sqlstore

Documentation

Overview

Package sqlstore is the SQL-backed registry.Store, built on Ent. It supports SQLite, for a single host, and PostgreSQL, for a service shared by several replicas. Both pass the conformance suite in package storetest.

The store holds wrapped keys and never a plaintext one. Every operation that changes state runs in one transaction, and a transaction that loses a race is retried, so callers see the same atomic behaviour as the in-memory store: among concurrent callers there is a single winner and the others converge on it.

Serialization comes from the engine. On PostgreSQL every transaction runs at the serializable isolation level, and a serialization failure, a deadlock or a unique violation from a lost race is retried. On SQLite, transactions begin immediately, so writers queue behind one another, and the connection pool is held to a single connection.

Index

• type Dialect
• type Store
  • func New(db *sql.DB, d Dialect) (*Store, error)
  • func OpenPostgres(ctx context.Context, dsn string) (*Store, error)
  • func OpenSQLite(ctx context.Context, path string) (*Store, error)
  • func (s *Store) ActiveKEK(ctx context.Context, purpose keyforge.Purpose) (keyforge.KEKVersion, error)
  • func (s *Store) AddVersion(ctx context.Context, v registry.VersionRecord) error
  • func (s *Store) AdvanceDEK(ctx context.Context, purpose keyforge.Purpose, subject string, from uint32, ...) (keyforge.DEKRecord, error)
  • func (s *Store) Backup(ctx context.Context, path string) error
  • func (s *Store) Close() error
  • func (s *Store) CompleteShred(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)
  • func (s *Store) CountDEKStates(ctx context.Context, purpose keyforge.Purpose) (map[keyforge.DEKState]int, error)
  • func (s *Store) CountDEKs(ctx context.Context, kekID envelope.ID, version uint32) (int, error)
  • func (s *Store) CreateKEK(ctx context.Context, k registry.KEK) error
  • func (s *Store) CurrentDEK(ctx context.Context, purpose keyforge.Purpose, subject string) (keyforge.DEKRecord, error)
  • func (s *Store) GetDEK(ctx context.Context, id envelope.ID) (keyforge.DEKRecord, error)
  • func (s *Store) GetKEK(ctx context.Context, id envelope.ID) (registry.KEK, error)
  • func (s *Store) GetSentinel(ctx context.Context, kekID envelope.ID, version uint32) (registry.Sentinel, error)
  • func (s *Store) GetShred(ctx context.Context, purpose keyforge.Purpose, subject string) (registry.ShredRecord, error)
  • func (s *Store) GetVersion(ctx context.Context, kekID envelope.ID, version uint32) (registry.VersionRecord, error)
  • func (s *Store) KEK(ctx context.Context, id envelope.ID) (provider.KeyRef, error)
  • func (s *Store) KEKForPurpose(ctx context.Context, purpose keyforge.Purpose) (registry.KEK, error)
  • func (s *Store) KEKVersionUsable(ctx context.Context, id envelope.ID, version uint32) (bool, error)
  • func (s *Store) ListDEKs(ctx context.Context, f registry.DEKFilter) ([]keyforge.DEKRecord, error)
  • func (s *Store) ListKEKs(ctx context.Context) ([]registry.KEK, error)
  • func (s *Store) ListSentinels(ctx context.Context, kekID envelope.ID) ([]registry.Sentinel, error)
  • func (s *Store) ListShreds(ctx context.Context) ([]registry.ShredRecord, error)
  • func (s *Store) ListVersions(ctx context.Context, kekID envelope.ID) ([]registry.VersionRecord, error)
  • func (s *Store) MarkDEK(ctx context.Context, id envelope.ID, to keyforge.DEKState) error
  • func (s *Store) Migrate(ctx context.Context) error
  • func (s *Store) Ping(ctx context.Context) error
  • func (s *Store) PutSentinel(ctx context.Context, sn registry.Sentinel) error
  • func (s *Store) ReserveEncryptions(ctx context.Context, id envelope.ID, n, limit uint64) (uint64, error)
  • func (s *Store) RewrapDEK(ctx context.Context, r registry.Rewrap) error
  • func (s *Store) ShredSubject(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)
  • func (s *Store) TransitionVersion(ctx context.Context, kekID envelope.ID, version uint32, ...) error

Types

type Dialect

type Dialect string

Dialect names a supported database engine.

const (
	// SQLite is a single-file embedded database.
	SQLite Dialect = Dialect(entdialect.SQLite)
	// Postgres is PostgreSQL.
	Postgres Dialect = Dialect(entdialect.Postgres)
)

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store is a registry in a SQL database. It is safe for concurrent use.

func New

func New(db *sql.DB, d Dialect) (*Store, error)

New returns a store over an open database. The caller owns db and closes it. It does not create the schema: call Store.Migrate first.

func OpenPostgres

func OpenPostgres(ctx context.Context, dsn string) (*Store, error)

OpenPostgres opens a PostgreSQL database by connection string and creates its schema. It uses pgx.

func OpenSQLite

func OpenSQLite(ctx context.Context, path string) (*Store, error)

OpenSQLite opens, or creates, a SQLite database file and its schema. It is the store for a single host. The database uses write-ahead logging, waits for a busy lock rather than failing, enforces foreign keys, and begins write transactions immediately so that writers queue.

