diff --git a/go.mod b/go.mod index bf2cedadf2..f0c90feb2a 100644 --- a/go.mod +++ b/go.mod @@ -26,11 +26,11 @@ require ( github.com/sigstore/cosign/v2 v2.6.5 github.com/sigstore/protobuf-specs v0.5.2 github.com/sigstore/rekor v1.5.4 - github.com/sigstore/sigstore v1.11.1 - github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.1 - github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.1 - github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.1 - github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.1 + github.com/sigstore/sigstore v1.11.2 + github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.2 + github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.2 + github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.2 + github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.2 github.com/spiffe/go-spiffe/v2 v2.9.0 github.com/stretchr/testify v1.12.1 github.com/tektoncd/pipeline v1.18.0 @@ -65,7 +65,7 @@ require ( cloud.google.com/go/auth/oauth2adapt v0.3.0 // indirect cloud.google.com/go/firestore v1.25.0 // indirect cloud.google.com/go/iam v1.13.0 // indirect - cloud.google.com/go/kms v1.33.0 // indirect + cloud.google.com/go/kms v1.35.0 // indirect cloud.google.com/go/longrunning v1.2.0 // indirect cloud.google.com/go/monitoring v1.30.0 // indirect filippo.io/edwards25519 v1.2.0 // indirect @@ -76,10 +76,10 @@ require ( github.com/Antonboom/nilnil v1.0.1 // indirect github.com/Antonboom/testifylint v1.5.2 // indirect github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 // indirect - github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect @@ -91,7 +91,7 @@ require ( github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect github.com/Azure/go-autorest/logger v0.2.1 // indirect github.com/Azure/go-autorest/tracing v0.6.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 // indirect github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect github.com/Crocmagnon/fatcontext v0.7.1 // indirect github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect diff --git a/go.sum b/go.sum index ef9c1a3de8..b28e6edb58 100644 --- a/go.sum +++ b/go.sum @@ -68,8 +68,8 @@ cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp cloud.google.com/go/iam v0.4.0/go.mod h1:cbaZxyScUhxl7ZAkNWiALgihfP75wS/fUsVNaa1r3vA= cloud.google.com/go/iam v1.13.0 h1:ufT3FPT5rFFXu6UtLkNoxaOaV5EuA1dsSkmemCSTo6U= cloud.google.com/go/iam v1.13.0/go.mod h1:gHXdDEiPDvqd1q1KwBDGQlgZY/BwY760zU2LhOZS5w0= -cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo= -cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= +cloud.google.com/go/kms v1.35.0 h1:nJ/ktaqspx1nPM9vIcO0SHbhqCAm8nvAxL1siuVgKm0= +cloud.google.com/go/kms v1.35.0/go.mod h1:0++71pIHvJL+GmMa8K4jOWFq7gNOX3jm2PRMSJwTKJw= cloud.google.com/go/logging v1.19.1 h1:7SsLhyTDBDrJw+Ll6Ns3I2mByqHXvJUc3rGjSlwiWgU= cloud.google.com/go/logging v1.19.1/go.mod h1:2IkQ/d8jVJqV2qW8ZUGUiMjdZG1gkLD2JReGbZ8isqg= cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= @@ -121,16 +121,16 @@ github.com/Antonboom/testifylint v1.5.2 h1:4s3Xhuv5AvdIgbd8wOOEeo0uZG7PbDKQyKY5l github.com/Antonboom/testifylint v1.5.2/go.mod h1:vxy8VJ0bc6NavlYqjZfmp6EfqXMtBgQ4+mhCojwC1P8= github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU= github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 h1:zvXfGJCWvywnCA814d8ZiVyt+fm9nnTE8xSb99zRyfo= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3/go.mod h1:XtxD48QPInqoj+GMlcRlXHEYsoOxFnP6w2JgIZ9rDS4= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 h1:w3gDUJlJ0BfBsHH02DCBDwbkmMSXJqBj6nBOCo9iocY= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0/go.mod h1:7scl8mG/IFLVjJ9ef/ltdND2T1z0CkgVSaQoUxLvmeU= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 h1:ldKsKtEIblsgsr6mPwrd9yRntoX6uLz/K89wsldwx/k= github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3/go.mod h1:MAm7bk0oDLmD8yIkvfbxPW04fxzphPyL+7GzwHxOp6Y= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 h1:Terj1CMW4+NY5CpWjSRkqLoxh2DkYDdv/FH2z0897Uc= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0/go.mod h1:7Ut2Qw9vcwpLW5Q4MBy43uSxXS7tK2yjs94OJ6j5thE= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0/go.mod h1:i2h9fsTFKZorh8RdV2IcSUf/Qj98GlTkrTvUbX/s8as= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= @@ -162,8 +162,8 @@ github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUM github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 h1:MDT4FxAPve5FnYn6vOL1r7RCRDG+l9cI7a5LlCuHsqA= -github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI= +github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 h1:0O6j18nQDoIff6/mtosT5LNU2WehEwp+LqfX6699oqY= +github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1/go.mod h1:xdYAf5bjkOpsd3auA8riiJW4vneBubt9caavL7626jQ= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs= github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= @@ -1134,18 +1134,18 @@ github.com/sigstore/rekor v1.5.4 h1:A9zITTrkRwO+8lfq7L/gBR7rDHHcBQJRI+a0JQo4xDM= github.com/sigstore/rekor v1.5.4/go.mod h1:0bcUHhZPlG+RVW1dI/7sdBp0MiVWVzk9h0tgOH/o0Yc= github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443 h1:/CO8F6m3Bo/f59bZo5dv1sTIfUnQqVnepIdDV24KoDw= github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443/go.mod h1:w1h8wF8vq9lHjmtRdwJiEaoVxhP+WHIMpj4M39pkzp0= -github.com/sigstore/sigstore v1.11.1 h1:kPqGeoOk3IGCJH76ssgX5PKMm8mbHNnM9fhKLDc6M8E= -github.com/sigstore/sigstore v1.11.1/go.mod h1:0jewOSMygmxdOaBIOhD1teBSIleg7RExQ1baacNrv4A= +github.com/sigstore/sigstore v1.11.2 h1:oFPZIqFuOFJcTfNMW847kvq/czev7oeo/eDYPPMRwr8= +github.com/sigstore/sigstore v1.11.2/go.mod h1:72vQpQeeHgCFJzQnLX1w2sD1HjSJTEeW300ialacOkI= github.com/sigstore/sigstore-go v1.2.1 h1:YWP/rDbBaEBvtbkj6xtwsSj38ZCFEhTVVadNOXjVe3A= github.com/sigstore/sigstore-go v1.2.1/go.mod h1:I8BqVwAb/SaQJ5pBu5IDFY+ksq8O/1/kCag8XUgrsko= -github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.1 h1:Xw+W6YvW/bQ3zSAYK6hsOQplGz/X9yOvCGeQLfkNy4c= -github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.1/go.mod h1:agtjJMPuI6q2rBTM0XZiOFsZjlcZnTi7xkBFQt0NISY= -github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.1 h1:UfIJOml1Y9uJwTy8cDbP7a6x/0By+fXIV7dyUHvEZlA= -github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.1/go.mod h1:xQ5RXq7EDorvH2+1cNQLXQUjXVlhz64q+CZf5Jol8FU= -github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.1 h1:Ab4K/QqBmlmOu5X05qLTeQnPblVqqzrC//F7J/imzoI= -github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.1/go.mod h1:db/U8Hp9wrarN12CE99SdDEef9FCsgyGTD2gaFRfep4= -github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.1 h1:WIgn5z+Wx9ZM8MPTZlMIJ5YXZq36VrcYXFfCCokMqGc= -github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.1/go.mod h1:byZFStGl4JcpWux75DD7gmpYyYjyy2BmkjsJhdSA8UE= +github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.2 h1:ll52dCkIiLuB2V/GcddjieE0+EjA3INqC0HYITavVFQ= +github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.2/go.mod h1:agtjJMPuI6q2rBTM0XZiOFsZjlcZnTi7xkBFQt0NISY= +github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.2 h1:/gBoE9TCQPu8WX6IpCsub7EhQKhGbIrLyGDz5Neo/dc= +github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.2/go.mod h1:KZB5ngHanlWe3AqY/7GRyu6aBbgkN3m+JqIDmIBp6GI= +github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.2 h1:S1t28MpG12QmxxzlyNYPLrkzNReilXBOkJ35i2hb4SU= +github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.2/go.mod h1:uJqXrPsnGjiSKl1IfI0eVq0gMEfLBaD8yzOQ1pKpG0E= +github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.2 h1:YTIl3++lxXf/QPGkyawEN8FxFjprRekRnNYdHsWG9ns= +github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.2/go.mod h1:pyX09Xu5qJ1+4S31v+g38yYN0XlA4WJGmD+El8bav40= github.com/sigstore/timestamp-authority/v2 v2.1.2 h1:7DDhnknLL4w8VwomyvW2W8qblOS9LDR8oihna+jc7Ls= github.com/sigstore/timestamp-authority/v2 v2.1.2/go.mod h1:o6rAVZceFyejClIj/uStRNIemP16bVMZtbMmhk6pr0U= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= @@ -1240,8 +1240,8 @@ github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0 h1:xpI5pnEQ0erFCS3JmcEl7Blluo8Zi github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0/go.mod h1:wDDAhjfd1t4TjeJCSsmFK7CARPUs/ITi16ZZ8kmAaFQ= github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0 h1:eXuNqgrcYelxU1MVikOJDP3wTS5lvihM4ntoAbAMfvs= github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0/go.mod h1:3RhcxAqek6xUlRFmJifvU4CYLZN60KMQdIKqpZAZJG0= -github.com/tink-crypto/tink-go/v2 v2.8.0 h1:1zODq1bZDqOQdNPjhvwGYLDw9On7mDWPnQf+4xXlpAc= -github.com/tink-crypto/tink-go/v2 v2.8.0/go.mod h1:aNXZeyxjQU9iqAeARRNmbESXUW6Mao1HRCCTY8B1TFM= +github.com/tink-crypto/tink-go/v2 v2.9.0 h1:uvjgS1IYDB4zhDK0Zow8ZFB73IjzMAoSqW0JkFnvkrc= +github.com/tink-crypto/tink-go/v2 v2.9.0/go.mod h1:aNXZeyxjQU9iqAeARRNmbESXUW6Mao1HRCCTY8B1TFM= github.com/tjfoc/gmsm v1.3.2/go.mod h1:HaUcFuY0auTiaHB9MHFGCPx5IaLhTUd2atbCFBQXn9w= github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho= github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE= diff --git a/vendor/cloud.google.com/go/kms/apiv1/auxiliary.go b/vendor/cloud.google.com/go/kms/apiv1/auxiliary.go index 5a59688fc7..4228eb10e2 100644 --- a/vendor/cloud.google.com/go/kms/apiv1/auxiliary.go +++ b/vendor/cloud.google.com/go/kms/apiv1/auxiliary.go @@ -18,11 +18,13 @@ package kms import ( "context" + "iter" "time" kmspb "cloud.google.com/go/kms/apiv1/kmspb" "cloud.google.com/go/longrunning" gax "github.com/googleapis/gax-go/v2" + gaxiter "github.com/googleapis/gax-go/v2/iterator" "google.golang.org/api/iterator" locationpb "google.golang.org/genproto/googleapis/cloud/location" ) @@ -389,6 +391,12 @@ func (op *ExecuteSingleTenantHsmInstanceProposalOperation) Name() string { return op.lro.Name() } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *CryptoKeyIterator) All() iter.Seq2[*kmspb.CryptoKey, error] { + return gaxiter.RangeAdapter(it.Next) +} + // CryptoKeyIterator manages a stream of *kmspb.CryptoKey. type CryptoKeyIterator struct { items []*kmspb.CryptoKey @@ -436,6 +444,12 @@ func (it *CryptoKeyIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *CryptoKeyVersionIterator) All() iter.Seq2[*kmspb.CryptoKeyVersion, error] { + return gaxiter.RangeAdapter(it.Next) +} + // CryptoKeyVersionIterator manages a stream of *kmspb.CryptoKeyVersion. type CryptoKeyVersionIterator struct { items []*kmspb.CryptoKeyVersion @@ -483,6 +497,12 @@ func (it *CryptoKeyVersionIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *EkmConnectionIterator) All() iter.Seq2[*kmspb.EkmConnection, error] { + return gaxiter.RangeAdapter(it.Next) +} + // EkmConnectionIterator manages a stream of *kmspb.EkmConnection. type EkmConnectionIterator struct { items []*kmspb.EkmConnection @@ -530,6 +550,12 @@ func (it *EkmConnectionIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *ImportJobIterator) All() iter.Seq2[*kmspb.ImportJob, error] { + return gaxiter.RangeAdapter(it.Next) +} + // ImportJobIterator manages a stream of *kmspb.ImportJob. type ImportJobIterator struct { items []*kmspb.ImportJob @@ -577,6 +603,12 @@ func (it *ImportJobIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *KeyHandleIterator) All() iter.Seq2[*kmspb.KeyHandle, error] { + return gaxiter.RangeAdapter(it.Next) +} + // KeyHandleIterator manages a stream of *kmspb.KeyHandle. type KeyHandleIterator struct { items []*kmspb.KeyHandle @@ -624,6 +656,12 @@ func (it *KeyHandleIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *KeyRingIterator) All() iter.Seq2[*kmspb.KeyRing, error] { + return gaxiter.RangeAdapter(it.Next) +} + // KeyRingIterator manages a stream of *kmspb.KeyRing. type KeyRingIterator struct { items []*kmspb.KeyRing @@ -671,6 +709,12 @@ func (it *KeyRingIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *LocationIterator) All() iter.Seq2[*locationpb.Location, error] { + return gaxiter.RangeAdapter(it.Next) +} + // LocationIterator manages a stream of *locationpb.Location. type LocationIterator struct { items []*locationpb.Location @@ -718,6 +762,12 @@ func (it *LocationIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *RetiredResourceIterator) All() iter.Seq2[*kmspb.RetiredResource, error] { + return gaxiter.RangeAdapter(it.Next) +} + // RetiredResourceIterator manages a stream of *kmspb.RetiredResource. type RetiredResourceIterator struct { items []*kmspb.RetiredResource @@ -765,6 +815,12 @@ func (it *RetiredResourceIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *SingleTenantHsmInstanceIterator) All() iter.Seq2[*kmspb.SingleTenantHsmInstance, error] { + return gaxiter.RangeAdapter(it.Next) +} + // SingleTenantHsmInstanceIterator manages a stream of *kmspb.SingleTenantHsmInstance. type SingleTenantHsmInstanceIterator struct { items []*kmspb.SingleTenantHsmInstance @@ -812,6 +868,12 @@ func (it *SingleTenantHsmInstanceIterator) takeBuf() interface{} { return b } +// All returns an iterator. If an error is returned by the iterator, the +// iterator will stop after that iteration. +func (it *SingleTenantHsmInstanceProposalIterator) All() iter.Seq2[*kmspb.SingleTenantHsmInstanceProposal, error] { + return gaxiter.RangeAdapter(it.Next) +} + // SingleTenantHsmInstanceProposalIterator manages a stream of *kmspb.SingleTenantHsmInstanceProposal. type SingleTenantHsmInstanceProposalIterator struct { items []*kmspb.SingleTenantHsmInstanceProposal diff --git a/vendor/cloud.google.com/go/kms/apiv1/auxiliary_go123.go b/vendor/cloud.google.com/go/kms/apiv1/auxiliary_go123.go deleted file mode 100644 index fb957bb098..0000000000 --- a/vendor/cloud.google.com/go/kms/apiv1/auxiliary_go123.go +++ /dev/null @@ -1,87 +0,0 @@ -// Copyright 2026 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// https://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// Code generated by protoc-gen-go_gapic. DO NOT EDIT. - -//go:build go1.23 - -package kms - -import ( - "iter" - - kmspb "cloud.google.com/go/kms/apiv1/kmspb" - "github.com/googleapis/gax-go/v2/iterator" - locationpb "google.golang.org/genproto/googleapis/cloud/location" -) - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *CryptoKeyIterator) All() iter.Seq2[*kmspb.CryptoKey, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *CryptoKeyVersionIterator) All() iter.Seq2[*kmspb.CryptoKeyVersion, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *EkmConnectionIterator) All() iter.Seq2[*kmspb.EkmConnection, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *ImportJobIterator) All() iter.Seq2[*kmspb.ImportJob, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *KeyHandleIterator) All() iter.Seq2[*kmspb.KeyHandle, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *KeyRingIterator) All() iter.Seq2[*kmspb.KeyRing, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *LocationIterator) All() iter.Seq2[*locationpb.Location, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *RetiredResourceIterator) All() iter.Seq2[*kmspb.RetiredResource, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *SingleTenantHsmInstanceIterator) All() iter.Seq2[*kmspb.SingleTenantHsmInstance, error] { - return iterator.RangeAdapter(it.Next) -} - -// All returns an iterator. If an error is returned by the iterator, the -// iterator will stop after that iteration. -func (it *SingleTenantHsmInstanceProposalIterator) All() iter.Seq2[*kmspb.SingleTenantHsmInstanceProposal, error] { - return iterator.RangeAdapter(it.Next) -} diff --git a/vendor/cloud.google.com/go/kms/apiv1/kmspb/resources.pb.go b/vendor/cloud.google.com/go/kms/apiv1/kmspb/resources.pb.go index 5df438cc88..bd2aee6d8f 100644 --- a/vendor/cloud.google.com/go/kms/apiv1/kmspb/resources.pb.go +++ b/vendor/cloud.google.com/go/kms/apiv1/kmspb/resources.pb.go @@ -2268,16 +2268,24 @@ func (x *ImportJob) GetCryptoKeyBackend() string { // levels. type ExternalProtectionLevelOptions struct { state protoimpl.MessageState `protogen:"open.v1"` - // The URI for an external resource that this + // Optional. The URI for an external resource that this // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents. ExternalKeyUri string `protobuf:"bytes,1,opt,name=external_key_uri,json=externalKeyUri,proto3" json:"external_key_uri,omitempty"` - // The path to the external key material on the EKM when using + // Optional. The path to the external key material on the EKM when using // [EkmConnection][google.cloud.kms.v1.EkmConnection] e.g., "v0/my/key". Set // this field instead of external_key_uri when using an // [EkmConnection][google.cloud.kms.v1.EkmConnection]. EkmConnectionKeyPath string `protobuf:"bytes,2,opt,name=ekm_connection_key_path,json=ekmConnectionKeyPath,proto3" json:"ekm_connection_key_path,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Optional. The resource name of the backend environment where the key + // material of [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] is + // associated with. Setting this field overrides the [CryptoKeyBackend][]. + // This field may be set when + // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] is set to + // [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC]. Format: + // `projects/*/locations/*/ekmConnections/*`. + EkmConnectionBackendOverride string `protobuf:"bytes,3,opt,name=ekm_connection_backend_override,json=ekmConnectionBackendOverride,proto3" json:"ekm_connection_backend_override,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ExternalProtectionLevelOptions) Reset() { @@ -2324,6 +2332,13 @@ func (x *ExternalProtectionLevelOptions) GetEkmConnectionKeyPath() string { return "" } +func (x *ExternalProtectionLevelOptions) GetEkmConnectionBackendOverride() string { + if x != nil { + return x.EkmConnectionBackendOverride + } + return "" +} + // A // [KeyAccessJustificationsPolicy][google.cloud.kms.v1.KeyAccessJustificationsPolicy] // specifies zero or more allowed @@ -2810,10 +2825,12 @@ const file_google_cloud_kms_v1_resources_proto_rawDesc = "" + "\n" + "\x06ACTIVE\x10\x02\x12\v\n" + "\aEXPIRED\x10\x03:{\xeaAx\n" + - "!cloudkms.googleapis.com/ImportJob\x12Sprojects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}\"\x81\x01\n" + - "\x1eExternalProtectionLevelOptions\x12(\n" + - "\x10external_key_uri\x18\x01 \x01(\tR\x0eexternalKeyUri\x125\n" + - "\x17ekm_connection_key_path\x18\x02 \x01(\tR\x14ekmConnectionKeyPath\"x\n" + + "!cloudkms.googleapis.com/ImportJob\x12Sprojects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}\"\x81\x02\n" + + "\x1eExternalProtectionLevelOptions\x12-\n" + + "\x10external_key_uri\x18\x01 \x01(\tB\x03\xe0A\x01R\x0eexternalKeyUri\x12:\n" + + "\x17ekm_connection_key_path\x18\x02 \x01(\tB\x03\xe0A\x01R\x14ekmConnectionKeyPath\x12t\n" + + "\x1fekm_connection_backend_override\x18\x03 \x01(\tB-\xe0A\x01\xfaA'\n" + + "%cloudkms.googleapis.com/EkmConnectionR\x1cekmConnectionBackendOverride\"x\n" + "\x1dKeyAccessJustificationsPolicy\x12W\n" + "\x16allowed_access_reasons\x18\x01 \x03(\x0e2!.google.cloud.kms.v1.AccessReasonR\x14allowedAccessReasons\"\xeb\x02\n" + "\x0fRetiredResource\x12\x1a\n" + diff --git a/vendor/cloud.google.com/go/kms/internal/version.go b/vendor/cloud.google.com/go/kms/internal/version.go index 133b3d568e..7405e512ea 100644 --- a/vendor/cloud.google.com/go/kms/internal/version.go +++ b/vendor/cloud.google.com/go/kms/internal/version.go @@ -17,4 +17,4 @@ package internal // Version is the current tagged release of the library. -const Version = "1.33.0" +const Version = "1.35.0" diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md index f745dca9d6..8cda72f567 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md @@ -1,5 +1,22 @@ # Release History +## 1.23.3 (2026-10-06) + +### Bugs Fixed + +* Fixed `arm.ResourceID.Location` being empty when the `locations` segment uses different casing. + +### Other Changes + +* Added `azure-deprecating` to the default set of allowed (non-redacted) response headers for logging. +* Replaced internal default HTTP client with the one from `sdk/internal`. + +## 1.23.2 (2026-09-28) + +### Bugs Fixed + +* Fixed unmarshalling `datetime.RFC7231` to use a fixed `GMT` zone. + ## 1.23.1 (2026-08-27) ### Other Changes diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go index c602e77d1b..4b4aa1fb98 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource/resource_identifier.go @@ -141,7 +141,7 @@ func (id *ResourceID) init(parent *ResourceID, resourceType ResourceType, name s id.SubscriptionID = name } - if resourceType.lastType() == locationsKey { + if strings.EqualFold(resourceType.lastType(), locationsKey) { id.Location = name } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml index b81b621038..5807f6b69c 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/ci.yml @@ -3,7 +3,6 @@ trigger: branches: include: - main - - feature/* - hotfix/* - release/* paths: diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go index fcbf011e7d..bfbea747dd 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go @@ -37,5 +37,5 @@ const ( Module = "azcore" // Version is the semantic version (see http://semver.org) of this module. - Version = "v1.23.1" + Version = "v1.23.3" ) diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go index 3d95fe30dd..b93c9c362d 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pipeline.go @@ -6,6 +6,7 @@ package runtime import ( "github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported" "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" + azt "github.com/Azure/azure-sdk-for-go/sdk/internal/transport" ) // PipelineOptions contains Pipeline options for SDK developers @@ -85,7 +86,7 @@ func NewPipeline(module, version string, plOpts PipelineOptions, options *policy policies = append(policies, exported.PolicyFunc(bodyDownloadPolicy)) transport := cp.Transport if transport == nil { - transport = defaultHTTPClient + transport = azt.DefaultHTTPClient } return exported.NewPipeline(transport, policies...) } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go index d9e6481de8..61ba383aae 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_logging.go @@ -34,6 +34,7 @@ func NewLogPolicy(o *policy.LogOptions) policy.Policy { // construct default hash set of allowed headers allowedHeaders := map[string]struct{}{ "accept": {}, + "azure-deprecating": {}, "cache-control": {}, "connection": {}, "content-length": {}, diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md index 567e6975b1..a7551e49a6 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/BREAKING_CHANGES.md @@ -1,11 +1,22 @@ # Breaking Changes +## v1.15.0 + +### Service Fabric transport requirements + +`ManagedIdentityCredential` now requires a transport that supports the Service Fabric endpoint's +certificate pinning. Applications with a custom `ClientOptions.Transport` must provide an +`*http.Client` whose Transport is `nil` or a standard `*http.Transport` without custom TLS dialing +or verification callbacks. Unsupported transports cause credential construction to fail. +Leave `ClientOptions.Transport` `nil` to use the default transport. The credential derives the +pinned client without modifying a caller-supplied client and rejects redirects. + ## v1.8.0 ### New errors from `NewManagedIdentityCredential` in some environments `NewManagedIdentityCredential` now returns an error when `ManagedIdentityCredentialOptions.ID` is set in a hosting environment whose managed identity API doesn't support user-assigned identities. `ManagedIdentityCredential.GetToken()` formerly logged a warning in these cases. Returning an error instead prevents the credential authenticating an unexpected identity. The affected hosting environments are: - * Azure Arc + * Azure Arc (user-assigned identities are supported starting in v1.15.0 when the agent supports them) * Azure ML (when a resource or object ID is specified; client IDs are supported) * Cloud Shell * Service Fabric diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md index 3dea713ccf..ce7aff7ee2 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/CHANGELOG.md @@ -1,5 +1,25 @@ # Release History +## 1.15.0 (2026-10-14) + +### Features Added + +- `ManagedIdentityCredential` and `DefaultAzureCredential` support user-assigned managed identities + on Azure Arc when the agent supports them +- `WorkloadIdentityCredential` supports identity binding mode via `WorkloadIdentityCredentialOptions.EnableAzureProxy` + +### Bugs Fixed + +- `ManagedIdentityCredential` verifies the Service Fabric endpoint's certificate against + `IDENTITY_SERVER_THUMBPRINT` and rejects redirects + +### Other Changes + +- On Service Fabric, a custom `ClientOptions.Transport` must be an `*http.Client` with a `nil` + Transport or a standard `*http.Transport` without custom TLS dialing or verification callbacks. + Unsupported transports now cause credential construction to fail +- Upgraded dependencies + ## 1.14.1 (2026-08-27) ### Other Changes diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md index 127c25b72c..2abfccfa37 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/README.md @@ -68,6 +68,25 @@ in any hosting environment which supports managed identities, such as (this list * [Azure Service Fabric](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity) * [Azure Virtual Machines](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/how-to-use-vm-token) +### Azure Arc user-assigned identities + +On Azure Arc, `ManagedIdentityCredential` supports selecting a user-assigned identity by client, +object, or resource ID through `ManagedIdentityCredentialOptions.ID`. `DefaultAzureCredential` +supports selecting one by client ID through the `AZURE_CLIENT_ID` environment variable. +The Azure Arc agent must support user-assigned +identities and confirm the requested identity in its token response. Otherwise, token acquisition +fails rather than authenticating the machine's system-assigned identity. + +### Service Fabric transport requirements + +On Service Fabric, `ManagedIdentityCredential` pins the endpoint certificate to +`IDENTITY_SERVER_THUMBPRINT` and rejects redirects. Leave `ClientOptions.Transport` `nil` to use +the default transport. A custom transport must be an `*http.Client` whose `Transport` is `nil` or +an `*http.Transport` without custom TLS dialing or verification callbacks. The credential derives +the pinned client without modifying the caller's client. Unsupported transports cause credential +construction to fail. See the [troubleshooting guide](https://aka.ms/azsdk/go/identity/troubleshoot#azure-service-fabric-managed-identity) +for configuration errors. + ## Examples - [Authenticate with DefaultAzureCredential](#authenticate-with-defaultazurecredential "Authenticate with DefaultAzureCredential") @@ -244,5 +263,3 @@ additional questions or comments. [ctc_overview]: https://aka.ms/azsdk/go/identity/credential-chains#chainedtokencredential-overview [dac_overview]: https://aka.ms/azsdk/go/identity/credential-chains#defaultazurecredential-overview - - diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md index c69664a84a..82c2ba7b95 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/TROUBLESHOOTING.md @@ -20,6 +20,8 @@ This troubleshooting guide covers failure investigation techniques, common error - [Troubleshoot ManagedIdentityCredential authentication issues](#troubleshoot-managedidentitycredential-authentication-issues) - [Azure App Service and Azure Functions managed identity](#azure-app-service-and-azure-functions-managed-identity) - [Azure Virtual Machine managed identity](#azure-virtual-machine-managed-identity) + - [Azure Arc managed identity](#azure-arc-managed-identity) + - [Azure Service Fabric managed identity](#azure-service-fabric-managed-identity) - [Troubleshoot WorkloadIdentityCredential authentication issues](#troubleshoot-workloadidentitycredential-authentication-issues) - [Get additional help](#get-additional-help) @@ -120,8 +122,35 @@ azlog.SetEvents(azidentity.EventAuthentication) |---|---|---| |Azure Virtual Machines and Scale Sets|[Configuration](https://learn.microsoft.com/entra/identity/managed-identities-azure-resources/qs-configure-portal-windows-vm)|[Troubleshooting](#azure-virtual-machine-managed-identity)| |Azure App Service and Azure Functions|[Configuration](https://learn.microsoft.com/azure/app-service/overview-managed-identity)|[Troubleshooting](#azure-app-service-and-azure-functions-managed-identity)| -|Azure Arc|[Configuration](https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)|| -|Azure Service Fabric|[Configuration](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity)|| +|Azure Arc|[Configuration](https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication)|[Troubleshooting](#azure-arc-managed-identity)| +|Azure Service Fabric|[Configuration](https://learn.microsoft.com/azure/service-fabric/concepts-managed-identity)|[Troubleshooting](#azure-service-fabric-managed-identity)| + +### Azure Arc managed identity + +User-assigned identities require an Azure Arc agent that supports selecting an identity by client, +object, or resource ID. `NewManagedIdentityCredential` accepts these IDs, but token acquisition +fails if the agent doesn't confirm the requested identity. This prevents an older agent from +silently authenticating the machine's system-assigned identity instead. + +| Error Message | Description | Mitigation | +|---|---|---| +|azure arc did not confirm the requested user-assigned managed identity in the token response|The agent's response omitted the requested identity selector or returned a different identity.