Versions in this module Expand all Collapse all v1 v1.0.0 Sep 28, 2026 Changes in this version + const AgentTypeCIMD + const AgentTypeDirectory + const AgentTypeJWKSURI + const AlgECDSAP256SHA256 + const AlgECDSAP384SHA384 + const AlgEd25519 + const AlgRSAPSSSHA512 + const DefaultClockSkew + const DefaultDirectoryMaxAge + const DefaultDirectorySignatureLifetime + const DefaultExpiry + const DefaultFetchTimeout + const DefaultLabel + const DefaultMaxCacheEntries + const DefaultMaxConcurrentFetches + const DefaultMaxDirectorySize + const DefaultMaxKeys + const DefaultMaxSignatures + const DefaultMaxTTL + const DefaultMaxValidity + const DefaultMinTTL + const DefaultNegativeTTL + const DefaultNonceStoreSize + const DefaultTTL + const HeaderSignatureAgent + const MaxExpiry + const MaxNegativeTTL + const MediaTypeDirectory + const MinRSAKeyBits + const RSAKeyBits + const TagDirectory + const TagWebBotAuth + const WellKnownPath + var ErrBadSignature = errors.New("samesame: signature does not verify") + var ErrBlockedAddress = errors.New("samesame: address is not publicly routable") + var ErrDirectoryTooBig = errors.New("samesame: key directory too large") + var ErrDirectoryUnbound = errors.New("samesame: directory key has no valid response signature") + var ErrDiscovery = errors.New("samesame: key discovery failed") + var ErrExpired = errors.New("samesame: signature expired") + var ErrFetchFailed = errors.New("samesame: directory fetch failed") + var ErrFetchRefused = errors.New("samesame: directory fetch refused") + var ErrInsecureTransport = errors.New("samesame: signature sent over plaintext HTTP") + var ErrInvalidAgentMember = errors.New("samesame: invalid Signature-Agent member") + var ErrInvalidKey = errors.New("samesame: invalid key in directory") + var ErrKeyUnknown = errors.New("samesame: signing key unknown") + var ErrLabelInUse = errors.New("samesame: signature label already present on request") + var ErrMalformedDirectory = errors.New("samesame: malformed key directory") + var ErrMalformedSignature = errors.New("samesame: malformed signature headers") + var ErrMalformedSignatureAgent = errors.New("samesame: malformed Signature-Agent header") + var ErrNoSignature = errors.New("samesame: no web-bot-auth signature") + var ErrNonceRequired = errors.New("samesame: signature has no nonce") + var ErrNonceStore = errors.New("samesame: nonce store unavailable") + var ErrNotADirectory = errors.New("samesame: response is not a key directory") + var ErrNotYetValid = errors.New("samesame: signature created in the future") + var ErrProfile = errors.New("samesame: signature does not follow the web-bot-auth profile") + var ErrReplay = errors.New("samesame: nonce already used") + var ErrSignerConfig = errors.New("samesame: invalid signer configuration") + var ErrTestKey = errors.New("samesame: key is a published test key") + var ErrTooManyKeys = errors.New("samesame: key directory has too many keys") + var ErrTooManySignatures = errors.New("samesame: too many signatures") + var ErrUnsupportedAgentType = errors.New("samesame: unsupported Signature-Agent member type") + var ErrUnsupportedKey = errors.New("samesame: unsupported signing key") + var ErrValidityTooLong = errors.New("samesame: signature validity window too long") + var KeyAlgorithms = []string + func GenerateKey(alg string) (crypto.Signer, error) + func IsTestKey(thumbprint string) bool + func MarshalDirectory(keys ...crypto.PublicKey) ([]byte, error) + func MarshalPrivateKeyPEM(key crypto.Signer) ([]byte, error) + func NewDirectoryHandler(keys []crypto.Signer, opts DirectoryHandlerOptions) (http.Handler, error) + func ParsePrivateKeyPEM(data []byte) (crypto.Signer, error) + func PublicJWK(pub crypto.PublicKey) (jwk.Key, error) + func StatusCode(err error) int + func Thumbprint(k jwk.Key) (string, error) + func WriteChallenge(w http.ResponseWriter, opts ChallengeOptions) error + type AgentMember struct + Err error + Identifier *url.URL + Key string + Type string + Value string + type ChallengeOptions struct + Label string + Nonce string + type Directory struct + Invalid []error + Keys []Key + func ParseDirectory(data []byte, opts DirectoryOptions) (*Directory, error) + func (d *Directory) Key(id string, now time.Time) (Key, bool) + type DirectoryHandlerOptions struct + Authorities []string + MaxAge time.Duration + SignatureLifetime time.Duration + type DirectoryOptions struct + AllowTestKeys bool + MaxKeys int + type Fetcher struct + func NewFetcher(opts FetcherOptions) *Fetcher + func (f *Fetcher) Resolve(ctx context.Context, identifier *url.URL) (*Directory, error) + type FetcherOptions struct + AllowPrivateAddresses bool + AllowedHosts []string + ClockSkew time.Duration + Directory DirectoryOptions + MaxBodySize int64 + MaxCacheEntries int + MaxConcurrentFetches int + MaxTTL time.Duration + MinTTL time.Duration + NegativeTTL time.Duration + Now func() time.Time + TLSConfig *tls.Config + TTL time.Duration + Timeout time.Duration + VerifyDirectorySignatures bool + type Key struct + Expires time.Time + ID string + JWK jwk.Key + NotBefore time.Time + func NewKey(k jwk.Key) (Key, error) + func (k Key) ValidAt(t time.Time) bool + type KeyResolver interface + Resolve func(ctx context.Context, identifier *url.URL) (*Directory, error) + type MemoryNonceStore struct + func NewMemoryNonceStore(size int) *MemoryNonceStore + func (s *MemoryNonceStore) CheckAndRecord(_ context.Context, scope, nonce string, until time.Time) (bool, error) + func (s *MemoryNonceStore) Evicted() uint64 + func (s *MemoryNonceStore) Len() int + type NonceStore interface + CheckAndRecord func(ctx context.Context, scope, nonce string, until time.Time) (fresh bool, err error) + type Outcome int + const OutcomeInvalid + const OutcomeUnverified + const OutcomeVerified + func OutcomeOf(err error) Outcome + func (o Outcome) String() string + type Result struct + Created time.Time + Expires time.Time + Identifier *url.URL + Key jwk.Key + KeyID string + Label string + Nonce string + NonceChecked bool + Outcome Outcome + type SignatureAgent struct + Legacy bool + Members map[string]AgentMember + func ParseSignatureAgent(h http.Header) (*SignatureAgent, error) + func (sa *SignatureAgent) Member(key string) (AgentMember, bool) + type Signer struct + func NewSigner(key crypto.Signer, opts SignerOptions) (*Signer, error) + func (s *Signer) KeyID() string + func (s *Signer) Sign(r *http.Request) error + func (s *Signer) Transport(next http.RoundTripper) http.RoundTripper + type SignerOptions struct + AgentKey string + AgentOrigin string + DisableNonce bool + Expiry time.Duration + Label string + type StaticDirectory struct + Body []byte + Expires time.Time + Header http.Header + func SignStaticDirectory(keys []crypto.Signer, authority string, opts DirectoryHandlerOptions) (*StaticDirectory, error) + type Verifier struct + func NewVerifier(opts VerifierOptions) (*Verifier, error) + func (v *Verifier) Verify(r *http.Request) (*Result, error) + type VerifierOptions struct + AllowInsecure bool + AllowTestKeys bool + ClockSkew time.Duration + MaxSignatures int + MaxValidity time.Duration + NonceStore NonceStore + Now func() time.Time + RequireNonce bool + Resolver KeyResolver + Scheme func(r *http.Request) string + StaticKeys []crypto.PublicKey + type VerifyError struct + Err error + Label string + Outcome Outcome + func (e *VerifyError) Error() string + func (e *VerifyError) LogValue() slog.Value + func (e *VerifyError) Unwrap() error v0 v0.0.0 Nov 5, 2025 Changes in this version + func Add(x, y int) int
Go to main page