPROVED                = CKA_TRUST + 16
-	CKA_CERT_SHA1_HASH                        = CKA_TRUST + 100
-	CKA_CERT_MD5_HASH                         = CKA_TRUST + 101
-	CKM_NSS_AES_KEY_WRAP                      = CKM_NSS + 1
-	CKM_NSS_AES_KEY_WRAP_PAD                  = CKM_NSS + 2
-	CKM_NSS_HKDF_SHA1                         = CKM_NSS + 3
-	CKM_NSS_HKDF_SHA256                       = CKM_NSS + 4
-	CKM_NSS_HKDF_SHA384                       = CKM_NSS + 5
-	CKM_NSS_HKDF_SHA512                       = CKM_NSS + 6
-	CKM_NSS_JPAKE_ROUND1_SHA1                 = CKM_NSS + 7
-	CKM_NSS_JPAKE_ROUND1_SHA256               = CKM_NSS + 8
-	CKM_NSS_JPAKE_ROUND1_SHA384               = CKM_NSS + 9
-	CKM_NSS_JPAKE_ROUND1_SHA512               = CKM_NSS + 10
-	CKM_NSS_JPAKE_ROUND2_SHA1                 = CKM_NSS + 11
-	CKM_NSS_JPAKE_ROUND2_SHA256               = CKM_NSS + 12
-	CKM_NSS_JPAKE_ROUND2_SHA384               = CKM_NSS + 13
-	CKM_NSS_JPAKE_ROUND2_SHA512               = CKM_NSS + 14
-	CKM_NSS_JPAKE_FINAL_SHA1                  = CKM_NSS + 15
-	CKM_NSS_JPAKE_FINAL_SHA256                = CKM_NSS + 16
-	CKM_NSS_JPAKE_FINAL_SHA384                = CKM_NSS + 17
-	CKM_NSS_JPAKE_FINAL_SHA512                = CKM_NSS + 18
-	CKM_NSS_HMAC_CONSTANT_TIME                = CKM_NSS + 19
-	CKM_NSS_SSL3_MAC_CONSTANT_TIME            = CKM_NSS + 20
-	CKM_NSS_TLS_PRF_GENERAL_SHA256            = CKM_NSS + 21
-	CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256      = CKM_NSS + 22
-	CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256     = CKM_NSS + 23
-	CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256   = CKM_NSS + 24
-	CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE    = CKM_NSS + 25
-	CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_DH = CKM_NSS + 26
-	CKM_NSS_CHACHA20_KEY_GEN                  = CKM_NSS + 27
-	CKM_NSS_CHACHA20_POLY1305                 = CKM_NSS + 28
-	CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN    = CKM_NSS + 29
-	CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN    = CKM_NSS + 30
-	CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN    = CKM_NSS + 31
-	CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN    = CKM_NSS + 32
-	CKR_NSS_CERTDB_FAILED                     = CKR_NSS + 1
-	CKR_NSS_KEYDB_FAILED                      = CKR_NSS + 2
-	CKT_NSS_TRUSTED                           = CKT_NSS + 1
-	CKT_NSS_TRUSTED_DELEGATOR                 = CKT_NSS + 2
-	CKT_NSS_MUST_VERIFY_TRUST                 = CKT_NSS + 3
-	CKT_NSS_NOT_TRUSTED                       = CKT_NSS + 10
-	CKT_NSS_TRUST_UNKNOWN                     = CKT_NSS + 5
-)