|Ensure the Azure Arc agent supports user-assigned identities, the identity is assigned to the resource, and the configured ID is correct. Upgrade the agent if necessary. Only omit the ID if the application intends to authenticate the system-assigned identity.| + +### Azure Service Fabric managed identity + +The credential requires an HTTPS endpoint, pins its certificate to `IDENTITY_SERVER_THUMBPRINT`, +and rejects redirects. It derives a pinned HTTP client without modifying a caller-supplied client. + +| Error Message | Description | Mitigation | +|---|---|---| +|Service Fabric managed identity requires ClientOptions.Transport to be an *http.Client|The configured transport can't be augmented with the required certificate pinning.|Leave `ClientOptions.Transport` `nil`, or provide an `*http.Client` with a `nil` Transport or a standard `*http.Transport`.| +|managed identity on Service Fabric requires a standard *http.Transport|The HTTP client's underlying transport can't be augmented with certificate pinning.|Use a standard `*http.Transport`, or leave the transport `nil`.| +|managed identity on Service Fabric does not support a transport with custom TLS dialing|A custom `DialTLS` or `DialTLSContext` callback can bypass certificate verification.|Remove the custom TLS dialing callback. Use `DialContext` if custom connection setup is needed.| +|managed identity on Service Fabric does not support custom TLS verification|The transport has a custom `VerifyPeerCertificate` or `VerifyConnection` callback.|Remove the custom verification callback so the credential can apply the required certificate pinning.| +|IDENTITY_SERVER_THUMBPRINT must be a SHA-1 certificate thumbprint|The configured thumbprint isn't a valid 40-digit hexadecimal SHA-1 thumbprint. Colons and whitespace are allowed.|Verify the Service Fabric environment configuration supplies the endpoint certificate's thumbprint.| +|TLS certificate thumbprint from Service Fabric did not match IDENTITY_SERVER_THUMBPRINT|The endpoint presented a certificate that doesn't match the configured thumbprint.|Verify the endpoint and thumbprint configuration, including any certificate rotation. Don't disable certificate verification.| +|managed identity endpoint for Service Fabric must use HTTPS|The configured endpoint isn't an absolute HTTPS URL.|Verify `IDENTITY_ENDPOINT` contains the HTTPS endpoint provided by Service Fabric.| +|redirects are not permitted for managed identity on Service Fabric|The endpoint returned a redirect.|Verify `IDENTITY_ENDPOINT` points directly to the Service Fabric managed identity endpoint.| ### Azure Virtual Machine managed identity @@ -249,6 +278,7 @@ Get-AzAccessToken -ResourceUrl "https://management.core.windows.net" | Error Message |Description| Mitigation | |---|---|---| |no client ID/tenant ID/token file specified|Incomplete configuration|In most cases these values are provided via environment variables set by Azure Workload Identity. +|In an application using [Azure Kubernetes Service identity bindings](https://learn.microsoft.com/azure/aks/identity-bindings-concepts): |`WorkloadIdentityCredential` isn't configured to use the identity binding proxy|Set `WorkloadIdentityCredentialOptions.EnableAzureProxy` to `true` ## Troubleshoot AzurePipelinesCredential authentication issues diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml index 7e05ddcecb..c50b0be2e9 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/ci.yml @@ -3,7 +3,6 @@ trigger: branches: include: - main - - feature/* - hotfix/* - release/* paths: diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/configurable_client.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/configurable_client.go new file mode 100644 index 0000000000..0ebba8d851 --- /dev/null +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/configurable_client.go @@ -0,0 +1,25 @@ +// Copyright (c) Microsoft Corporation. All rights reserved. +// Licensed under the MIT License. + +package azidentity + +import ( + "errors" + "net/http" + + "github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo" +) + +// configurableClient is installed at the bottom of the managed identity pipeline as the transport +// for sources that require MSAL to configure the client/transport (Service Fabric today, mTLS later). +type configurableClient struct { + client *http.Client +} + +// Do implements policy.Transporter. +func (c *configurableClient) Do(req *http.Request) (*http.Response, error) { + if c.client == nil { + return nil, errorinfo.NonRetriableError(errors.New(credNameManagedIdentity + ": managed identity transport was not configured")) + } + return c.client.Do(req) +} diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go index 02f02fec41..1173b8deb7 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_client.go @@ -15,6 +15,7 @@ import ( "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" azruntime "github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime" "github.com/Azure/azure-sdk-for-go/sdk/internal/log" + "github.com/Azure/azure-sdk-for-go/sdk/internal/transport" msalerrors "github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors" "github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity" ) @@ -44,6 +45,11 @@ type managedIdentityClient struct { // a credentialUnavailableError instead of an AuthenticationFailedError for an unexpected IMDS response. chained bool msalClient msalManagedIdentityClient + // configurableClient is set when a source (Service Fabric today, mTLS later) requires MSAL to + // configure the transport. MSAL applies certificate pinning and the redirect policy via + // ConfigureClient, preserving the azcore pipeline's middleware. Its client field holds the + // caller-supplied base until ConfigureClient replaces it with the augmented client. + configurableClient configurableClient } // setIMDSRetryOptionDefaults sets zero-valued fields to default values appropriate for IMDS @@ -104,6 +110,22 @@ func newManagedIdentityClient(options *ManagedIdentityCredentialOptions) (*manag setIMDSRetryOptionDefaults(&cp.Retry) } + if source == managedidentity.ServiceFabric { + if cp.Transport != nil { + // This source has MSAL pin the base client, so a caller-supplied Transport must be an + // *http.Client MSAL can clone. Any other transporter can't be pinned, so fail closed + // rather than send credentials unpinned. + base, ok := cp.Transport.(*http.Client) + if !ok { + return nil, errors.New(credNameManagedIdentity + ": Service Fabric managed identity requires ClientOptions.Transport to be an *http.Client") + } + c.configurableClient.client = base + } + // Install a client MSAL configures (see ConfigureClient) at the bottom of the pipeline, + // so certificate verification and the redirect policy apply without discarding middleware. + cp.Transport = &c.configurableClient + } + c.azClient, err = azcore.NewClient(module, version, azruntime.PipelineOptions{ Tracing: azruntime.TracingOptions{ Namespace: traceNamespace, @@ -157,6 +179,24 @@ func (c *managedIdentityClient) Do(r *http.Request) (*http.Response, error) { return doForClient(c.azClient, r) } +// ConfigureClient implements managedidentity.ClientConfigurer. MSAL passes an augmentation +// that applies a source's certificate pinning and redirect policy; azidentity supplies the caller's +// Transport as the base (or the SDK default when none was set) and installs the augmented client at +// the bottom of the pipeline, preserving the azcore middleware above. +func (c *managedIdentityClient) ConfigureClient(augment func(*http.Client) (*http.Client, error)) error { + base := c.configurableClient.client + if base == nil { + // no caller provided transport so use our default + base = transport.DefaultHTTPClient + } + client, err := augment(base) + if err != nil { + return err + } + c.configurableClient.client = client + return nil +} + // authenticate acquires an access token func (c *managedIdentityClient) GetToken(ctx context.Context, tro policy.TokenRequestOptions) (azcore.AccessToken, error) { // no need to synchronize around this value because it's true only when DefaultAzureCredential constructed the client, @@ -220,3 +260,5 @@ func (c *managedIdentityClient) GetToken(ctx context.Context, tro policy.TokenRe err = newAuthenticationFailedErrorFromMSAL(credNameManagedIdentity, err) return azcore.AccessToken{}, err } + +var _ managedidentity.ClientConfigurer = (*managedIdentityClient)(nil) diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go index d0a5ecf97e..074c0b62bf 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/managed_identity_credential.go @@ -32,7 +32,6 @@ type ManagedIDKind interface { // ClientID is the client ID of a user-assigned managed identity. [NewManagedIdentityCredential] // returns an error when a ClientID is specified on the following platforms: // -// - Azure Arc // - Cloud Shell // - Service Fabric type ClientID string @@ -49,7 +48,6 @@ func (c ClientID) String() string { // ObjectID is the object ID of a user-assigned managed identity. [NewManagedIdentityCredential] // returns an error when an ObjectID is specified on the following platforms: // -// - Azure Arc // - Azure ML // - Cloud Shell // - Service Fabric @@ -67,7 +65,6 @@ func (o ObjectID) String() string { // ResourceID is the resource ID of a user-assigned managed identity. [NewManagedIdentityCredential] // returns an error when a ResourceID is specified on the following platforms: // -// - Azure Arc // - Azure ML // - Cloud Shell // - Service Fabric @@ -84,12 +81,18 @@ func (r ResourceID) String() string { // ManagedIdentityCredentialOptions contains optional parameters for ManagedIdentityCredential. type ManagedIdentityCredentialOptions struct { + // ClientOptions configures the credential's HTTP pipeline. On Service Fabric, Transport must be nil + // or an *http.Client whose Transport is nil or an *http.Transport. Custom TLS dialing and verification + // callbacks aren't supported. The credential derives a client that pins the endpoint certificate + // and rejects redirects without modifying the caller's client. azcore.ClientOptions // ID of a managed identity the credential should authenticate. Set this field to use a specific identity instead of // the hosting environment's default. The value may be the identity's client, object, or resource ID. // NewManagedIdentityCredential returns an error when the hosting environment doesn't support user-assigned managed // identities, or the specified kind of ID. + // On Azure Arc, user-assigned identities require an agent that supports them. GetToken returns an error if the + // agent doesn't confirm the requested identity in its response. ID ManagedIDKind // dac indicates whether the credential is part of DefaultAzureCredential. When true, and the environment doesn't have diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go index fb5014489d..17841c50d0 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/version.go @@ -11,5 +11,5 @@ const ( module = "github.com/Azure/azure-sdk-for-go/sdk/" + component // Version is the semantic version (see http://semver.org) of this module. - version = "v1.14.1" + version = "v1.15.0" ) diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go index 87399aed37..11b43e0904 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azidentity/workload_identity.go @@ -52,14 +52,14 @@ type WorkloadIdentityCredentialOptions struct { // the application responsible for ensuring the configured authority is valid and trustworthy. DisableInstanceDiscovery bool - // enableAzureProxy determines whether the credential reads proxy configuration from environment variables. When + // EnableAzureProxy determines whether the credential reads proxy configuration from environment variables. When // this value is true and proxy configuration isn't present or this value is false, the credential will request // tokens directly from Entra ID. // // The proxy feature is designed for applications that deploy to many clusters and clusters that host many // applications. See the Azure Kubernetes Service identity bindings documentation for more information on when // to set this option: https://learn.microsoft.com/azure/aks/identity-bindings-concepts - enableAzureProxy bool + EnableAzureProxy bool // TenantID of the service principal. Defaults to the value of the environment variable AZURE_TENANT_ID. TenantID string @@ -103,7 +103,7 @@ func NewWorkloadIdentityCredential(options *WorkloadIdentityCredentialOptions) ( DisableInstanceDiscovery: options.DisableInstanceDiscovery, } - if options.enableAzureProxy { + if options.EnableAzureProxy { if err := customtokenproxy.Configure(&caco.ClientOptions); err != nil { return nil, err } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_http_client.