build(deps): bump github.com/containers/image/v5 from 5.0.0 to 5.1.0

Bumps [github.com/containers/image/v5](https://github.com/containers/image) from 5.0.0 to 5.1.0.
- [Release notes](https://github.com/containers/image/releases)
- [Commits](https://github.com/containers/image/compare/v5.0.0...v5.1.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

vendor/github.com/containers/ocicrypt/MAINTAINERS

@@ -0,0 +1,5 @@
+# ocicrypt maintainers
+#
+# Github ID, Name, Email Address
+lumjjb, Brandon Lum, lumjjb@gmail.com
+stefanberger, Stefan Berger, stefanb@linux.ibm.com

vendor/github.com/containers/ocicrypt/Makefile

@@ -0,0 +1,31 @@
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+.PHONY: check build decoder
+
+all: build
+
+FORCE:
+
+check:
+	golangci-lint run
+
+build: vendor
+	go build ./...
+
+vendor:
+	go mod tidy
+
+test:
+	go test ./...

vendor/github.com/containers/ocicrypt/README.md

@@ -0,0 +1,32 @@
+# OCIcrypt Library
+
+The `ocicrypt` library is the OCI image spec implementation of container image encryption. More details of the spec can be seen in the [OCI repository](https://github.com/opencontainers/image-spec/pull/775). The purpose of this library is to encode spec structures and consts in code, as well as provide a consistent implementation of image encryption across container runtimes and build tools.
+
+## Usage
+
+There are various levels of usage for this library. The main consumers of these would be runtime/buil tools, and a more specific use would be in the ability to extend cryptographic function.
+
+### Runtime/Build tool usage
+
+The general exposed interface a runtime/build tool would use, would be to perform encryption or decryption of layers:
+
+```
+package "github.com/containers/ocicrypt"
+func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error)
+func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error)
+```
+
+The settings/parameters to these functions can be specified via creation of an encryption config with the `github.com/containers/ocicrypt/config` package. We note that because setting of annotations and other fields of the layer descriptor is done through various means in different runtimes/build tools, it is the resposibility of the caller to still ensure that the layer descriptor follows the OCI specification (i.e. encoding, setting annotations, etc.).
+
+
+### Crypto Agility and Extensibility
+
+The implementation for both symmetric and assymetric encryption used in this library are behind 2 main interfaces, which users can extend if need be. These are in the following packages:
+- github.com/containers/ocicrypt/blockcipher - LayerBlockCipher interface for block ciphers
+- github.com/containers/ocicrypt/keywrap - KeyWrapper interface for key wrapping
+
+We note that adding interfaces here is risky outside the OCI spec is not recommended, unless for very specialized and confined usecases. Please open an issue or PR if there is a general usecase that could be added to the OCI spec.
+
+## Security Issues
+
+We consider security issues related to this library critical. Please report and security related issues by emailing maintainers in the [MAINTAINERS](MAINTAINERS) file.

vendor/github.com/containers/ocicrypt/blockcipher/blockcipher.go

@@ -0,0 +1,160 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package blockcipher
+
+import (
+	"io"
+
+	"github.com/opencontainers/go-digest"
+	"github.com/pkg/errors"
+)
+
+// LayerCipherType is the ciphertype as specified in the layer metadata
+type LayerCipherType string
+
+// TODO: Should be obtained from OCI spec once included
+const (
+	AES256CTR LayerCipherType = "AES_256_CTR_HMAC_SHA256"
+)
+
+// PrivateLayerBlockCipherOptions includes the information required to encrypt/decrypt
+// an image which are sensitive and should not be in plaintext
+type PrivateLayerBlockCipherOptions struct {
+	// SymmetricKey represents the symmetric key used for encryption/decryption
+	// This field should be populated by Encrypt/Decrypt calls
+	SymmetricKey []byte `json:"symkey"`
+
+	// Digest is the digest of the original data for verification.
+	// This is NOT populated by Encrypt/Decrypt calls
+	Digest digest.Digest `json:"digest"`
+
+	// CipherOptions contains the cipher metadata used for encryption/decryption
+	// This field should be populated by Encrypt/Decrypt calls
+	CipherOptions map[string][]byte `json:"cipheroptions"`
+}
+
+// PublicLayerBlockCipherOptions includes the information required to encrypt/decrypt
+// an image which are public and can be deduplicated in plaintext across multiple
+// recipients
+type PublicLayerBlockCipherOptions struct {
+	// CipherType denotes the cipher type according to the list of OCI suppported
+	// cipher types.
+	CipherType LayerCipherType `json:"cipher"`
+
+	// Hmac contains the hmac string to help verify encryption
+	Hmac []byte `json:"hmac"`
+
+	// CipherOptions contains the cipher metadata used for encryption/decryption
+	// This field should be populated by Encrypt/Decrypt calls
+	CipherOptions map[string][]byte `json:"cipheroptions"`
+}
+
+// LayerBlockCipherOptions contains the public and private LayerBlockCipherOptions
+// required to encrypt/decrypt an image
+type LayerBlockCipherOptions struct {
+	Public  PublicLayerBlockCipherOptions
+	Private PrivateLayerBlockCipherOptions
+}
+
+// LayerBlockCipher returns a provider for encrypt/decrypt functionality
+// for handling the layer data for a specific algorithm
+type LayerBlockCipher interface {
+	// GenerateKey creates a symmetric key
+	GenerateKey() ([]byte, error)
+	// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
+	Encrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error)
+	// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
+	Decrypt(layerDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error)
+}
+
+// LayerBlockCipherHandler is the handler for encrypt/decrypt for layers
+type LayerBlockCipherHandler struct {
+	cipherMap map[LayerCipherType]LayerBlockCipher
+}
+
+// Finalizer is called after data blobs are written, and returns the LayerBlockCipherOptions for the encrypted blob
+type Finalizer func() (LayerBlockCipherOptions, error)
+
+// GetOpt returns the value of the cipher option and if the option exists
+func (lbco LayerBlockCipherOptions) GetOpt(key string) (value []byte, ok bool) {
+	if v, ok := lbco.Public.CipherOptions[key]; ok {
+		return v, ok
+	} else if v, ok := lbco.Private.CipherOptions[key]; ok {
+		return v, ok
+	} else {
+		return nil, false
+	}
+}
+
+func wrapFinalizerWithType(fin Finalizer, typ LayerCipherType) Finalizer {
+	return func() (LayerBlockCipherOptions, error) {
+		lbco, err := fin()
+		if err != nil {
+			return LayerBlockCipherOptions{}, err
+		}
+		lbco.Public.CipherType = typ
+		return lbco, err
+	}
+}
+
+// Encrypt is the handler for the layer decryption routine
+func (h *LayerBlockCipherHandler) Encrypt(plainDataReader io.Reader, typ LayerCipherType) (io.Reader, Finalizer, error) {
+	if c, ok := h.cipherMap[typ]; ok {
+		sk, err := c.GenerateKey()
+		if err != nil {
+			return nil, nil, err
+		}
+		opt := LayerBlockCipherOptions{
+			Private: PrivateLayerBlockCipherOptions{
+				SymmetricKey: sk,
+			},
+		}
+		encDataReader, fin, err := c.Encrypt(plainDataReader, opt)
+		if err == nil {
+			fin = wrapFinalizerWithType(fin, typ)
+		}
+		return encDataReader, fin, err
+	}
+	return nil, nil, errors.Errorf("unsupported cipher type: %s", typ)
+}
+
+// Decrypt is the handler for the layer decryption routine
+func (h *LayerBlockCipherHandler) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
+	typ := opt.Public.CipherType
+	if typ == "" {
+		return nil, LayerBlockCipherOptions{}, errors.New("no cipher type provided")
+	}
+	if c, ok := h.cipherMap[LayerCipherType(typ)]; ok {
+		return c.Decrypt(encDataReader, opt)
+	}
+	return nil, LayerBlockCipherOptions{}, errors.Errorf("unsupported cipher type: %s", typ)
+}
+
+// NewLayerBlockCipherHandler returns a new default handler
+func NewLayerBlockCipherHandler() (*LayerBlockCipherHandler, error) {
+	h := LayerBlockCipherHandler{
+		cipherMap: map[LayerCipherType]LayerBlockCipher{},
+	}
+
+	var err error
+	h.cipherMap[AES256CTR], err = NewAESCTRLayerBlockCipher(256)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to set up Cipher AES-256-CTR")
+	}
+
+	return &h, nil
+}