vendor/github.com/miekg/pkcs11/zconst.go

@@ -1,766 +0,0 @@
-// Copyright 2013 Miek Gieben. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Code generated by "go run const_generate.go"; DO NOT EDIT.
-
-package pkcs11
-
-const (
-	CK_TRUE                              = 1
-	CK_FALSE                             = 0
-	CK_UNAVAILABLE_INFORMATION           = ^uint(0)
-	CK_EFFECTIVELY_INFINITE              = 0
-	CK_INVALID_HANDLE                    = 0
-	CKN_SURRENDER                        = 0
-	CKN_OTP_CHANGED                      = 1
-	CKF_TOKEN_PRESENT                    = 0x00000001
-	CKF_REMOVABLE_DEVICE                 = 0x00000002
-	CKF_HW_SLOT                          = 0x00000004
-	CKF_RNG                              = 0x00000001
-	CKF_WRITE_PROTECTED                  = 0x00000002
-	CKF_LOGIN_REQUIRED                   = 0x00000004
-	CKF_USER_PIN_INITIALIZED             = 0x00000008
-	CKF_RESTORE_KEY_NOT_NEEDED           = 0x00000020
-	CKF_CLOCK_ON_TOKEN                   = 0x00000040
-	CKF_PROTECTED_AUTHENTICATION_PATH    = 0x00000100
-	CKF_DUAL_CRYPTO_OPERATIONS           = 0x00000200
-	CKF_TOKEN_INITIALIZED                = 0x00000400
-	CKF_SECONDARY_AUTHENTICATION         = 0x00000800
-	CKF_USER_PIN_COUNT_LOW               = 0x00010000
-	CKF_USER_PIN_FINAL_TRY               = 0x00020000
-	CKF_USER_PIN_LOCKED                  = 0x00040000
-	CKF_USER_PIN_TO_BE_CHANGED           = 0x00080000
-	CKF_SO_PIN_COUNT_LOW                 = 0x00100000
-	CKF_SO_PIN_FINAL_TRY                 = 0x00200000
-	CKF_SO_PIN_LOCKED                    = 0x00400000
-	CKF_SO_PIN_TO_BE_CHANGED             = 0x00800000
-	CKF_ERROR_STATE                      = 0x01000000
-	CKU_SO                               = 0
-	CKU_USER                             = 1
-	CKU_CONTEXT_SPECIFIC                 = 2
-	CKS_RO_PUBLIC_SESSION                = 0
-	CKS_RO_USER_FUNCTIONS                = 1
-	CKS_RW_PUBLIC_SESSION                = 2
-	CKS_RW_USER_FUNCTIONS                = 3
-	CKS_RW_SO_FUNCTIONS                  = 4
-	CKF_RW_SESSION                       = 0x00000002
-	CKF_SERIAL_SESSION                   = 0x00000004
-	CKO_DATA                             = 0x00000000
-	CKO_CERTIFICATE                      = 0x00000001
-	CKO_PUBLIC_KEY                       = 0x00000002
-	CKO_PRIVATE_KEY                      = 0x00000003
-	CKO_SECRET_KEY                       = 0x00000004
-	CKO_HW_FEATURE                       = 0x00000005
-	CKO_DOMAIN_PARAMETERS                = 0x00000006
-	CKO_MECHANISM                        = 0x00000007
-	CKO_OTP_KEY                          = 0x00000008
-	CKO_VENDOR_DEFINED                   = 0x80000000
-	CKH_MONOTONIC_COUNTER                = 0x00000001
-	CKH_CLOCK                            = 0x00000002
-	CKH_USER_INTERFACE                   = 0x00000003
-	CKH_VENDOR_DEFINED                   = 0x80000000
-	CKK_RSA                              = 0x00000000
-	CKK_DSA                              = 0x00000001
-	CKK_DH                               = 0x00000002
-	CKK_ECDSA                            = 0x00000003 // Deprecated
-	CKK_EC                               = 0x00000003
-	CKK_X9_42_DH                         = 0x00000004
-	CKK_KEA                              = 0x00000005
-	CKK_GENERIC_SECRET                   = 0x00000010
-	CKK_RC2                              = 0x00000011
-	CKK_RC4                              = 0x00000012
-	CKK_DES                              = 0x00000013
-	CKK_DES2                             = 0x00000014
-	CKK_DES3                             = 0x00000015
-	CKK_CAST                             = 0x00000016
-	CKK_CAST3                            = 0x00000017
-	CKK_CAST5                            = 0x00000018 // Deprecated
-	CKK_CAST128                          = 0x00000018
-	CKK_RC5                              = 0x00000019
-	CKK_IDEA                             = 0x0000001A
-	CKK_SKIPJACK                         = 0x0000001B
-	CKK_BATON                            = 0x0000001C
-	CKK_JUNIPER                          = 0x0000001D
-	CKK_CDMF                             = 0x0000001E
-	CKK_AES                              = 0x0000001F
-	CKK_BLOWFISH                         = 0x00000020
-	CKK_TWOFISH                          = 0x00000021
-	CKK_SECURID                          = 0x00000022
-	CKK_HOTP                             = 0x00000023
-	CKK_ACTI                             = 0x00000024
-	CKK_CAMELLIA                         = 0x00000025
-	CKK_ARIA                             = 0x00000026
-	CKK_MD5_HMAC                         = 0x00000027
-	CKK_SHA_1_HMAC                       = 0x00000028
-	CKK_RIPEMD128_HMAC                   = 0x00000029
-	CKK_RIPEMD160_HMAC                   = 0x0000002A
-	CKK_SHA256_HMAC                      = 0x0000002B
-	CKK_SHA384_HMAC                      = 0x0000002C
-	CKK_SHA512_HMAC                      = 0x0000002D
-	CKK_SHA224_HMAC                      = 0x0000002E
-	CKK_SEED                             = 0x0000002F
-	CKK_GOSTR3410                        = 0x00000030
-	CKK_GOSTR3411                        = 0x00000031
-	CKK_GOST28147                        = 0x00000032
-	CKK_SHA3_224_HMAC                    = 0x00000033
-	CKK_SHA3_256_HMAC                    = 0x00000034
-	CKK_SHA3_384_HMAC                    = 0x00000035
-	CKK_SHA3_512_HMAC                    = 0x00000036
-	CKK_VENDOR_DEFINED                   = 0x80000000
-	CK_CERTIFICATE_CATEGORY_UNSPECIFIED  = 0
-	CK_CERTIFICATE_CATEGORY_TOKEN_USER   = 1
-	CK_CERTIFICATE_CATEGORY_AUTHORITY    = 2
-	CK_CERTIFICATE_CATEGORY_OTHER_ENTITY = 3
-	CK_SECURITY_DOMAIN_UNSPECIFIED       = 0
-	CK_SECURITY_DOMAIN_MANUFACTURER      = 1
-	CK_SECURITY_DOMAIN_OPERATOR          = 2
-	CK_SECURITY_DOMAIN_THIRD_PARTY       = 3
-	CKC_X_509                            = 0x00000000
-	CKC_X_509_ATTR_CERT                  = 0x00000001
-	CKC_WTLS                             = 0x00000002
-	CKC_VENDOR_DEFINED                   = 0x80000000
-	CKF_ARRAY_ATTRIBUTE                  = 0x40000000
-	CK_OTP_FORMAT_DECIMAL                = 0
-	CK_OTP_FORMAT_HEXADECIMAL            = 1
-	CK_OTP_FORMAT_ALPHANUMERIC           = 2
-	CK_OTP_FORMAT_BINARY                 = 3
-	CK_OTP_PARAM_IGNORED                 = 0
-	CK_OTP_PARAM_OPTIONAL                = 1
-	CK_OTP_PARAM_MANDATORY               = 2
-	CKA_CLASS                            = 0x00000000
-	CKA_TOKEN                            = 0x00000001
-	CKA_PRIVATE                          = 0x00000002
-	CKA_LABEL                            = 0x00000003
-	CKA_APPLICATION                      = 0x00000010
-	CKA_VALUE                            = 0x00000011
-	CKA_OBJECT_ID                        = 0x00000012
-	CKA_CERTIFICATE_TYPE                 = 0x00000080
-	CKA_ISSUER                           = 0x00000081
-	CKA_SERIAL_NUMBER                    = 0x00000082
-	CKA_AC_ISSUER                        = 0x00000083
-	CKA_OWNER                            = 0x00000084
-	CKA_ATTR_TYPES                       = 0x00000085
-	CKA_TRUSTED                          = 0x00000086
-	CKA_CERTIFICATE_CATEGORY             = 0x00000087
-	CKA_JAVA_MIDP_SECURITY_DOMAIN        = 0x00000088
-	CKA_URL                              = 0x00000089
-	CKA_HASH_OF_SUBJECT_PUBLIC_KEY       = 0x0000008A
-	CKA_HASH_OF_ISSUER_PUBLIC_KEY        = 0x0000008B
-	CKA_NAME_HASH_ALGORITHM              = 0x0000008C
-	CKA_CHECK_VALUE                      = 0x00000090
-	CKA_KEY_TYPE                         = 0x00000100
-	CKA_SUBJECT                          = 0x00000101
-	CKA_ID                               = 0x00000102
-	CKA_SENSITIVE                        = 0x00000103
-	CKA_ENCRYPT                          = 0x00000104
-	CKA_DECRYPT                          = 0x00000105
-	CKA_WRAP                             = 0x00000106
-	CKA_UNWRAP                           = 0x00000107
-	CKA_SIGN                             = 0x00000108
-	CKA_SIGN_RECOVER                     = 0x00000109