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport.go similarity index 88% rename from vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_http_client.go rename to vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport.go index 928e9bf925..dce3e118b4 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_http_client.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport.go @@ -1,7 +1,7 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -package runtime +package transport import ( "crypto/tls" @@ -12,7 +12,8 @@ import ( "golang.org/x/net/http2" ) -var defaultHTTPClient *http.Client +// DefaultHTTPClient is the default configured http.Client used by all clients. +var DefaultHTTPClient *http.Client func init() { defaultTransport := &http.Transport{ @@ -39,7 +40,7 @@ func init() { // if there's no response to the ping within the timeout, the connection will be closed http2Transport.PingTimeout = 5 * time.Second } - defaultHTTPClient = &http.Client{ + DefaultHTTPClient = &http.Client{ Transport: defaultTransport, } } diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_dialer_other.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport_other.go similarity index 94% rename from vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_dialer_other.go rename to vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport_other.go index 1c75d771f2..2477c308a6 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_dialer_other.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport_other.go @@ -3,7 +3,7 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -package runtime +package transport import ( "context" diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_dialer_wasm.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport_wasm.go similarity index 94% rename from vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_dialer_wasm.go rename to vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport_wasm.go index 3dc9eeecdd..9b14ecab64 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/transport_default_dialer_wasm.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/internal/transport/transport_wasm.go @@ -3,7 +3,7 @@ // Copyright (c) Microsoft Corporation. All rights reserved. // Licensed under the MIT License. -package runtime +package transport import ( "context" diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go index 97f4de2591..4a4979fcf1 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential/confidential.go @@ -986,7 +986,7 @@ func WithFMIPath(path string) interface { // WithAttribute specifies an identity attribute to include in the token request. // The attribute is sent as "attributes" in the request body and returned as "xmc_attr" -// in the access token claims. This is sometimes used withFMIPath +// in the access token claims. It can be used with or without [WithFMIPath]. func WithAttribute(attrValue string) interface { AcquireByCredentialOption options.CallOption @@ -1002,6 +1002,10 @@ func WithAttribute(attrValue string) interface { if t.extraBodyParameters == nil { t.extraBodyParameters = make(map[string]string) } + if t.cacheKeyComponents == nil { + t.cacheKeyComponents = make(map[string]string) + } + t.cacheKeyComponents["attributes"] = attrValue t.extraBodyParameters["attributes"] = attrValue default: return fmt.Errorf("unexpected options type %T", a) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors/errors.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors/errors.go index b5cbb57217..2d6e9c23e0 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors/errors.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/errors/errors.go @@ -36,10 +36,7 @@ type verboser interface { // Verbose prints the most verbose error that the error message has. func Verbose(err error) string { build := strings.Builder{} - for { - if err == nil { - break - } + for err != nil { if v, ok := err.(verboser); ok { build.WriteString(v.Verbose()) } else { diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go index ed622e5ec6..27068cad08 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/base/base.go @@ -328,6 +328,30 @@ func (b Client) AuthCodeURL(ctx context.Context, clientID, redirectURI string, s return baseURL.String(), nil } +func (b Client) proactiveRefresh(ctx context.Context, silent AcquireTokenSilentParameters, authParams authority.AuthParams, refreshToken accesstokens.RefreshToken) (accesstokens.TokenResponse, bool, error) { + if silent.IsAppCache { + token, err := b.Token.Credential(ctx, authParams, silent.Credential) + return token, err == nil, nil + } + if silent.AuthorizationType == authority.ATOnBehalfOf { + token, err := b.Token.OnBehalfOf(ctx, authParams, silent.Credential) + return token, err == nil, nil + } + + switch silent.RequestType { + case accesstokens.ATConfidential: + token, err := b.Token.Refresh(ctx, silent.RequestType, authParams, silent.Credential, refreshToken) + return token, err == nil, nil + case accesstokens.ATPublic: + token, err := b.Token.Refresh(ctx, silent.RequestType, authParams, silent.Credential, refreshToken) + return token, err == nil, err + case accesstokens.ATUnknown: + return accesstokens.TokenResponse{}, false, errors.New("silent request type cannot be ATUnknown") + default: + return accesstokens.TokenResponse{}, false, fmt.Errorf("unsupported silent request type %s", silent.RequestType) + } +} + func (b Client) AcquireTokenSilent(ctx context.Context, silent AcquireTokenSilentParameters) (AuthResult, error) { ar := AuthResult{} // when tenant == "", the caller didn't specify a tenant and WithTenant will choose the client's configured tenant @@ -391,19 +415,12 @@ func (b Client) AcquireTokenSilent(ctx context.Context, silent AcquireTokenSilen // If the token is not same, we don't need to refresh it. // Which means it refreshed. if str, err := m.Read(ctx, authParams); err == nil && str.AccessToken.Secret == ar.AccessToken { - switch silent.RequestType { - case accesstokens.ATConfidential: - if tr, er := b.Token.Credential(ctx, authParams, silent.Credential); er == nil { - return b.AuthResultFromToken(ctx, authParams, tr) - } - case accesstokens.ATPublic: - token, err := b.Token.Refresh(ctx, silent.RequestType, authParams, silent.Credential, storageTokenResponse.RefreshToken) - if err != nil { - return ar, err - } + token, refreshed, err := b.proactiveRefresh(ctx, silent, authParams, storageTokenResponse.RefreshToken) + if err != nil { + return ar, err + } + if refreshed { return b.AuthResultFromToken(ctx, authParams, token) - case accesstokens.ATUnknown: - return ar, errors.New("silent request type cannot be ATUnknown") } } } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go index b0311ca6d9..382d7253ef 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/json.go @@ -45,7 +45,7 @@ func Marshal(i interface{}) ([]byte, error) { enc.SetIndent("", "") v := reflect.ValueOf(i) - if v.Kind() != reflect.Ptr && v.CanAddr() { + if v.Kind() != reflect.Pointer && v.CanAddr() { v = v.Addr() } err := marshalStruct(v, &buff, enc) @@ -124,7 +124,7 @@ func hasMarshalJSON(v reflect.Value) bool { ok := false if _, ok = v.Interface().(json.Marshaler); !ok { var i any - if v.Kind() == reflect.Ptr { + if v.Kind() == reflect.Pointer { i = v.Elem().Interface() } else if v.CanAddr() { i = v.Addr().Interface() @@ -141,7 +141,7 @@ func callMarshalJSON(v reflect.Value) ([]byte, error) { return marsh.MarshalJSON() } - if v.Kind() == reflect.Ptr { + if v.Kind() == reflect.Pointer { if marsh, ok := v.Elem().Interface().(json.Marshaler); ok { return marsh.MarshalJSON() } @@ -160,7 +160,7 @@ func callMarshalJSON(v reflect.Value) ([]byte, error) { // the UnmarshalJSON method. func hasUnmarshalJSON(v reflect.Value) bool { // You can't unmarshal on a non-pointer type. - if v.Kind() != reflect.Ptr { + if v.Kind() != reflect.Pointer { if !v.CanAddr() { return false } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/mapslice.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/mapslice.go index cef442f25c..3e90d8272a 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/mapslice.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/mapslice.go @@ -11,7 +11,7 @@ import ( // unmarshalMap unmarshal's a map. func unmarshalMap(dec *json.Decoder, m reflect.Value) error { - if m.Kind() != reflect.Ptr || m.Elem().Kind() != reflect.Map { + if m.Kind() != reflect.Pointer || m.Elem().Kind() != reflect.Map { panic("unmarshalMap called on non-*map value") } mapValueType := m.Elem().Type().Elem() @@ -72,7 +72,7 @@ func (m *mapWalk) start() (stateFn, error) { return nil, fmt.Errorf("Unmarshal expected opening {, received %v", delim) } return m.next, nil - case reflect.Ptr: + case reflect.Pointer: return nil, fmt.Errorf("do not support maps with values of '**type' or '*reference") } @@ -105,7 +105,7 @@ func (m *mapWalk) storeValue() (stateFn, error) { v := m.valueType for { switch v.Kind() { - case reflect.Ptr: + case reflect.Pointer: v = v.Elem() continue case reflect.Struct: @@ -125,7 +125,7 @@ func (m *mapWalk) storeStruct() (stateFn, error) { return nil, err } - if m.valueType.Kind() == reflect.Ptr { + if m.valueType.Kind() == reflect.Pointer { m.m.Elem().SetMapIndex(reflect.ValueOf(m.key), v) return m.next, nil } @@ -163,7 +163,7 @@ func (m *mapWalk) storeSlice() (stateFn, error) { func (m *mapWalk) valueBaseType() (reflect.Type, bool) { ptr := false v := m.valueType - if v.Kind() == reflect.Ptr { + if v.Kind() == reflect.Pointer { ptr = true v = v.Elem() } @@ -174,7 +174,7 @@ func (m *mapWalk) valueBaseType() (reflect.Type, bool) { // ptrSlice, which must be a pointer to a slice. newValue() can be use to // create the slice. func unmarshalSlice(dec *json.Decoder, ptrSlice reflect.Value) error { - if ptrSlice.Kind() != reflect.Ptr || ptrSlice.Elem().Kind() != reflect.Slice { + if ptrSlice.Kind() != reflect.Pointer || ptrSlice.Elem().Kind() != reflect.Slice { panic("unmarshalSlice called on non-*[]slice value") } sliceValueType := ptrSlice.Elem().Type().Elem() @@ -227,7 +227,7 @@ func (s *sliceWalk) start() (stateFn, error) { t := s.valueBaseType() switch t.Kind() { - case reflect.Ptr: + case reflect.Pointer: return nil, fmt.Errorf("cannot unmarshal into a ** or *") case reflect.Struct, reflect.Map, reflect.Slice: delim, err := s.dec.Token() @@ -262,7 +262,7 @@ func (s *sliceWalk) next() (stateFn, error) { func (s *sliceWalk) storeValue() (stateFn, error) { t := s.valueBaseType() switch t.Kind() { - case reflect.Ptr: + case reflect.Pointer: return nil, fmt.Errorf("do not support 'pointer to pointer' or 'pointer to reference' types") case reflect.Struct: return s.storeStruct, nil @@ -280,7 +280,7 @@ func (s *sliceWalk) storeStruct() (stateFn, error) { return nil, err } - if s.valueType.Kind() == reflect.Ptr { + if s.valueType.Kind() == reflect.Pointer { s.s.Elem().Set(reflect.Append(s.s.Elem(), v)) return s.next, nil } @@ -318,7 +318,7 @@ func (s *sliceWalk) storeSlice() (stateFn, error) { // struct, etc... func (s *sliceWalk) valueBaseType() reflect.Type { v := s.valueType - if v.Kind() == reflect.Ptr { + if v.Kind() == reflect.Pointer { v = v.Elem() } return v @@ -326,7 +326,7 @@ func (s *sliceWalk) valueBaseType() reflect.Type { // newValue() returns a new *type that represents type passed. func newValue(valueType reflect.Type) reflect.Value { - if valueType.Kind() == reflect.Ptr { + if valueType.Kind() == reflect.Pointer { return reflect.New(valueType.Elem()) } return reflect.New(valueType) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/marshal.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/marshal.go index df5dc6e11b..f5d7a5373a 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/marshal.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/marshal.go @@ -15,7 +15,7 @@ import ( // as JSON into buff (sometimes with writes to buff directly, sometimes via enc). // This call is recursive for all fields of *struct or struct type. func marshalStruct(v reflect.Value, buff *bytes.Buffer, enc *json.Encoder) error { - if v.Kind() == reflect.Ptr { + if v.Kind() == reflect.Pointer { v = v.Elem() } // We only care about custom Marshalling a struct. @@ -79,9 +79,9 @@ func marshalStruct(v reflect.Value, buff *bytes.Buffer, enc *json.Encoder) error // Write out the field name part. jsonName := translator.jsonName(t.Field(x).Name) - buff.WriteString(fmt.Sprintf("%q:", jsonName)) + fmt.Fprintf(buff, "%q:", jsonName) - if field.Kind() == reflect.Ptr { + if field.Kind() == reflect.Pointer { field = field.Elem() } @@ -169,13 +169,13 @@ func (m *mapEncode) start() (stateFn, error) { } valueBaseType := m.m.Type().Elem() - if valueBaseType.Kind() == reflect.Ptr { + if valueBaseType.Kind() == reflect.Pointer { valueBaseType = valueBaseType.Elem() } m.valueBaseType = valueBaseType switch valueBaseType.Kind() { - case reflect.Ptr: + case reflect.Pointer: return nil, fmt.Errorf("Marshal does not support ** or *") case reflect.Struct, reflect.Map, reflect.Slice: return m.encode, nil @@ -196,7 +196,7 @@ func (m *mapEncode) encode() (stateFn, error) { for iter.Next() { // Write the key. k := iter.Key() - m.buff.WriteString(fmt.Sprintf("%q:", k.String())) + fmt.Fprintf(m.buff, "%q:", k.String()) v := iter.Value() switch m.valueBaseType.Kind() { @@ -273,13 +273,13 @@ func (s *sliceEncode) start() (stateFn, error) { } valueBaseType := s.s.Type().Elem() - if valueBaseType.Kind() == reflect.Ptr { + if valueBaseType.Kind() == reflect.Pointer { valueBaseType = valueBaseType.Elem() } s.valueBaseType = valueBaseType switch valueBaseType.Kind() { - case reflect.Ptr: + case reflect.Pointer: return nil, fmt.Errorf("Marshal does not support ** or *") case reflect.Struct, reflect.Map, reflect.Slice: return s.encode, nil @@ -331,7 +331,7 @@ func writeAddFields(i interface{}, buff *bytes.Buffer, enc *json.Encoder) error x := 0 for k, v := range m { - buff.WriteString(fmt.Sprintf("%q:", k)) + fmt.Fprintf(buff, "%q:", k) if err := enc.Encode(v); err != nil { return err } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/struct.