vendor/github.com/containers/ocicrypt/blockcipher/blockcipher_aes_ctr.go

@@ -0,0 +1,193 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package blockcipher
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"hash"
+	"io"
+
+	"github.com/containers/ocicrypt/utils"
+	"github.com/pkg/errors"
+)
+
+// AESCTRLayerBlockCipher implements the AES CTR stream cipher
+type AESCTRLayerBlockCipher struct {
+	keylen         int // in bytes
+	reader         io.Reader
+	encrypt        bool
+	stream         cipher.Stream
+	err            error
+	hmac           hash.Hash
+	expHmac        []byte
+	doneEncrypting bool
+}
+
+type aesctrcryptor struct {
+	bc *AESCTRLayerBlockCipher
+}
+
+// NewAESCTRLayerBlockCipher returns a new AES SIV block cipher of 256 or 512 bits
+func NewAESCTRLayerBlockCipher(bits int) (LayerBlockCipher, error) {
+	if bits != 256 {
+		return nil, errors.New("AES CTR bit count not supported")
+	}
+	return &AESCTRLayerBlockCipher{keylen: bits / 8}, nil
+}
+
+func (r *aesctrcryptor) Read(p []byte) (int, error) {
+	var (
+		o int
+	)
+
+	if r.bc.err != nil {
+		return 0, r.bc.err
+	}
+
+	o, err := utils.FillBuffer(r.bc.reader, p)
+	if err != nil {
+		if err == io.EOF {
+			r.bc.err = err
+		} else {
+			return 0, err
+		}
+	}
+
+	if !r.bc.encrypt {
+		if _, err := r.bc.hmac.Write(p[:o]); err != nil {
+			r.bc.err = errors.Wrapf(err, "could not write to hmac")
+			return 0, r.bc.err
+		}
+
+		if r.bc.err == io.EOF {
+			// Before we return EOF we let the HMAC comparison
+			// provide a verdict
+			if !hmac.Equal(r.bc.hmac.Sum(nil), r.bc.expHmac) {
+				r.bc.err = fmt.Errorf("could not properly decrypt byte stream; exp hmac: '%x', actual hmac: '%s'", r.bc.expHmac, r.bc.hmac.Sum(nil))
+				return 0, r.bc.err
+			}
+		}
+	}
+
+	r.bc.stream.XORKeyStream(p[:o], p[:o])
+
+	if r.bc.encrypt {
+		if _, err := r.bc.hmac.Write(p[:o]); err != nil {
+			r.bc.err = errors.Wrapf(err, "could not write to hmac")
+			return 0, r.bc.err
+		}
+
+		if r.bc.err == io.EOF {
+			// Final data encrypted; Do the 'then-MAC' part
+			r.bc.doneEncrypting = true
+		}
+	}
+
+	return o, r.bc.err
+}
+
+// init initializes an instance
+func (bc *AESCTRLayerBlockCipher) init(encrypt bool, reader io.Reader, opts LayerBlockCipherOptions) (LayerBlockCipherOptions, error) {
+	var (
+		err error
+	)
+
+	key := opts.Private.SymmetricKey
+	if len(key) != bc.keylen {
+		return LayerBlockCipherOptions{}, fmt.Errorf("invalid key length of %d bytes; need %d bytes", len(key), bc.keylen)
+	}
+
+	nonce, ok := opts.GetOpt("nonce")
+	if !ok {
+		nonce = make([]byte, aes.BlockSize)
+		if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+			return LayerBlockCipherOptions{}, errors.Wrap(err, "unable to generate random nonce")
+		}
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return LayerBlockCipherOptions{}, errors.Wrap(err, "aes.NewCipher failed")
+	}
+
+	bc.reader = reader
+	bc.encrypt = encrypt
+	bc.stream = cipher.NewCTR(block, nonce)
+	bc.err = nil
+	bc.hmac = hmac.New(sha256.New, key)
+	bc.expHmac = opts.Public.Hmac
+	bc.doneEncrypting = false
+
+	if !encrypt && len(bc.expHmac) == 0 {
+		return LayerBlockCipherOptions{}, errors.New("HMAC is not provided for decryption process")
+	}
+
+	lbco := LayerBlockCipherOptions{
+		Private: PrivateLayerBlockCipherOptions{
+			SymmetricKey: key,
+			CipherOptions: map[string][]byte{
+				"nonce": nonce,
+			},
+		},
+	}
+
+	return lbco, nil
+}
+
+// GenerateKey creates a synmmetric key
+func (bc *AESCTRLayerBlockCipher) GenerateKey() ([]byte, error) {
+	key := make([]byte, bc.keylen)
+	if _, err := io.ReadFull(rand.Reader, key); err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+// Encrypt takes in layer data and returns the ciphertext and relevant LayerBlockCipherOptions
+func (bc *AESCTRLayerBlockCipher) Encrypt(plainDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, Finalizer, error) {
+	lbco, err := bc.init(true, plainDataReader, opt)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	finalizer := func() (LayerBlockCipherOptions, error) {
+		if !bc.doneEncrypting {
+			return LayerBlockCipherOptions{}, errors.New("Read()ing not complete, unable to finalize")
+		}
+		if lbco.Public.CipherOptions == nil {
+			lbco.Public.CipherOptions = map[string][]byte{}
+		}
+		lbco.Public.Hmac = bc.hmac.Sum(nil)
+		return lbco, nil
+	}
+	return &aesctrcryptor{bc}, finalizer, nil
+}
+
+// Decrypt takes in layer ciphertext data and returns the plaintext and relevant LayerBlockCipherOptions
+func (bc *AESCTRLayerBlockCipher) Decrypt(encDataReader io.Reader, opt LayerBlockCipherOptions) (io.Reader, LayerBlockCipherOptions, error) {
+	lbco, err := bc.init(false, encDataReader, opt)
+	if err != nil {
+		return nil, LayerBlockCipherOptions{}, err
+	}
+
+	return utils.NewDelayedReader(&aesctrcryptor{bc}, 1024*10), lbco, nil
+}

vendor/github.com/containers/ocicrypt/config/config.go

@@ -0,0 +1,114 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+// EncryptConfig is the container image PGP encryption configuration holding
+// the identifiers of those that will be able to decrypt the container and
+// the PGP public keyring file data that contains their public keys.
+type EncryptConfig struct {
+	// map holding 'gpg-recipients', 'gpg-pubkeyringfile', 'pubkeys', 'x509s'
+	Parameters map[string][][]byte
+
+	DecryptConfig DecryptConfig
+}
+
+// DecryptConfig wraps the Parameters map that holds the decryption key
+type DecryptConfig struct {
+	// map holding 'privkeys', 'x509s', 'gpg-privatekeys'
+	Parameters map[string][][]byte
+}
+
+// CryptoConfig is a common wrapper for EncryptConfig and DecrypConfig that can
+// be passed through functions that share much code for encryption and decryption
+type CryptoConfig struct {
+	EncryptConfig *EncryptConfig
+	DecryptConfig *DecryptConfig
+}
+
+// InitDecryption initialized a CryptoConfig object with parameters used for decryption
+func InitDecryption(dcparameters map[string][][]byte) CryptoConfig {
+	return CryptoConfig{
+		DecryptConfig: &DecryptConfig{
+			Parameters: dcparameters,
+		},
+	}
+}
+
+// InitEncryption initializes a CryptoConfig object with parameters used for encryption
+// It also takes dcparameters that may be needed for decryption when adding a recipient
+// to an already encrypted image
+func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig {
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters: parameters,
+			DecryptConfig: DecryptConfig{
+				Parameters: dcparameters,
+			},
+		},
+	}
+}
+
+// CombineCryptoConfigs takes a CryptoConfig list and creates a single CryptoConfig
+// containing the crypto configuration of all the key bundles
+func CombineCryptoConfigs(ccs []CryptoConfig) CryptoConfig {
+	ecparam := map[string][][]byte{}
+	ecdcparam := map[string][][]byte{}
+	dcparam := map[string][][]byte{}
+
+	for _, cc := range ccs {
+		if ec := cc.EncryptConfig; ec != nil {
+			addToMap(ecparam, ec.Parameters)
+			addToMap(ecdcparam, ec.DecryptConfig.Parameters)
+		}
+
+		if dc := cc.DecryptConfig; dc != nil {
+			addToMap(dcparam, dc.Parameters)
+		}
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters: ecparam,
+			DecryptConfig: DecryptConfig{
+				Parameters: ecdcparam,
+			},
+		},
+		DecryptConfig: &DecryptConfig{
+			Parameters: dcparam,
+		},
+	}
+
+}
+
+// AttachDecryptConfig adds DecryptConfig to the field of EncryptConfig so that
+// the decryption parameters can be used to add recipients to an existing image
+// if the user is able to decrypt it.
+func (ec *EncryptConfig) AttachDecryptConfig(dc *DecryptConfig) {
+	if dc != nil {
+		addToMap(ec.DecryptConfig.Parameters, dc.Parameters)
+	}
+}
+
+func addToMap(orig map[string][][]byte, add map[string][][]byte) {
+	for k, v := range add {
+		if ov, ok := orig[k]; ok {
+			orig[k] = append(ov, v...)
+		} else {
+			orig[k] = v
+		}
+	}
+}

vendor/github.com/containers/ocicrypt/config/constructors.go

@@ -0,0 +1,134 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/pkg/errors"
+)
+
+// EncryptWithJwe returns a CryptoConfig to encrypt with jwe public keys
+func EncryptWithJwe(pubKeys [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{}
+	ep := map[string][][]byte{
+		"pubkeys": pubKeys,
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// EncryptWithPkcs7 returns a CryptoConfig to encrypt with pkcs7 x509 certs
+func EncryptWithPkcs7(x509s [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{}
+
+	ep := map[string][][]byte{
+		"x509s": x509s,
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// EncryptWithGpg returns a CryptoConfig to encrypt with configured gpg parameters
+func EncryptWithGpg(gpgRecipients [][]byte, gpgPubRingFile []byte) (CryptoConfig, error) {
+	dc := DecryptConfig{}
+	ep := map[string][][]byte{
+		"gpg-recipients":     gpgRecipients,
+		"gpg-pubkeyringfile": {gpgPubRingFile},
+	}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// DecryptWithPrivKeys returns a CryptoConfig to decrypt with configured private keys
+func DecryptWithPrivKeys(privKeys [][]byte, privKeysPasswords [][]byte) (CryptoConfig, error) {
+	if len(privKeys) != len(privKeysPasswords) {
+		return CryptoConfig{}, errors.New("Length of privKeys should match length of privKeysPasswords")
+	}
+
+	dc := DecryptConfig{
+		Parameters: map[string][][]byte{
+			"privkeys":           privKeys,
+			"privkeys-passwords": privKeysPasswords,
+		},
+	}
+
+	ep := map[string][][]byte{}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// DecryptWithX509s returns a CryptoConfig to decrypt with configured x509 certs
+func DecryptWithX509s(x509s [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{
+		Parameters: map[string][][]byte{
+			"x509s": x509s,
+		},
+	}
+
+	ep := map[string][][]byte{}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}
+
+// DecryptWithGpgPrivKeys returns a CryptoConfig to decrypt with configured gpg private keys
+func DecryptWithGpgPrivKeys(gpgPrivKeys, gpgPrivKeysPwds [][]byte) (CryptoConfig, error) {
+	dc := DecryptConfig{
+		Parameters: map[string][][]byte{
+			"gpg-privatekeys":           gpgPrivKeys,
+			"gpg-privatekeys-passwords": gpgPrivKeysPwds,
+		},
+	}
+
+	ep := map[string][][]byte{}
+
+	return CryptoConfig{
+		EncryptConfig: &EncryptConfig{
+			Parameters:    ep,
+			DecryptConfig: dc,
+		},
+		DecryptConfig: &dc,
+	}, nil
+}