-	CKA_VERIFY                           = 0x0000010A
-	CKA_VERIFY_RECOVER                   = 0x0000010B
-	CKA_DERIVE                           = 0x0000010C
-	CKA_START_DATE                       = 0x00000110
-	CKA_END_DATE                         = 0x00000111
-	CKA_MODULUS                          = 0x00000120
-	CKA_MODULUS_BITS                     = 0x00000121
-	CKA_PUBLIC_EXPONENT                  = 0x00000122
-	CKA_PRIVATE_EXPONENT                 = 0x00000123
-	CKA_PRIME_1                          = 0x00000124
-	CKA_PRIME_2                          = 0x00000125
-	CKA_EXPONENT_1                       = 0x00000126
-	CKA_EXPONENT_2                       = 0x00000127
-	CKA_COEFFICIENT                      = 0x00000128
-	CKA_PUBLIC_KEY_INFO                  = 0x00000129
-	CKA_PRIME                            = 0x00000130
-	CKA_SUBPRIME                         = 0x00000131
-	CKA_BASE                             = 0x00000132
-	CKA_PRIME_BITS                       = 0x00000133
-	CKA_SUBPRIME_BITS                    = 0x00000134
-	CKA_SUB_PRIME_BITS                   = CKA_SUBPRIME_BITS
-	CKA_VALUE_BITS                       = 0x00000160
-	CKA_VALUE_LEN                        = 0x00000161
-	CKA_EXTRACTABLE                      = 0x00000162
-	CKA_LOCAL                            = 0x00000163
-	CKA_NEVER_EXTRACTABLE                = 0x00000164
-	CKA_ALWAYS_SENSITIVE                 = 0x00000165
-	CKA_KEY_GEN_MECHANISM                = 0x00000166
-	CKA_MODIFIABLE                       = 0x00000170
-	CKA_COPYABLE                         = 0x00000171
-	CKA_DESTROYABLE                      = 0x00000172
-	CKA_ECDSA_PARAMS                     = 0x00000180 // Deprecated
-	CKA_EC_PARAMS                        = 0x00000180
-	CKA_EC_POINT                         = 0x00000181
-	CKA_SECONDARY_AUTH                   = 0x00000200 // Deprecated
-	CKA_AUTH_PIN_FLAGS                   = 0x00000201 // Deprecated
-	CKA_ALWAYS_AUTHENTICATE              = 0x00000202
-	CKA_WRAP_WITH_TRUSTED                = 0x00000210
-	CKA_WRAP_TEMPLATE                    = (CKF_ARRAY_ATTRIBUTE | 0x00000211)
-	CKA_UNWRAP_TEMPLATE                  = (CKF_ARRAY_ATTRIBUTE | 0x00000212)
-	CKA_DERIVE_TEMPLATE                  = (CKF_ARRAY_ATTRIBUTE | 0x00000213)
-	CKA_OTP_FORMAT                       = 0x00000220
-	CKA_OTP_LENGTH                       = 0x00000221
-	CKA_OTP_TIME_INTERVAL                = 0x00000222
-	CKA_OTP_USER_FRIENDLY_MODE           = 0x00000223
-	CKA_OTP_CHALLENGE_REQUIREMENT        = 0x00000224
-	CKA_OTP_TIME_REQUIREMENT             = 0x00000225
-	CKA_OTP_COUNTER_REQUIREMENT          = 0x00000226
-	CKA_OTP_PIN_REQUIREMENT              = 0x00000227
-	CKA_OTP_COUNTER                      = 0x0000022E
-	CKA_OTP_TIME                         = 0x0000022F
-	CKA_OTP_USER_IDENTIFIER              = 0x0000022A
-	CKA_OTP_SERVICE_IDENTIFIER           = 0x0000022B
-	CKA_OTP_SERVICE_LOGO                 = 0x0000022C
-	CKA_OTP_SERVICE_LOGO_TYPE            = 0x0000022D
-	CKA_GOSTR3410_PARAMS                 = 0x00000250
-	CKA_GOSTR3411_PARAMS                 = 0x00000251
-	CKA_GOST28147_PARAMS                 = 0x00000252
-	CKA_HW_FEATURE_TYPE                  = 0x00000300
-	CKA_RESET_ON_INIT                    = 0x00000301
-	CKA_HAS_RESET                        = 0x00000302
-	CKA_PIXEL_X                          = 0x00000400
-	CKA_PIXEL_Y                          = 0x00000401
-	CKA_RESOLUTION                       = 0x00000402
-	CKA_CHAR_ROWS                        = 0x00000403
-	CKA_CHAR_COLUMNS                     = 0x00000404
-	CKA_COLOR                            = 0x00000405
-	CKA_BITS_PER_PIXEL                   = 0x00000406
-	CKA_CHAR_SETS                        = 0x00000480
-	CKA_ENCODING_METHODS                 = 0x00000481
-	CKA_MIME_TYPES                       = 0x00000482
-	CKA_MECHANISM_TYPE                   = 0x00000500
-	CKA_REQUIRED_CMS_ATTRIBUTES          = 0x00000501
-	CKA_DEFAULT_CMS_ATTRIBUTES           = 0x00000502
-	CKA_SUPPORTED_CMS_ATTRIBUTES         = 0x00000503
-	CKA_ALLOWED_MECHANISMS               = (CKF_ARRAY_ATTRIBUTE | 0x00000600)
-	CKA_VENDOR_DEFINED                   = 0x80000000
-	CKM_RSA_PKCS_KEY_PAIR_GEN            = 0x00000000
-	CKM_RSA_PKCS                         = 0x00000001
-	CKM_RSA_9796                         = 0x00000002
-	CKM_RSA_X_509                        = 0x00000003
-	CKM_MD2_RSA_PKCS                     = 0x00000004
-	CKM_MD5_RSA_PKCS                     = 0x00000005
-	CKM_SHA1_RSA_PKCS                    = 0x00000006
-	CKM_RIPEMD128_RSA_PKCS               = 0x00000007
-	CKM_RIPEMD160_RSA_PKCS               = 0x00000008
-	CKM_RSA_PKCS_OAEP                    = 0x00000009
-	CKM_RSA_X9_31_KEY_PAIR_GEN           = 0x0000000A
-	CKM_RSA_X9_31                        = 0x0000000B
-	CKM_SHA1_RSA_X9_31                   = 0x0000000C
-	CKM_RSA_PKCS_PSS                     = 0x0000000D
-	CKM_SHA1_RSA_PKCS_PSS                = 0x0000000E
-	CKM_DSA_KEY_PAIR_GEN                 = 0x00000010
-	CKM_DSA                              = 0x00000011
-	CKM_DSA_SHA1                         = 0x00000012
-	CKM_DSA_SHA224                       = 0x00000013
-	CKM_DSA_SHA256                       = 0x00000014
-	CKM_DSA_SHA384                       = 0x00000015
-	CKM_DSA_SHA512                       = 0x00000016
-	CKM_DSA_SHA3_224                     = 0x00000018
-	CKM_DSA_SHA3_256                     = 0x00000019
-	CKM_DSA_SHA3_384                     = 0x0000001A
-	CKM_DSA_SHA3_512                     = 0x0000001B
-	CKM_DH_PKCS_KEY_PAIR_GEN             = 0x00000020
-	CKM_DH_PKCS_DERIVE                   = 0x00000021
-	CKM_X9_42_DH_KEY_PAIR_GEN            = 0x00000030
-	CKM_X9_42_DH_DERIVE                  = 0x00000031
-	CKM_X9_42_DH_HYBRID_DERIVE           = 0x00000032
-	CKM_X9_42_MQV_DERIVE                 = 0x00000033
-	CKM_SHA256_RSA_PKCS                  = 0x00000040
-	CKM_SHA384_RSA_PKCS                  = 0x00000041
-	CKM_SHA512_RSA_PKCS                  = 0x00000042
-	CKM_SHA256_RSA_PKCS_PSS              = 0x00000043
-	CKM_SHA384_RSA_PKCS_PSS              = 0x00000044
-	CKM_SHA512_RSA_PKCS_PSS              = 0x00000045
-	CKM_SHA224_RSA_PKCS                  = 0x00000046
-	CKM_SHA224_RSA_PKCS_PSS              = 0x00000047
-	CKM_SHA512_224                       = 0x00000048
-	CKM_SHA512_224_HMAC                  = 0x00000049
-	CKM_SHA512_224_HMAC_GENERAL          = 0x0000004A
-	CKM_SHA512_224_KEY_DERIVATION        = 0x0000004B
-	CKM_SHA512_256                       = 0x0000004C
-	CKM_SHA512_256_HMAC                  = 0x0000004D
-	CKM_SHA512_256_HMAC_GENERAL          = 0x0000004E
-	CKM_SHA512_256_KEY_DERIVATION        = 0x0000004F
-	CKM_SHA512_T                         = 0x00000050
-	CKM_SHA512_T_HMAC                    = 0x00000051
-	CKM_SHA512_T_HMAC_GENERAL            = 0x00000052
-	CKM_SHA512_T_KEY_DERIVATION          = 0x00000053
-	CKM_SHA3_256_RSA_PKCS                = 0x00000060
-	CKM_SHA3_384_RSA_PKCS                = 0x00000061
-	CKM_SHA3_512_RSA_PKCS                = 0x00000062
-	CKM_SHA3_256_RSA_PKCS_PSS            = 0x00000063
-	CKM_SHA3_384_RSA_PKCS_PSS            = 0x00000064
-	CKM_SHA3_512_RSA_PKCS_PSS            = 0x00000065
-	CKM_SHA3_224_RSA_PKCS                = 0x00000066
-	CKM_SHA3_224_RSA_PKCS_PSS            = 0x00000067
-	CKM_RC2_KEY_GEN                      = 0x00000100
-	CKM_RC2_ECB                          = 0x00000101
-	CKM_RC2_CBC                          = 0x00000102
-	CKM_RC2_MAC                          = 0x00000103
-	CKM_RC2_MAC_GENERAL                  = 0x00000104
-	CKM_RC2_CBC_PAD                      = 0x00000105
-	CKM_RC4_KEY_GEN                      = 0x00000110
-	CKM_RC4                              = 0x00000111
-	CKM_DES_KEY_GEN                      = 0x00000120
-	CKM_DES_ECB                          = 0x00000121
-	CKM_DES_CBC                          = 0x00000122
-	CKM_DES_MAC                          = 0x00000123
-	CKM_DES_MAC_GENERAL                  = 0x00000124