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/struct.go index 07751544a2..77032d050b 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/struct.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/json/struct.go @@ -12,7 +12,7 @@ import ( func unmarshalStruct(jdec *json.Decoder, i interface{}) error { v := reflect.ValueOf(i) - if v.Kind() != reflect.Ptr { + if v.Kind() != reflect.Pointer { return fmt.Errorf("Unmarshal() received type %T, which is not a *struct", i) } v = v.Elem() @@ -201,11 +201,11 @@ func fieldBaseType(v reflect.Value, fieldName string) (t reflect.Type, isPtr boo return nil, false, fmt.Errorf("bug: fieldBaseType() lookup of field(%s) on type(%s): do not have field", fieldName, v.Type().Name()) } t = sf.Type - if t.Kind() == reflect.Ptr { + if t.Kind() == reflect.Pointer { t = t.Elem() isPtr = true } - if t.Kind() == reflect.Ptr { + if t.Kind() == reflect.Pointer { return nil, isPtr, fmt.Errorf("received pointer to pointer type, not supported") } return t, isPtr, nil @@ -248,7 +248,7 @@ var umarshalerType = reflect.TypeOf((*json.Unmarshaler)(nil)).Elem() // findFields parses a struct and writes the field tags for lookup. It will return an error // if any field has a type of *struct or struct that does not implement json.Marshaler. func findFields(v reflect.Value) (translateFields, error) { - if v.Kind() == reflect.Ptr { + if v.Kind() == reflect.Pointer { v = v.Elem() } if v.Kind() != reflect.Struct { @@ -267,7 +267,7 @@ func findFields(v reflect.Value) (translateFields, error) { tfs = append(tfs, tf) f := v.Field(i) - if f.Kind() == reflect.Ptr { + if f.Kind() == reflect.Pointer { f = f.Elem() } if f.Kind() == reflect.Struct { diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go index 1fb012fea3..309dda688e 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/local/server.go @@ -174,7 +174,7 @@ func (s *Server) handler(w http.ResponseWriter, r *http.Request) { escapedHeaderErr := html.EscapeString(headerErr) // Note: It is a little weird we handle some errors by not going to the failPage. If they all should, // change this to s.error() and make s.error() write the failPage instead of an error code. - _, _ = w.Write([]byte(fmt.Sprintf(failPage, escapedHeaderErr, desc))) + _, _ = fmt.Fprintf(w, failPage, escapedHeaderErr, desc) s.putResult(Result{Err: fmt.Errorf("%s", desc)}) return diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go index 9b7d3a5f4d..47eba97825 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/oauth.go @@ -311,8 +311,9 @@ func isWaitDeviceCodeErr(err error) bool { return false } var dCErr deviceCodeError - defer c.Resp.Body.Close() body, err := io.ReadAll(c.Resp.Body) + // A close error can't change the result after the response body has been consumed. + _ = c.Resp.Body.Close() if err != nil { return false } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go index dc07c558d1..d4fca719e7 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/accesstokens/accesstokens.go @@ -387,7 +387,7 @@ func (c Client) DeviceCodeResult(ctx context.Context, authParameters authority.A qv.Set(clientID, authParameters.ClientID) addScopeQueryParam(qv, authParameters) - endpoint := strings.Replace(authParameters.Endpoints.TokenEndpoint, "token", "devicecode", -1) + endpoint := strings.ReplaceAll(authParameters.Endpoints.TokenEndpoint, "token", "devicecode") resp := DeviceCodeResponse{} err := c.Comm.URLFormCall(ctx, endpoint, qv, &resp) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go index bf0af2629c..8c30509914 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/authority/authority.go @@ -25,14 +25,14 @@ import ( ) const ( - authorizationEndpoint = "https://%v/%v/oauth2/v2.0/authorize" - aadInstanceDiscoveryEndpoint = "https://%v/common/discovery/instance" - tenantDiscoveryEndpointWithRegion = "https://%s.%s/%s/v2.0/.well-known/openid-configuration" - regionName = "REGION_NAME" - defaultAPIVersion = "2021-02-01" - imdsEndpoint = "http://169.254.169.254/metadata/instance/compute?api-version=" + defaultAPIVersion - autoDetectRegion = "TryAutoDetect" - AccessTokenTypeBearer = "Bearer" + authorizationEndpoint = "https://%v/%v/oauth2/v2.0/authorize" + aadInstanceDiscoveryEndpoint = "https://%v/common/discovery/instance" + regionalTenantDiscoveryEndpoint = "https://%s/%s/v2.0/.well-known/openid-configuration" + regionName = "REGION_NAME" + defaultAPIVersion = "2021-02-01" + imdsEndpoint = "http://169.254.169.254/metadata/instance/compute?api-version=" + defaultAPIVersion + autoDetectRegion = "TryAutoDetect" + AccessTokenTypeBearer = "Bearer" ) // These are various hosts that host AAD Instance discovery endpoints. @@ -134,17 +134,19 @@ func (r *TenantDiscoveryResponse) ValidateIssuerMatchesAuthority(authorityURI st } // Fast path: exact scheme + host match - if issuerURL.Scheme == authorityURL.Scheme && issuerURL.Host == authorityURL.Host { + if issuerURL.Scheme == authorityURL.Scheme && strings.EqualFold(issuerURL.Host, authorityURL.Host) { return nil } // Alias-based acceptance - if aliases != nil && aliases[issuerURL.Host] { - return nil + for alias, trusted := range aliases { + if trusted && strings.EqualFold(alias, issuerURL.Host) { + return nil + } } - issuerHost := issuerURL.Host - authorityHost := authorityURL.Host + issuerHost := strings.ToLower(issuerURL.Host) + authorityHost := strings.ToLower(authorityURL.Host) // Accept if issuer host is trusted if TrustedHost(issuerHost) { @@ -678,16 +680,30 @@ func (c Client) AADInstanceDiscovery(ctx context.Context, authorityInfo Info) (I } if region != "" { environment := authorityInfo.Host + canonicalAlias := "" switch environment { case loginMicrosoft, loginWindows, loginSTSWindows, defaultHost: environment = loginMicrosoft + default: + if metadata, ok := GetKnownMetadata(environment); ok { + environment = metadata.PreferredNetwork + if environment != authorityInfo.Host { + canonicalAlias = environment + } + } } - resp.TenantDiscoveryEndpoint = fmt.Sprintf(tenantDiscoveryEndpointWithRegion, region, environment, authorityInfo.Tenant) + regionalEnvironment := fmt.Sprintf("%s.%s", region, environment) + aliases := []string{regionalEnvironment} + if canonicalAlias != "" { + aliases = append(aliases, canonicalAlias) + } + aliases = append(aliases, authorityInfo.Host) + resp.TenantDiscoveryEndpoint = fmt.Sprintf(regionalTenantDiscoveryEndpoint, regionalEnvironment, authorityInfo.Tenant) metadata := InstanceDiscoveryMetadata{ - PreferredNetwork: fmt.Sprintf("%v.%v", region, authorityInfo.Host), + PreferredNetwork: regionalEnvironment, PreferredCache: authorityInfo.Host, - Aliases: []string{fmt.Sprintf("%v.%v", region, authorityInfo.Host), authorityInfo.Host}, + Aliases: aliases, } resp.Metadata = []InstanceDiscoveryMetadata{metadata} } else { @@ -728,20 +744,37 @@ func detectRegion(ctx context.Context) string { client := http.Client{ Timeout: time.Duration(2 * time.Second), } - req, _ := http.NewRequestWithContext(ctx, http.MethodGet, imdsEndpoint, nil) + return detectRegionWithClient(ctx, &client, imdsEndpoint) +} + +func detectRegionWithClient(ctx context.Context, client *http.Client, endpoint string) string { + req, _ := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) req.Header.Set("Metadata", "true") resp, err := client.Do(req) if err == nil { - defer resp.Body.Close() + if resp.StatusCode == http.StatusOK { + response, readErr := io.ReadAll(resp.Body) + // A close error can't change the result after the response body has been consumed. + _ = resp.Body.Close() + if readErr != nil { + return "" + } + return parseRegionFromIMDSResponse(response) + } + _ = resp.Body.Close() } // If the request times out or there is an error, it is retried once - if err != nil || resp.StatusCode != http.StatusOK { - resp, err = client.Do(req) - if err != nil || resp.StatusCode != http.StatusOK { - return "" - } + resp, err = client.Do(req) + if err != nil { + return "" + } + if resp.StatusCode != http.StatusOK { + _ = resp.Body.Close() + return "" } response, err := io.ReadAll(resp.Body) + // A close error can't change the result after the response body has been consumed. + _ = resp.Body.Close() if err != nil { return "" } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go index 87e38798ab..ee30537306 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/internal/comm/comm.go @@ -240,9 +240,10 @@ func (c *Client) do(ctx context.Context, req *http.Request) ([]byte, error) { if err != nil { return nil, fmt.Errorf("server response error:\n %w", err) } - defer reply.Body.Close() data, err := c.readBody(reply) + // A close error can't change the result after the response body has been consumed. + _ = reply.Body.Close() if err != nil { return nil, fmt.Errorf("could not read the body of an HTTP Response: %w", err) } @@ -274,7 +275,7 @@ func (c *Client) do(ctx context.Context, req *http.Request) ([]byte, error) { // checkResp checks a response object o make sure it is a pointer to a struct. func (c *Client) checkResp(v reflect.Value) error { - if v.Kind() != reflect.Ptr { + if v.Kind() != reflect.Pointer { return fmt.Errorf("bug: resp argument must a *struct, was %T", v.Interface()) } v = v.Elem() diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/wstrust/defs/wstrust_mex_document.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/wstrust/defs/wstrust_mex_document.go index 99e1205e51..9796728eaf 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/wstrust/defs/wstrust_mex_document.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/ops/wstrust/defs/wstrust_mex_document.go @@ -112,11 +112,12 @@ func bindings(defs Definitions, policies map[string]endpointType) (map[string]ws bindingName := binding.Name specVersion := binding.Operation.Operation.SoapAction - if specVersion == trust13Spec { + switch specVersion { + case trust13Spec: bindings[bindingName] = wsEndpointData{Trust13, policy} - } else if specVersion == trust2005Spec { + case trust2005Spec: bindings[bindingName] = wsEndpointData{Trust2005, policy} - } else { + default: return nil, errors.New("found unknown spec version in mex document") } } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go index 92170a7628..86e88dd513 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/oauth/resolvers.go @@ -22,12 +22,10 @@ import ( type cacheEntry struct { Endpoints authority.Endpoints ValidForDomainsInList map[string]bool - // Aliases stores host aliases from instance discovery for quick lookup - Aliases map[string]bool } func createcacheEntry(endpoints authority.Endpoints) cacheEntry { - return cacheEntry{endpoints, map[string]bool{}, map[string]bool{}} + return cacheEntry{endpoints, map[string]bool{}} } // AuthorityEndpoint retrieves endpoints from an authority for auth and token acquisition. @@ -61,7 +59,7 @@ func (m *authorityEndpoint) ResolveEndpoints(ctx context.Context, authorityInfo return endpoints, nil } - endpoint, err := m.openIDConfigurationEndpoint(ctx, authorityInfo) + endpoint, metadata, err := m.openIDConfigurationEndpoint(ctx, authorityInfo) if err != nil { return authority.Endpoints{}, err } @@ -77,18 +75,19 @@ func (m *authorityEndpoint) ResolveEndpoints(ctx context.Context, authorityInfo tenant := authorityInfo.Tenant endpoints := authority.NewEndpoints( - strings.Replace(resp.AuthorizationEndpoint, "{tenant}", tenant, -1), - strings.Replace(resp.TokenEndpoint, "{tenant}", tenant, -1), - strings.Replace(resp.Issuer, "{tenant}", tenant, -1), + strings.ReplaceAll(resp.AuthorizationEndpoint, "{tenant}", tenant), + strings.ReplaceAll(resp.TokenEndpoint, "{tenant}", tenant), + strings.ReplaceAll(resp.Issuer, "{tenant}", tenant), authorityInfo.Host) - aliases := m.addCachedEndpoints(authorityInfo, userPrincipalName, endpoints) + aliases := aliasesFromMetadata(metadata, authorityInfo.Host) if err := resp.ValidateIssuerMatchesAuthority(authorityInfo.CanonicalAuthorityURI, aliases); err != nil { return authority.Endpoints{}, fmt.Errorf("ResolveEndpoints(): %w", err) } + m.addCachedEndpoints(authorityInfo, userPrincipalName, endpoints) return endpoints, nil }) if err != nil { @@ -117,7 +116,22 @@ func (m *authorityEndpoint) cachedEndpoints(authorityInfo authority.Info, userPr return authority.Endpoints{}, false } -func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, userPrincipalName string, endpoints authority.Endpoints) map[string]bool { +func aliasesFromMetadata(metadata []authority.InstanceDiscoveryMetadata, authorityHost string) map[string]bool { + for _, entry := range metadata { + for _, alias := range entry.Aliases { + if strings.EqualFold(alias, authorityHost) { + aliases := make(map[string]bool, len(entry.Aliases)) + for _, alias := range entry.Aliases { + aliases[alias] = true + } + return aliases + } + } + } + return map[string]bool{} +} + +func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, userPrincipalName