vendor/github.com/containers/ocicrypt/encryption.go

@@ -0,0 +1,325 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"strings"
+
+	"github.com/containers/ocicrypt/blockcipher"
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/containers/ocicrypt/keywrap/jwe"
+	"github.com/containers/ocicrypt/keywrap/pgp"
+	"github.com/containers/ocicrypt/keywrap/pkcs7"
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+)
+
+// EncryptLayerFinalizer is a finalizer run to return the annotations to set for
+// the encrypted layer
+type EncryptLayerFinalizer func() (map[string]string, error)
+
+func init() {
+	keyWrappers = make(map[string]keywrap.KeyWrapper)
+	keyWrapperAnnotations = make(map[string]string)
+	RegisterKeyWrapper("pgp", pgp.NewKeyWrapper())
+	RegisterKeyWrapper("jwe", jwe.NewKeyWrapper())
+	RegisterKeyWrapper("pkcs7", pkcs7.NewKeyWrapper())
+}
+
+var keyWrappers map[string]keywrap.KeyWrapper
+var keyWrapperAnnotations map[string]string
+
+// RegisterKeyWrapper allows to register key wrappers by their encryption scheme
+func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper) {
+	keyWrappers[scheme] = iface
+	keyWrapperAnnotations[iface.GetAnnotationID()] = scheme
+}
+
+// GetKeyWrapper looks up the encryptor interface given an encryption scheme (gpg, jwe)
+func GetKeyWrapper(scheme string) keywrap.KeyWrapper {
+	return keyWrappers[scheme]
+}
+
+// GetWrappedKeysMap returns a map of wrappedKeys as values in a
+// map with the encryption scheme(s) as the key(s)
+func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string {
+	wrappedKeysMap := make(map[string]string)
+
+	for annotationsID, scheme := range keyWrapperAnnotations {
+		if annotation, ok := desc.Annotations[annotationsID]; ok {
+			wrappedKeysMap[scheme] = annotation
+		}
+	}
+	return wrappedKeysMap
+}
+
+// EncryptLayer encrypts the layer by running one encryptor after the other
+func EncryptLayer(ec *config.EncryptConfig, encOrPlainLayerReader io.Reader, desc ocispec.Descriptor) (io.Reader, EncryptLayerFinalizer, error) {
+	var (
+		encLayerReader io.Reader
+		err            error
+		encrypted      bool
+		bcFin          blockcipher.Finalizer
+		privOptsData   []byte
+		pubOptsData    []byte
+	)
+
+	if ec == nil {
+		return nil, nil, errors.New("EncryptConfig must not be nil")
+	}
+
+	for annotationsID := range keyWrapperAnnotations {
+		annotation := desc.Annotations[annotationsID]
+		if annotation != "" {
+			privOptsData, err = decryptLayerKeyOptsData(&ec.DecryptConfig, desc)
+			if err != nil {
+				return nil, nil, err
+			}
+			pubOptsData, err = getLayerPubOpts(desc)
+			if err != nil {
+				return nil, nil, err
+			}
+			// already encrypted!
+			encrypted = true
+		}
+	}
+
+	if !encrypted {
+		encLayerReader, bcFin, err = commonEncryptLayer(encOrPlainLayerReader, desc.Digest, blockcipher.AES256CTR)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	encLayerFinalizer := func() (map[string]string, error) {
+		// If layer was already encrypted, bcFin should be nil, use existing optsData
+		if bcFin != nil {
+			opts, err := bcFin()
+			if err != nil {
+				return nil, err
+			}
+			privOptsData, err = json.Marshal(opts.Private)
+			if err != nil {
+				return nil, errors.Wrapf(err, "could not JSON marshal opts")
+			}
+			pubOptsData, err = json.Marshal(opts.Public)
+			if err != nil {
+				return nil, errors.Wrapf(err, "could not JSON marshal opts")
+			}
+		}
+
+		newAnnotations := make(map[string]string)
+		for annotationsID, scheme := range keyWrapperAnnotations {
+			b64Annotations := desc.Annotations[annotationsID]
+			keywrapper := GetKeyWrapper(scheme)
+			b64Annotations, err = preWrapKeys(keywrapper, ec, b64Annotations, privOptsData)
+			if err != nil {
+				return nil, err
+			}
+			if b64Annotations != "" {
+				newAnnotations[annotationsID] = b64Annotations
+			}
+		}
+
+		newAnnotations["org.opencontainers.image.enc.pubopts"] = base64.StdEncoding.EncodeToString(pubOptsData)
+
+		if len(newAnnotations) == 0 {
+			return nil, errors.New("no encryptor found to handle encryption")
+		}
+
+		return newAnnotations, err
+	}
+
+	// if nothing was encrypted, we just return encLayer = nil
+	return encLayerReader, encLayerFinalizer, err
+
+}
+
+// preWrapKeys calls WrapKeys and handles the base64 encoding and concatenation of the
+// annotation data
+func preWrapKeys(keywrapper keywrap.KeyWrapper, ec *config.EncryptConfig, b64Annotations string, optsData []byte) (string, error) {
+	newAnnotation, err := keywrapper.WrapKeys(ec, optsData)
+	if err != nil || len(newAnnotation) == 0 {
+		return b64Annotations, err
+	}
+	b64newAnnotation := base64.StdEncoding.EncodeToString(newAnnotation)
+	if b64Annotations == "" {
+		return b64newAnnotation, nil
+	}
+	return b64Annotations + "," + b64newAnnotation, nil
+}
+
+// DecryptLayer decrypts a layer trying one keywrap.KeyWrapper after the other to see whether it
+// can apply the provided private key
+// If unwrapOnly is set we will only try to decrypt the layer encryption key and return
+func DecryptLayer(dc *config.DecryptConfig, encLayerReader io.Reader, desc ocispec.Descriptor, unwrapOnly bool) (io.Reader, digest.Digest, error) {
+	if dc == nil {
+		return nil, "", errors.New("DecryptConfig must not be nil")
+	}
+	privOptsData, err := decryptLayerKeyOptsData(dc, desc)
+	if err != nil || unwrapOnly {
+		return nil, "", err
+	}
+
+	var pubOptsData []byte
+	pubOptsData, err = getLayerPubOpts(desc)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return commonDecryptLayer(encLayerReader, privOptsData, pubOptsData)
+}
+
+func decryptLayerKeyOptsData(dc *config.DecryptConfig, desc ocispec.Descriptor) ([]byte, error) {
+	privKeyGiven := false
+	for annotationsID, scheme := range keyWrapperAnnotations {
+		b64Annotation := desc.Annotations[annotationsID]
+		if b64Annotation != "" {
+			keywrapper := GetKeyWrapper(scheme)
+
+			if len(keywrapper.GetPrivateKeys(dc.Parameters)) == 0 {
+				continue
+			}
+			privKeyGiven = true
+
+			optsData, err := preUnwrapKey(keywrapper, dc, b64Annotation)
+			if err != nil {
+				// try next keywrap.KeyWrapper
+				continue
+			}
+			if optsData == nil {
+				// try next keywrap.KeyWrapper
+				continue
+			}
+			return optsData, nil
+		}
+	}
+	if !privKeyGiven {
+		return nil, errors.New("missing private key needed for decryption")
+	}
+	return nil, errors.Errorf("no suitable key unwrapper found or none of the private keys could be used for decryption")
+}
+
+func getLayerPubOpts(desc ocispec.Descriptor) ([]byte, error) {
+	pubOptsString := desc.Annotations["org.opencontainers.image.enc.pubopts"]
+	if pubOptsString == "" {
+		return json.Marshal(blockcipher.PublicLayerBlockCipherOptions{})
+	}
+	return base64.StdEncoding.DecodeString(pubOptsString)
+}
+
+// preUnwrapKey decodes the comma separated base64 strings and calls the Unwrap function
+// of the given keywrapper with it and returns the result in case the Unwrap functions
+// does not return an error. If all attempts fail, an error is returned.
+func preUnwrapKey(keywrapper keywrap.KeyWrapper, dc *config.DecryptConfig, b64Annotations string) ([]byte, error) {
+	if b64Annotations == "" {
+		return nil, nil
+	}
+	for _, b64Annotation := range strings.Split(b64Annotations, ",") {
+		annotation, err := base64.StdEncoding.DecodeString(b64Annotation)
+		if err != nil {
+			return nil, errors.New("could not base64 decode the annotation")
+		}
+		optsData, err := keywrapper.UnwrapKey(dc, annotation)
+		if err != nil {
+			continue
+		}
+		return optsData, nil
+	}
+	return nil, errors.New("no suitable key found for decrypting layer key")
+}
+
+// commonEncryptLayer is a function to encrypt the plain layer using a new random
+// symmetric key and return the LayerBlockCipherHandler's JSON in string form for
+// later use during decryption
+func commonEncryptLayer(plainLayerReader io.Reader, d digest.Digest, typ blockcipher.LayerCipherType) (io.Reader, blockcipher.Finalizer, error) {
+	lbch, err := blockcipher.NewLayerBlockCipherHandler()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	encLayerReader, bcFin, err := lbch.Encrypt(plainLayerReader, typ)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	newBcFin := func() (blockcipher.LayerBlockCipherOptions, error) {
+		lbco, err := bcFin()
+		if err != nil {
+			return blockcipher.LayerBlockCipherOptions{}, err
+		}
+		lbco.Private.Digest = d
+		return lbco, nil
+	}
+
+	return encLayerReader, newBcFin, err
+}
+
+// commonDecryptLayer decrypts an encrypted layer previously encrypted with commonEncryptLayer
+// by passing along the optsData
+func commonDecryptLayer(encLayerReader io.Reader, privOptsData []byte, pubOptsData []byte) (io.Reader, digest.Digest, error) {
+	privOpts := blockcipher.PrivateLayerBlockCipherOptions{}
+	err := json.Unmarshal(privOptsData, &privOpts)
+	if err != nil {
+		return nil, "", errors.Wrapf(err, "could not JSON unmarshal privOptsData")
+	}
+
+	lbch, err := blockcipher.NewLayerBlockCipherHandler()
+	if err != nil {
+		return nil, "", err
+	}
+
+	pubOpts := blockcipher.PublicLayerBlockCipherOptions{}
+	if len(pubOptsData) > 0 {
+		err := json.Unmarshal(pubOptsData, &pubOpts)
+		if err != nil {
+			return nil, "", errors.Wrapf(err, "could not JSON unmarshal pubOptsData")
+		}
+	}
+
+	opts := blockcipher.LayerBlockCipherOptions{
+		Private: privOpts,
+		Public:  pubOpts,
+	}
+
+	plainLayerReader, opts, err := lbch.Decrypt(encLayerReader, opts)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return plainLayerReader, opts.Private.Digest, nil
+}
+
+// FilterOutAnnotations filters out the annotations belonging to the image encryption 'namespace'
+// and returns a map with those taken out
+func FilterOutAnnotations(annotations map[string]string) map[string]string {
+	a := make(map[string]string)
+	if len(annotations) > 0 {
+		for k, v := range annotations {
+			if strings.HasPrefix(k, "org.opencontainers.image.enc.") {
+				continue
+			}
+			a[k] = v
+		}
+	}
+	return a
+}

