signature/signature.go
func verifyAndExtractSignature(mech SigningMechanism, unverifiedSignature []byte, rules signatureAcceptanceRules) (*Signature, error) {
	signed, keyIdentity, err := mech.Verify(unverifiedSignature)
	if err != nil {
		return nil, err
	}
	if err := rules.validateKeyIdentity(keyIdentity); err != nil {
		return nil, err
	}

	var unmatchedSignature untrustedSignature
	if err := json.Unmarshal(signed, &unmatchedSignature); err != nil {
		return nil, InvalidSignatureError{msg: err.Error()}
	}
	if err := rules.validateSignedDockerManifestDigest(unmatchedSignature.UntrustedDockerManifestDigest); err != nil {
		return nil, err
	}
	if err := rules.validateSignedDockerReference(unmatchedSignature.UntrustedDockerReference); err != nil {
		return nil, err
	}
	// signatureAcceptanceRules have accepted this value.
	return &Signature{
		DockerManifestDigest: unmatchedSignature.UntrustedDockerManifestDigest,
		DockerReference:      unmatchedSignature.UntrustedDockerReference,
	}, nil
}
func verifyAndExtractSignature(mech SigningMechanism, unverifiedSignature []byte, rules signatureAcceptanceRules) (*Signature, error) {
	signed, keyIdentity, err := mech.Verify(unverifiedSignature)
	if err != nil {
		return nil, err
	}
	if err := rules.validateKeyIdentity(keyIdentity); err != nil {
		return nil, err
	}

	var unmatchedSignature untrustedSignature
	if err := json.Unmarshal(signed, &unmatchedSignature); err != nil {
		return nil, InvalidSignatureError{msg: err.Error()}
	}
	if err := rules.validateSignedDockerManifestDigest(unmatchedSignature.UntrustedDockerManifestDigest); err != nil {
		return nil, err
	}
	if err := rules.validateSignedDockerReference(unmatchedSignature.UntrustedDockerReference); err != nil {
		return nil, err
	}
	// signatureAcceptanceRules have accepted this value.
	return &Signature{
		DockerManifestDigest: unmatchedSignature.UntrustedDockerManifestDigest,
		DockerReference:      unmatchedSignature.UntrustedDockerReference,
	}, nil
}
func verifyAndExtractSignature ( mech SigningMechanism , unverifiedSignature [ ] byte , rules signatureAcceptanceRules ) ( * Signature , error ) { signed , keyIdentity , err := mech . Verify ( unverifiedSignature ) if err != nil { return nil , err } if err := rules . validateKeyIdentity ( keyIdentity ) ; err != nil { return nil , err } var unmatchedSignature untrustedSignature if err := json . Unmarshal ( signed , & unmatchedSignature ) ; err != nil { return nil , InvalidSignatureError { msg : err . Error ( ) } } if err := rules . validateSignedDockerManifestDigest ( unmatchedSignature . UntrustedDockerManifestDigest ) ; err != nil { return nil , err } if err := rules . validateSignedDockerReference ( unmatchedSignature . UntrustedDockerReference ) ; err != nil { return nil , err } // signatureAcceptanceRules have accepted this value. return & Signature { DockerManifestDigest : unmatchedSignature . UntrustedDockerManifestDigest , DockerReference : unmatchedSignature . UntrustedDockerReference , } , nil }
// verifyAndExtractSignature verifies that unverifiedSignature has been signed, and that its principial components
// match expected values, both as specified by rules, and returns it
verifyAndExtractSignature verifies that unverifiedSignature has been signed and that its principial components match expected values both as specified by rules and returns it