diff --git a/Godeps/Godeps.json b/Godeps/Godeps.json index 79bef68aab1..723f028e81b 100644 --- a/Godeps/Godeps.json +++ b/Godeps/Godeps.json @@ -446,47 +446,47 @@ }, { "ImportPath": "github.com/containerd/containerd/api/services/containers/v1", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/api/services/tasks/v1", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/api/services/version/v1", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/api/types", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/api/types/task", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/containers", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/dialer", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/errdefs", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { "ImportPath": "github.com/containerd/containerd/namespaces", - "Comment": "v1.0.0-beta.2-159-g27d450a", + "Comment": "v1.0.0-beta.2-159-g27d450a0", "Rev": "27d450a01bb533d7ebc5701eb52792565396b084" }, { @@ -1006,147 +1006,147 @@ }, { "ImportPath": "github.com/docker/distribution/digestset", - "Comment": "v2.6.0-rc.1-209-gedc3ab2", + "Comment": "v2.6.0-rc.1-209-gedc3ab29", "Rev": "edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c" }, { "ImportPath": "github.com/docker/distribution/reference", - "Comment": "v2.6.0-rc.1-209-gedc3ab2", + "Comment": "v2.6.0-rc.1-209-gedc3ab29", "Rev": "edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c" }, { "ImportPath": "github.com/docker/docker/api", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/blkiodev", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/container", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/events", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/filters", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/image", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/mount", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/network", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/registry", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/strslice", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/swarm", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/swarm/runtime", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/time", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/versions", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/api/types/volume", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/client", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/ioutils", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/jsonlog", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/jsonmessage", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/longpath", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/mount", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/stdcopy", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/system", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/term", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/term/windows", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { "ImportPath": "github.com/docker/docker/pkg/tlsconfig", - "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616f", + "Comment": "docs-v1.12.0-rc4-2016-07-15-7401-g4f3616fb1", "Rev": "4f3616fb1c112e206b88cb7a9922bf49067a7756" }, { @@ -1171,7 +1171,7 @@ }, { "ImportPath": "github.com/docker/libnetwork/ipvs", - "Comment": "v0.8.0-dev.2-910-gba46b92", + "Comment": "v0.8.0-dev.2-910-gba46b928", "Rev": "ba46b928444931e6865d8618dc03622cac79aa6f" }, { @@ -1298,132 +1298,132 @@ }, { "ImportPath": "github.com/gogo/protobuf/gogoproto", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/compare", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/defaultcheck", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/description", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/embedcheck", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/enumstringer", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/equal", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/face", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/gostring", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/marshalto", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/oneofcheck", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/populate", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/size", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/stringer", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/testgen", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/union", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/plugin/unmarshal", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/proto", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/protoc-gen-gogo/descriptor", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/protoc-gen-gogo/generator", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/protoc-gen-gogo/grpc", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/protoc-gen-gogo/plugin", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/sortkeys", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/types", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/vanity", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { "ImportPath": "github.com/gogo/protobuf/vanity/command", - "Comment": "v0.4-3-gc0656ed", + "Comment": "v0.4-3-gc0656edd", "Rev": "c0656edd0d9eab7c66d1eb0c568f9039345796f7" }, { @@ -1480,217 +1480,217 @@ }, { "ImportPath": "github.com/google/cadvisor/accelerators", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/api", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/cache/memory", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/client/v2", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/collector", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/common", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/containerd", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/crio", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/docker", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/libcontainer", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/raw", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/rkt", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/container/systemd", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/devicemapper", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/events", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/fs", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/healthz", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/http", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/http/mux", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/info/v1", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/info/v2", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/machine", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/manager", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/manager/watcher", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/manager/watcher/raw", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/manager/watcher/rkt", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/metrics", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/pages", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/pages/static", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/storage", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/summary", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/cloudinfo", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/cpuload", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/cpuload/netlink", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/docker", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/oomparser", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/sysfs", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/utils/sysinfo", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/validate", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/version", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { "ImportPath": "github.com/google/cadvisor/zfs", - "Comment": "v0.24.0-alpha1-322-g13d955d", + "Comment": "v0.28.3-7-g13d955d6", "Rev": "13d955d6a9faa2f70387354ff17df3d614a6c37b" }, { @@ -2349,82 +2349,82 @@ }, { "ImportPath": "github.com/opencontainers/runc/libcontainer", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/apparmor", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/cgroups", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/cgroups/fs", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/cgroups/systemd", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/configs", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/configs/validate", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/criurpc", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/intelrdt", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/keys", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/mount", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/seccomp", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/stacktrace", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/system", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/user", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { "ImportPath": "github.com/opencontainers/runc/libcontainer/utils", - "Comment": "v1.0.0-rc4-197-gd5b4a3e", + "Comment": "v1.0.0-rc4-197-gd5b4a3ed", "Rev": "d5b4a3eddbe4c890843da971b64f45a0f023f4db" }, { @@ -2573,10 +2573,12 @@ }, { "ImportPath": "github.com/spf13/cobra", + "Comment": "v0.0.1-10-g19e54c4", "Rev": "19e54c4a2b8a78c9d54b2bed61b1a6c5e1bfcf6f" }, { "ImportPath": "github.com/spf13/cobra/doc", + "Comment": "v0.0.1-10-g19e54c4", "Rev": "19e54c4a2b8a78c9d54b2bed61b1a6c5e1bfcf6f" }, { @@ -2585,6 +2587,7 @@ }, { "ImportPath": "github.com/spf13/pflag", + "Comment": "v1.0.0-10-g4c012f6", "Rev": "4c012f6dcd9546820e378d0bdda4d8fc772cdfea" }, { @@ -3191,6 +3194,11 @@ "Comment": "v2.1.3", "Rev": "f8f38de21b4dcd69d0413faf231983f5fd6634b1" }, + { + "ImportPath": "gopkg.in/square/go-jose.v2/jwt", + "Comment": "v2.1.3", + "Rev": "f8f38de21b4dcd69d0413faf231983f5fd6634b1" + }, { "ImportPath": "gopkg.in/warnings.v0", "Comment": "v0.1.1", diff --git a/Godeps/LICENSES b/Godeps/LICENSES index 11656b1d0b6..d6b69a99c67 100644 --- a/Godeps/LICENSES +++ b/Godeps/LICENSES @@ -95955,6 +95955,216 @@ SOFTWARE. ================================================================================ +================================================================================ += vendor/gopkg.in/square/go-jose.v2/jwt licensed under: = + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + += vendor/gopkg.in/square/go-jose.v2/LICENSE 3b83ef96387f14655fc854ddc3c6bd57 +================================================================================ + + ================================================================================ = vendor/gopkg.in/warnings.v0 licensed under: = diff --git a/pkg/serviceaccount/BUILD b/pkg/serviceaccount/BUILD index afafa2849d9..d3f44c72350 100644 --- a/pkg/serviceaccount/BUILD +++ b/pkg/serviceaccount/BUILD @@ -15,9 +15,11 @@ go_library( importpath = "k8s.io/kubernetes/pkg/serviceaccount", deps = [ "//pkg/apis/core:go_default_library", - "//vendor/github.com/dgrijalva/jwt-go:go_default_library", "//vendor/github.com/golang/glog:go_default_library", + "//vendor/gopkg.in/square/go-jose.v2:go_default_library", + "//vendor/gopkg.in/square/go-jose.v2/jwt:go_default_library", "//vendor/k8s.io/api/core/v1:go_default_library", + "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library", "//vendor/k8s.io/apiserver/pkg/authentication/authenticator:go_default_library", "//vendor/k8s.io/apiserver/pkg/authentication/serviceaccount:go_default_library", "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library", diff --git a/pkg/serviceaccount/jwt.go b/pkg/serviceaccount/jwt.go index fc380e33a87..9b6dd838522 100644 --- a/pkg/serviceaccount/jwt.go +++ b/pkg/serviceaccount/jwt.go @@ -25,24 +25,24 @@ import ( "fmt" "k8s.io/api/core/v1" + utilerrors "k8s.io/apimachinery/pkg/util/errors" "k8s.io/apiserver/pkg/authentication/authenticator" apiserverserviceaccount "k8s.io/apiserver/pkg/authentication/serviceaccount" "k8s.io/apiserver/pkg/authentication/user" - jwt "github.com/dgrijalva/jwt-go" "github.com/golang/glog" + jose "gopkg.in/square/go-jose.v2" + "gopkg.in/square/go-jose.v2/jwt" ) -const ( - Issuer = "kubernetes/serviceaccount" +const Issuer = "kubernetes/serviceaccount" - SubjectClaim = "sub" - IssuerClaim = "iss" - ServiceAccountNameClaim = "kubernetes.io/serviceaccount/service-account.name" - ServiceAccountUIDClaim = "kubernetes.io/serviceaccount/service-account.uid" - SecretNameClaim = "kubernetes.io/serviceaccount/secret.name" - NamespaceClaim = "kubernetes.io/serviceaccount/namespace" -) +type privateClaims struct { + ServiceAccountName string `json:"kubernetes.io/serviceaccount/service-account.name"` + ServiceAccountUID string `json:"kubernetes.io/serviceaccount/service-account.uid"` + SecretName string `json:"kubernetes.io/serviceaccount/secret.name"` + Namespace string `json:"kubernetes.io/serviceaccount/namespace"` +} // ServiceAccountTokenGetter defines functions to retrieve a named service account and secret type ServiceAccountTokenGetter interface { @@ -68,18 +68,18 @@ type jwtTokenGenerator struct { } func (j *jwtTokenGenerator) GenerateToken(serviceAccount v1.ServiceAccount, secret v1.Secret) (string, error) { - var method jwt.SigningMethod + var alg jose.SignatureAlgorithm switch privateKey := j.privateKey.(type) { case *rsa.PrivateKey: - method = jwt.SigningMethodRS256 + alg = jose.RS256 case *ecdsa.PrivateKey: switch privateKey.Curve { case elliptic.P256(): - method = jwt.SigningMethodES256 + alg = jose.ES256 case elliptic.P384(): - method = jwt.SigningMethodES384 + alg = jose.ES384 case elliptic.P521(): - method = jwt.SigningMethodES512 + alg = jose.ES512 default: return "", fmt.Errorf("unknown private key curve, must be 256, 384, or 521") } @@ -87,24 +87,28 @@ func (j *jwtTokenGenerator) GenerateToken(serviceAccount v1.ServiceAccount, secr return "", fmt.Errorf("unknown private key type %T, must be *rsa.PrivateKey or *ecdsa.PrivateKey", j.privateKey) } - token := jwt.New(method) + signer, err := jose.NewSigner( + jose.SigningKey{ + Algorithm: alg, + Key: j.privateKey, + }, + nil, + ) + if err != nil { + return "", err + } - claims, _ := token.Claims.(jwt.MapClaims) - - // Identify the issuer - claims[IssuerClaim] = Issuer - - // Username - claims[SubjectClaim] = apiserverserviceaccount.MakeUsername(serviceAccount.Namespace, serviceAccount.Name) - - // Persist enough structured info for the authenticator to be able to look up the service account and secret - claims[NamespaceClaim] = serviceAccount.Namespace - claims[ServiceAccountNameClaim] = serviceAccount.Name - claims[ServiceAccountUIDClaim] = serviceAccount.UID - claims[SecretNameClaim] = secret.Name - - // Sign and get the complete encoded token as a string - return token.SignedString(j.privateKey) + return jwt.Signed(signer). + Claims(&jwt.Claims{ + Issuer: Issuer, + Subject: apiserverserviceaccount.MakeUsername(serviceAccount.Namespace, serviceAccount.Name), + }). + Claims(&privateClaims{ + Namespace: serviceAccount.Namespace, + ServiceAccountName: serviceAccount.Name, + ServiceAccountUID: string(serviceAccount.UID), + SecretName: secret.Name, + }).CompactSerialize() } // JWTTokenAuthenticator authenticates tokens as JWT tokens produced by JWTTokenGenerator @@ -122,129 +126,106 @@ type jwtTokenAuthenticator struct { var errMismatchedSigningMethod = errors.New("invalid signing method") -func (j *jwtTokenAuthenticator) AuthenticateToken(token string) (user.Info, bool, error) { - var validationError error - - for i, key := range j.keys { - // Attempt to verify with each key until we find one that works - parsedToken, err := jwt.Parse(token, func(token *jwt.Token) (interface{}, error) { - switch token.Method.