string, endpoints authority.Endpoints) { m.mu.Lock() defer m.mu.Unlock() @@ -137,40 +151,30 @@ func (m *authorityEndpoint) addCachedEndpoints(authorityInfo authority.Info, use } } - // Extract aliases from instance discovery metadata and add to cache - for _, metadata := range authorityInfo.InstanceDiscoveryMetadata { - for _, alias := range metadata.Aliases { - updatedCacheEntry.Aliases[alias] = true - } - } - m.cache[authorityInfo.CanonicalAuthorityURI] = updatedCacheEntry - return updatedCacheEntry.Aliases } -func (m *authorityEndpoint) openIDConfigurationEndpoint(ctx context.Context, authorityInfo authority.Info) (string, error) { +func (m *authorityEndpoint) openIDConfigurationEndpoint(ctx context.Context, authorityInfo authority.Info) (string, []authority.InstanceDiscoveryMetadata, error) { if authorityInfo.AuthorityType == authority.ADFS { - return fmt.Sprintf("https://%s/adfs/.well-known/openid-configuration", authorityInfo.Host), nil + return fmt.Sprintf("https://%s/adfs/.well-known/openid-configuration", authorityInfo.Host), authorityInfo.InstanceDiscoveryMetadata, nil } else if authorityInfo.AuthorityType == authority.DSTS { - return fmt.Sprintf("https://%s/dstsv2/%s/v2.0/.well-known/openid-configuration", authorityInfo.Host, authority.DSTSTenant), nil + return fmt.Sprintf("https://%s/dstsv2/%s/v2.0/.well-known/openid-configuration", authorityInfo.Host, authority.DSTSTenant), authorityInfo.InstanceDiscoveryMetadata, nil } else if authorityInfo.ValidateAuthority && !authority.TrustedHost(authorityInfo.Host) { resp, err := m.rest.Authority().AADInstanceDiscovery(ctx, authorityInfo) if err != nil { - return "", err + return "", nil, err } - authorityInfo.InstanceDiscoveryMetadata = resp.Metadata - return resp.TenantDiscoveryEndpoint, nil + return resp.TenantDiscoveryEndpoint, resp.Metadata, nil } else if authorityInfo.Region != "" { resp, err := m.rest.Authority().AADInstanceDiscovery(ctx, authorityInfo) if err != nil { - return "", err + return "", nil, err } - authorityInfo.InstanceDiscoveryMetadata = resp.Metadata - return resp.TenantDiscoveryEndpoint, nil + return resp.TenantDiscoveryEndpoint, resp.Metadata, nil } - return authorityInfo.CanonicalAuthorityURI + "v2.0/.well-known/openid-configuration", nil + return authorityInfo.CanonicalAuthorityURI + "v2.0/.well-known/openid-configuration", authorityInfo.InstanceDiscoveryMetadata, nil } func adfsDomainFromUpn(userPrincipalName string) (string, error) { diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go index 1305c467fe..1dd67289ed 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/internal/version/version.go @@ -8,4 +8,4 @@ package version const SKU = "MSAL.Go" // Version is the version of this client package that is communicated to the server. -const Version = "1.9.0" +const Version = "1.10.1" diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/azure_ml.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/azure_ml.go index d7cffc295e..d638f426e5 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/azure_ml.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/azure_ml.go @@ -10,6 +10,7 @@ import ( ) func createAzureMLAuthRequest(ctx context.Context, id ID, resource string) (*http.Request, error) { + // #nosec G704 -- MSI_ENDPOINT is supplied by the Azure ML managed identity host. req, err := http.NewRequestWithContext(ctx, http.MethodGet, os.Getenv(msiEndpointEnvVar), nil) if err != nil { return nil, err diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/cloud_shell.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/cloud_shell.go index be9a0bca38..e6ede188b4 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/cloud_shell.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/cloud_shell.go @@ -25,6 +25,7 @@ func createCloudShellAuthRequest(ctx context.Context, resource string) (*http.Re msiDataEncoded := data.Encode() body := io.NopCloser(strings.NewReader(msiDataEncoded)) + // #nosec G704 -- MSI_ENDPOINT is supplied by the Cloud Shell managed identity host. req, err := http.NewRequestWithContext(ctx, http.MethodPost, msiEndpointParsed.String(), body) if err != nil { return nil, fmt.Errorf("error creating http request %s", err) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go index d4815be9c2..ffd23bc96c 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/managedidentity.go @@ -200,14 +200,48 @@ func WithClaims(claims string) AcquireTokenOption { } } -// WithHTTPClient allows for a custom HTTP client to be set. Service Fabric requires a standard -// *http.Client with a *http.Transport and does not support custom TLS dialing or verification. +// WithHTTPClient allows for a custom HTTP client to be set. Flows that must configure the +// transport underlying the client (for example, Service Fabric certificate pinning) require a +// [ClientConfigurer], because a plain ops.HTTPClient exposes no way to apply those requirements; +// pass a [ClientConfigurer] here and MSAL will invoke it to install the configuration it needs. +// +// Only the Service Fabric source currently consumes a [ClientConfigurer]; every other managed +// identity source treats the value as a plain ops.HTTPClient and never calls ConfigureClient. func WithHTTPClient(httpClient ops.HTTPClient) ClientOption { return func(c *Client) { c.httpClient = httpClient } } +// ClientConfigurer is an [ops.HTTPClient] that lets MSAL install the transport and client +// configuration a flow requires, such as Service Fabric certificate pinning. Pass one to +// [WithHTTPClient] and MSAL will call ConfigureClient during [New]. +// +// Only the Service Fabric managed identity source consumes a ClientConfigurer. For every other +// source MSAL uses the value directly as an ops.HTTPClient and does not call ConfigureClient, so +// implementations should not rely on ConfigureClient being invoked outside Service Fabric. +// +// Implementations of ConfigureClient must: +// - call augment exactly once, synchronously, before ConfigureClient returns, passing the +// non-nil client MSAL should build upon; +// - route every subsequent Do call through the client augment returns, without bypassing its +// transport, TLS configuration, or redirect policy; +// - forward CloseIdleConnections to that same client; +// - return any error augment reports and complete all configuration before returning. +// +// MSAL fails closed: if augment reports an error, [New] returns it even when ConfigureClient +// discards the error and returns nil, so a misconfigured client is never returned. +// +// MSAL calls ConfigureClient once, during [New]; a ClientConfigurer need not be safe for +// concurrent configuration. An implementation may wrap additional middleware around the client +// augment returns so long as requests still traverse the augmented transport and redirect policy. +type ClientConfigurer interface { + ops.HTTPClient + // ConfigureClient receives augment, which derives the client MSAL requires from the supplied + // base client. See [ClientConfigurer] for the contract implementations must satisfy. + ConfigureClient(augment func(*http.Client) (*http.Client, error)) error +} + func WithRetryPolicyDisabled() ClientOption { return func(c *Client) { c.retryPolicyEnabled = false @@ -273,11 +307,42 @@ func New(id ID, options ...ClientOption) (Client, error) { option(&client) } if source == ServiceFabric { - serviceFabricClient, serviceFabricURL, err := serviceFabricCertificateVerifiedHTTPClient(client.httpClient) + serviceFabricURL, err := serviceFabricEndpoint() + if err != nil { + return Client{}, err + } + + switch tt := client.httpClient.(type) { + case ClientConfigurer: + augmentCalls := 0 + var augmentErr error + err = tt.ConfigureClient(func(c *http.Client) (*http.Client, error) { + augmentCalls++ + var configured *http.Client + configured, augmentErr = serviceFabricCertificateVerifiedHTTPClient(c) + return configured, augmentErr + }) + // Fail closed: if augment failed, New must return that error even when + // ConfigureClient ignores it, so a caller never receives a client that lacks + // the mandatory certificate pinning and redirect policy. + if err == nil { + err = augmentErr + } + if err == nil && augmentCalls != 1 { + return Client{}, fmt.Errorf("ConfigureClient must call augment exactly once to install the Service Fabric client, got %d calls", augmentCalls) + } + case *http.Client: + var serviceFabricClient *http.Client + serviceFabricClient, err = serviceFabricCertificateVerifiedHTTPClient(tt) + client.httpClient = serviceFabricClient + default: + return Client{}, errors.New("Service Fabric managed identity requires an *http.Client or a ClientConfigurer") + } + if err != nil { return Client{}, err } - client.httpClient = serviceFabricClient + client.serviceFabricURL = serviceFabricURL } fakeAuthInfo, err := authority.NewInfoFromAuthorityURI("https://login.microsoftonline.com/managed_identity", false, true) @@ -441,7 +506,8 @@ func (c Client) acquireTokenForAzureArc(ctx context.Context, resource string) (A if err != nil { return AuthResult{}, err } - defer response.Body.Close() + // The response body is unused; a close error can't change its status or headers. + _ = response.Body.Close() if response.StatusCode != http.StatusUnauthorized { return AuthResult{}, fmt.Errorf("expected a 401 response, received %d", response.StatusCode) @@ -572,7 +638,8 @@ func bufferResponseBody(resp *http.Response) error { return nil } body, err := io.ReadAll(resp.Body) - resp.Body.Close() + // A close error can't change the result after the response body has been consumed. + _ = resp.Body.Close() if err != nil { return err } @@ -597,7 +664,8 @@ func (c Client) retry(maxRetries int, req *http.Request) (*http.Response, error) tryCtx, tryCancel := context.WithTimeout(req.Context(), time.Minute) if resp != nil && resp.Body != nil { _, _ = io.Copy(io.Discard, resp.Body) - resp.Body.Close() + // The previous response is discarded, so a close error is non-actionable. + _ = resp.Body.Close() } if cancelPrev != nil { cancelPrev() @@ -646,7 +714,8 @@ func (c Client) getTokenForRequest(req *http.Request, resource string) (accessto return r, err } responseBytes, err := io.ReadAll(resp.Body) - defer resp.Body.Close() + // A close error can't change the result after the response body has been consumed. + _ = resp.Body.Close() if err != nil { return r, err } @@ -691,6 +760,7 @@ func (c Client) getTokenForRequest(req *http.Request, resource string) (accessto func createAppServiceAuthRequest(ctx context.Context, id ID, resource string) (*http.Request, error) { identityEndpoint := os.Getenv(identityEndpointEnvVar) + // #nosec G704 -- IDENTITY_ENDPOINT is supplied by the App Service managed identity host. req, err := http.NewRequestWithContext(ctx, http.MethodGet, identityEndpoint, nil) if err != nil { return nil, err @@ -728,6 +798,7 @@ func createIMDSAuthRequest(ctx context.Context, id ID, resource string) (*http.R } msiEndpoint.RawQuery = msiParameters.Encode() + // #nosec G704 -- imdsDefaultEndpoint is a library constant for the Azure IMDS link-local endpoint. req, err := http.NewRequestWithContext(ctx, http.MethodGet, msiEndpoint.String(), nil) if err != nil { return nil, fmt.Errorf("error creating http request %s", err) @@ -761,6 +832,7 @@ func createAzureArcAuthRequest(ctx context.Context, id ID, resource string, key } msiEndpoint.RawQuery = msiParameters.Encode() + // #nosec G704 -- IDENTITY_ENDPOINT is supplied by the Azure Arc managed identity host. req, err := http.NewRequestWithContext(ctx, http.MethodGet, msiEndpoint.String(), nil) if err != nil { return nil, fmt.Errorf("error creating http request %s", err) diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/servicefabric.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/servicefabric.go index 33c32e4b18..c7b44ac744 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/servicefabric.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/managedidentity/servicefabric.go @@ -22,51 +22,47 @@ import ( // serviceFabricCertificateVerifiedHTTPClient derives a client with Service Fabric's required certificate pinning. // Only standard clients and transports can be safely cloned and augmented without changing the // caller's behavior for other requests. -func serviceFabricCertificateVerifiedHTTPClient(httpClient interface { - Do(*http.Request) (*http.Response, error) - CloseIdleConnections() -}) (*http.Client, string, error) { - endpoint, err := serviceFabricEndpoint() - if err != nil { - return nil, "", err +func serviceFabricCertificateVerifiedHTTPClient(httpClient *http.Client) (*http.Client, error) { + if httpClient == nil { + return nil, errors.New("managed identity on Service Fabric requires a non-nil *http.Client") } pin, err := serviceFabricThumbprint(os.Getenv(identityServerThumbprintEnvVar)) if err != nil { - return nil, "", err + return nil, err } - callerClient, ok := httpClient.(*http.Client) - if !ok { - return nil, "", errors.New("Service Fabric managed identity requires a standard *http.Client") - } - derivedClient := *callerClient + derivedClient := *httpClient var callerTransport *http.Transport - if callerClient.Transport == nil { + if httpClient.Transport == nil { var ok bool callerTransport, ok = http.DefaultTransport.(*http.Transport) if !ok { - return nil, "", errors.New("Service Fabric managed identity requires a standard *http.Transport") + return nil, errors.New("managed identity on Service Fabric requires a standard *http.Transport") } } else { var ok bool - callerTransport, ok = callerClient.Transport.(*http.Transport) + callerTransport, ok = httpClient.Transport.