vendor/github.com/containers/ocicrypt/go.mod

@@ -0,0 +1,18 @@
+module github.com/containers/ocicrypt
+
+go 1.12
+
+require (
+	github.com/containerd/containerd v1.2.10
+	github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa
+	github.com/opencontainers/go-digest v1.0.0-rc1
+	github.com/opencontainers/image-spec v1.0.1
+	github.com/pkg/errors v0.8.1
+	github.com/sirupsen/logrus v1.4.2 // indirect
+	github.com/stretchr/testify v1.3.0 // indirect
+	github.com/urfave/cli v1.22.1
+	golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4
+	google.golang.org/grpc v1.24.0 // indirect
+	gopkg.in/square/go-jose.v2 v2.3.1
+	gotest.tools v2.2.0+incompatible // indirect
+)

vendor/github.com/containers/ocicrypt/go.sum

@@ -0,0 +1,73 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/containerd/containerd v1.2.10 h1:liQDhXqIn7y6cJ/7qBgOaZsiTZJc56/wkkhDBiDBRDw=
+github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU=
+github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
+github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/urfave/cli v1.22.1 h1:+mkCCcOFKPnCmVYVcURKps1Xe+3zP90gSYGNfRkjoIY=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4 h1:HuIa8hRrWRSrqYzx1qI49NNxhdi2PrY7gxVSq1JjLDc=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/grpc v1.24.0 h1:vb/1TCsVn3DcJlQ0Gs1yB1pKI6Do2/QNwxdKqmc/b0s=
+google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/square/go-jose.v2 v2.3.1 h1:SK5KegNXmKmqE342YYN2qPHEnUYeoMiXXl1poUlI+o4=
+gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

vendor/github.com/containers/ocicrypt/gpg.go

@@ -0,0 +1,425 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/ssh/terminal"
+)
+
+// GPGVersion enum representing the GPG client version to use.
+type GPGVersion int
+
+const (
+	// GPGv2 signifies gpgv2+
+	GPGv2 GPGVersion = iota
+	// GPGv1 signifies gpgv1+
+	GPGv1
+	// GPGVersionUndetermined signifies gpg client version undetermined
+	GPGVersionUndetermined
+)
+
+// GPGClient defines an interface for wrapping the gpg command line tools
+type GPGClient interface {
+	// ReadGPGPubRingFile gets the byte sequence of the gpg public keyring
+	ReadGPGPubRingFile() ([]byte, error)
+	// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
+	GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error)
+	// GetSecretKeyDetails gets the details of a secret key
+	GetSecretKeyDetails(keyid uint64) ([]byte, bool, error)
+	// GetKeyDetails gets the details of a public key
+	GetKeyDetails(keyid uint64) ([]byte, bool, error)
+	// ResolveRecipients resolves PGP key ids to user names
+	ResolveRecipients([]string) []string
+}
+
+// gpgClient contains generic gpg client information
+type gpgClient struct {
+	gpgHomeDir string
+}
+
+// gpgv2Client is a gpg2 client
+type gpgv2Client struct {
+	gpgClient
+}
+
+// gpgv1Client is a gpg client
+type gpgv1Client struct {
+	gpgClient
+}
+
+// GuessGPGVersion guesses the version of gpg. Defaults to gpg2 if exists, if
+// not defaults to regular gpg.
+func GuessGPGVersion() GPGVersion {
+	if err := exec.Command("gpg2", "--version").Run(); err == nil {
+		return GPGv2
+	} else if err := exec.Command("gpg", "--version").Run(); err == nil {
+		return GPGv1
+	} else {
+		return GPGVersionUndetermined
+	}
+}
+
+// NewGPGClient creates a new GPGClient object representing the given version
+// and using the given home directory
+func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error) {
+	v := new(GPGVersion)
+	switch gpgVersion {
+	case "v1":
+		*v = GPGv1
+	case "v2":
+		*v = GPGv2
+	default:
+		v = nil
+	}
+	return newGPGClient(v, gpgHomeDir)
+}
+
+func newGPGClient(version *GPGVersion, homedir string) (GPGClient, error) {
+	var gpgVersion GPGVersion
+	if version != nil {
+		gpgVersion = *version
+	} else {
+		gpgVersion = GuessGPGVersion()
+	}
+
+	switch gpgVersion {
+	case GPGv1:
+		return &gpgv1Client{
+			gpgClient: gpgClient{gpgHomeDir: homedir},
+		}, nil
+	case GPGv2:
+		return &gpgv2Client{
+			gpgClient: gpgClient{gpgHomeDir: homedir},
+		}, nil
+	case GPGVersionUndetermined:
+		return nil, fmt.Errorf("unable to determine GPG version")
+	default:
+		return nil, fmt.Errorf("unhandled case: NewGPGClient")
+	}
+}
+
+// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
+func (gc *gpgv2Client) GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+
+	rfile, wfile, err := os.Pipe()
+	if err != nil {
+		return nil, errors.Wrapf(err, "could not create pipe")
+	}
+	defer func() {
+		rfile.Close()
+		wfile.Close()
+	}()
+	// fill pipe in background
+	go func(passphrase string) {
+		_, _ = wfile.Write([]byte(passphrase))
+		wfile.Close()
+	}(passphrase)
+
+	args = append(args, []string{"--pinentry-mode", "loopback", "--batch", "--passphrase-fd", fmt.Sprintf("%d", 3), "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
+
+	cmd := exec.Command("gpg2", args...)
+	cmd.ExtraFiles = []*os.File{rfile}
+
+	return runGPGGetOutput(cmd)
+}
+
+// ReadGPGPubRingFile reads the GPG public key ring file
+func (gc *gpgv2Client) ReadGPGPubRingFile() ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+	args = append(args, []string{"--batch", "--export"}...)
+
+	cmd := exec.Command("gpg2", args...)
+
+	return runGPGGetOutput(cmd)
+}
+
+func (gc *gpgv2Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append([]string{"--homedir", gc.gpgHomeDir})
+	}
+	args = append(args, option, fmt.Sprintf("0x%x", keyid))
+
+	cmd := exec.Command("gpg2", args...)
+
+	keydata, err := runGPGGetOutput(cmd)
+	return keydata, err == nil, err
+}
+
+// GetSecretKeyDetails retrives the secret key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv2Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-K", keyid)
+}
+
+// GetKeyDetails retrives the public key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv2Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-k", keyid)
+}
+
+// ResolveRecipients converts PGP keyids to email addresses, if possible
+func (gc *gpgv2Client) ResolveRecipients(recipients []string) []string {
+	return resolveRecipients(gc, recipients)
+}
+
+// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
+func (gc *gpgv1Client) GetGPGPrivateKey(keyid uint64, _ string) ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+	args = append(args, []string{"--batch", "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...)
+
+	cmd := exec.Command("gpg", args...)
+
+	return runGPGGetOutput(cmd)
+}
+
+// ReadGPGPubRingFile reads the GPG public key ring file
+func (gc *gpgv1Client) ReadGPGPubRingFile() ([]byte, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append(args, []string{"--homedir", gc.gpgHomeDir}...)
+	}
+	args = append(args, []string{"--batch", "--export"}...)
+
+	cmd := exec.Command("gpg", args...)
+
+	return runGPGGetOutput(cmd)
+}
+
+func (gc *gpgv1Client) getKeyDetails(option string, keyid uint64) ([]byte, bool, error) {
+	var args []string
+
+	if gc.gpgHomeDir != "" {
+		args = append([]string{"--homedir", gc.gpgHomeDir})
+	}
+	args = append(args, option, fmt.Sprintf("0x%x", keyid))
+
+	cmd := exec.Command("gpg", args...)
+
+	keydata, err := runGPGGetOutput(cmd)
+
+	return keydata, err == nil, err
+}
+
+// GetSecretKeyDetails retrives the secret key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv1Client) GetSecretKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-K", keyid)
+}
+
+// GetKeyDetails retrives the public key details of key with keyid.
+// returns a byte array of the details and a bool if the key exists
+func (gc *gpgv1Client) GetKeyDetails(keyid uint64) ([]byte, bool, error) {
+	return gc.getKeyDetails("-k", keyid)
+}
+
+// ResolveRecipients converts PGP keyids to email addresses, if possible
+func (gc *gpgv1Client) ResolveRecipients(recipients []string) []string {
+	return resolveRecipients(gc, recipients)
+}
+
+// runGPGGetOutput runs the GPG commandline and returns stdout as byte array
+// and any stderr in the error
+func runGPGGetOutput(cmd *exec.Cmd) ([]byte, error) {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+
+	stdoutstr, err2 := ioutil.ReadAll(stdout)
+	stderrstr, _ := ioutil.ReadAll(stderr)
+
+	if err := cmd.Wait(); err != nil {
+		return nil, fmt.Errorf("error from %s: %s", cmd.Path, string(stderrstr))
+	}
+
+	return stdoutstr, err2
+}
+
+// resolveRecipients walks the list of recipients and attempts to convert
+// all keyIds to email addresses; if something goes wrong during the
+// conversion of a recipient, the original string is returned for that
+// recpient
+func resolveRecipients(gc GPGClient, recipients []string) []string {
+	var result []string
+
+	for _, recipient := range recipients {
+		keyID, err := strconv.ParseUint(recipient, 0, 64)
+		if err != nil {
+			result = append(result, recipient)
+		} else {
+			details, found, _ := gc.GetKeyDetails(keyID)
+			if !found {
+				result = append(result, recipient)
+			} else {
+				email := extractEmailFromDetails(details)
+				if email == "" {
+					result = append(result, recipient)
+				} else {
+					result = append(result, email)
+				}
+			}
+		}
+	}
+	return result
+}
+
+var emailPattern = regexp.MustCompile(`uid\s+\[.*\]\s.*\s<(?P<email>.+)>`)
+
+func extractEmailFromDetails(details []byte) string {
+	loc := emailPattern.FindSubmatchIndex(details)
+	if len(loc) == 0 {
+		return ""
+	}
+	return string(emailPattern.Expand(nil, []byte("$email"), details, loc))
+}
+
+// uint64ToStringArray converts an array of uint64's to an array of strings
+// by applying a format string to each uint64
+func uint64ToStringArray(format string, in []uint64) []string {
+	var ret []string
+
+	for _, v := range in {
+		ret = append(ret, fmt.Sprintf(format, v))
+	}
+	return ret
+}
+
+// GPGGetPrivateKey walks the list of layerInfos and tries to decrypt the
+// wrapped symmetric keys. For this it determines whether a private key is
+// in the GPGVault or on this system and prompts for the passwords for those
+// that are available. If we do not find a private key on the system for
+// getting to the symmetric key of a layer then an error is generated.
+func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, mustFindKey bool) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error) {
+	// PrivateKeyData describes a private key
+	type PrivateKeyData struct {
+		KeyData         []byte
+		KeyDataPassword []byte
+	}
+	var pkd PrivateKeyData
+	keyIDPasswordMap := make(map[uint64]PrivateKeyData)
+
+	for _, desc := range descs {
+		for scheme, b64pgpPackets := range GetWrappedKeysMap(desc) {
+			if scheme != "pgp" {
+				continue
+			}
+			keywrapper := GetKeyWrapper(scheme)
+			if keywrapper == nil {
+				return nil, nil, errors.Errorf("could not get KeyWrapper for %s\n", scheme)
+			}
+			keyIds, err := keywrapper.GetKeyIdsFromPacket(b64pgpPackets)
+			if err != nil {
+				return nil, nil, err
+			}
+
+			found := false
+			for _, keyid := range keyIds {
+				// do we have this key? -- first check the vault
+				if gpgVault != nil {
+					_, keydata := gpgVault.GetGPGPrivateKey(keyid)
+					if len(keydata) > 0 {
+						pkd = PrivateKeyData{
+							KeyData:         keydata,
+							KeyDataPassword: nil, // password not supported in this case
+						}
+						keyIDPasswordMap[keyid] = pkd
+						found = true
+						break
+					}
+				} else if gpgClient != nil {
+					// check the local system's gpg installation
+					keyinfo, haveKey, _ := gpgClient.GetSecretKeyDetails(keyid)
+					// this may fail if the key is not here; we ignore the error
+					if !haveKey {
+						// key not on this system
+						continue
+					}
+
+					_, found = keyIDPasswordMap[keyid]
+					if !found {
+						fmt.Printf("Passphrase required for Key id 0x%x: \n%v", keyid, string(keyinfo))
+						fmt.Printf("Enter passphrase for key with Id 0x%x: ", keyid)
+
+						password, err := terminal.ReadPassword(int(os.Stdin.Fd()))
+						fmt.Printf("\n")
+						if err != nil {
+							return nil, nil, err
+						}
+						keydata, err := gpgClient.GetGPGPrivateKey(keyid, string(password))
+						if err != nil {
+							return nil, nil, err
+						}
+						pkd = PrivateKeyData{
+							KeyData:         keydata,
+							KeyDataPassword: password,
+						}
+						keyIDPasswordMap[keyid] = pkd
+						found = true
+					}
+					break
+				} else {
+					return nil, nil, errors.New("no GPGVault or GPGClient passed")
+				}
+			}
+			if !found && len(b64pgpPackets) > 0 && mustFindKey {
+				ids := uint64ToStringArray("0x%x", keyIds)
+
+				return nil, nil, errors.Errorf("missing key for decryption of layer %x of %s. Need one of the following keys: %s", desc.Digest, desc.Platform, strings.Join(ids, ", "))
+			}
+		}
+	}
+
+	for _, pkd := range keyIDPasswordMap {
+		gpgPrivKeys = append(gpgPrivKeys, pkd.KeyData)
+		gpgPrivKeysPwds = append(gpgPrivKeysPwds, pkd.KeyDataPassword)
+	}
+
+	return gpgPrivKeys, gpgPrivKeysPwds, nil
+}

