0c29d6bac1
This commit adds support for the oauth [device-code](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow)
login flow when authenticating against the official registry.
This is achieved by adding `cli/internal/oauth`, which contains code to manage
interacting with the Docker OAuth tenant (`login.docker.com`), including launching
the device-code flow, refreshing access using the refresh-token, and logging out.
The `OAuthManager` introduced here is also made available through the `command.Cli`
interface method `OAuthManager()`.
In order to maintain compatibility with any clients manually accessing
the credentials through `~/.docker/config.json` or via credential
helpers, the added `OAuthManager` uses the retrieved access token to
automatically generate a PAT with Hub, and store that in the
credentials.
Signed-off-by: Laura Brehm <laurabrehm@hey.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| cipher | ||
| json | ||
| jwt | ||
| .gitignore | ||
| .golangci.yml | ||
| .travis.yml | ||
| CHANGELOG.md | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| README.md | ||
| SECURITY.md | ||
| asymmetric.go | ||
| crypter.go | ||
| doc.go | ||
| encoding.go | ||
| jwe.go | ||
| jwk.go | ||
| jws.go | ||
| opaque.go | ||
| shared.go | ||
| signing.go | ||
| symmetric.go | ||
README.md
Go JOSE
Versions
Version 4 (branch, doc, releases) is the current stable version:
import "github.com/go-jose/go-jose/v4"
The old square/go-jose repo contains the prior v1 and v2 versions, which are deprecated.
Summary
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. This includes support for JSON Web Encryption, JSON Web Signature, and JSON Web Token standards.
Disclaimer: This library contains encryption software that is subject to the U.S. Export Administration Regulations. You may not export, re-export, transfer or download this code or any part of it in violation of any United States law, directive or regulation. In particular this software may not be exported or re-exported in any form or on any media to Iran, North Sudan, Syria, Cuba, or North Korea, or to denied persons or entities mentioned on any US maintained blocked list.
Overview
The implementation follows the
JSON Web Encryption (RFC 7516),
JSON Web Signature (RFC 7515), and
JSON Web Token (RFC 7519) specifications.
Tables of supported algorithms are shown below. The library supports both
the compact and JWS/JWE JSON Serialization formats, and has optional support for
multiple recipients. It also comes with a small command-line utility
(jose-util)
for dealing with JOSE messages in a shell.
Note: We use a forked version of the encoding/json package from the Go
standard library which uses case-sensitive matching for member names (instead
of case-insensitive matching).
This is to avoid differences in interpretation of messages between go-jose and
libraries in other languages.
Supported algorithms
See below for a table of supported algorithms. Algorithm identifiers match the names in the JSON Web Algorithms standard where possible. The Godoc reference has a list of constants.
| Key encryption | Algorithm identifier(s) |
|---|---|
| RSA-PKCS#1v1.5 | RSA1_5 |
| RSA-OAEP | RSA-OAEP, RSA-OAEP-256 |
| AES key wrap | A128KW, A192KW, A256KW |
| AES-GCM key wrap | A128GCMKW, A192GCMKW, A256GCMKW |
| ECDH-ES + AES key wrap | ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW |
| ECDH-ES (direct) | ECDH-ES1 |
| Direct encryption | dir1 |
1. Not supported in multi-recipient mode
| Signing / MAC | Algorithm identifier(s) |
|---|---|
| RSASSA-PKCS#1v1.5 | RS256, RS384, RS512 |
| RSASSA-PSS | PS256, PS384, PS512 |
| HMAC | HS256, HS384, HS512 |
| ECDSA | ES256, ES384, ES512 |
| Ed25519 | EdDSA2 |
2. Only available in version 2 of the package
| Content encryption | Algorithm identifier(s) |
|---|---|
| AES-CBC+HMAC | A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 |
| AES-GCM | A128GCM, A192GCM, A256GCM |
| Compression | Algorithm identifiers(s) |
|---|---|
| DEFLATE (RFC 1951) | DEF |
Supported key types
See below for a table of supported key types. These are understood by the
library, and can be passed to corresponding functions such as NewEncrypter or
NewSigner. Each of these keys can also be wrapped in a JWK if desired, which
allows attaching a key id.
| Algorithm(s) | Corresponding types |
|---|---|
| RSA | *rsa.PublicKey, *rsa.PrivateKey |
| ECDH, ECDSA | *ecdsa.PublicKey, *ecdsa.PrivateKey |
| EdDSA1 | ed25519.PublicKey, ed25519.PrivateKey |
| AES, HMAC | []byte |
1. Only available in version 2 or later of the package
Examples
Examples can be found in the Godoc
reference for this package. The
jose-util
subdirectory also contains a small command-line utility which might be useful
as an example as well.