(*http.Transport) if !ok { - return nil, "", errors.New("Service Fabric managed identity requires a standard *http.Transport") + return nil, errors.New("managed identity on Service Fabric requires a standard *http.Transport") } } //nolint:staticcheck // DialTLS must be rejected because it bypasses TLSClientConfig. if callerTransport.DialTLS != nil || callerTransport.DialTLSContext != nil { - return nil, "", errors.New("Service Fabric managed identity does not support a transport with custom TLS dialing") + return nil, errors.New("managed identity on Service Fabric does not support a transport with custom TLS dialing") } if callerTransport.TLSClientConfig != nil && (callerTransport.TLSClientConfig.VerifyPeerCertificate != nil || callerTransport.TLSClientConfig.VerifyConnection != nil) { - return nil, "", errors.New("Service Fabric managed identity does not support custom TLS verification") - } - if callerTransport.TLSNextProto != nil { - return nil, "", errors.New("Service Fabric managed identity does not support custom TLS protocol handlers") + return nil, errors.New("managed identity on Service Fabric does not support custom TLS verification") } derivedTransport := callerTransport.Clone() + // Give the derived transport its own HTTP/2 state so it can never serve a Service Fabric request over a + // connection from the caller's pool. golang.org/x/net/http2.ConfigureTransports (used by azure-sdk-for-go's + // default transport) installs an "h2" callback that retains the original connection pool, and Transport.Clone + // copies that callback by reference. Without clearing it, a pre-existing, unpinned connection to the same + // authority could be reused, bypassing the certificate pin below. Resetting TLSNextProto makes the standard + // library lazily re-establish HTTP/2 with a fresh pool governed by this transport's pinned TLS configuration. + derivedTransport.TLSNextProto = nil tlsConfig := derivedTransport.TLSClientConfig.Clone() if tlsConfig == nil { tlsConfig = &tls.Config{} @@ -74,29 +70,30 @@ func serviceFabricCertificateVerifiedHTTPClient(httpClient interface { tlsConfig.InsecureSkipVerify = true // #nosec G402 -- VerifyConnection below pins the Service Fabric self-signed certificate. tlsConfig.VerifyConnection = func(connectionState tls.ConnectionState) error { if len(connectionState.PeerCertificates) == 0 { - return errors.New("Service Fabric TLS connection did not provide a certificate") + return errors.New("TLS connection to Service Fabric did not provide a certificate") } if subtle.ConstantTimeCompare(serviceFabricCertificateThumbprint(connectionState.PeerCertificates[0]), pin) != 1 { - return errors.New("Service Fabric TLS certificate thumbprint did not match IDENTITY_SERVER_THUMBPRINT") + return errors.New("TLS certificate thumbprint from Service Fabric did not match IDENTITY_SERVER_THUMBPRINT") } return nil } derivedTransport.TLSClientConfig = tlsConfig derivedClient.Transport = derivedTransport derivedClient.CheckRedirect = func(*http.Request, []*http.Request) error { - return errors.New("Service Fabric managed identity redirects are not permitted") + return errors.New("redirects are not permitted for managed identity on Service Fabric") } - return &derivedClient, endpoint, nil + return &derivedClient, nil } func serviceFabricEndpoint() (string, error) { endpoint := os.Getenv(identityEndpointEnvVar) + // #nosec G704 -- the URL is restricted to HTTPS and the caller pins its certificate thumbprint. request, err := http.NewRequest(http.MethodGet, endpoint, nil) if err != nil { return "", err } if request.URL.Scheme != "https" || request.URL.Host == "" { - return "", errors.New("Service Fabric managed identity endpoint must use HTTPS") + return "", errors.New("managed identity endpoint for Service Fabric must use HTTPS") } return request.URL.String(), nil } diff --git a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go index 97c615452f..93f6e702ed 100644 --- a/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go +++ b/vendor/github.com/AzureAD/microsoft-authentication-library-for-go/apps/public/public.go @@ -72,7 +72,7 @@ type clientOptions struct { func (p *clientOptions) validate() error { u, err := url.Parse(p.authority) if err != nil { - return fmt.Errorf("Authority options cannot be URL parsed: %w", err) + return fmt.Errorf("authority options cannot be URL parsed: %w", err) } if u.Scheme != "https" { return fmt.Errorf("Authority(%s) did not start with https://", u.String()) diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/cliplugin/client.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/cliplugin/client.go index 213a926cb3..f2a5b57ba1 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/cliplugin/client.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/cliplugin/client.go @@ -71,6 +71,10 @@ func getPluginExecutableAndKeyResourceID(inputKeyResourceID string) (string, str return "", "", fmt.Errorf("%w: expected format: [plugin name]://[key ref], got: %s", ErrorInputKeyResourceID, inputKeyResourceID) } pluginName, keyResourceID := parts[0], parts[1] + // A path separator would make exec skip the PATH lookup and run a file relative to the working directory. + if strings.ContainsAny(pluginName, `/\`) { + return "", "", fmt.Errorf("%w: plugin name must not contain a path separator, got: %s", ErrorInputKeyResourceID, pluginName) + } executable := PluginBinaryPrefix + pluginName return executable, keyResourceID, nil } diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/client.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/client.go index 3dcd0eb79c..41f8dfdae0 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/client.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/client.go @@ -20,11 +20,13 @@ import ( "context" "crypto" "crypto/ed25519" + "crypto/mldsa" "encoding/base64" "encoding/json" "errors" "fmt" "log" + "net/http" "os" "regexp" "strconv" @@ -279,9 +281,106 @@ func (h *hashivaultClient) fetchPublicKey(_ context.Context) (crypto.PublicKey, return ed25519.PublicKey(decodedPublicKey), nil } + // Vault enterprise also reports the parameter set at the top level of the key + // read response; whichMldsa uses it when the entry name does not carry the set. + params, isMldsa, err := whichMldsa(keyMap, keyResult.Data["parameter_set"]) + if err != nil { + return nil, err + } + if isMldsa { + // Vault and OpenBao return ML-DSA public keys as base64 encoding of the raw key bytes + decodedPublicKey, err := base64.StdEncoding.DecodeString(strPublicKey) + if err != nil { + return nil, fmt.Errorf("failed to base64 decode ML-DSA public key: %w", err) + } + mldsaPublicKey, err := mldsa.NewPublicKey(params, decodedPublicKey) + if err != nil { + return nil, fmt.Errorf("parsing ML-DSA public key: %w", err) + } + // Same validation as the in-process ML-DSA loaders (pkg/signature/mldsa.go): + // it probes Parameters(), rejecting zero-value keys that NewPublicKey accepts. + if _, err := cryptoutils.ValidateMLDSAPublicKey(mldsaPublicKey); err != nil { + return nil, fmt.Errorf("validating ML-DSA public key: %w", err) + } + return mldsaPublicKey, nil + } + return cryptoutils.UnmarshalPEMToPublicKey([]byte(strPublicKey)) } +// whichMldsa determines the ML-DSA parameters of a transit key version entry. +// OpenBao names one key type per parameter set ("mldsa-44"|"mldsa-65"|"mldsa-87"). +// Vault enterprise creates keys with type "ml-dsa" and a parameter_set +// ("44"|"65"|"87"); its key read reports each version entry's name as +// "ml-dsa-", with type and parameter_set at the top level of the response +// (formatKeyPolicy in Vault's builtin/logical/transit/path_keys.go). A bare +// "ml-dsa" entry name is also accepted, taking the parameter set from the entry +// or, failing that, from the top level of the response, passed as paramSet. +// +// isMldsa is false only for key types that are not ML-DSA. An ML-DSA key type that +// cannot be mapped to parameters is an error rather than falling through to PEM +// parsing, which would fail with a misleading error. +func whichMldsa(entry map[string]any, paramSet any) (params mldsa.Parameters, isMldsa bool, err error) { + name, _ := entry["name"].(string) + switch name { + case AlgorithmMLDSA44, AlgorithmMLDSA44FB: + return mldsa.MLDSA44(), true, nil + case AlgorithmMLDSA65, AlgorithmMLDSA65FB: + return mldsa.MLDSA65(), true, nil + case AlgorithmMLDSA87, AlgorithmMLDSA87FB: + return mldsa.MLDSA87(), true, nil + case AlgorithmMLDSA: + // Get the string parameter value from one of the two possible locations, then select the + // corresponding parameter set. The entry's parameter set has priority. + set := "" + if parameterSet, ok := mldsaParameterSet(paramSet); ok { + set = parameterSet + } + if parameterSet, ok := mldsaParameterSet(entry["parameter_set"]); ok { + set = parameterSet + } + if set == "" { + return mldsa.Parameters{}, true, fmt.Errorf("ML-DSA key type %q has no parameter_set", name) + } + params, ok := mldsaParamsForSet(set) + if !ok { + return mldsa.Parameters{}, true, fmt.Errorf("unsupported ML-DSA parameter set %q for key type %q", set, name) + } + return params, true, nil + default: + if strings.HasPrefix(name, "mldsa-") || strings.HasPrefix(name, "ml-dsa-") { + return mldsa.Parameters{}, true, fmt.Errorf("unsupported ML-DSA key type %q", name) + } + return mldsa.Parameters{}, false, nil + } +} + +// Handle both string and Number typed parameter sets. +func mldsaParameterSet(value any) (string, bool) { + switch set := value.(type) { + case string: + return set, true + case json.Number: + return set.String(), true + default: + return "", false + } +} + +// Map parameter set string to mldsa type. +func mldsaParamsForSet(set string) (mldsa.Parameters, bool) { + switch set { + case "44": + return mldsa.MLDSA44(), true + case "65": + return mldsa.MLDSA65(), true + case "87": + return mldsa.MLDSA87(), true + default: + return mldsa.Parameters{}, false + } +} + func (h *hashivaultClient) public() (crypto.PublicKey, error) { var lerr error loader := ttlcache.LoaderFunc[string, crypto.PublicKey]( @@ -326,19 +425,6 @@ func (h hashivaultClient) sign(digest []byte, alg crypto.Hash, opts ...signature prehashed := alg != crypto.Hash(0) - pub, err := h.public() - if err != nil { - return nil, fmt.Errorf("determining key type: %w", err) - } - switch pub.(type) { - case ed25519.PublicKey: - if alg == crypto.SHA512 { - prehashed = true - break - } - prehashed = false - } - signResult, err := client.Write(fmt.Sprintf("/%s/sign/%s%s", h.transitSecretEnginePath, h.keyPath, hashString(alg)), map[string]any{ "input": base64.StdEncoding.Strict().EncodeToString(digest), "prehashed": prehashed, @@ -389,20 +475,8 @@ func (h hashivaultClient) verify(sig, digest []byte, alg crypto.Hash, opts ...si } prehashed := alg != crypto.Hash(0) - pub, err := h.public() - if err != nil { - return fmt.Errorf("determining key type: %w", err) - } - switch pub.(type) { - case ed25519.PublicKey: - if alg == crypto.SHA512 { - prehashed = true - break - } - prehashed = false - } - - result, err := client.Write(fmt.Sprintf("/%s/verify/%s/%s", h.transitSecretEnginePath, h.keyPath, hashString(alg)), map[string]any{ + // Non-empty hash strings include a preceding '/'. + result, err := client.Write(fmt.Sprintf("/%s/verify/%s%s", h.transitSecretEnginePath, h.keyPath, hashString(alg)), map[string]any{ "input": base64.StdEncoding.EncodeToString(digest), "prehashed": prehashed, "signature": fmt.Sprintf("%s%s", vaultDataPrefix, encodedSig), @@ -441,6 +515,9 @@ func vaultDecode(data any, keyVersionUsed *string) ([]byte, error) { return base64.StdEncoding.DecodeString(prefixRegex.ReplaceAllString(encoded, "")) } +// hashString maps alg to the hash suffix of the transit sign/verify URL. +// crypto.Hash(0) yields no suffix: ML-DSA and pure Ed25519 sign the raw +// message and choose their own hash algorithm server-side. func hashString(h crypto.Hash) string { var hashStr string switch h { @@ -461,10 +538,30 @@ func hashString(h crypto.Hash) string { func (h hashivaultClient) createKey(typeStr string) (crypto.PublicKey, error) { client := h.client.Logical() - if _, err := client.Write(fmt.Sprintf("/%s/keys/%s", h.transitSecretEnginePath, h.keyPath), map[string]any{ - "type": typeStr, - }); err != nil { - return nil, fmt.Errorf("failed to create transit key: %w", err) + path := fmt.Sprintf("/%s/keys/%s", h.transitSecretEnginePath, h.keyPath) + fields := map[string]any{"type": typeStr} + if _, err := client.Write(path, fields); err != nil { + // OpenBao types an ML-DSA key "mldsa-"; Vault enterprise instead requires + // type "ml-dsa" with the set as a separate parameter_set field: retry that, + // but only for request-validation failures — other errors (403, sealed, wrong + // mount) would fail the retry too and must not mask the original cause. + parameterSet := "" + switch typeStr { + case AlgorithmMLDSA44: + parameterSet = "44" + case AlgorithmMLDSA65: + parameterSet = "65" + case AlgorithmMLDSA87: + parameterSet = "87" + } + var respErr *vault.ResponseError + if parameterSet == "" || !errors.As(err, &respErr) || respErr.StatusCode != http.StatusBadRequest { + return nil, fmt.Errorf("failed to create transit key: %w", err) + } + fields = map[string]any{"type": AlgorithmMLDSA, "parameter_set": parameterSet} + if _, retryErr := client.Write(path, fields); retryErr != nil { + return nil, fmt.Errorf("failed to create transit key: %w; retrying as vault enterprise ml-dsa: %w", err, retryErr) + } } return h.public() } diff --git a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go index 9fb237edc2..54e8fdacff 100644 --- a/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go +++ b/vendor/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/signer.go @@ -18,6 +18,8 @@ package hashivault import ( "context" "crypto" + "crypto/ed25519" + "crypto/mldsa" "errors" "fmt" "io" @@ -36,6 +38,13 @@ const ( AlgorithmRSA2048 = "rsa-2048" AlgorithmRSA3072 = "rsa-3072" AlgorithmRSA4096 = "rsa-4096" + AlgorithmMLDSA = "ml-dsa" // Vault enterprise: one type for all sets, parameter_set field carries the set + AlgorithmMLDSA44 = "mldsa-44" + AlgorithmMLDSA65 = "mldsa-65" + AlgorithmMLDSA87 = "mldsa-87" + AlgorithmMLDSA44FB = "ml-dsa-44" // Vault enterprise reports ML-DSA version entries as "ml-dsa-" + AlgorithmMLDSA65FB = "ml-dsa-65" + AlgorithmMLDSA87FB = "ml-dsa-87" ) var hvSupportedAlgorithms = []string{ @@ -46,6 +55,9 @@ var hvSupportedAlgorithms = []string{ AlgorithmRSA2048, AlgorithmRSA3072, AlgorithmRSA4096, + AlgorithmMLDSA44, + AlgorithmMLDSA65, + AlgorithmMLDSA87, } var hvSupportedHashFuncs = []crypto.Hash{ @@ -64,8 +76,12 @@ type SignerVerifier struct { // LoadSignerVerifier generates signatures using the specified key object in Vault and hash algorithm. // -// It also can verify signatures (via a remote vall to the Vault instance). hashFunc should be -// set to crypto.Hash(0) if the key referred to by referenceStr is an ED25519 signing key. +// It can also verify signatures (via a remote vall to the Vault instance). +// ML-DSA keys always sign the raw message (Pure ML-DSA) regardless of hashFunc; +// ED25519 keys do too unless hashFunc is crypto.SHA512 (ED25519ph). +// +// ED25519ph follows the transit prehashed protocol, which HashiCorp Vault >= 1.19 +// currently refuses (hashicorp/vault#31574); OpenBao and Vault <= 1.18 accept it. func LoadSignerVerifier(referenceStr string, hashFunc crypto.Hash, opts ...signature.RPCOption) (*SignerVerifier, error) { h := &SignerVerifier{} ctx := context.Background() @@ -107,13 +123,55 @@ func LoadSignerVerifier(referenceStr string, hashFunc crypto.Hash, opts ...signa return h, nil } +// hashingMode computes the correct hash to use for a given key-hash pair. +// ML-DSA keys always use crypto.Hash(0). Pure Ed25519 works the same except +// explicit SHA-512 requests (for Ed25519ph) are respected. +// All other key types prehash the message as requested. +func hashingMode(pub crypto.PublicKey, requested crypto.Hash) crypto.Hash { + switch pub.