Use ":memory:" for a database that lives as long as the store.

func (*Store) ActiveKEK

func (s *Store) ActiveKEK(ctx context.Context, purpose keyforge.Purpose) (keyforge.KEKVersion, error)

ActiveKEK implements keyforge.Store.

func (*Store) AddVersion

func (s *Store) AddVersion(ctx context.Context, v registry.VersionRecord) error

AddVersion implements registry.Store.

func (*Store) AdvanceDEK

func (s *Store) AdvanceDEK(ctx context.Context, purpose keyforge.Purpose, subject string, from uint32, next keyforge.DEKRecord) (keyforge.DEKRecord, error)

AdvanceDEK implements keyforge.Store.

func (*Store) Backup

func (s *Store) Backup(ctx context.Context, path string) error

Backup writes a consistent copy of a SQLite registry to path, which must not exist. It is safe while the store is in use: the copy is a snapshot taken in one transaction, including what is still in the write-ahead log, so copying the database file by itself is not a backup.

A restored registry is only usable with a keyring that holds the key versions it names, so a backup of the registry and a backup of the keyring belong together.

func (*Store) Close

func (s *Store) Close() error

Close releases the store. It closes the database only if the store opened it.

func (*Store) CompleteShred

func (s *Store) CompleteShred(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)

CompleteShred implements registry.Store.

func (*Store) CountDEKStates

func (s *Store) CountDEKStates(ctx context.Context, purpose keyforge.Purpose) (map[keyforge.DEKState]int, error)

CountDEKStates implements registry.Store.

func (*Store) CountDEKs

func (s *Store) CountDEKs(ctx context.Context, kekID envelope.ID, version uint32) (int, error)

CountDEKs implements registry.Store.

func (*Store) CreateKEK

func (s *Store) CreateKEK(ctx context.Context, k registry.KEK) error

CreateKEK implements registry.Store.

func (*Store) CurrentDEK

func (s *Store) CurrentDEK(ctx context.Context, purpose keyforge.Purpose, subject string) (keyforge.DEKRecord, error)

CurrentDEK implements keyforge.Store.

func (*Store) GetDEK

func (s *Store) GetDEK(ctx context.Context, id envelope.ID) (keyforge.DEKRecord, error)

GetDEK implements keyforge.Store.

func (*Store) GetKEK

func (s *Store) GetKEK(ctx context.Context, id envelope.ID) (registry.KEK, error)

GetKEK implements registry.Store.

func (*Store) GetSentinel

func (s *Store) GetSentinel(ctx context.Context, kekID envelope.ID, version uint32) (registry.Sentinel, error)

GetSentinel implements registry.Store.

func (*Store) GetShred

func (s *Store) GetShred(ctx context.Context, purpose keyforge.Purpose, subject string) (registry.ShredRecord, error)

GetShred implements registry.Store.

func (*Store) GetVersion

func (s *Store) GetVersion(ctx context.Context, kekID envelope.ID, version uint32) (registry.VersionRecord, error)

GetVersion implements registry.Store.

func (*Store) KEK

func (s *Store) KEK(ctx context.Context, id envelope.ID) (provider.KeyRef, error)

KEK implements keyforge.Store.

func (*Store) KEKForPurpose

func (s *Store) KEKForPurpose(ctx context.Context, purpose keyforge.Purpose) (registry.KEK, error)

KEKForPurpose implements registry.Store.

func (*Store) KEKVersionUsable

func (s *Store) KEKVersionUsable(ctx context.Context, id envelope.ID, version uint32) (bool, error)

KEKVersionUsable implements keyforge.Store.

func (*Store) ListDEKs

func (s *Store) ListDEKs(ctx context.Context, f registry.DEKFilter) ([]keyforge.DEKRecord, error)

ListDEKs implements registry.Store.

func (*Store) ListKEKs

func (s *Store) ListKEKs(ctx context.Context) ([]registry.KEK, error)

ListKEKs implements registry.Store.

func (*Store) ListSentinels

func (s *Store) ListSentinels(ctx context.Context, kekID envelope.ID) ([]registry.Sentinel, error)

ListSentinels implements registry.Store.

func (*Store) ListShreds

func (s *Store) ListShreds(ctx context.Context) ([]registry.ShredRecord, error)

ListShreds implements registry.Store.

func (*Store) ListVersions

func (s *Store) ListVersions(ctx context.Context, kekID envelope.ID) ([]registry.VersionRecord, error)

ListVersions implements registry.Store.

func (*Store) MarkDEK

func (s *Store) MarkDEK(ctx context.Context, id envelope.ID, to keyforge.DEKState) error

MarkDEK implements registry.Store.

func (*Store) Migrate

func (s *Store) Migrate(ctx context.Context) error

Migrate creates or updates the schema so that it matches this version of the store. It is idempotent.

func (*Store) Ping

func (s *Store) Ping(ctx context.Context) error

Ping checks that the database answers.

func (*Store) PutSentinel

func (s *Store) PutSentinel(ctx context.Context, sn registry.Sentinel) error

PutSentinel implements registry.Store.

func (*Store) ReserveEncryptions

func (s *Store) ReserveEncryptions(ctx context.Context, id envelope.ID, n, limit uint64) (uint64, error)

ReserveEncryptions implements keyforge.Store.

func (*Store) RewrapDEK

func (s *Store) RewrapDEK(ctx context.Context, r registry.Rewrap) error

RewrapDEK implements registry.Store.

func (*Store) ShredSubject

func (s *Store) ShredSubject(ctx context.Context, purpose keyforge.Purpose, subject string, at time.Time) (registry.ShredRecord, error)

ShredSubject implements registry.Store.

func (*Store) TransitionVersion

func (s *Store) TransitionVersion(ctx context.Context, kekID envelope.ID, version uint32, to registry.VersionState, opts registry.TransitionOptions) error

TransitionVersion implements registry.Store.