signature/signature.go
func GetUntrustedSignatureInformationWithoutVerifying(untrustedSignatureBytes []byte) (*UntrustedSignatureInformation, error) {
	// NOTE: This should eventualy do format autodetection.
	mech, _, err := NewEphemeralGPGSigningMechanism([]byte{})
	if err != nil {
		return nil, err
	}
	defer mech.Close()

	untrustedContents, shortKeyIdentifier, err := mech.UntrustedSignatureContents(untrustedSignatureBytes)
	if err != nil {
		return nil, err
	}
	var untrustedDecodedContents untrustedSignature
	if err := json.Unmarshal(untrustedContents, &untrustedDecodedContents); err != nil {
		return nil, InvalidSignatureError{msg: err.Error()}
	}

	var timestamp *time.Time // = nil
	if untrustedDecodedContents.UntrustedTimestamp != nil {
		ts := time.Unix(*untrustedDecodedContents.UntrustedTimestamp, 0)
		timestamp = &ts
	}
	return &UntrustedSignatureInformation{
		UntrustedDockerManifestDigest: untrustedDecodedContents.UntrustedDockerManifestDigest,
		UntrustedDockerReference:      untrustedDecodedContents.UntrustedDockerReference,
		UntrustedCreatorID:            untrustedDecodedContents.UntrustedCreatorID,
		UntrustedTimestamp:            timestamp,
		UntrustedShortKeyIdentifier:   shortKeyIdentifier,
	}, nil
}
func GetUntrustedSignatureInformationWithoutVerifying(untrustedSignatureBytes []byte) (*UntrustedSignatureInformation, error) {
	// NOTE: This should eventualy do format autodetection.
	mech, _, err := NewEphemeralGPGSigningMechanism([]byte{})
	if err != nil {
		return nil, err
	}
	defer mech.Close()

	untrustedContents, shortKeyIdentifier, err := mech.UntrustedSignatureContents(untrustedSignatureBytes)
	if err != nil {
		return nil, err
	}
	var untrustedDecodedContents untrustedSignature
	if err := json.Unmarshal(untrustedContents, &untrustedDecodedContents); err != nil {
		return nil, InvalidSignatureError{msg: err.Error()}
	}

	var timestamp *time.Time // = nil
	if untrustedDecodedContents.UntrustedTimestamp != nil {
		ts := time.Unix(*untrustedDecodedContents.UntrustedTimestamp, 0)
		timestamp = &ts
	}
	return &UntrustedSignatureInformation{
		UntrustedDockerManifestDigest: untrustedDecodedContents.UntrustedDockerManifestDigest,
		UntrustedDockerReference:      untrustedDecodedContents.UntrustedDockerReference,
		UntrustedCreatorID:            untrustedDecodedContents.UntrustedCreatorID,
		UntrustedTimestamp:            timestamp,
		UntrustedShortKeyIdentifier:   shortKeyIdentifier,
	}, nil
}
func GetUntrustedSignatureInformationWithoutVerifying ( untrustedSignatureBytes [ ] byte ) ( * UntrustedSignatureInformation , error ) { // NOTE: This should eventualy do format autodetection. mech , _ , err := NewEphemeralGPGSigningMechanism ( [ ] byte { } ) if err != nil { return nil , err } defer mech . Close ( ) untrustedContents , shortKeyIdentifier , err := mech . UntrustedSignatureContents ( untrustedSignatureBytes ) if err != nil { return nil , err } var untrustedDecodedContents untrustedSignature if err := json . Unmarshal ( untrustedContents , & untrustedDecodedContents ) ; err != nil { return nil , InvalidSignatureError { msg : err . Error ( ) } } var timestamp * time . Time // = nil if untrustedDecodedContents . UntrustedTimestamp != nil { ts := time . Unix ( * untrustedDecodedContents . UntrustedTimestamp , 0 ) timestamp = & ts } return & UntrustedSignatureInformation { UntrustedDockerManifestDigest : untrustedDecodedContents . UntrustedDockerManifestDigest , UntrustedDockerReference : untrustedDecodedContents . UntrustedDockerReference , UntrustedCreatorID : untrustedDecodedContents . UntrustedCreatorID , UntrustedTimestamp : timestamp , UntrustedShortKeyIdentifier : shortKeyIdentifier , } , nil }
// GetUntrustedSignatureInformationWithoutVerifying extracts information available in an untrusted signature,
// WITHOUT doing any cryptographic verification.
// This may be useful when debugging signature verification failures,
// or when managing a set of signatures on a single image.
//
// WARNING: Do not use the contents of this for ANY security decisions,
// and be VERY CAREFUL about showing this information to humans in any way which suggest that these values “are probably” reliable.
// There is NO REASON to expect the values to be correct, or not intentionally misleading
// (including things like “✅ Verified by $authority”)
GetUntrustedSignatureInformationWithoutVerifying extracts information available in an untrusted signature WITHOUT doing any cryptographic verification . This may be useful when debugging signature verification failures or when managing a set of signatures on a single image . WARNING : Do not use the contents of this for ANY security decisions and be VERY CAREFUL about showing this information to humans in any way which suggest that these values “are probably” reliable . There is NO REASON to expect the values to be correct or not intentionally misleading ( including things like “✅ Verified by $authority” )