vendor/github.com/containers/ocicrypt/gpgvault.go

@@ -0,0 +1,100 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"bytes"
+	"io/ioutil"
+
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/packet"
+)
+
+// GPGVault defines an interface for wrapping multiple secret key rings
+type GPGVault interface {
+	// AddSecretKeyRingData adds a secret keyring via its raw byte array
+	AddSecretKeyRingData(gpgSecretKeyRingData []byte) error
+	// AddSecretKeyRingDataArray adds secret keyring via its raw byte arrays
+	AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error
+	// AddSecretKeyRingFiles adds secret keyrings given their filenames
+	AddSecretKeyRingFiles(filenames []string) error
+	// GetGPGPrivateKey gets the private key bytes of a keyid given a passphrase
+	GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte)
+}
+
+// gpgVault wraps an array of gpgSecretKeyRing
+type gpgVault struct {
+	entityLists []openpgp.EntityList
+	keyDataList [][]byte // the raw data original passed in
+}
+
+// NewGPGVault creates an empty GPGVault
+func NewGPGVault() GPGVault {
+	return &gpgVault{}
+}
+
+// AddSecretKeyRingData adds a secret keyring's to the gpgVault; the raw byte
+// array read from the file must be passed and will be parsed by this function
+func (g *gpgVault) AddSecretKeyRingData(gpgSecretKeyRingData []byte) error {
+	// read the private keys
+	r := bytes.NewReader(gpgSecretKeyRingData)
+	entityList, err := openpgp.ReadKeyRing(r)
+	if err != nil {
+		return errors.Wrapf(err, "could not read keyring")
+	}
+	g.entityLists = append(g.entityLists, entityList)
+	g.keyDataList = append(g.keyDataList, gpgSecretKeyRingData)
+	return nil
+}
+
+// AddSecretKeyRingDataArray adds secret keyrings to the gpgVault; the raw byte
+// arrays read from files must be passed
+func (g *gpgVault) AddSecretKeyRingDataArray(gpgSecretKeyRingDataArray [][]byte) error {
+	for _, gpgSecretKeyRingData := range gpgSecretKeyRingDataArray {
+		if err := g.AddSecretKeyRingData(gpgSecretKeyRingData); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// AddSecretKeyRingFiles adds the secret key rings given their filenames
+func (g *gpgVault) AddSecretKeyRingFiles(filenames []string) error {
+	for _, filename := range filenames {
+		gpgSecretKeyRingData, err := ioutil.ReadFile(filename)
+		if err != nil {
+			return err
+		}
+		err = g.AddSecretKeyRingData(gpgSecretKeyRingData)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// GetGPGPrivateKey gets the bytes of a specified keyid, supplying a passphrase
+func (g *gpgVault) GetGPGPrivateKey(keyid uint64) ([]openpgp.Key, []byte) {
+	for i, el := range g.entityLists {
+		decKeys := el.KeysByIdUsage(keyid, packet.KeyFlagEncryptCommunications)
+		if len(decKeys) > 0 {
+			return decKeys, g.keyDataList[i]
+		}
+	}
+	return nil, nil
+}

vendor/github.com/containers/ocicrypt/keywrap/jwe/keywrapper_jwe.go

@@ -0,0 +1,132 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package jwe
+
+import (
+	"crypto/ecdsa"
+
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/containers/ocicrypt/utils"
+	"github.com/pkg/errors"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+type jweKeyWrapper struct {
+}
+
+func (kw *jweKeyWrapper) GetAnnotationID() string {
+	return "org.opencontainers.image.enc.keys.jwe"
+}
+
+// NewKeyWrapper returns a new key wrapping interface using jwe
+func NewKeyWrapper() keywrap.KeyWrapper {
+	return &jweKeyWrapper{}
+}
+
+// WrapKeys wraps the session key for recpients and encrypts the optsData, which
+// describe the symmetric key used for encrypting the layer
+func (kw *jweKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
+	var joseRecipients []jose.Recipient
+
+	err := addPubKeys(&joseRecipients, ec.Parameters["pubkeys"])
+	if err != nil {
+		return nil, err
+	}
+	// no recipients is not an error...
+	if len(joseRecipients) == 0 {
+		return nil, nil
+	}
+
+	encrypter, err := jose.NewMultiEncrypter(jose.A256GCM, joseRecipients, nil)
+	if err != nil {
+		return nil, errors.Wrapf(err, "jose.NewMultiEncrypter failed")
+	}
+	jwe, err := encrypter.Encrypt(optsData)
+	if err != nil {
+		return nil, errors.Wrapf(err, "JWE Encrypt failed")
+	}
+	return []byte(jwe.FullSerialize()), nil
+}
+
+func (kw *jweKeyWrapper) UnwrapKey(dc *config.DecryptConfig, jweString []byte) ([]byte, error) {
+	jwe, err := jose.ParseEncrypted(string(jweString))
+	if err != nil {
+		return nil, errors.New("jose.ParseEncrypted failed")
+	}
+
+	privKeys := kw.GetPrivateKeys(dc.Parameters)
+	if len(privKeys) == 0 {
+		return nil, errors.New("No private keys found for JWE decryption")
+	}
+	privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
+	if len(privKeysPasswords) != len(privKeys) {
+		return nil, errors.New("Private key password array length must be same as that of private keys")
+	}
+
+	for idx, privKey := range privKeys {
+		key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "JWE")
+		if err != nil {
+			return nil, err
+		}
+		_, _, plain, err := jwe.DecryptMulti(key)
+		if err == nil {
+			return plain, nil
+		}
+	}
+	return nil, errors.New("JWE: No suitable private key found for decryption")
+}
+
+func (kw *jweKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys"]
+}
+
+func (kw *jweKeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys-passwords"]
+}
+
+func (kw *jweKeyWrapper) GetKeyIdsFromPacket(b64jwes string) ([]uint64, error) {
+	return nil, nil
+}
+
+func (kw *jweKeyWrapper) GetRecipients(b64jwes string) ([]string, error) {
+	return []string{"[jwe]"}, nil
+}
+
+func addPubKeys(joseRecipients *[]jose.Recipient, pubKeys [][]byte) error {
+	if len(pubKeys) == 0 {
+		return nil
+	}
+	for _, pubKey := range pubKeys {
+		key, err := utils.ParsePublicKey(pubKey, "JWE")
+		if err != nil {
+			return err
+		}
+
+		alg := jose.RSA_OAEP
+		switch key.(type) {
+		case *ecdsa.PublicKey:
+			alg = jose.ECDH_ES_A256KW
+		}
+
+		*joseRecipients = append(*joseRecipients, jose.Recipient{
+			Algorithm: alg,
+			Key:       key,
+		})
+	}
+	return nil
+}