-	CKM_DES_CBC_PAD                      = 0x00000125
-	CKM_DES2_KEY_GEN                     = 0x00000130
-	CKM_DES3_KEY_GEN                     = 0x00000131
-	CKM_DES3_ECB                         = 0x00000132
-	CKM_DES3_CBC                         = 0x00000133
-	CKM_DES3_MAC                         = 0x00000134
-	CKM_DES3_MAC_GENERAL                 = 0x00000135
-	CKM_DES3_CBC_PAD                     = 0x00000136
-	CKM_DES3_CMAC_GENERAL                = 0x00000137
-	CKM_DES3_CMAC                        = 0x00000138
-	CKM_CDMF_KEY_GEN                     = 0x00000140
-	CKM_CDMF_ECB                         = 0x00000141
-	CKM_CDMF_CBC                         = 0x00000142
-	CKM_CDMF_MAC                         = 0x00000143
-	CKM_CDMF_MAC_GENERAL                 = 0x00000144
-	CKM_CDMF_CBC_PAD                     = 0x00000145
-	CKM_DES_OFB64                        = 0x00000150
-	CKM_DES_OFB8                         = 0x00000151
-	CKM_DES_CFB64                        = 0x00000152
-	CKM_DES_CFB8                         = 0x00000153
-	CKM_MD2                              = 0x00000200
-	CKM_MD2_HMAC                         = 0x00000201
-	CKM_MD2_HMAC_GENERAL                 = 0x00000202
-	CKM_MD5                              = 0x00000210
-	CKM_MD5_HMAC                         = 0x00000211
-	CKM_MD5_HMAC_GENERAL                 = 0x00000212
-	CKM_SHA_1                            = 0x00000220
-	CKM_SHA_1_HMAC                       = 0x00000221
-	CKM_SHA_1_HMAC_GENERAL               = 0x00000222
-	CKM_RIPEMD128                        = 0x00000230
-	CKM_RIPEMD128_HMAC                   = 0x00000231
-	CKM_RIPEMD128_HMAC_GENERAL           = 0x00000232
-	CKM_RIPEMD160                        = 0x00000240
-	CKM_RIPEMD160_HMAC                   = 0x00000241
-	CKM_RIPEMD160_HMAC_GENERAL           = 0x00000242
-	CKM_SHA256                           = 0x00000250
-	CKM_SHA256_HMAC                      = 0x00000251
-	CKM_SHA256_HMAC_GENERAL              = 0x00000252
-	CKM_SHA224                           = 0x00000255
-	CKM_SHA224_HMAC                      = 0x00000256
-	CKM_SHA224_HMAC_GENERAL              = 0x00000257
-	CKM_SHA384                           = 0x00000260
-	CKM_SHA384_HMAC                      = 0x00000261
-	CKM_SHA384_HMAC_GENERAL              = 0x00000262
-	CKM_SHA512                           = 0x00000270
-	CKM_SHA512_HMAC                      = 0x00000271
-	CKM_SHA512_HMAC_GENERAL              = 0x00000272
-	CKM_SECURID_KEY_GEN                  = 0x00000280
-	CKM_SECURID                          = 0x00000282
-	CKM_HOTP_KEY_GEN                     = 0x00000290
-	CKM_HOTP                             = 0x00000291
-	CKM_ACTI                             = 0x000002A0
-	CKM_ACTI_KEY_GEN                     = 0x000002A1
-	CKM_SHA3_256                         = 0x000002B0
-	CKM_SHA3_256_HMAC                    = 0x000002B1
-	CKM_SHA3_256_HMAC_GENERAL            = 0x000002B2
-	CKM_SHA3_256_KEY_GEN                 = 0x000002B3
-	CKM_SHA3_224                         = 0x000002B5
-	CKM_SHA3_224_HMAC                    = 0x000002B6
-	CKM_SHA3_224_HMAC_GENERAL            = 0x000002B7
-	CKM_SHA3_224_KEY_GEN                 = 0x000002B8
-	CKM_SHA3_384                         = 0x000002C0
-	CKM_SHA3_384_HMAC                    = 0x000002C1
-	CKM_SHA3_384_HMAC_GENERAL            = 0x000002C2
-	CKM_SHA3_384_KEY_GEN                 = 0x000002C3
-	CKM_SHA3_512                         = 0x000002D0
-	CKM_SHA3_512_HMAC                    = 0x000002D1
-	CKM_SHA3_512_HMAC_GENERAL            = 0x000002D2
-	CKM_SHA3_512_KEY_GEN                 = 0x000002D3
-	CKM_CAST_KEY_GEN                     = 0x00000300
-	CKM_CAST_ECB                         = 0x00000301
-	CKM_CAST_CBC                         = 0x00000302
-	CKM_CAST_MAC                         = 0x00000303
-	CKM_CAST_MAC_GENERAL                 = 0x00000304
-	CKM_CAST_CBC_PAD                     = 0x00000305
-	CKM_CAST3_KEY_GEN                    = 0x00000310
-	CKM_CAST3_ECB                        = 0x00000311
-	CKM_CAST3_CBC                        = 0x00000312
-	CKM_CAST3_MAC                        = 0x00000313
-	CKM_CAST3_MAC_GENERAL                = 0x00000314
-	CKM_CAST3_CBC_PAD                    = 0x00000315
-	CKM_CAST5_KEY_GEN                    = 0x00000320
-	CKM_CAST128_KEY_GEN                  = 0x00000320
-	CKM_CAST5_ECB                        = 0x00000321
-	CKM_CAST128_ECB                      = 0x00000321
-	CKM_CAST5_CBC                        = 0x00000322 // Deprecated
-	CKM_CAST128_CBC                      = 0x00000322
-	CKM_CAST5_MAC                        = 0x00000323 // Deprecated
-	CKM_CAST128_MAC                      = 0x00000323
-	CKM_CAST5_MAC_GENERAL                = 0x00000324 // Deprecated
-	CKM_CAST128_MAC_GENERAL              = 0x00000324
-	CKM_CAST5_CBC_PAD                    = 0x00000325 // Deprecated
-	CKM_CAST128_CBC_PAD                  = 0x00000325
-	CKM_RC5_KEY_GEN                      = 0x00000330
-	CKM_RC5_ECB                          = 0x00000331
-	CKM_RC5_CBC                          = 0x00000332
-	CKM_RC5_MAC                          = 0x00000333
-	CKM_RC5_MAC_GENERAL                  = 0x00000334
-	CKM_RC5_CBC_PAD                      = 0x00000335
-	CKM_IDEA_KEY_GEN                     = 0x00000340
-	CKM_IDEA_ECB                         = 0x00000341
-	CKM_IDEA_CBC                         = 0x00000342
-	CKM_IDEA_MAC                         = 0x00000343
-	CKM_IDEA_MAC_GENERAL                 = 0x00000344
-	CKM_IDEA_CBC_PAD                     = 0x00000345
-	CKM_GENERIC_SECRET_KEY_GEN           = 0x00000350
-	CKM_CONCATENATE_BASE_AND_KEY         = 0x00000360
-	CKM_CONCATENATE_BASE_AND_DATA        = 0x00000362
-	CKM_CONCATENATE_DATA_AND_BASE        = 0x00000363
-	CKM_XOR_BASE_AND_DATA                = 0x00000364
-	CKM_EXTRACT_KEY_FROM_KEY             = 0x00000365
-	CKM_SSL3_PRE_MASTER_KEY_GEN          = 0x00000370
-	CKM_SSL3_MASTER_KEY_DERIVE           = 0x00000371
-	CKM_SSL3_KEY_AND_MAC_DERIVE          = 0x00000372
-	CKM_SSL3_MASTER_KEY_DERIVE_DH        = 0x00000373
-	CKM_TLS_PRE_MASTER_KEY_GEN           = 0x00000374
-	CKM_TLS_MASTER_KEY_DERIVE            = 0x00000375
-	CKM_TLS_KEY_AND_MAC_DERIVE           = 0x00000376
-	CKM_TLS_MASTER_KEY_DERIVE_DH         = 0x00000377
-	CKM_TLS_PRF                          = 0x00000378
-	CKM_SSL3_MD5_MAC                     = 0x00000380
-	CKM_SSL3_SHA1_MAC                    = 0x00000381
-	CKM_MD5_KEY_DERIVATION               = 0x00000390
-	CKM_MD2_KEY_DERIVATION               = 0x00000391
-	CKM_SHA1_KEY_DERIVATION              = 0x00000392
-	CKM_SHA256_KEY_DERIVATION            = 0x00000393
-	CKM_SHA384_KEY_DERIVATION            = 0x00000394
-	CKM_SHA512_KEY_DERIVATION            = 0x00000395
-	CKM_SHA224_KEY_DERIVATION            = 0x00000396
-	CKM_SHA3_256_KEY_DERIVE              = 0x00000397
-	CKM_SHA3_224_KEY_DERIVE              = 0x00000398
-	CKM_SHA3_384_KEY_DERIVE              = 0x00000399
-	CKM_SHA3_512_KEY_DERIVE              = 0x0000039A
-	CKM_SHAKE_128_KEY_DERIVE             = 0x0000039B
-	CKM_SHAKE_256_KEY_DERIVE             = 0x0000039C
-	CKM_PBE_MD2_DES_CBC                  = 0x000003A0
-	CKM_PBE_MD5_DES_CBC                  = 0x000003A1
-	CKM_PBE_MD5_CAST_CBC                 = 0x000003A2
-	CKM_PBE_MD5_CAST3_CBC                = 0x000003A3
-	CKM_PBE_MD5_CAST5_CBC                = 0x000003A4 // Deprecated
-	CKM_PBE_MD5_CAST128_CBC              = 0x000003A4
-	CKM_PBE_SHA1_CAST5_CBC               = 0x000003A5 // Deprecated
-	CKM_PBE_SHA1_CAST128_CBC             = 0x000003A5
-	CKM_PBE_SHA1_RC4_128                 = 0x000003A6
-	CKM_PBE_SHA1_RC4_40                  = 0x000003A7
-	CKM_PBE_SHA1_DES3_EDE_CBC            = 0x000003A8
-	CKM_PBE_SHA1_DES2_EDE_CBC            = 0x000003A9
-	CKM_PBE_SHA1_RC2_128_CBC             = 0x000003AA
-	CKM_PBE_SHA1_RC2_40_CBC              = 0x000003AB
-	CKM_PKCS5_PBKD2                      = 0x000003B0