(type) { - case *jwt.SigningMethodRSA: - if _, ok := key.(*rsa.PublicKey); ok { - return key, nil - } - return nil, errMismatchedSigningMethod - case *jwt.SigningMethodECDSA: - if _, ok := key.(*ecdsa.PublicKey); ok { - return key, nil - } - return nil, errMismatchedSigningMethod - default: - return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"]) - } - }) - - if err != nil { - switch err := err.(type) { - case *jwt.ValidationError: - if (err.Errors & jwt.ValidationErrorMalformed) != 0 { - // Not a JWT, no point in continuing - return nil, false, nil - } - - if (err.Errors & jwt.ValidationErrorSignatureInvalid) != 0 { - // Signature error, perhaps one of the other keys will verify the signature - // If not, we want to return this error - glog.V(4).Infof("Signature error (key %d): %v", i, err) - validationError = err - continue - } - - // This key doesn't apply to the given signature type - // Perhaps one of the other keys will verify the signature - // If not, we want to return this error - if err.Inner == errMismatchedSigningMethod { - glog.V(4).Infof("Mismatched key type (key %d): %v", i, err) - validationError = err - continue - } - } - - // Other errors should just return as errors - return nil, false, err - } - - // If we get here, we have a token with a recognized signature - - claims, _ := parsedToken.Claims.(jwt.MapClaims) - - // Make sure we issued the token - iss, _ := claims[IssuerClaim].(string) - if iss != Issuer { - return nil, false, nil - } - - // Make sure the claims we need exist - sub, _ := claims[SubjectClaim].(string) - if len(sub) == 0 { - return nil, false, errors.New("sub claim is missing") - } - namespace, _ := claims[NamespaceClaim].(string) - if len(namespace) == 0 { - return nil, false, errors.New("namespace claim is missing") - } - secretName, _ := claims[SecretNameClaim].(string) - if len(secretName) == 0 { - return nil, false, errors.New("secretName claim is missing") - } - serviceAccountName, _ := claims[ServiceAccountNameClaim].(string) - if len(serviceAccountName) == 0 { - return nil, false, errors.New("serviceAccountName claim is missing") - } - serviceAccountUID, _ := claims[ServiceAccountUIDClaim].(string) - if len(serviceAccountUID) == 0 { - return nil, false, errors.New("serviceAccountUID claim is missing") - } - - subjectNamespace, subjectName, err := apiserverserviceaccount.SplitUsername(sub) - if err != nil || subjectNamespace != namespace || subjectName != serviceAccountName { - return nil, false, errors.New("sub claim is invalid") - } - - if j.lookup { - // Make sure token hasn't been invalidated by deletion of the secret - secret, err := j.getter.GetSecret(namespace, secretName) - if err != nil { - glog.V(4).Infof("Could not retrieve token %s/%s for service account %s/%s: %v", namespace, secretName, namespace, serviceAccountName, err) - return nil, false, errors.New("Token has been invalidated") - } - if secret.DeletionTimestamp != nil { - glog.V(4).Infof("Token is deleted and awaiting removal: %s/%s for service account %s/%s", namespace, secretName, namespace, serviceAccountName) - return nil, false, errors.New("Token has been invalidated") - } - if bytes.Compare(secret.Data[v1.ServiceAccountTokenKey], []byte(token)) != 0 { - glog.V(4).Infof("Token contents no longer matches %s/%s for service account %s/%s", namespace, secretName, namespace, serviceAccountName) - return nil, false, errors.New("Token does not match server's copy") - } - - // Make sure service account still exists (name and UID) - serviceAccount, err := j.getter.GetServiceAccount(namespace, serviceAccountName) - if err != nil { - glog.V(4).Infof("Could not retrieve service account %s/%s: %v", namespace, serviceAccountName, err) - return nil, false, err - } - if serviceAccount.DeletionTimestamp != nil { - glog.V(4).Infof("Service account has been deleted %s/%s", namespace, serviceAccountName) - return nil, false, fmt.Errorf("ServiceAccount %s/%s has been deleted", namespace, serviceAccountName) - } - if string(serviceAccount.UID) != serviceAccountUID { - glog.V(4).Infof("Service account UID no longer matches %s/%s: %q != %q", namespace, serviceAccountName, string(serviceAccount.UID), serviceAccountUID) - return nil, false, fmt.Errorf("ServiceAccount UID (%s) does not match claim (%s)", serviceAccount.UID, serviceAccountUID) - } - } - - return UserInfo(namespace, serviceAccountName, serviceAccountUID), true, nil +func (j *jwtTokenAuthenticator) AuthenticateToken(tokenData string) (user.Info, bool, error) { + tok, err := jwt.ParseSigned(tokenData) + if err != nil { + return nil, false, nil } - return nil, false, validationError + public := &jwt.Claims{} + private := &privateClaims{} + + var ( + found bool + errlist []error + ) + for _, key := range j.keys { + if err := tok.Claims(key, public, private); err != nil { + errlist = append(errlist, err) + continue + } + found = true + break + } + + if !found { + return nil, false, utilerrors.NewAggregate(errlist) + } + + // If we get here, we have a token with a recognized signature + + // Make sure we issued the token + if public.Issuer != Issuer { + return nil, false, nil + } + + if err := j.Validate(tokenData, public, private); err != nil { + return nil, false, err + } + + return UserInfo(private.Namespace, private.ServiceAccountName, private.ServiceAccountUID), true, nil + +} + +func (j *jwtTokenAuthenticator) Validate(tokenData string, public *jwt.Claims, private *privateClaims) error { + + // Make sure the claims we need exist + if len(public.Subject) == 0 { + return errors.New("sub claim is missing") + } + namespace := private.Namespace + if len(namespace) == 0 { + return errors.New("namespace claim is missing") + } + secretName := private.SecretName + if len(secretName) == 0 { + return errors.New("secretName claim is missing") + } + serviceAccountName := private.ServiceAccountName + if len(serviceAccountName) == 0 { + return errors.New("serviceAccountName claim is missing") + } + serviceAccountUID := private.ServiceAccountUID + if len(serviceAccountUID) == 0 { + return errors.New("serviceAccountUID claim is missing") + } + + subjectNamespace, subjectName, err := apiserverserviceaccount.SplitUsername(public.Subject) + if err != nil || subjectNamespace != namespace || subjectName != serviceAccountName { + return errors.New("sub claim is invalid") + } + + if j.lookup { + // Make sure token hasn't been invalidated by deletion of the secret + secret, err := j.getter.GetSecret(namespace, secretName) + if err != nil { + glog.V(4).Infof("Could not retrieve token %s/%s for service account %s/%s: %v", namespace, secretName, namespace, serviceAccountName, err) + return errors.New("Token has been invalidated") + } + if secret.DeletionTimestamp != nil { + glog.V(4).Infof("Token is deleted and awaiting removal: %s/%s for service account %s/%s", namespace, secretName, namespace, serviceAccountName) + return errors.New("Token has been invalidated") + } + if bytes.Compare(secret.Data[v1.ServiceAccountTokenKey], []byte(tokenData)) != 0 { + glog.V(4).Infof("Token contents no longer matches %s/%s for service account %s/%s", namespace, secretName, namespace, serviceAccountName) + return errors.New("Token does not match server's copy") + } + + // Make sure service account still exists (name and UID) + serviceAccount, err := j.getter.GetServiceAccount(namespace, serviceAccountName) + if err != nil { + glog.V(4).Infof("Could not retrieve service account %s/%s: %v", namespace, serviceAccountName, err) + return err + } + if serviceAccount.DeletionTimestamp != nil { + glog.V(4).Infof("Service account has been deleted %s/%s", namespace, serviceAccountName) + return fmt.Errorf("ServiceAccount %s/%s has been deleted", namespace, serviceAccountName) + } + if string(serviceAccount.UID) != serviceAccountUID { + glog.V(4).Infof("Service account UID no longer matches %s/%s: %q != %q", namespace, serviceAccountName, string(serviceAccount.UID), serviceAccountUID) + return fmt.Errorf("ServiceAccount UID (%s) does not match claim (%s)", serviceAccount.UID, serviceAccountUID) + } + } + + return nil } diff --git a/vendor/gopkg.in/square/go-jose.v2/BUILD b/vendor/gopkg.in/square/go-jose.v2/BUILD index f5a1e7efa6f..1afbd8278d3 100644 --- a/vendor/gopkg.in/square/go-jose.v2/BUILD +++ b/vendor/gopkg.in/square/go-jose.v2/BUILD @@ -36,6 +36,7 @@ filegroup( ":package-srcs", "//vendor/gopkg.in/square/go-jose.v2/cipher:all-srcs", "//vendor/gopkg.in/square/go-jose.v2/json:all-srcs", + "//vendor/gopkg.in/square/go-jose.v2/jwt:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/BUILD b/vendor/gopkg.in/square/go-jose.v2/jwt/BUILD new file mode 100644 index 00000000000..148a4186b41 --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/BUILD @@ -0,0 +1,33 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = [ + "builder.go", + "claims.go", + "doc.go", + "errors.go", + "jwt.go", + "validation.go", + ], + importpath = "gopkg.in/square/go-jose.v2/jwt", + visibility = ["//visibility:public"], + deps = [ + "//vendor/gopkg.in/square/go-jose.v2:go_default_library", + "//vendor/gopkg.in/square/go-jose.v2/json:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/builder.go b/vendor/gopkg.in/square/go-jose.v2/jwt/builder.go new file mode 100644 index 00000000000..686ec80a4bb --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/builder.go @@ -0,0 +1,334 @@ +/*- + * Copyright 2016 Zbigniew Mandziejewicz + * Copyright 2016 Square, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package jwt + +import ( + "bytes" + "reflect" + + "gopkg.in/square/go-jose.v2/json" + + "gopkg.in/square/go-jose.v2" +) + +// Builder is a utility for making JSON Web Tokens. Calls can be chained, and +// errors are accumulated until the final call to CompactSerialize/FullSerialize. +type Builder interface { + // Claims encodes claims into JWE/JWS form. Multiple calls will merge claims + // into single JSON object. If you are passing private claims, make sure to set + // struct field tags to specify the name for the JSON key to be used when + // serializing. + Claims(i interface{}) Builder + // Token builds a JSONWebToken from provided data. + Token() (*JSONWebToken, error) + // FullSerialize serializes a token using the full serialization format. + FullSerialize() (string, error) + // CompactSerialize serializes a token using the compact serialization format. + CompactSerialize() (string, error) +} + +// NestedBuilder is a utility for making Signed-Then-Encrypted JSON Web Tokens. +// Calls can be chained, and errors are accumulated until final call to +// CompactSerialize/FullSerialize. +type NestedBuilder interface { + // Claims encodes claims into JWE/JWS form. Multiple calls will merge claims + // into single JSON