vendor/github.com/containers/ocicrypt/keywrap/keywrap.go

@@ -0,0 +1,40 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package keywrap
+
+import (
+	"github.com/containers/ocicrypt/config"
+)
+
+// KeyWrapper is the interface used for wrapping keys using
+// a specific encryption technology (pgp, jwe)
+type KeyWrapper interface {
+	WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error)
+	UnwrapKey(dc *config.DecryptConfig, annotation []byte) ([]byte, error)
+	GetAnnotationID() string
+	// GetPrivateKeys (optional) gets the array of private keys. It is an optional implementation
+	// as in some key services, a private key may not be exportable (i.e. HSM)
+	GetPrivateKeys(dcparameters map[string][][]byte) [][]byte
+
+	// GetKeyIdsFromPacket (optional) gets a list of key IDs. This is optional as some encryption
+	// schemes may not have a notion of key IDs
+	GetKeyIdsFromPacket(packet string) ([]uint64, error)
+
+	// GetRecipients (optional) gets a list of recipients. It is optional due to the validity of
+	// recipients in a particular encryptiong scheme
+	GetRecipients(packet string) ([]string, error)
+}

vendor/github.com/containers/ocicrypt/keywrap/pgp/keywrapper_gpg.go

@@ -0,0 +1,269 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package pgp
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/mail"
+	"strconv"
+	"strings"
+
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/packet"
+)
+
+type gpgKeyWrapper struct {
+}
+
+// NewKeyWrapper returns a new key wrapping interface for pgp
+func NewKeyWrapper() keywrap.KeyWrapper {
+	return &gpgKeyWrapper{}
+}
+
+var (
+	// GPGDefaultEncryptConfig is the default configuration for layer encryption/decryption
+	GPGDefaultEncryptConfig = &packet.Config{
+		Rand:              rand.Reader,
+		DefaultHash:       crypto.SHA256,
+		DefaultCipher:     packet.CipherAES256,
+		CompressionConfig: &packet.CompressionConfig{Level: 0}, // No compression
+		RSABits:           2048,
+	}
+)
+
+func (kw *gpgKeyWrapper) GetAnnotationID() string {
+	return "org.opencontainers.image.enc.keys.pgp"
+}
+
+// WrapKeys wraps the session key for recpients and encrypts the optsData, which
+// describe the symmetric key used for encrypting the layer
+func (kw *gpgKeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
+	ciphertext := new(bytes.Buffer)
+	el, err := kw.createEntityList(ec)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to create entity list")
+	}
+	if len(el) == 0 {
+		// nothing to do -- not an error
+		return nil, nil
+	}
+
+	plaintextWriter, err := openpgp.Encrypt(ciphertext,
+		el,  /*EntityList*/
+		nil, /* Sign*/
+		nil, /* FileHint */
+		GPGDefaultEncryptConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err = plaintextWriter.Write(optsData); err != nil {
+		return nil, err
+	} else if err = plaintextWriter.Close(); err != nil {
+		return nil, err
+	}
+	return ciphertext.Bytes(), err
+}
+
+// UnwrapKey unwraps the symmetric key with which the layer is encrypted
+// This symmetric key is encrypted in the PGP payload.
+func (kw *gpgKeyWrapper) UnwrapKey(dc *config.DecryptConfig, pgpPacket []byte) ([]byte, error) {
+	pgpPrivateKeys, pgpPrivateKeysPwd, err := kw.getKeyParameters(dc.Parameters)
+	if err != nil {
+		return nil, err
+	}
+
+	for idx, pgpPrivateKey := range pgpPrivateKeys {
+		r := bytes.NewBuffer(pgpPrivateKey)
+		entityList, err := openpgp.ReadKeyRing(r)
+		if err != nil {
+			return nil, errors.Wrap(err, "unable to parse private keys")
+		}
+
+		var prompt openpgp.PromptFunction
+		if len(pgpPrivateKeysPwd) > idx {
+			responded := false
+			prompt = func(keys []openpgp.Key, symmetric bool) ([]byte, error) {
+				if responded {
+					return nil, fmt.Errorf("don't seem to have the right password")
+				}
+				responded = true
+				for _, key := range keys {
+					if key.PrivateKey != nil {
+						_ = key.PrivateKey.Decrypt(pgpPrivateKeysPwd[idx])
+					}
+				}
+				return pgpPrivateKeysPwd[idx], nil
+			}
+		}
+
+		r = bytes.NewBuffer(pgpPacket)
+		md, err := openpgp.ReadMessage(r, entityList, prompt, GPGDefaultEncryptConfig)
+		if err != nil {
+			continue
+		}
+		// we get the plain key options back
+		optsData, err := ioutil.ReadAll(md.UnverifiedBody)
+		if err != nil {
+			continue
+		}
+		return optsData, nil
+	}
+	return nil, errors.New("PGP: No suitable key found to unwrap key")
+}
+
+// GetKeyIdsFromWrappedKeys converts the base64 encoded PGPPacket to uint64 keyIds
+func (kw *gpgKeyWrapper) GetKeyIdsFromPacket(b64pgpPackets string) ([]uint64, error) {
+
+	var keyids []uint64
+	for _, b64pgpPacket := range strings.Split(b64pgpPackets, ",") {
+		pgpPacket, err := base64.StdEncoding.DecodeString(b64pgpPacket)
+		if err != nil {
+			return nil, errors.Wrapf(err, "could not decode base64 encoded PGP packet")
+		}
+		newids, err := kw.getKeyIDs(pgpPacket)
+		if err != nil {
+			return nil, err
+		}
+		keyids = append(keyids, newids...)
+	}
+	return keyids, nil
+}
+
+// getKeyIDs parses a PGPPacket and gets the list of recipients' key IDs
+func (kw *gpgKeyWrapper) getKeyIDs(pgpPacket []byte) ([]uint64, error) {
+	var keyids []uint64
+
+	kbuf := bytes.NewBuffer(pgpPacket)
+	packets := packet.NewReader(kbuf)
+ParsePackets:
+	for {
+		p, err := packets.Next()
+		if err == io.EOF {
+			break ParsePackets
+		}
+		if err != nil {
+			return []uint64{}, errors.Wrapf(err, "packets.Next() failed")
+		}
+		switch p := p.(type) {
+		case *packet.EncryptedKey:
+			keyids = append(keyids, p.KeyId)
+		case *packet.SymmetricallyEncrypted:
+			break ParsePackets
+		}
+	}
+	return keyids, nil
+}
+
+// GetRecipients converts the wrappedKeys to an array of recipients
+func (kw *gpgKeyWrapper) GetRecipients(b64pgpPackets string) ([]string, error) {
+	keyIds, err := kw.GetKeyIdsFromPacket(b64pgpPackets)
+	if err != nil {
+		return nil, err
+	}
+	var array []string
+	for _, keyid := range keyIds {
+		array = append(array, "0x"+strconv.FormatUint(keyid, 16))
+	}
+	return array, nil
+}
+
+func (kw *gpgKeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["gpg-privatekeys"]
+}
+
+func (kw *gpgKeyWrapper) getKeyParameters(dcparameters map[string][][]byte) ([][]byte, [][]byte, error) {
+
+	privKeys := kw.GetPrivateKeys(dcparameters)
+	if len(privKeys) == 0 {
+		return nil, nil, errors.New("GPG: Missing private key parameter")
+	}
+
+	return privKeys, dcparameters["gpg-privatekeys-passwords"], nil
+}
+
+// createEntityList creates the opengpg EntityList by reading the KeyRing
+// first and then filtering out recipients' keys
+func (kw *gpgKeyWrapper) createEntityList(ec *config.EncryptConfig) (openpgp.EntityList, error) {
+	pgpPubringFile := ec.Parameters["gpg-pubkeyringfile"]
+	if len(pgpPubringFile) == 0 {
+		return nil, nil
+	}
+	r := bytes.NewReader(pgpPubringFile[0])
+
+	entityList, err := openpgp.ReadKeyRing(r)
+	if err != nil {
+		return nil, err
+	}
+
+	gpgRecipients := ec.Parameters["gpg-recipients"]
+	if len(gpgRecipients) == 0 {
+		return nil, nil
+	}
+
+	rSet := make(map[string]int)
+	for _, r := range gpgRecipients {
+		rSet[string(r)] = 0
+	}
+
+	var filteredList openpgp.EntityList
+	for _, entity := range entityList {
+		for k := range entity.Identities {
+			addr, err := mail.ParseAddress(k)
+			if err != nil {
+				return nil, err
+			}
+			for _, r := range gpgRecipients {
+				recp := string(r)
+				if strings.Compare(addr.Name, recp) == 0 || strings.Compare(addr.Address, recp) == 0 {
+					filteredList = append(filteredList, entity)
+					rSet[recp] = rSet[recp] + 1
+				}
+			}
+		}
+	}
+
+	// make sure we found keys for all the Recipients...
+	var buffer bytes.Buffer
+	notFound := false
+	buffer.WriteString("PGP: No key found for the following recipients: ")
+
+	for k, v := range rSet {
+		if v == 0 {
+			if notFound {
+				buffer.WriteString(", ")
+			}
+			buffer.WriteString(k)
+			notFound = true
+		}
+	}
+
+	if notFound {
+		return nil, errors.New(buffer.String())
+	}
+
+	return filteredList, nil
+}