(type) { + case *mldsa.PublicKey: + return crypto.Hash(0) + case ed25519.PublicKey: + if requested == crypto.SHA512 { + return crypto.SHA512 + } + return crypto.Hash(0) + default: + return requested + } +} + +// digestPolicy resolves the effective hash for pub (see hashingMode) and rejects +// WithDigest values pure-mode keys cannot use: they sign the message itself, so +// a precomputed digest paired with an explicit prehash is an error. Bytes paired +// with crypto.Hash(0) instead carry the message itself — the crypto.Signer +// convention cryptoSignerWrapper forwards, like the other KMS providers; this +// intentionally diverges from the in-process MLDSASigner, which rejects WithDigest +// outright. This one policy drives SignMessage and VerifySignature. +func digestPolicy(pub crypto.PublicKey, requested crypto.Hash, digest []byte) (crypto.Hash, error) { + hashFunc := hashingMode(pub, requested) + if len(digest) > 0 && requested != crypto.Hash(0) && hashFunc == crypto.Hash(0) { + switch pub.(type) { + case *mldsa.PublicKey: + return 0, errors.New("WithDigest is not supported for ML-DSA") + case ed25519.PublicKey: + return 0, errors.New("WithDigest is not supported for pure Ed25519") + } + } + return hashFunc, nil +} + // SignMessage signs the provided message using HashiCorp Vault KMS. If the message is provided, // this method will compute the digest according to the hash function specified // when the HashivaultSigner was created. // +// ML-DSA and pure ED25519 keys ignore the loaded signature.HashFunc and any +// WithCryptoSignerOpts: their APIs only support raw messages. +// // SignMessage recognizes the following Options listed in order of preference: // -// - WithDigest() +// - WithDigest(): for pure modes (ML-DSA, pure ED25519) the bytes carry the message +// when paired with crypto.Hash(0) and are rejected otherwise // // All other options are ignored if specified. func (h SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOption) ([]byte, error) { @@ -125,12 +183,32 @@ func (h SignerVerifier) SignMessage(message io.Reader, opts ...signature.SignOpt opt.ApplyCryptoSignerOpts(&signerOpts) } - digest, hf, err := signature.ComputeDigestForSigning(message, signerOpts.HashFunc(), hvSupportedHashFuncs, opts...) + // The key type is only known remotely, so it gates how the message is digested. + // Resolved before computing the digest: a raw-message key loaded or called with a + // prehash must still sign the message itself, not the prehash. + pub, err := h.client.public() + if err != nil { + return nil, fmt.Errorf("determining key type: %w", err) + } + hashFunc, err := digestPolicy(pub, signerOpts.HashFunc(), digest) if err != nil { return nil, err } - return h.client.sign(digest, hf, opts...) + if hashFunc == crypto.Hash(0) { + // Override the hash to the identity function. A provided digest already + // carries the message bytes; only compute when none was given. + if len(digest) == 0 { + digest, _, err = signature.ComputeDigestForSigning(message, crypto.Hash(0), []crypto.Hash{crypto.Hash(0)}) + } + } else { + digest, hashFunc, err = signature.ComputeDigestForSigning(message, hashFunc, hvSupportedHashFuncs, opts...) + } + if err != nil { + return nil, err + } + + return h.client.sign(digest, hashFunc, opts...) } // PublicKey returns the public key that can be used to verify signatures created by @@ -147,7 +225,8 @@ func (h SignerVerifier) PublicKey(_ ...signature.PublicKeyOption) (crypto.Public // // This function recognizes the following Options listed in order of preference: // -// - WithDigest() +// - WithDigest(): for pure modes (ML-DSA, pure ED25519) the bytes carry the message +// when paired with crypto.Hash(0) and are rejected otherwise // // - WithCryptoSignerOpts() // @@ -161,7 +240,25 @@ func (h SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signatur opt.ApplyCryptoSignerOpts(&signerOpts) } - digest, hf, err := signature.ComputeDigestForVerifying(message, signerOpts.HashFunc(), hvSupportedHashFuncs, opts...) + // The key type is only known remotely; see SignMessage for how it gates the digest. + pub, err := h.client.public() + if err != nil { + return fmt.Errorf("determining key type: %w", err) + } + hashFunc, err := digestPolicy(pub, signerOpts.HashFunc(), digest) + if err != nil { + return err + } + + if hashFunc == crypto.Hash(0) { + // Override hash function with identity function. A provided digest already + // carries the message bytes; only compute when none was given. + if len(digest) == 0 { + digest, _, err = signature.ComputeDigestForVerifying(message, crypto.Hash(0), []crypto.Hash{crypto.Hash(0)}) + } + } else { + digest, hashFunc, err = signature.ComputeDigestForVerifying(message, hashFunc, hvSupportedHashFuncs, opts...) + } if err != nil { return err } @@ -171,7 +268,7 @@ func (h SignerVerifier) VerifySignature(sig, message io.Reader, opts ...signatur return fmt.Errorf("reading signature: %w", err) } - return h.client.verify(sigBytes, digest, hf, opts...) + return h.client.verify(sigBytes, digest, hashFunc, opts...) } // CreateKey attempts to create a new key in Vault with the specified algorithm. @@ -197,8 +294,19 @@ func (c cryptoSignerWrapper) Public() crypto.PublicKey { func (c cryptoSignerWrapper) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) { hashFunc := c.hashFunc if opts != nil { + // Empty contexts are enforced for compatibility (see pkg/signature/mldsa.go); honoring a + // non-empty context would produce unverifiable signatures. + if mldsaOpts, ok := opts.(*mldsa.Options); ok && mldsaOpts.Context != "" { + return nil, errors.New("non-empty context is not supported; use empty context for consistency across backends") + } + // Vault transit cannot carry an Ed25519 signing context; dropping it would + // silently sign without the domain separation the caller asked for. + if edOpts, ok := opts.(*ed25519.Options); ok && edOpts.Context != "" { + return nil, errors.New("Ed25519 signing context is not supported by Vault transit; use an empty context") + } hashFunc = opts.HashFunc() } + hvOptions := []signature.SignOption{ options.WithContext(c.ctx), options.WithDigest(digest), @@ -210,15 +318,28 @@ func (c cryptoSignerWrapper) Sign(_ io.Reader, digest []byte, opts crypto.Signer // CryptoSigner returns a crypto.Signer object that uses the underlying SignerVerifier, along with a crypto.SignerOpts object // that allows the KMS to be used in APIs that only accept the standard golang objects +// +// For keys that sign the raw message (Ed25519, ML-DSA) the returned options carry crypto.Hash(0), so +// callers pass the message itself rather than a digest. Ed25519ph keys carry crypto.SHA512. +// +// The key type is resolved eagerly with a remote key read, so construction fails +// when the transit server is unreachable; in exchange the returned options always +// reflect the stored key type. func (h *SignerVerifier) CryptoSigner(ctx context.Context, errFunc func(error)) (crypto.Signer, crypto.SignerOpts, error) { + pub, err := h.client.public() + if err != nil { + return nil, nil, fmt.Errorf("determining key type: %w", err) + } + hashFunc := hashingMode(pub, h.hashFunc) + csw := &cryptoSignerWrapper{ ctx: ctx, sv: h, - hashFunc: h.hashFunc, + hashFunc: hashFunc, errFunc: errFunc, } - return csw, h.hashFunc, nil + return csw, hashFunc, nil } // SupportedAlgorithms returns the list of algorithms supported by the Hashicorp Vault service diff --git a/vendor/modules.txt b/vendor/modules.txt index 8481ac89b1..880c5dbdf2 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -75,8 +75,8 @@ cloud.google.com/go/firestore/internal ## explicit; go 1.25.0 cloud.google.com/go/iam cloud.google.com/go/iam/apiv1/iampb -# cloud.google.com/go/kms v1.33.0 -## explicit; go 1.25.0 +# cloud.google.com/go/kms v1.35.0 +## explicit; go 1.26.0 cloud.google.com/go/kms/apiv1 cloud.google.com/go/kms/apiv1/kmspb cloud.google.com/go/kms/internal @@ -129,7 +129,7 @@ github.com/Antonboom/testifylint/internal/testify ## explicit github.com/Azure/azure-sdk-for-go/services/preview/containerregistry/runtime/2019-08-15-preview/containerregistry github.com/Azure/azure-sdk-for-go/version -# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 +# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 ## explicit; go 1.25.0 github.com/Azure/azure-sdk-for-go/sdk/azcore github.com/Azure/azure-sdk-for-go/sdk/azcore/arm/internal/resource @@ -151,7 +151,7 @@ github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime github.com/Azure/azure-sdk-for-go/sdk/azcore/streaming github.com/Azure/azure-sdk-for-go/sdk/azcore/to github.com/Azure/azure-sdk-for-go/sdk/azcore/tracing -# github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 +# github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0 ## explicit; go 1.25.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal @@ -159,14 +159,15 @@ github.com/Azure/azure-sdk-for-go/sdk/azidentity/internal/customtokenproxy # github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry v0.2.3 ## explicit; go 1.23.0 github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry -# github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 -## explicit; go 1.24.0 +# github.com/Azure/azure-sdk-for-go/sdk/internal v1.13.0 +## explicit; go 1.25.0 github.com/Azure/azure-sdk-for-go/sdk/internal/diag github.com/Azure/azure-sdk-for-go/sdk/internal/errorinfo github.com/Azure/azure-sdk-for-go/sdk/internal/exported github.com/Azure/azure-sdk-for-go/sdk/internal/log github.com/Azure/azure-sdk-for-go/sdk/internal/poller github.com/Azure/azure-sdk-for-go/sdk/internal/temporal +github.com/Azure/azure-sdk-for-go/sdk/internal/transport github.com/Azure/azure-sdk-for-go/sdk/internal/uuid # github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 ## explicit; go 1.25.0 @@ -203,7 +204,7 @@ github.com/Azure/go-autorest/logger # github.com/Azure/go-autorest/tracing v0.6.0 ## explicit; go 1.12 github.com/Azure/go-autorest/tracing -# github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 +# github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 ## explicit; go 1.18 github.com/AzureAD/microsoft-authentication-library-for-go/apps/cache github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential @@ -1961,7 +1962,7 @@ github.com/sigstore/rekor-tiles/v2/pkg/verifier/certificate github.com/sigstore/rekor-tiles/v2/pkg/verifier/identity github.com/sigstore/rekor-tiles/v2/pkg/verifier/publickey github.com/sigstore/rekor-tiles/v2/pkg/verify -# github.com/sigstore/sigstore v1.11.1 +# github.com/sigstore/sigstore v1.11.2 ## explicit; go 1.27 github.com/sigstore/sigstore/pkg/cryptoutils github.com/sigstore/sigstore/pkg/cryptoutils/goodkey @@ -1989,16 +1990,16 @@ github.com/sigstore/sigstore-go/pkg/tlog github.com/sigstore/sigstore-go/pkg/tuf github.com/sigstore/sigstore-go/pkg/util github.com/sigstore/sigstore-go/pkg/verify -# github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.1 +# github.com/sigstore/sigstore/pkg/signature/kms/aws v1.11.2 ## explicit; go 1.27 github.com/sigstore/sigstore/pkg/signature/kms/aws -# github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.1 +# github.com/sigstore/sigstore/pkg/signature/kms/azure v1.11.2 ## explicit; go 1.27 github.com/sigstore/sigstore/pkg/signature/kms/azure -# github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.1 +# github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.11.2 ## explicit; go 1.27 github.com/sigstore/sigstore/pkg/signature/kms/gcp -# github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.1 +# github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.11.2 ## explicit; go 1.27 github.com/sigstore/sigstore/pkg/signature/kms/hashivault # github.com/sigstore/timestamp-authority/v2 v2.1.2