-	CKM_PBA_SHA1_WITH_SHA1_HMAC          = 0x000003C0
-	CKM_WTLS_PRE_MASTER_KEY_GEN          = 0x000003D0
-	CKM_WTLS_MASTER_KEY_DERIVE           = 0x000003D1
-	CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC    = 0x000003D2
-	CKM_WTLS_PRF                         = 0x000003D3
-	CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE   = 0x000003D4
-	CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE   = 0x000003D5
-	CKM_TLS10_MAC_SERVER                 = 0x000003D6
-	CKM_TLS10_MAC_CLIENT                 = 0x000003D7
-	CKM_TLS12_MAC                        = 0x000003D8
-	CKM_TLS12_KDF                        = 0x000003D9
-	CKM_TLS12_MASTER_KEY_DERIVE          = 0x000003E0
-	CKM_TLS12_KEY_AND_MAC_DERIVE         = 0x000003E1
-	CKM_TLS12_MASTER_KEY_DERIVE_DH       = 0x000003E2
-	CKM_TLS12_KEY_SAFE_DERIVE            = 0x000003E3
-	CKM_TLS_MAC                          = 0x000003E4
-	CKM_TLS_KDF                          = 0x000003E5
-	CKM_KEY_WRAP_LYNKS                   = 0x00000400
-	CKM_KEY_WRAP_SET_OAEP                = 0x00000401
-	CKM_CMS_SIG                          = 0x00000500
-	CKM_KIP_DERIVE                       = 0x00000510
-	CKM_KIP_WRAP                         = 0x00000511
-	CKM_KIP_MAC                          = 0x00000512
-	CKM_CAMELLIA_KEY_GEN                 = 0x00000550
-	CKM_CAMELLIA_ECB                     = 0x00000551
-	CKM_CAMELLIA_CBC                     = 0x00000552
-	CKM_CAMELLIA_MAC                     = 0x00000553
-	CKM_CAMELLIA_MAC_GENERAL             = 0x00000554
-	CKM_CAMELLIA_CBC_PAD                 = 0x00000555
-	CKM_CAMELLIA_ECB_ENCRYPT_DATA        = 0x00000556
-	CKM_CAMELLIA_CBC_ENCRYPT_DATA        = 0x00000557
-	CKM_CAMELLIA_CTR                     = 0x00000558
-	CKM_ARIA_KEY_GEN                     = 0x00000560
-	CKM_ARIA_ECB                         = 0x00000561
-	CKM_ARIA_CBC                         = 0x00000562
-	CKM_ARIA_MAC                         = 0x00000563
-	CKM_ARIA_MAC_GENERAL                 = 0x00000564
-	CKM_ARIA_CBC_PAD                     = 0x00000565
-	CKM_ARIA_ECB_ENCRYPT_DATA            = 0x00000566
-	CKM_ARIA_CBC_ENCRYPT_DATA            = 0x00000567
-	CKM_SEED_KEY_GEN                     = 0x00000650
-	CKM_SEED_ECB                         = 0x00000651
-	CKM_SEED_CBC                         = 0x00000652
-	CKM_SEED_MAC                         = 0x00000653
-	CKM_SEED_MAC_GENERAL                 = 0x00000654
-	CKM_SEED_CBC_PAD                     = 0x00000655
-	CKM_SEED_ECB_ENCRYPT_DATA            = 0x00000656
-	CKM_SEED_CBC_ENCRYPT_DATA            = 0x00000657
-	CKM_SKIPJACK_KEY_GEN                 = 0x00001000
-	CKM_SKIPJACK_ECB64                   = 0x00001001
-	CKM_SKIPJACK_CBC64                   = 0x00001002
-	CKM_SKIPJACK_OFB64                   = 0x00001003
-	CKM_SKIPJACK_CFB64                   = 0x00001004
-	CKM_SKIPJACK_CFB32                   = 0x00001005
-	CKM_SKIPJACK_CFB16                   = 0x00001006
-	CKM_SKIPJACK_CFB8                    = 0x00001007
-	CKM_SKIPJACK_WRAP                    = 0x00001008
-	CKM_SKIPJACK_PRIVATE_WRAP            = 0x00001009
-	CKM_SKIPJACK_RELAYX                  = 0x0000100a
-	CKM_KEA_KEY_PAIR_GEN                 = 0x00001010
-	CKM_KEA_KEY_DERIVE                   = 0x00001011
-	CKM_KEA_DERIVE                       = 0x00001012
-	CKM_FORTEZZA_TIMESTAMP               = 0x00001020
-	CKM_BATON_KEY_GEN                    = 0x00001030
-	CKM_BATON_ECB128                     = 0x00001031
-	CKM_BATON_ECB96                      = 0x00001032
-	CKM_BATON_CBC128                     = 0x00001033
-	CKM_BATON_COUNTER                    = 0x00001034
-	CKM_BATON_SHUFFLE                    = 0x00001035
-	CKM_BATON_WRAP                       = 0x00001036
-	CKM_ECDSA_KEY_PAIR_GEN               = 0x00001040 // Deprecated
-	CKM_EC_KEY_PAIR_GEN                  = 0x00001040
-	CKM_ECDSA                            = 0x00001041
-	CKM_ECDSA_SHA1                       = 0x00001042
-	CKM_ECDSA_SHA224                     = 0x00001043
-	CKM_ECDSA_SHA256                     = 0x00001044
-	CKM_ECDSA_SHA384                     = 0x00001045
-	CKM_ECDSA_SHA512                     = 0x00001046
-	CKM_ECDH1_DERIVE                     = 0x00001050
-	CKM_ECDH1_COFACTOR_DERIVE            = 0x00001051
-	CKM_ECMQV_DERIVE                     = 0x00001052
-	CKM_ECDH_AES_KEY_WRAP                = 0x00001053
-	CKM_RSA_AES_KEY_WRAP                 = 0x00001054
-	CKM_JUNIPER_KEY_GEN                  = 0x00001060
-	CKM_JUNIPER_ECB128                   = 0x00001061
-	CKM_JUNIPER_CBC128                   = 0x00001062
-	CKM_JUNIPER_COUNTER                  = 0x00001063
-	CKM_JUNIPER_SHUFFLE                  = 0x00001064
-	CKM_JUNIPER_WRAP                     = 0x00001065
-	CKM_FASTHASH                         = 0x00001070
-	CKM_AES_KEY_GEN                      = 0x00001080
-	CKM_AES_ECB                          = 0x00001081
-	CKM_AES_CBC                          = 0x00001082
-	CKM_AES_MAC                          = 0x00001083
-	CKM_AES_MAC_GENERAL                  = 0x00001084
-	CKM_AES_CBC_PAD                      = 0x00001085
-	CKM_AES_CTR                          = 0x00001086
-	CKM_AES_GCM                          = 0x00001087
-	CKM_AES_CCM                          = 0x00001088
-	CKM_AES_CTS                          = 0x00001089
-	CKM_AES_CMAC                         = 0x0000108A
-	CKM_AES_CMAC_GENERAL                 = 0x0000108B
-	CKM_AES_XCBC_MAC                     = 0x0000108C
-	CKM_AES_XCBC_MAC_96                  = 0x0000108D
-	CKM_AES_GMAC                         = 0x0000108E
-	CKM_BLOWFISH_KEY_GEN                 = 0x00001090
-	CKM_BLOWFISH_CBC                     = 0x00001091
-	CKM_TWOFISH_KEY_GEN                  = 0x00001092
-	CKM_TWOFISH_CBC                      = 0x00001093
-	CKM_BLOWFISH_CBC_PAD                 = 0x00001094
-	CKM_TWOFISH_CBC_PAD                  = 0x00001095
-	CKM_DES_ECB_ENCRYPT_DATA             = 0x00001100
-	CKM_DES_CBC_ENCRYPT_DATA             = 0x00001101
-	CKM_DES3_ECB_ENCRYPT_DATA            = 0x00001102
-	CKM_DES3_CBC_ENCRYPT_DATA            = 0x00001103
-	CKM_AES_ECB_ENCRYPT_DATA             = 0x00001104
-	CKM_AES_CBC_ENCRYPT_DATA             = 0x00001105
-	CKM_GOSTR3410_KEY_PAIR_GEN           = 0x00001200
-	CKM_GOSTR3410                        = 0x00001201
-	CKM_GOSTR3410_WITH_GOSTR3411         = 0x00001202
-	CKM_GOSTR3410_KEY_WRAP               = 0x00001203
-	CKM_GOSTR3410_DERIVE                 = 0x00001204
-	CKM_GOSTR3411                        = 0x00001210
-	CKM_GOSTR3411_HMAC                   = 0x00001211
-	CKM_GOST28147_KEY_GEN                = 0x00001220
-	CKM_GOST28147_ECB                    = 0x00001221
-	CKM_GOST28147                        = 0x00001222
-	CKM_GOST28147_MAC                    = 0x00001223
-	CKM_GOST28147_KEY_WRAP               = 0x00001224
-	CKM_DSA_PARAMETER_GEN                = 0x00002000
-	CKM_DH_PKCS_PARAMETER_GEN            = 0x00002001
-	CKM_X9_42_DH_PARAMETER_GEN           = 0x00002002
-	CKM_DSA_PROBABLISTIC_PARAMETER_GEN   = 0x00002003
-	CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN   = 0x00002004
-	CKM_AES_OFB                          = 0x00002104
-	CKM_AES_CFB64                        = 0x00002105
-	CKM_AES_CFB8                         = 0x00002106
-	CKM_AES_CFB128                       = 0x00002107
-	CKM_AES_CFB1                         = 0x00002108
-	CKM_AES_KEY_WRAP                     = 0x00002109
-	CKM_AES_KEY_WRAP_PAD                 = 0x0000210A
-	CKM_RSA_PKCS_TPM_1_1                 = 0x00004001
-	CKM_RSA_PKCS_OAEP_TPM_1_1            = 0x00004002
-	CKM_VENDOR_DEFINED                   = 0x80000000
-	CKF_HW                               = 0x00000001
-	CKF_ENCRYPT                          = 0x00000100
-	CKF_DECRYPT                          = 0x00000200
-	CKF_DIGEST                           = 0x00000400
-	CKF_SIGN                             = 0x00000800
-	CKF_SIGN_RECOVER                     = 0x00001000
-	CKF_VERIFY                           = 0x00002000