vendor/github.com/containers/ocicrypt/keywrap/pkcs7/keywrapper_pkcs7.go

@@ -0,0 +1,132 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package pkcs7
+
+import (
+	"crypto"
+	"crypto/x509"
+
+	"github.com/containers/ocicrypt/config"
+	"github.com/containers/ocicrypt/keywrap"
+	"github.com/containers/ocicrypt/utils"
+	"github.com/fullsailor/pkcs7"
+	"github.com/pkg/errors"
+)
+
+type pkcs7KeyWrapper struct {
+}
+
+// NewKeyWrapper returns a new key wrapping interface using jwe
+func NewKeyWrapper() keywrap.KeyWrapper {
+	return &pkcs7KeyWrapper{}
+}
+
+func (kw *pkcs7KeyWrapper) GetAnnotationID() string {
+	return "org.opencontainers.image.enc.keys.pkcs7"
+}
+
+// WrapKeys wraps the session key for recpients and encrypts the optsData, which
+// describe the symmetric key used for encrypting the layer
+func (kw *pkcs7KeyWrapper) WrapKeys(ec *config.EncryptConfig, optsData []byte) ([]byte, error) {
+	x509Certs, err := collectX509s(ec.Parameters["x509s"])
+	if err != nil {
+		return nil, err
+	}
+	// no recipients is not an error...
+	if len(x509Certs) == 0 {
+		return nil, nil
+	}
+
+	pkcs7.ContentEncryptionAlgorithm = pkcs7.EncryptionAlgorithmAES128GCM
+	return pkcs7.Encrypt(optsData, x509Certs)
+}
+
+func collectX509s(x509s [][]byte) ([]*x509.Certificate, error) {
+	if len(x509s) == 0 {
+		return nil, nil
+	}
+	var x509Certs []*x509.Certificate
+	for _, x509 := range x509s {
+		x509Cert, err := utils.ParseCertificate(x509, "PKCS7")
+		if err != nil {
+			return nil, err
+		}
+		x509Certs = append(x509Certs, x509Cert)
+	}
+	return x509Certs, nil
+}
+
+func (kw *pkcs7KeyWrapper) GetPrivateKeys(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys"]
+}
+
+func (kw *pkcs7KeyWrapper) getPrivateKeysPasswords(dcparameters map[string][][]byte) [][]byte {
+	return dcparameters["privkeys-passwords"]
+}
+
+// UnwrapKey unwraps the symmetric key with which the layer is encrypted
+// This symmetric key is encrypted in the PKCS7 payload.
+func (kw *pkcs7KeyWrapper) UnwrapKey(dc *config.DecryptConfig, pkcs7Packet []byte) ([]byte, error) {
+	privKeys := kw.GetPrivateKeys(dc.Parameters)
+	if len(privKeys) == 0 {
+		return nil, errors.New("no private keys found for PKCS7 decryption")
+	}
+	privKeysPasswords := kw.getPrivateKeysPasswords(dc.Parameters)
+	if len(privKeysPasswords) != len(privKeys) {
+		return nil, errors.New("private key password array length must be same as that of private keys")
+	}
+
+	x509Certs, err := collectX509s(dc.Parameters["x509s"])
+	if err != nil {
+		return nil, err
+	}
+	if len(x509Certs) == 0 {
+		return nil, errors.New("no x509 certificates found needed for PKCS7 decryption")
+	}
+
+	p7, err := pkcs7.Parse(pkcs7Packet)
+	if err != nil {
+		return nil, errors.Wrapf(err, "could not parse PKCS7 packet")
+	}
+
+	for idx, privKey := range privKeys {
+		key, err := utils.ParsePrivateKey(privKey, privKeysPasswords[idx], "PKCS7")
+		if err != nil {
+			return nil, err
+		}
+		for _, x509Cert := range x509Certs {
+			optsData, err := p7.Decrypt(x509Cert, crypto.PrivateKey(key))
+			if err != nil {
+				continue
+			}
+			return optsData, nil
+		}
+	}
+	return nil, errors.New("PKCS7: No suitable private key found for decryption")
+}
+
+// GetKeyIdsFromWrappedKeys converts the base64 encoded Packet to uint64 keyIds;
+// We cannot do this with pkcs7
+func (kw *pkcs7KeyWrapper) GetKeyIdsFromPacket(b64pkcs7Packets string) ([]uint64, error) {
+	return nil, nil
+}
+
+// GetRecipients converts the wrappedKeys to an array of recipients
+// We cannot do this with pkcs7
+func (kw *pkcs7KeyWrapper) GetRecipients(b64pkcs7Packets string) ([]string, error) {
+	return []string{"[pkcs7]"}, nil
+}

vendor/github.com/containers/ocicrypt/reader.go

@@ -0,0 +1,40 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package ocicrypt
+
+import (
+	"io"
+)
+
+type readerAtReader struct {
+	r   io.ReaderAt
+	off int64
+}
+
+// ReaderFromReaderAt takes an io.ReaderAt and returns an io.Reader
+func ReaderFromReaderAt(r io.ReaderAt) io.Reader {
+	return &readerAtReader{
+		r:   r,
+		off: 0,
+	}
+}
+
+func (rar *readerAtReader) Read(p []byte) (n int, err error) {
+	n, err = rar.r.ReadAt(p, rar.off)
+	rar.off += int64(n)
+	return n, err
+}

vendor/github.com/containers/ocicrypt/spec/spec.go

@@ -0,0 +1,12 @@
+package spec
+
+const (
+	// MediaTypeLayerEnc is MIME type used for encrypted layers.
+	MediaTypeLayerEnc = "application/vnd.oci.image.layer.v1.tar+encrypted"
+	// MediaTypeLayerGzipEnc is MIME type used for encrypted compressed layers.
+	MediaTypeLayerGzipEnc = "application/vnd.oci.image.layer.v1.tar+gzip+encrypted"
+	// MediaTypeLayerNonDistributableEnc is MIME type used for non distributable encrypted layers.
+	MediaTypeLayerNonDistributableEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+encrypted"
+	// MediaTypeLayerGzipEnc is MIME type used for non distributable encrypted compressed layers.
+	MediaTypeLayerNonDistributableGzipEnc = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip+encrypted"
+)

vendor/github.com/containers/ocicrypt/utils/delayedreader.go

@@ -0,0 +1,109 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"io"
+)
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// DelayedReader wraps a io.Reader and allows a client to use the Reader
+// interface. The DelayedReader holds back some buffer to the client
+// so that it can report any error that occurred on the Reader it wraps
+// early to the client while it may still have held some data back.
+type DelayedReader struct {
+	reader   io.Reader // Reader to Read() bytes from and delay them
+	err      error     // error that occurred on the reader
+	buffer   []byte    // delay buffer
+	bufbytes int       // number of bytes in the delay buffer to give to Read(); on '0' we return 'EOF' to caller
+	bufoff   int       // offset in the delay buffer to give to Read()
+}
+
+// NewDelayedReader wraps a io.Reader and allocates a delay buffer of bufsize bytes
+func NewDelayedReader(reader io.Reader, bufsize uint) io.Reader {
+	return &DelayedReader{
+		reader: reader,
+		buffer: make([]byte, bufsize),
+	}
+}
+
+// Read implements the io.Reader interface
+func (dr *DelayedReader) Read(p []byte) (int, error) {
+	if dr.err != nil && dr.err != io.EOF {
+		return 0, dr.err
+	}
+
+	// if we are completely drained, return io.EOF
+	if dr.err == io.EOF && dr.bufbytes == 0 {
+		return 0, io.EOF
+	}
+
+	// only at the beginning we fill our delay buffer in an extra step
+	if dr.bufbytes < len(dr.buffer) && dr.err == nil {
+		dr.bufbytes, dr.err = FillBuffer(dr.reader, dr.buffer)
+		if dr.err != nil && dr.err != io.EOF {
+			return 0, dr.err
+		}
+	}
+	// dr.err != nil means we have EOF and can drain the delay buffer
+	// otherwise we need to still read from the reader
+
+	var tmpbuf []byte
+	tmpbufbytes := 0
+	if dr.err == nil {
+		tmpbuf = make([]byte, len(p))
+		tmpbufbytes, dr.err = FillBuffer(dr.reader, tmpbuf)
+		if dr.err != nil && dr.err != io.EOF {
+			return 0, dr.err
+		}
+	}
+
+	// copy out of the delay buffer into 'p'
+	tocopy1 := min(len(p), dr.bufbytes)
+	c1 := copy(p[:tocopy1], dr.buffer[dr.bufoff:])
+	dr.bufoff += c1
+	dr.bufbytes -= c1
+
+	c2 := 0
+	// can p still hold more data?
+	if c1 < len(p) {
+		// copy out of the tmpbuf into 'p'
+		c2 = copy(p[tocopy1:], tmpbuf[:tmpbufbytes])
+	}
+
+	// if tmpbuf holds data we need to hold onto, copy them
+	// into the delay buffer
+	if tmpbufbytes-c2 > 0 {
+		// left-shift the delay buffer and append the tmpbuf's remaining data
+		dr.buffer = dr.buffer[dr.bufoff : dr.bufoff+dr.bufbytes]
+		dr.buffer = append(dr.buffer, tmpbuf[c2:tmpbufbytes]...)
+		dr.bufoff = 0
+		dr.bufbytes = len(dr.buffer)
+	}
+
+	var err error
+	if dr.bufbytes == 0 {
+		err = io.EOF
+	}
+	return c1 + c2, err
+}

vendor/github.com/containers/ocicrypt/utils/ioutils.go

@@ -0,0 +1,31 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"io"
+)
+
+// FillBuffer fills the given buffer with as many bytes from the reader as possible. It returns
+// EOF if an EOF was encountered or any other error.
+func FillBuffer(reader io.Reader, buffer []byte) (int, error) {
+	n, err := io.ReadFull(reader, buffer)
+	if err == io.ErrUnexpectedEOF {
+		return n, io.EOF
+	}
+	return n, err
+}

