func encodeCaveatV2V3(
	version Version,
	condition string,
	rootKey []byte,
	thirdPartyPubKey *PublicKey,
	key *KeyPair,
	ns *checkers.Namespace,
) ([]byte, error) {

	var nsData []byte
	if version >= Version3 {
		data, err := ns.MarshalText()
		if err != nil {
			return nil, errgo.Mask(err)
		}
		nsData = data
	}
	// dataLen is our estimate of how long the data will be.
	// As we always use append, this doesn't have to be strictly
	// accurate but it's nice to avoid allocations.
	dataLen := 0 +
		1 + // version
		publicKeyPrefixLen +
		KeyLen +
		NonceLen +
		box.Overhead +
		1 + // version
		uvarintLen(uint64(len(rootKey))) +
		len(rootKey) +
		uvarintLen(uint64(len(nsData))) +
		len(nsData) +
		len(condition)

	var nonce [NonceLen]byte = uuidGen.Next()

	data := make([]byte, 0, dataLen)
	data = append(data, byte(version))
	data = append(data, thirdPartyPubKey.Key[:publicKeyPrefixLen]...)
	data = append(data, key.Public.Key[:]...)
	data = append(data, nonce[:]...)
	secret := encodeSecretPartV2V3(version, condition, rootKey, nsData)
	return box.Seal(data, secret, &nonce, thirdPartyPubKey.boxKey(), key.Private.boxKey()), nil
}
// encodeCaveatV3 creates a version 2 or version 3 third-party caveat.
//
// The format has the following packed binary fields (note
// that all fields up to and including the nonce are the same
// as the v2 format):
//
// 	version 2 or 3 [1 byte]
// 	first 4 bytes of third-party Curve25519 public key [4 bytes]
// 	first-party Curve25519 public key [32 bytes]
// 	nonce [24 bytes]
// 	encrypted secret part [rest of message]
//
// The encrypted part encrypts the following fields
// with box.Seal:
//
// 	version 2 or 3 [1 byte]
// 	length of root key [n: uvarint]
// 	root key [n bytes]
// 	length of encoded namespace [n: uvarint] (Version 3 only)
// 	encoded namespace [n bytes] (Version 3 only)
// 	condition [rest of encrypted part]
encodeCaveatV3 creates a version 2 or version 3 third-party caveat.

The format has the following packed binary fields (note
that all fields up to and including the nonce are the same
as the v2 format).

version 2 or 3 [1 byte]
first 4 bytes of third-party Curve25519 public key [4 bytes]
first-party Curve25519 public key [32 bytes]
nonce [24 bytes]
encrypted secret part [rest of message]

The encrypted part encrypts the following fields
with box.Seal.

version 2 or 3 [1 byte]
length of root key [n: uvarint]
root key [n bytes]
length of encoded namespace [n: uvarint] (Version 3 only)
encoded namespace [n bytes] (Version 3 only)
condition [rest of encrypted part]
// encodeCaveatV3 creates a version 2 or version 3 third - party caveat . // // The format has the following packed binary fields ( note // that all fields up to and including the nonce are the same // as the v2 format ) : // // version 2 or 3 [ 1 byte ] // first 4 bytes of third - party Curve25519 public key [ 4 bytes ] // first - party Curve25519 public key [ 32 bytes ] // nonce [ 24 bytes ] // encrypted secret part [ rest of message ] // // The encrypted part encrypts the following fields // with box . Seal : // // version 2 or 3 [ 1 byte ] // length of root key [ n : uvarint ] // root key [ n bytes ] // length of encoded namespace [ n : uvarint ] ( Version 3 only ) // encoded namespace [ n bytes ] ( Version 3 only ) // condition [ rest of encrypted part ]
func encodeCaveatV2V3(
	version Version,
	condition string,
	rootKey []byte,
	thirdPartyPubKey *PublicKey,
	key *KeyPair,
	ns *checkers.Namespace,
) ([]byte, error) {
	var nsData []byte
	if version >= Version3 {
		data, err := ns.MarshalText()
		if err != nil {
			return nil, errgo.Mask(err)
		}
		nsData = data
	}
	dataLen := 0 +
		1 + 
		publicKeyPrefixLen +
		KeyLen +
		NonceLen +
		box.Overhead +
		1 + 
		uvarintLen(uint64(len(rootKey))) +
		len(rootKey) +
		uvarintLen(uint64(len(nsData))) +
		len(nsData) +
		len(condition)
	var nonce [NonceLen]byte = uuidGen.Next()
	data := make([]byte, 0, dataLen)
	data = append(data, byte(version))
	data = append(data, thirdPartyPubKey.Key[:publicKeyPrefixLen]...)
	data = append(data, key.Public.Key[:]...)
	data = append(data, nonce[:]...)
	secret := encodeSecretPartV2V3(version, condition, rootKey, nsData)
	return box.Seal(data, secret, &nonce, thirdPartyPubKey.boxKey(), key.Private.boxKey()), nil
}
func encodeCaveatV2V3 ( version Version , condition string , rootKey [ ] byte , thirdPartyPubKey * PublicKey , key * KeyPair , ns * checkers . Namespace , ) ( [ ] byte , error ) { var nsData [ ] byte if version >= Version3 { data , err := ns . MarshalText ( ) if err != nil { return nil , errgo . Mask ( err ) } nsData = data } dataLen := 0 + 1 + publicKeyPrefixLen + KeyLen + NonceLen + box . Overhead + 1 + uvarintLen ( uint64 ( len ( rootKey ) ) ) + len ( rootKey ) + uvarintLen ( uint64 ( len ( nsData ) ) ) + len ( nsData ) + len ( condition ) var nonce [ NonceLen ] byte = uuidGen . Next ( ) data := make ( [ ] byte , 0 , dataLen ) data = append ( data , byte ( version ) ) data = append ( data , thirdPartyPubKey . Key [ : publicKeyPrefixLen ] ... ) data = append ( data , key . Public . Key [ : ] ... ) data = append ( data , nonce [ : ] ... ) secret := encodeSecretPartV2V3 ( version , condition , rootKey , nsData ) return box . Seal ( data , secret , & nonce , thirdPartyPubKey . boxKey ( ) , key . Private . boxKey ( ) ) , nil }
encodeCaveatV3 creates a version 2 or version 3 third-party caveat.
encodeCaveatV3 creates a version 2 or version 3 third - party caveat .
// dataLen is our estimate of how long the data will be. // As we always use append, this doesn't have to be strictly // accurate but it's nice to avoid allocations. // version // version