object. If you are passing private claims, make sure to set + // struct field tags to specify the name for the JSON key to be used when + // serializing. + Claims(i interface{}) NestedBuilder + // Token builds a NestedJSONWebToken from provided data. + Token() (*NestedJSONWebToken, error) + // FullSerialize serializes a token using the full serialization format. + FullSerialize() (string, error) + // CompactSerialize serializes a token using the compact serialization format. + CompactSerialize() (string, error) +} + +type builder struct { + payload map[string]interface{} + err error +} + +type signedBuilder struct { + builder + sig jose.Signer +} + +type encryptedBuilder struct { + builder + enc jose.Encrypter +} + +type nestedBuilder struct { + builder + sig jose.Signer + enc jose.Encrypter +} + +// Signed creates builder for signed tokens. +func Signed(sig jose.Signer) Builder { + return &signedBuilder{ + sig: sig, + } +} + +// Encrypted creates builder for encrypted tokens. +func Encrypted(enc jose.Encrypter) Builder { + return &encryptedBuilder{ + enc: enc, + } +} + +// SignedAndEncrypted creates builder for signed-then-encrypted tokens. +// ErrInvalidContentType will be returned if encrypter doesn't have JWT content type. +func SignedAndEncrypted(sig jose.Signer, enc jose.Encrypter) NestedBuilder { + if contentType, _ := enc.Options().ExtraHeaders[jose.HeaderContentType].(jose.ContentType); contentType != "JWT" { + return &nestedBuilder{ + builder: builder{ + err: ErrInvalidContentType, + }, + } + } + return &nestedBuilder{ + sig: sig, + enc: enc, + } +} + +func (b builder) claims(i interface{}) builder { + if b.err != nil { + return b + } + + m, ok := i.(map[string]interface{}) + switch { + case ok: + return b.merge(m) + case reflect.Indirect(reflect.ValueOf(i)).Kind() == reflect.Struct: + m, err := normalize(i) + if err != nil { + return builder{ + err: err, + } + } + return b.merge(m) + default: + return builder{ + err: ErrInvalidClaims, + } + } +} + +func normalize(i interface{}) (map[string]interface{}, error) { + m := make(map[string]interface{}) + + raw, err := json.Marshal(i) + if err != nil { + return nil, err + } + + d := json.NewDecoder(bytes.NewReader(raw)) + d.UseNumber() + + if err := d.Decode(&m); err != nil { + return nil, err + } + + return m, nil +} + +func (b *builder) merge(m map[string]interface{}) builder { + p := make(map[string]interface{}) + for k, v := range b.payload { + p[k] = v + } + for k, v := range m { + p[k] = v + } + + return builder{ + payload: p, + } +} + +func (b *builder) token(p func(interface{}) ([]byte, error), h []jose.Header) (*JSONWebToken, error) { + return &JSONWebToken{ + payload: p, + Headers: h, + }, nil +} + +func (b *signedBuilder) Claims(i interface{}) Builder { + return &signedBuilder{ + builder: b.builder.claims(i), + sig: b.sig, + } +} + +func (b *signedBuilder) Token() (*JSONWebToken, error) { + sig, err := b.sign() + if err != nil { + return nil, err + } + + h := make([]jose.Header, len(sig.Signatures)) + for i, v := range sig.Signatures { + h[i] = v.Header + } + + return b.builder.token(sig.Verify, h) +} + +func (b *signedBuilder) CompactSerialize() (string, error) { + sig, err := b.sign() + if err != nil { + return "", err + } + + return sig.CompactSerialize() +} + +func (b *signedBuilder) FullSerialize() (string, error) { + sig, err := b.sign() + if err != nil { + return "", err + } + + return sig.FullSerialize(), nil +} + +func (b *signedBuilder) sign() (*jose.JSONWebSignature, error) { + if b.err != nil { + return nil, b.err + } + + p, err := json.Marshal(b.payload) + if err != nil { + return nil, err + } + + return b.sig.Sign(p) +} + +func (b *encryptedBuilder) Claims(i interface{}) Builder { + return &encryptedBuilder{ + builder: b.builder.claims(i), + enc: b.enc, + } +} + +func (b *encryptedBuilder) CompactSerialize() (string, error) { + enc, err := b.encrypt() + if err != nil { + return "", err + } + + return enc.CompactSerialize() +} + +func (b *encryptedBuilder) FullSerialize() (string, error) { + enc, err := b.encrypt() + if err != nil { + return "", err + } + + return enc.FullSerialize(), nil +} + +func (b *encryptedBuilder) Token() (*JSONWebToken, error) { + enc, err := b.encrypt() + if err != nil { + return nil, err + } + + return b.builder.token(enc.Decrypt, []jose.Header{enc.Header}) +} + +func (b *encryptedBuilder) encrypt() (*jose.JSONWebEncryption, error) { + if b.err != nil { + return nil, b.err + } + + p, err := json.Marshal(b.payload) + if err != nil { + return nil, err + } + + return b.enc.Encrypt(p) +} + +func (b *nestedBuilder) Claims(i interface{}) NestedBuilder { + return &nestedBuilder{ + builder: b.builder.claims(i), + sig: b.sig, + enc: b.enc, + } +} + +func (b *nestedBuilder) Token() (*NestedJSONWebToken, error) { + enc, err := b.signAndEncrypt() + if err != nil { + return nil, err + } + + return &NestedJSONWebToken{ + enc: enc, + Headers: []jose.Header{enc.Header}, + }, nil +} + +func (b *nestedBuilder) CompactSerialize() (string, error) { + enc, err := b.signAndEncrypt() + if err != nil { + return "", err + } + + return enc.CompactSerialize() +} + +func (b *nestedBuilder) FullSerialize() (string, error) { + enc, err := b.signAndEncrypt() + if err != nil { + return "", err + } + + return enc.FullSerialize(), nil +} + +func (b *nestedBuilder) signAndEncrypt() (*jose.JSONWebEncryption, error) { + if b.err != nil { + return nil, b.err + } + + p, err := json.Marshal(b.payload) + if err != nil { + return nil, err + } + + sig, err := b.sig.Sign(p) + if err != nil { + return nil, err + } + + p2, err := sig.CompactSerialize() + if err != nil { + return nil, err + } + + return b.enc.Encrypt([]byte(p2)) +} diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/claims.go b/vendor/gopkg.in/square/go-jose.v2/jwt/claims.go new file mode 100644 index 00000000000..60de940020b --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/claims.go @@ -0,0 +1,115 @@ +/*- + * Copyright 2016 Zbigniew Mandziejewicz + * Copyright 2016 Square, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package jwt + +import ( + "encoding/json" + "strconv" + "time" +) + +// Claims represents public claim values (as specified in RFC 7519). +type Claims struct { + Issuer string `json:"iss,omitempty"` + Subject string `json:"sub,omitempty"` + Audience Audience `json:"aud,omitempty"` + Expiry NumericDate `json:"exp,omitempty"` + NotBefore NumericDate `json:"nbf,omitempty"` + IssuedAt NumericDate `json:"iat,omitempty"` + ID string `json:"jti,omitempty"` +} + +// NumericDate represents date and time as the number of seconds since the +// epoch, including leap seconds. Non-integer values can be represented +// in the serialized format, but we round to the nearest second. +type NumericDate int64 + +// NewNumericDate constructs NumericDate from time.Time value. +func NewNumericDate(t time.Time) NumericDate { + if t.IsZero() { + return NumericDate(0) + } + + // While RFC 7519 technically states that NumericDate values may be + // non-integer values, we don't bother serializing timestamps in + // claims with sub-second accurancy and just round to the nearest + // second instead. Not convined sub-second accuracy is useful here. + return NumericDate(t.Unix()) +} + +// MarshalJSON serializes the given NumericDate into its JSON representation. +func (n NumericDate) MarshalJSON() ([]byte, error) { + return []byte(strconv.FormatInt(int64(n), 10)), nil +} + +// UnmarshalJSON reads a date from its JSON representation. +func (n *NumericDate) UnmarshalJSON(b []byte) error { + s := string(b) + + f, err := strconv.ParseFloat(s, 64) + if err != nil { + return ErrUnmarshalNumericDate + } + + *n = NumericDate(f) + return nil +} + +// Time returns time.Time representation of NumericDate. +func (n NumericDate) Time() time.Time { + return time.Unix(int64(n), 0) +} + +// Audience represents the recipents that the token is intended for. +type Audience []string + +// UnmarshalJSON reads an audience from its JSON representation. +func (s *Audience) UnmarshalJSON(b []byte) error { + var v interface{} + if err := json.Unmarshal(b, &v); err != nil { + return err + } + + switch v := v.(type) { + case string: + *s = []string{v} + case []interface{}: + a := make([]string, len(v)) + for i, e := range v { + s, ok := e.(string) + if !ok { + return ErrUnmarshalAudience + } + a[i] = s + } + *s = a + default: + return ErrUnmarshalAudience + } + + return nil +} + +func (s Audience) Contains(v string) bool { + for _, a := range s { + if a == v { + return true + } + } + return false +} diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/doc.go b/vendor/gopkg.in/square/go-jose.v2/jwt/doc.go new file mode 100644 index 00000000000..4cf97b54e78 --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/doc.go @@ -0,0 +1,22 @@ +/*- + * Copyright 2017 Square Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + +Package jwt provides an implementation of the JSON Web Token standard. + +*/ +package jwt diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/errors.go b/vendor/gopkg.in/square/go-jose.v2/jwt/errors.go new file mode 100644 index 00000000000..6507dfb28e8 --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/errors.go @@ -0,0 +1,50 @@ +/*- + * Copyright 2016 Zbigniew Mandziejewicz + * Copyright 2016 Square, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package jwt + +import "errors" + +// ErrUnmarshalAudience indicates that aud claim could not be unmarshalled. +var ErrUnmarshalAudience = errors.New("square/go-jose/jwt: expected string or array value to unmarshal to Audience") + +// ErrUnmarshalNumericDate indicates that JWT NumericDate could not be unmarshalled. +var ErrUnmarshalNumericDate = errors.New("square/go-jose/jwt: expected number value to unmarshal NumericDate") + +// ErrInvalidClaims indicates that given claims have invalid type. +var ErrInvalidClaims = errors.New("square/go-jose/jwt: expected claims to be value convertible into JSON object") + +// ErrInvalidIssuer indicates invalid iss claim. +var ErrInvalidIssuer = errors.New("square/go-jose/jwt: validation failed, invalid issuer claim (iss)") + +// ErrInvalidSubject indicates invalid sub claim. +var ErrInvalidSubject = errors.New("square/go-jose/jwt: validation failed, invalid subject claim (sub)") + +// ErrInvalidAudience indicated invalid aud claim. +var ErrInvalidAudience = errors.New("square/go-jose/jwt: validation failed, invalid audience claim (aud)") + +// ErrInvalidID indicates invalid jti claim. +var ErrInvalidID = errors.New("square/go-jose/jwt: validation failed, invalid ID claim (jti)") + +// ErrNotValidYet indicates that token is used before time indicated in nbf claim. +var ErrNotValidYet = errors.New("square/go-jose/jwt: validation failed, token not valid yet (nbf)") + +// ErrExpired indicates that token is used after expiry time indicated in exp claim. +var ErrExpired = errors.New("square/go-jose/jwt: validation failed, token is expired (exp)") + +// ErrInvalidContentType indicated that token requires JWT cty header. +var ErrInvalidContentType = errors.New("square/go-jose/jwt: expected content type to be JWT (cty header)") diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go b/vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go new file mode 100644 index 00000000000..2155b2d274d --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go @@ -0,0 +1,113 @@ +/*- + * Copyright 2016 Zbigniew Mandziejewicz + * Copyright 2016 Square, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package jwt + +import ( + "gopkg.in/square/go-jose.v2" + "gopkg.in/square/go-jose.v2/json" + "strings" +) + +// JSONWebToken represents a JSON Web Token (as specified in RFC7519). +type JSONWebToken struct { + payload func(k interface{}) ([]byte, error) + Headers []jose.Header +} + +type NestedJSONWebToken struct { + enc *jose.JSONWebEncryption + Headers []jose.Header +} + +// Claims deserializes a JSONWebToken into dest using the provided key. +func (t *JSONWebToken) Claims(key interface{}, dest ...interface{}) error { + b, err := t.payload(key) + if err != nil { + return err + } + + for _, d := range dest { + if err := json.Unmarshal(b, d); err != nil { + return err + } + } + + return nil +} + +func (t *NestedJSONWebToken) Decrypt(decryptionKey interface{}) (*JSONWebToken, error) { + b, err := t.enc.Decrypt(decryptionKey) + if err != nil { + return nil, err + } + + sig, err := ParseSigned(string(b)) + if err != nil { + return nil, err + } + + return sig, nil +} + +// ParseSigned parses token from JWS form. +func ParseSigned(s string) (*JSONWebToken, error) { + sig, err := jose.ParseSigned(s) + if err != nil { + return nil, err + } + headers := make([]jose.Header, len(sig.Signatures)) + for i, signature := range sig.Signatures { + headers[i] = signature.Header + } + + return &JSONWebToken{ + payload: sig.Verify, + Headers: headers, + }, nil +} + +// ParseEncrypted parses token from JWE form. +func ParseEncrypted(s string) (*JSONWebToken, error) { + enc, err := jose.ParseEncrypted(s) + if err != nil { + return nil, err + } + + return &JSONWebToken{ + payload: enc.Decrypt, + Headers: []jose.Header{enc.Header}, + }, nil +} + +// ParseSignedAndEncrypted parses signed-then-encrypted token from JWE form. +func ParseSignedAndEncrypted(s string) (*NestedJSONWebToken, error) { + enc, err := jose.ParseEncrypted(s) + if err != nil { + return nil, err + } + + contentType, _ := enc.Header.ExtraHeaders[jose.HeaderContentType].(string) + if strings.ToUpper(contentType) != "JWT" { + return nil, ErrInvalidContentType + } + + return &NestedJSONWebToken{ + enc: enc, + Headers: []jose.Header{enc.Header}, + }, nil +} diff --git a/vendor/gopkg.in/square/go-jose.v2/jwt/validation.go b/vendor/gopkg.in/square/go-jose.v2/jwt/validation.go new file mode 100644 index 00000000000..fdcee371b1d --- /dev/null +++ b/vendor/gopkg.in/square/go-jose.v2/jwt/validation.go @@ -0,0 +1,89 @@ +/*- + * Copyright 2016 Zbigniew Mandziejewicz + * Copyright 2016 Square, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package jwt + +import "time" + +const ( + // DefaultLeeway defines the default leeway for matching NotBefore/Expiry claims. + DefaultLeeway = 1.0 * time.Minute +) + +// Expected defines values used for protected claims validation. +// If field has zero value then validation is skipped. +type Expected struct { + // Issuer matches the "iss" claim exactly. + Issuer string + // Subject matches the "sub" claim exactly. + Subject string + // Audience matches the values in "aud" claim, regardless of their order. + Audience Audience + // ID matches the "jti" claim exactly. + ID string + // Time matches the "exp" and "ebf" claims with leeway. + Time time.Time +} + +// WithTime copies expectations with new time. +func (e Expected) WithTime(t time.Time) Expected { + e.Time = t + return e +} + +// Validate checks claims in a token against expected values. +// A default leeway value of one minute is used to compare time values. +func (c Claims) Validate(e Expected) error { + return c.ValidateWithLeeway(e, DefaultLeeway) +} + +// ValidateWithLeeway checks claims in a token against expected values. A +// custom leeway may be specified for comparing time values. You may pass a +// zero value to check time values with no leeway, but you should not that +// numeric date values are rounded to the nearest second and sub-second +// precision is not supported. +func (c Claims) ValidateWithLeeway(e Expected, leeway time.Duration) error { + if e.Issuer != "" && e.Issuer != c.Issuer { + return ErrInvalidIssuer + } + + if e.Subject != "" && e.Subject != c.Subject { + return ErrInvalidSubject + } + + if e.ID != "" && e.ID != c.ID { + return ErrInvalidID + } + + if len(e.Audience) != 0 { + for _, v := range e.Audience { + if !c.Audience.Contains(v) { + return ErrInvalidAudience + } + } + } + + if !e.Time.IsZero() && e.Time.Add(leeway).Before(c.NotBefore.Time()) { + return ErrNotValidYet + } + + if !e.Time.IsZero() && e.Time.Add(-leeway).After(c.Expiry.Time()) { + return ErrExpired + } + + return nil +}