vendor/github.com/containers/ocicrypt/utils/testing.go

@@ -0,0 +1,166 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+// CreateRSAKey creates an RSA key
+func CreateRSAKey(bits int) (*rsa.PrivateKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, bits)
+	if err != nil {
+		return nil, errors.Wrap(err, "rsa.GenerateKey failed")
+	}
+	return key, nil
+}
+
+// CreateRSATestKey creates an RSA key of the given size and returns
+// the public and private key in PEM or DER format
+func CreateRSATestKey(bits int, password []byte, pemencode bool) ([]byte, []byte, error) {
+	key, err := CreateRSAKey(bits)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "x509.MarshalPKIXPublicKey failed")
+	}
+	privData := x509.MarshalPKCS1PrivateKey(key)
+
+	// no more encoding needed for DER
+	if !pemencode {
+		return pubData, privData, nil
+	}
+
+	publicKey := pem.EncodeToMemory(&pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: pubData,
+	})
+
+	var block *pem.Block
+
+	typ := "RSA PRIVATE KEY"
+	if len(password) > 0 {
+		block, err = x509.EncryptPEMBlock(rand.Reader, typ, privData, password, x509.PEMCipherAES256)
+		if err != nil {
+			return nil, nil, errors.Wrap(err, "x509.EncryptPEMBlock failed")
+		}
+	} else {
+		block = &pem.Block{
+			Type:  typ,
+			Bytes: privData,
+		}
+	}
+
+	privateKey := pem.EncodeToMemory(block)
+
+	return publicKey, privateKey, nil
+}
+
+// CreateECDSATestKey creates and elliptic curve key for the given curve and returns
+// the public and private key in DER format
+func CreateECDSATestKey(curve elliptic.Curve) ([]byte, []byte, error) {
+	key, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "ecdsa.GenerateKey failed")
+	}
+
+	pubData, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "x509.MarshalPKIXPublicKey failed")
+	}
+
+	privData, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "x509.MarshalECPrivateKey failed")
+	}
+
+	return pubData, privData, nil
+}
+
+// CreateTestCA creates a root CA for testing
+func CreateTestCA() (*rsa.PrivateKey, *x509.Certificate, error) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "rsa.GenerateKey failed")
+	}
+
+	ca := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			CommonName: "test-ca",
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().AddDate(1, 0, 0),
+		IsCA:                  true,
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+	}
+	caCert, err := certifyKey(&key.PublicKey, ca, key, ca)
+
+	return key, caCert, err
+}
+
+// CertifyKey certifies a public key using the given CA's private key and cert;
+// The certificate template for the public key is optional
+func CertifyKey(pubbytes []byte, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
+	pubKey, err := ParsePublicKey(pubbytes, "CertifyKey")
+	if err != nil {
+		return nil, err
+	}
+	return certifyKey(pubKey, template, caKey, caCert)
+}
+
+func certifyKey(pub interface{}, template *x509.Certificate, caKey *rsa.PrivateKey, caCert *x509.Certificate) (*x509.Certificate, error) {
+	if template == nil {
+		template = &x509.Certificate{
+			SerialNumber: big.NewInt(1),
+			Subject: pkix.Name{
+				CommonName: "testkey",
+			},
+			NotBefore:             time.Now(),
+			NotAfter:              time.Now().Add(time.Hour),
+			IsCA:                  false,
+			KeyUsage:              x509.KeyUsageDigitalSignature,
+			BasicConstraintsValid: true,
+		}
+	}
+
+	certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, pub, caKey)
+	if err != nil {
+		return nil, errors.Wrap(err, "x509.CreateCertificate failed")
+	}
+
+	cert, err := x509.ParseCertificate(certDER)
+	if err != nil {
+		return nil, errors.Wrap(err, "x509.ParseCertificate failed")
+	}
+
+	return cert, nil
+}

vendor/github.com/containers/ocicrypt/utils/utils.go

@@ -0,0 +1,220 @@
+/*
+   Copyright The ocicrypt Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package utils
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"strings"
+
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	json "gopkg.in/square/go-jose.v2"
+)
+
+// parseJWKPrivateKey parses the input byte array as a JWK and makes sure it's a private key
+func parseJWKPrivateKey(privKey []byte, prefix string) (interface{}, error) {
+	jwk := json.JSONWebKey{}
+	err := jwk.UnmarshalJSON(privKey)
+	if err != nil {
+		return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
+	}
+	if jwk.IsPublic() {
+		return nil, fmt.Errorf("%s: JWK is not a private key", prefix)
+	}
+	return &jwk, nil
+}
+
+// parseJWKPublicKey parses the input byte array as a JWK
+func parseJWKPublicKey(privKey []byte, prefix string) (interface{}, error) {
+	jwk := json.JSONWebKey{}
+	err := jwk.UnmarshalJSON(privKey)
+	if err != nil {
+		return nil, errors.Wrapf(err, "%s: Could not parse input as JWK", prefix)
+	}
+	if !jwk.IsPublic() {
+		return nil, fmt.Errorf("%s: JWK is not a public key", prefix)
+	}
+	return &jwk, nil
+}
+
+// IsPasswordError checks whether an error is related to a missing or wrong
+// password
+func IsPasswordError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+
+	return strings.Contains(msg, "password") &&
+		(strings.Contains(msg, "missing") || strings.Contains(msg, "wrong"))
+}
+
+// ParsePrivateKey tries to parse a private key in DER format first and
+// PEM format after, returning an error if the parsing failed
+func ParsePrivateKey(privKey, privKeyPassword []byte, prefix string) (interface{}, error) {
+	key, err := x509.ParsePKCS8PrivateKey(privKey)
+	if err != nil {
+		key, err = x509.ParsePKCS1PrivateKey(privKey)
+		if err != nil {
+			key, err = x509.ParseECPrivateKey(privKey)
+		}
+	}
+	if err != nil {
+		block, _ := pem.Decode(privKey)
+		if block != nil {
+			var der []byte
+			if x509.IsEncryptedPEMBlock(block) {
+				if privKeyPassword == nil {
+					return nil, errors.Errorf("%s: Missing password for encrypted private key", prefix)
+				}
+				der, err = x509.DecryptPEMBlock(block, privKeyPassword)
+				if err != nil {
+					return nil, errors.Errorf("%s: Wrong password: could not decrypt private key", prefix)
+				}
+			} else {
+				der = block.Bytes
+			}
+
+			key, err = x509.ParsePKCS8PrivateKey(der)
+			if err != nil {
+				key, err = x509.ParsePKCS1PrivateKey(der)
+				if err != nil {
+					return nil, errors.Wrapf(err, "%s: Could not parse private key", prefix)
+				}
+			}
+		} else {
+			key, err = parseJWKPrivateKey(privKey, prefix)
+		}
+	}
+	return key, err
+}
+
+// IsPrivateKey returns true in case the given byte array represents a private key
+// It returns an error if for example the password is wrong
+func IsPrivateKey(data []byte, password []byte) (bool, error) {
+	_, err := ParsePrivateKey(data, password, "")
+	return err == nil, err
+}
+
+// ParsePublicKey tries to parse a public key in DER format first and
+// PEM format after, returning an error if the parsing failed
+func ParsePublicKey(pubKey []byte, prefix string) (interface{}, error) {
+	key, err := x509.ParsePKIXPublicKey(pubKey)
+	if err != nil {
+		block, _ := pem.Decode(pubKey)
+		if block != nil {
+			key, err = x509.ParsePKIXPublicKey(block.Bytes)
+			if err != nil {
+				return nil, errors.Wrapf(err, "%s: Could not parse public key", prefix)
+			}
+		} else {
+			key, err = parseJWKPublicKey(pubKey, prefix)
+		}
+	}
+	return key, err
+}
+
+// IsPublicKey returns true in case the given byte array represents a public key
+func IsPublicKey(data []byte) bool {
+	_, err := ParsePublicKey(data, "")
+	return err == nil
+}
+
+// ParseCertificate tries to parse a public key in DER format first and
+// PEM format after, returning an error if the parsing failed
+func ParseCertificate(certBytes []byte, prefix string) (*x509.Certificate, error) {
+	x509Cert, err := x509.ParseCertificate(certBytes)
+	if err != nil {
+		block, _ := pem.Decode(certBytes)
+		if block == nil {
+			return nil, fmt.Errorf("%s: Could not PEM decode x509 certificate", prefix)
+		}
+		x509Cert, err = x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return nil, errors.Wrapf(err, "%s: Could not parse x509 certificate", prefix)
+		}
+	}
+	return x509Cert, err
+}
+
+// IsCertificate returns true in case the given byte array represents an x.509 certificate
+func IsCertificate(data []byte) bool {
+	_, err := ParseCertificate(data, "")
+	return err == nil
+}
+
+// IsGPGPrivateKeyRing returns true in case the given byte array represents a GPG private key ring file
+func IsGPGPrivateKeyRing(data []byte) bool {
+	r := bytes.NewBuffer(data)
+	_, err := openpgp.ReadKeyRing(r)
+	return err == nil
+}
+
+// SortDecryptionKeys parses a list of comma separated base64 entries and sorts the data into
+// a map. Each entry in the list may be either a GPG private key ring, private key, or x.509
+// certificate
+func SortDecryptionKeys(b64ItemList string) (map[string][][]byte, error) {
+	dcparameters := make(map[string][][]byte)
+
+	for _, b64Item := range strings.Split(b64ItemList, ",") {
+		var password []byte
+		b64Data := strings.Split(b64Item, ":")
+		keyData, err := base64.StdEncoding.DecodeString(b64Data[0])
+		if err != nil {
+			return nil, errors.New("Could not base64 decode a passed decryption key")
+		}
+		if len(b64Data) == 2 {
+			password, err = base64.StdEncoding.DecodeString(b64Data[1])
+			if err != nil {
+				return nil, errors.New("Could not base64 decode a passed decryption key password")
+			}
+		}
+		var key string
+		isPrivKey, err := IsPrivateKey(keyData, password)
+		if IsPasswordError(err) {
+			return nil, err
+		}
+		if isPrivKey {
+			key = "privkeys"
+			if _, ok := dcparameters["privkeys-passwords"]; !ok {
+				dcparameters["privkeys-passwords"] = [][]byte{password}
+			} else {
+				dcparameters["privkeys-passwords"] = append(dcparameters["privkeys-passwords"], password)
+			}
+		} else if IsCertificate(keyData) {
+			key = "x509s"
+		} else if IsGPGPrivateKeyRing(keyData) {
+			key = "gpg-privatekeys"
+		}
+		if key != "" {
+			values := dcparameters[key]
+			if values == nil {
+				dcparameters[key] = [][]byte{keyData}
+			} else {
+				dcparameters[key] = append(dcparameters[key], keyData)
+			}
+		} else {
+			return nil, errors.New("Unknown decryption key type")
+		}
+	}
+
+	return dcparameters, nil
+}