-	CKF_VERIFY_RECOVER                   = 0x00004000
-	CKF_GENERATE                         = 0x00008000
-	CKF_GENERATE_KEY_PAIR                = 0x00010000
-	CKF_WRAP                             = 0x00020000
-	CKF_UNWRAP                           = 0x00040000
-	CKF_DERIVE                           = 0x00080000
-	CKF_EC_F_P                           = 0x00100000
-	CKF_EC_F_2M                          = 0x00200000
-	CKF_EC_ECPARAMETERS                  = 0x00400000
-	CKF_EC_NAMEDCURVE                    = 0x00800000
-	CKF_EC_UNCOMPRESS                    = 0x01000000
-	CKF_EC_COMPRESS                      = 0x02000000
-	CKF_EXTENSION                        = 0x80000000
-	CKR_OK                               = 0x00000000
-	CKR_CANCEL                           = 0x00000001
-	CKR_HOST_MEMORY                      = 0x00000002
-	CKR_SLOT_ID_INVALID                  = 0x00000003
-	CKR_GENERAL_ERROR                    = 0x00000005
-	CKR_FUNCTION_FAILED                  = 0x00000006
-	CKR_ARGUMENTS_BAD                    = 0x00000007
-	CKR_NO_EVENT                         = 0x00000008
-	CKR_NEED_TO_CREATE_THREADS           = 0x00000009
-	CKR_CANT_LOCK                        = 0x0000000A
-	CKR_ATTRIBUTE_READ_ONLY              = 0x00000010
-	CKR_ATTRIBUTE_SENSITIVE              = 0x00000011
-	CKR_ATTRIBUTE_TYPE_INVALID           = 0x00000012
-	CKR_ATTRIBUTE_VALUE_INVALID          = 0x00000013
-	CKR_ACTION_PROHIBITED                = 0x0000001B
-	CKR_DATA_INVALID                     = 0x00000020
-	CKR_DATA_LEN_RANGE                   = 0x00000021
-	CKR_DEVICE_ERROR                     = 0x00000030
-	CKR_DEVICE_MEMORY                    = 0x00000031
-	CKR_DEVICE_REMOVED                   = 0x00000032
-	CKR_ENCRYPTED_DATA_INVALID           = 0x00000040
-	CKR_ENCRYPTED_DATA_LEN_RANGE         = 0x00000041
-	CKR_FUNCTION_CANCELED                = 0x00000050
-	CKR_FUNCTION_NOT_PARALLEL            = 0x00000051
-	CKR_FUNCTION_NOT_SUPPORTED           = 0x00000054
-	CKR_KEY_HANDLE_INVALID               = 0x00000060
-	CKR_KEY_SIZE_RANGE                   = 0x00000062
-	CKR_KEY_TYPE_INCONSISTENT            = 0x00000063
-	CKR_KEY_NOT_NEEDED                   = 0x00000064
-	CKR_KEY_CHANGED                      = 0x00000065
-	CKR_KEY_NEEDED                       = 0x00000066
-	CKR_KEY_INDIGESTIBLE                 = 0x00000067
-	CKR_KEY_FUNCTION_NOT_PERMITTED       = 0x00000068
-	CKR_KEY_NOT_WRAPPABLE                = 0x00000069
-	CKR_KEY_UNEXTRACTABLE                = 0x0000006A
-	CKR_MECHANISM_INVALID                = 0x00000070
-	CKR_MECHANISM_PARAM_INVALID          = 0x00000071
-	CKR_OBJECT_HANDLE_INVALID            = 0x00000082
-	CKR_OPERATION_ACTIVE                 = 0x00000090
-	CKR_OPERATION_NOT_INITIALIZED        = 0x00000091
-	CKR_PIN_INCORRECT                    = 0x000000A0
-	CKR_PIN_INVALID                      = 0x000000A1
-	CKR_PIN_LEN_RANGE                    = 0x000000A2
-	CKR_PIN_EXPIRED                      = 0x000000A3
-	CKR_PIN_LOCKED                       = 0x000000A4
-	CKR_SESSION_CLOSED                   = 0x000000B0
-	CKR_SESSION_COUNT                    = 0x000000B1
-	CKR_SESSION_HANDLE_INVALID           = 0x000000B3
-	CKR_SESSION_PARALLEL_NOT_SUPPORTED   = 0x000000B4
-	CKR_SESSION_READ_ONLY                = 0x000000B5
-	CKR_SESSION_EXISTS                   = 0x000000B6
-	CKR_SESSION_READ_ONLY_EXISTS         = 0x000000B7
-	CKR_SESSION_READ_WRITE_SO_EXISTS     = 0x000000B8
-	CKR_SIGNATURE_INVALID                = 0x000000C0
-	CKR_SIGNATURE_LEN_RANGE              = 0x000000C1
-	CKR_TEMPLATE_INCOMPLETE              = 0x000000D0
-	CKR_TEMPLATE_INCONSISTENT            = 0x000000D1
-	CKR_TOKEN_NOT_PRESENT                = 0x000000E0
-	CKR_TOKEN_NOT_RECOGNIZED             = 0x000000E1
-	CKR_TOKEN_WRITE_PROTECTED            = 0x000000E2
-	CKR_UNWRAPPING_KEY_HANDLE_INVALID    = 0x000000F0
-	CKR_UNWRAPPING_KEY_SIZE_RANGE        = 0x000000F1
-	CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT = 0x000000F2
-	CKR_USER_ALREADY_LOGGED_IN           = 0x00000100
-	CKR_USER_NOT_LOGGED_IN               = 0x00000101
-	CKR_USER_PIN_NOT_INITIALIZED         = 0x00000102
-	CKR_USER_TYPE_INVALID                = 0x00000103
-	CKR_USER_ANOTHER_ALREADY_LOGGED_IN   = 0x00000104
-	CKR_USER_TOO_MANY_TYPES              = 0x00000105
-	CKR_WRAPPED_KEY_INVALID              = 0x00000110
-	CKR_WRAPPED_KEY_LEN_RANGE            = 0x00000112
-	CKR_WRAPPING_KEY_HANDLE_INVALID      = 0x00000113
-	CKR_WRAPPING_KEY_SIZE_RANGE          = 0x00000114
-	CKR_WRAPPING_KEY_TYPE_INCONSISTENT   = 0x00000115
-	CKR_RANDOM_SEED_NOT_SUPPORTED        = 0x00000120
-	CKR_RANDOM_NO_RNG                    = 0x00000121
-	CKR_DOMAIN_PARAMS_INVALID            = 0x00000130
-	CKR_CURVE_NOT_SUPPORTED              = 0x00000140
-	CKR_BUFFER_TOO_SMALL                 = 0x00000150
-	CKR_SAVED_STATE_INVALID              = 0x00000160
-	CKR_INFORMATION_SENSITIVE            = 0x00000170
-	CKR_STATE_UNSAVEABLE                 = 0x00000180
-	CKR_CRYPTOKI_NOT_INITIALIZED         = 0x00000190
-	CKR_CRYPTOKI_ALREADY_INITIALIZED     = 0x00000191
-	CKR_MUTEX_BAD                        = 0x000001A0
-	CKR_MUTEX_NOT_LOCKED                 = 0x000001A1
-	CKR_NEW_PIN_MODE                     = 0x000001B0
-	CKR_NEXT_OTP                         = 0x000001B1
-	CKR_EXCEEDED_MAX_ITERATIONS          = 0x000001B5
-	CKR_FIPS_SELF_TEST_FAILED            = 0x000001B6
-	CKR_LIBRARY_LOAD_FAILED              = 0x000001B7
-	CKR_PIN_TOO_WEAK                     = 0x000001B8
-	CKR_PUBLIC_KEY_INVALID               = 0x000001B9
-	CKR_FUNCTION_REJECTED                = 0x00000200
-	CKR_VENDOR_DEFINED                   = 0x80000000
-	CKF_LIBRARY_CANT_CREATE_OS_THREADS   = 0x00000001
-	CKF_OS_LOCKING_OK                    = 0x00000002
-	CKF_DONT_BLOCK                       = 1
-	CKG_MGF1_SHA1                        = 0x00000001
-	CKG_MGF1_SHA256                      = 0x00000002
-	CKG_MGF1_SHA384                      = 0x00000003
-	CKG_MGF1_SHA512                      = 0x00000004
-	CKG_MGF1_SHA224                      = 0x00000005
-	CKZ_DATA_SPECIFIED                   = 0x00000001
-	CKD_NULL                             = 0x00000001
-	CKD_SHA1_KDF                         = 0x00000002
-	CKD_SHA1_KDF_ASN1                    = 0x00000003
-	CKD_SHA1_KDF_CONCATENATE             = 0x00000004
-	CKD_SHA224_KDF                       = 0x00000005
-	CKD_SHA256_KDF                       = 0x00000006
-	CKD_SHA384_KDF                       = 0x00000007
-	CKD_SHA512_KDF                       = 0x00000008
-	CKD_CPDIVERSIFY_KDF                  = 0x00000009
-	CKD_SHA3_224_KDF                     = 0x0000000A
-	CKD_SHA3_256_KDF                     = 0x0000000B
-	CKD_SHA3_384_KDF                     = 0x0000000C
-	CKD_SHA3_512_KDF                     = 0x0000000D
-	CKP_PKCS5_PBKD2_HMAC_SHA1            = 0x00000001
-	CKP_PKCS5_PBKD2_HMAC_GOSTR3411       = 0x00000002
-	CKP_PKCS5_PBKD2_HMAC_SHA224          = 0x00000003
-	CKP_PKCS5_PBKD2_HMAC_SHA256          = 0x00000004
-	CKP_PKCS5_PBKD2_HMAC_SHA384          = 0x00000005
-	CKP_PKCS5_PBKD2_HMAC_SHA512          = 0x00000006
-	CKP_PKCS5_PBKD2_HMAC_SHA512_224      = 0x00000007
-	CKP_PKCS5_PBKD2_HMAC_SHA512_256      = 0x00000008
-	CKZ_SALT_SPECIFIED                   = 0x00000001
-	CK_OTP_VALUE                         = 0
-	CK_OTP_PIN                           = 1
-	CK_OTP_CHALLENGE                     = 2
-	CK_OTP_TIME                          = 3
-	CK_OTP_COUNTER                       = 4
-	CK_OTP_FLAGS                         = 5
-	CK_OTP_OUTPUT_LENGTH                 = 6
-	CK_OTP_OUTPUT_FORMAT                 = 7
-	CKF_NEXT_OTP                         = 0x00000001
-	CKF_EXCLUDE_TIME                     = 0x00000002
-	CKF_EXCLUDE_COUNTER                  = 0x00000004
-	CKF_EXCLUDE_CHALLENGE                = 0x00000008
-	CKF_EXCLUDE_PIN                      = 0x00000010
-	CKF_USER_FRIENDLY_OTP                = 0x00000020
-)

vendor/github.com/stefanberger/go-pkcs11uri/.gitignore

@@ -1,2 +0,0 @@
-*~
-pkcs11uri

vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml

@@ -1,25 +0,0 @@
-dist: bionic
-language: go
-
-os:
-- linux
-
-go:
-  - "1.13.x"
-
-matrix:
-  include:
-    - os: linux
-
-addons:
-  apt:
-    packages:
-      - softhsm2
-
-install:
-  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.30.0
-
-script:
-  - make
-  - make check
-  - make test

vendor/github.com/stefanberger/go-pkcs11uri/LICENSE

@@ -1,177 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS

vendor/github.com/stefanberger/go-pkcs11uri/Makefile

@@ -1,28 +0,0 @@
-#   Copyright IBM Corporation, 2020
-
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-
-#       http://www.apache.org/licenses/LICENSE-2.0
-
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-.PHONY: check build test
-
-all: build
-
-FORCE:
-
-check:
-	golangci-lint run
-
-build:
-	go build ./...
-
-test:
-	go test ./... -test.v

vendor/github.com/stefanberger/go-pkcs11uri/README.md

@@ -1,102 +0,0 @@
-# go-pkcs11uri
-
-Welcome to the go-pkcs11uri library. The implementation follows [RFC 7512](https://tools.ietf.org/html/rfc7512) and this [errata](https://www.rfc-editor.org/errata/rfc7512).
-
-# Exampe usage:
-
-The following example builds on this library [here](https://github.com/miekg/pkcs11) and are using softhsm2 on Fedora.
-
-## Example
-
-This example program extending the one found [here](https://github.com/miekg/pkcs11/blob/master/README.md#examples):
-
-```
-package main
-
-import (
-	"fmt"
-	"os"
-	"strconv"
-
-	"github.com/miekg/pkcs11"
-	pkcs11uri "github.com/stefanberger/go-pkcs11uri"
-)
-
-func main() {
-	if len(os.Args) < 2 {
-		panic("Missing pkcs11 URI argument")
-	}
-	uristr := os.Args[1]
-
-	uri, err := pkcs11uri.New()
-	if err != nil {
-		panic(err)
-	}
-	err = uri.Parse(uristr)
-	if err != nil {
-		panic(err)
-	}
-
-	module, err := uri.GetModule()
-	if err != nil {
-		panic(err)
-	}
-
-	slot, ok := uri.GetPathAttribute("slot-id", false)
-	if !ok {
-		panic("No slot-id in pkcs11 URI")
-	}
-	slotid, err := strconv.Atoi(slot)
-	if err != nil {
-		panic(err)
-	}
-
-	pin, err := uri.GetPIN()
-	if err != nil {
-		panic(err)
-	}
-
-	p := pkcs11.New(module)
-	err = p.Initialize()
-	if err != nil {
-		panic(err)
-	}
-
-	defer p.Destroy()
-	defer p.Finalize()
-
-	session, err := p.OpenSession(uint(slotid), pkcs11.CKF_SERIAL_SESSION|pkcs11.CKF_RW_SESSION)
-	if err != nil {
-		panic(err)
-	}
-	defer p.CloseSession(session)
-
-	err = p.Login(session, pkcs11.CKU_USER, pin)
-	if err != nil {
-		panic(err)
-	}
-	defer p.Logout(session)
-
-	p.DigestInit(session, []*pkcs11.Mechanism{pkcs11.NewMechanism(pkcs11.CKM_SHA_1, nil)})
-	hash, err := p.Digest(session, []byte("this is a string"))
-	if err != nil {
-		panic(err)
-	}
-
-	for _, d := range hash {
-		fmt.Printf("%x", d)
-	}
-	fmt.Println()
-}
-```
-
-## Exampe Usage
-
-```
-$ sudo softhsm2-util --init-token --slot 1 --label test --pin 1234 --so-pin 1234
-The token has been initialized and is reassigned to slot 2053753261
-$ go build ./...
-$ sudo ./pkcs11-example 'pkcs11:slot-id=2053753261?module-path=/usr/lib64/pkcs11/libsofthsm2.so&pin-value=1234'
-517592df8fec3ad146a79a9af153db2a4d784ec5
-```
-

vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go

@@ -1,453 +0,0 @@
-/*
-   (c) Copyright IBM Corporation, 2020
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-*/
-
-package pkcs11uri
-
-import (
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"net/url"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-// Pkcs11URI holds a pkcs11 URI object
-type Pkcs11URI struct {
-	// path and query attributes may have custom attributes that either
-	// have to be in the query or in the path part, so we use two maps
-	pathAttributes  map[string]string
-	queryAttributes map[string]string
-	// directories to search for pkcs11 modules
-	moduleDirectories []string
-	// file paths of allowed pkcs11 modules
-	allowedModulePaths []string
-	// whether any module is allowed to be loaded
-	allowAnyModule bool
-	// A map of environment variables needed by the pkcs11 module using this URI.
-	// This map is not needed by this implementation but is there for convenience.
-	env map[string]string
-}
-
-// upper character hex digits needed for pct-encoding
-const hex = "0123456789ABCDEF"
-
-// escapeAll pct-escapes all characters in the string
-func escapeAll(s string) string {
-	res := make([]byte, len(s)*3)
-	j := 0
-	for i := 0; i < len(s); i++ {
-		c := s[i]
-		res[j] = '%'
-		res[j+1] = hex[c>>4]
-		res[j+2] = hex[c&0xf]
-		j += 3
-	}
-	return string(res)
-}
-
-// escape pct-escapes the path and query part of the pkcs11 URI following the different rules of the
-// path and query part as decribed in RFC 7512 sec. 2.3
-func escape(s string, isPath bool) string {
-	res := make([]byte, len(s)*3)
-	j := 0
-	for i := 0; i < len(s); i++ {
-		c := s[i]
-		// unreserved per RFC 3986 sec. 2.3
-		if (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') {
-			res[j] = c
-		} else if isPath && c == '&' {
-			res[j] = c
-		} else if !isPath && (c == '/' || c == '?' || c == '|') {
-			res[j] = c
-		} else {
-			switch c {
-			case '-', '.', '_', '~': // unreserved per RFC 3986 sec. 2.3
-				res[j] = c
-			case ':', '[', ']', '@', '!', '$', '\'', '(', ')', '*', '+', ',', '=':
-				res[j] = c
-			default:
-				res[j] = '%'
-				res[j+1] = hex[c>>4]
-				res[j+2] = hex[c&0xf]
-				j += 2
-			}
-		}
-		j++
-	}
-	return string(res[:j])
-}
-
-// New creates a new Pkcs11URI object
-func New() *Pkcs11URI {
-	return &Pkcs11URI{
-		pathAttributes:  make(map[string]string),
-		queryAttributes: make(map[string]string),
-		env:             make(map[string]string),
-	}
-}
-
-func (uri *Pkcs11URI) setAttribute(attrMap map[string]string, name, value string) error {
-	v, err := url.PathUnescape(value)
-	if err != nil {
-		return err
-	}
-	attrMap[name] = v
-	return nil
-}
-
-// GetPathAttribute returns the value of a path attribute in unescaped form or
-// pct-encoded form
-func (uri *Pkcs11URI) GetPathAttribute(name string, pctencode bool) (string, bool) {
-	v, ok := uri.pathAttributes[name]
-	if ok && pctencode {
-		v = escape(v, true)
-	}
-	return v, ok
-}
-
-// SetPathAttribute sets the value for a path attribute; this function may return an error
-// if the given value cannot be pct-unescaped
-func (uri *Pkcs11URI) SetPathAttribute(name, value string) error {
-	return uri.setAttribute(uri.pathAttributes, name, value)
-}
-
-// AddPathAttribute adds a path attribute; it returns an error if an attribute with the same
-// name already existed or if the given value cannot be pct-unescaped
-func (uri *Pkcs11URI) AddPathAttribute(name, value string) error {
-	if _, ok := uri.pathAttributes[name]; ok {
-		return errors.New("duplicate path attribute")
-	}
-	return uri.SetPathAttribute(name, value)
-}
-
-// RemovePathAttribute removes a path attribute
-func (uri *Pkcs11URI) RemovePathAttribute(name string) {
-	delete(uri.pathAttributes, name)
-}
-
-// AddEnv adds an environment variable for the pkcs11 module
-func (uri *Pkcs11URI) AddEnv(name, value string) {
-	uri.env[name] = value
-}
-
-// SetEnvMap sets the environment variables for the pkcs11 module
-func (uri *Pkcs11URI) SetEnvMap(env map[string]string) {
-	uri.env = env
-}
-
-// GetEnvMap returns the map of environment variables
-func (uri *Pkcs11URI) GetEnvMap() map[string]string {
-	return uri.env
-}
-
-// GetQueryAttribute returns the value of a query attribute in unescaped or
-// pct-encoded form
-func (uri *Pkcs11URI) GetQueryAttribute(name string, pctencode bool) (string, bool) {
-	v, ok := uri.queryAttributes[name]
-	if ok && pctencode {
-		v = escape(v, false)
-	}
-	return v, ok
-}
-
-// SetQueryAttribute sets the value for a query attribute; this function may return an error
-// if the given value cannot pct-unescaped
-func (uri *Pkcs11URI) SetQueryAttribute(name, value string) error {
-	return uri.setAttribute(uri.queryAttributes, name, value)
-}
-
-// AddQueryAttribute adds a query attribute; it returns an error if an attribute with the same
-// name already existed or if the given value cannot be pct-unescaped
-func (uri *Pkcs11URI) AddQueryAttribute(name, value string) error {
-	if _, ok := uri.queryAttributes[name]; ok {
-		return errors.New("duplicate query attribute")
-	}
-	return uri.SetQueryAttribute(name, value)
-}
-
-// RemoveQueryAttribute removes a path attribute
-func (uri *Pkcs11URI) RemoveQueryAttribute(name string) {
-	delete(uri.queryAttributes, name)
-}
-
-// Validate validates a Pkcs11URI object's attributes following RFC 7512 rules and proper formatting of
-// their values
-func (uri *Pkcs11URI) Validate() error {
-	/* RFC 7512: 2.3 */
-	/* slot-id should be DIGIT, but we go for number */
-	if v, ok := uri.pathAttributes["slot-id"]; ok {
-		if _, err := strconv.Atoi(v); err != nil {
-			return fmt.Errorf("slot-id must be a number: %s", v)
-		}
-	}
-
-	/* library-version should 1*DIGIT [ "." 1 *DIGIT ]; allow NUMBERS for DIGIT */
-	if v, ok := uri.pathAttributes["library-version"]; ok {
-		m, err := regexp.Match("^[0-9]+(\\.[0-9]+)?$", []byte(v))
-		if err != nil || !m {
-			return fmt.Errorf("Invalid format for library-version '%s'", v)
-		}
-	}
-
-	if v, ok := uri.pathAttributes["type"]; ok {
-		m, err := regexp.Match("^(public|private|cert|secret-key}data)?$", []byte(v))
-		if err != nil || !m {
-			return fmt.Errorf("Invalid type '%s'", v)
-		}
-	}
-
-	/* RFC 7512: 2.4 */
-	_, ok1 := uri.queryAttributes["pin-source"]
-	_, ok2 := uri.queryAttributes["pin-value"]
-	if ok1 && ok2 {
-		return errors.New("URI must not contain pin-source and pin-value")
-	}
-
-	if v, ok := uri.queryAttributes["module-path"]; ok {
-		if !filepath.IsAbs(v) {
-			return fmt.Errorf("path %s of module-name attribute must be absolute", v)
-		}
-	}
-
-	return nil
-}
-
-// HasPIN allows the user to check whether a PIN has been provided either by the pin-value or the pin-source
-// attributes. It should be called before GetPIN(), which may still fail getting the PIN from a file for example.
-func (uri *Pkcs11URI) HasPIN() bool {
-	_, ok := uri.queryAttributes["pin-value"]
-	if ok {
-		return true
-	}
-	_, ok = uri.queryAttributes["pin-source"]
-	return ok
-}
-
-// GetPIN gets the PIN from either the pin-value or pin-source attribute; a user may want to call HasPIN()
-// before calling this function to determine whether a PIN has been provided at all so that an error code
-// returned by this function indicates that the PIN value could not be retrieved.
-func (uri *Pkcs11URI) GetPIN() (string, error) {
-	if v, ok := uri.queryAttributes["pin-value"]; ok {
-		return v, nil
-	}
-	if v, ok := uri.queryAttributes["pin-source"]; ok {
-		pinuri, err := url.ParseRequestURI(v)
-		if err != nil {
-			return "", fmt.Errorf("Could not parse pin-source: %s ", err)
-		}
-		switch pinuri.Scheme {
-		case "", "file":
-			if !filepath.IsAbs(pinuri.Path) {
-				return "", fmt.Errorf("PIN URI path '%s' is not absolute", pinuri.Path)
-			}
-			pin, err := ioutil.ReadFile(pinuri.Path)
-			if err != nil {
-				return "", fmt.Errorf("Could not open PIN file: %s", err)
-			}
-			return string(pin), nil
-		default:
-			return "", fmt.Errorf("PIN URI scheme %s is not supported", pinuri.Scheme)
-		}
-	}
-	return "", fmt.Errorf("Neither pin-source nor pin-value are available")
-}
-
-// Parse parses a pkcs11: URI string
-func (uri *Pkcs11URI) Parse(uristring string) error {
-	if !strings.HasPrefix(uristring, "pkcs11:") {
-		return errors.New("Malformed pkcs11 URI: missing pcks11: prefix")
-	}
-
-	parts := strings.SplitN(uristring[7:], "?", 2)
-
-	uri.pathAttributes = make(map[string]string)
-	uri.queryAttributes = make(map[string]string)
-
-	if len(parts[0]) > 0 {
-		/* parse path part */
-		for _, part := range strings.Split(parts[0], ";") {
-			p := strings.SplitN(part, "=", 2)
-			if len(p) != 2 {
-				return errors.New("Malformed pkcs11 URI: malformed path attribute")
-			}
-			if err := uri.AddPathAttribute(p[0], p[1]); err != nil {
-				return fmt.Errorf("Malformed pkcs11 URI: %s", err)
-			}
-		}
-	}
-
-	if len(parts) == 2 {
-		/* parse query part */
-		for _, part := range strings.Split(parts[1], "&") {
-			p := strings.SplitN(part, "=", 2)
-			if len(p) != 2 {
-				return errors.New("Malformed pkcs11 URI: malformed query attribute")
-			}
-			if err := uri.AddQueryAttribute(p[0], p[1]); err != nil {
-				return fmt.Errorf("Malformed pkcs11 URI: %s", err)
-			}
-		}
-	}
-	return uri.Validate()
-}
-
-// formatAttribute formats attributes and escapes their values as needed
-func formatAttributes(attrMap map[string]string, ispath bool) string {
-	res := ""
-	for key, value := range attrMap {
-		switch key {
-		case "id":
-			/* id is always pct-encoded */
-			value = escapeAll(value)
-		default:
-			if ispath {
-				value = escape(value, true)
-			} else {
-				value = escape(value, false)
-			}
-		}
-		if len(res) > 0 {
-			if ispath {
-				res += ";"
-			} else {
-				res += "&"
-			}
-		}
-		res += key + "=" + value
-	}
-	return res
-}
-
-// Format formats a Pkcs11URI to it string representaion
-func (uri *Pkcs11URI) Format() (string, error) {
-	if err := uri.Validate(); err != nil {
-		return "", err
-	}
-	result := "pkcs11:" + formatAttributes(uri.pathAttributes, true)
-	if len(uri.queryAttributes) > 0 {
-		result += "?" + formatAttributes(uri.queryAttributes, false)
-	}
-	return result, nil
-}
-
-// SetModuleDirectories sets the search directories for pkcs11 modules
-func (uri *Pkcs11URI) SetModuleDirectories(moduleDirectories []string) {
-	uri.moduleDirectories = moduleDirectories
-}
-
-// GetModuleDirectories gets the search directories for pkcs11 modules
-func (uri *Pkcs11URI) GetModuleDirectories() []string {
-	return uri.moduleDirectories
-}
-
-// SetAllowedModulePaths sets allowed module paths to restrict access to modules.
-// Directory entries must end with a '/', all other ones are assumed to be file entries.
-// Allowed modules are filtered by string matching.
-func (uri *Pkcs11URI) SetAllowedModulePaths(allowedModulePaths []string) {
-	uri.allowedModulePaths = allowedModulePaths
-}
-
-// SetAllowAnyModule allows any module to be loaded; by default this is not allowed
-func (uri *Pkcs11URI) SetAllowAnyModule(allowAnyModule bool) {
-	uri.allowAnyModule = allowAnyModule
-}
-
-func (uri *Pkcs11URI) isAllowedPath(path string, allowedPaths []string) bool {
-	if uri.allowAnyModule {
-		return true
-	}
-	for _, allowedPath := range allowedPaths {
-		if allowedPath == path {
-			// exact filename match
-			return true
-		}
-		if allowedPath[len(allowedPath)-1] == '/' && strings.HasPrefix(path, allowedPath) {
-			// allowedPath no subdirectory is allowed
-			idx := strings.IndexRune(path[len(allowedPath):], os.PathSeparator)
-			if idx < 0 {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// GetModule returns the module to use or an error in case no module could be found.
-// First the module-path is checked for whether it holds an absolute that can be read
-// by the current user. If this is the case the module is returned. Otherwise either the module-path
-// is used or the user-provided module path is used to match a module containing what is set in the
-// attribute module-name.
-func (uri *Pkcs11URI) GetModule() (string, error) {
-	var searchdirs []string
-	v, ok := uri.queryAttributes["module-path"]
-
-	if ok {
-		info, err := os.Stat(v)
-		if err != nil {
-			return "", fmt.Errorf("module-path '%s' is not accessible", v)
-		}
-		if err == nil && info.Mode().IsRegular() {
-			// it's a file
-			if uri.isAllowedPath(v, uri.allowedModulePaths) {
-				return v, nil
-			}
-			return "", fmt.Errorf("module-path '%s' is not allowed by policy", v)
-		}
-		if !info.IsDir() {
-			return "", fmt.Errorf("module-path '%s' points to an invalid file type", v)
-		}
-		// v is a directory
-		searchdirs = []string{v}
-	} else {
-		searchdirs = uri.GetModuleDirectories()
-	}
-
-	moduleName, ok := uri.queryAttributes["module-name"]
-	if !ok {
-		return "", fmt.Errorf("module-name attribute is not set")
-	}
-	moduleName = strings.ToLower(moduleName)
-
-	for _, dir := range searchdirs {
-		files, err := ioutil.ReadDir(dir)
-		if err != nil {
-			continue
-		}
-		for _, file := range files {
-			fileLower := strings.ToLower(file.Name())
-
-			i := strings.Index(fileLower, moduleName)
-			if i < 0 {
-				continue
-			}
-			// we require that the fileLower ends with moduleName or that
-			// a suffix follows so that softhsm will not match libsofthsm2.so but only
-			// libsofthsm.so
-			if len(fileLower) == i+len(moduleName) || fileLower[i+len(moduleName)] == '.' {
-				f := filepath.Join(dir, file.Name())
-				if uri.isAllowedPath(f, uri.allowedModulePaths) {
-					return f, nil
-				}
-				return "", fmt.Errorf("module '%s' is not allowed by policy", f)
-			}
-		}
-	}
-	return "", fmt.Errorf("No module could be found")
-}

vendor/go.mozilla.org/pkcs7/.gitignore

@@ -1,24 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
-*.test
-*.prof

vendor/go.mozilla.org/pkcs7/.travis.yml

@@ -1,10 +0,0 @@
-language: go
-go:
-    - "1.11"
-    - "1.12"
-    - "1.13"
-    - tip
-before_install:
-    - make gettools
-script:
-    - make

vendor/go.mozilla.org/pkcs7/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2015 Andrew Smith
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-