Add global bin tests along with testdata

Fix API for bootstrap-pods daemonsets (apps/v1)

See merge request novit-nc/direktil/local-server!2

Dockerfile

@@ -1,18 +1,11 @@
 # ------------------------------------------------------------------------
-from golang:1.11.5 as build
-
-env pkg novit.nc/direktil/local-server
-copy vendor /go/src/${pkg}/vendor
-copy pkg    /go/src/${pkg}/pkg
-copy cmd    /go/src/${pkg}/cmd
-workdir /go/src/${pkg}
-run go test ./... \
- && go install ./cmd/...
+from mcluseau/golang-builder:1.17.3 as build
 
 # ------------------------------------------------------------------------
 from debian:stretch
 entrypoint ["/bin/dkl-local-server"]
 
+env _uncache 1
 run apt-get update \
  && apt-get install -y genisoimage gdisk dosfstools util-linux udev \
  && apt-get clean
@@ -20,4 +13,11 @@ run apt-get update \
 run yes |apt-get install -y grub2 grub-pc-bin grub-efi-amd64-bin \
  && apt-get clean
 
+run apt-get install -y ca-certificates curl openssh-client \
+ && apt-get clean
+
+run curl -L https://github.com/vmware/govmomi/releases/download/v0.21.0/govc_linux_amd64.gz | gunzip > /bin/govc && chmod +x /bin/govc
+
+copy upload-vmware.sh govc.env /var/lib/direktil/
+
 copy --from=build /go/bin/ /bin/

cmd/dkl-dir2config/main.go

@@ -1,9 +1,7 @@
 package main
 
 import (
-	"bytes"
 	"flag"
-	"fmt"
 	"log"
 	"os"
 
@@ -46,6 +44,7 @@ func main() {
 		dst.Clusters = append(dst.Clusters, &localconfig.Cluster{
 			Name:          cluster.Name,
 			Addons:        renderAddons(cluster),
+			BootstrapPods: renderBootstrapPodsDS(cluster),
 		})
 	}
 
@@ -78,6 +77,12 @@ func main() {
 
 		dst.Hosts = append(dst.Hosts, &localconfig.Host{
 			Name: host.Name,
+
+			ClusterName: ctx.Cluster.Name,
+
+			Labels:      ctx.Labels,
+			Annotations: ctx.Annotations,
+
 			MACs: macs,
 			IPs:  ips,
 
@@ -104,34 +109,3 @@ func main() {
 	}
 
 }
-
-func renderAddons(cluster *clustersconfig.Cluster) string {
-	if len(cluster.Addons) == 0 {
-		return ""
-	}
-
-	addons := src.Addons[cluster.Addons]
-	if addons == nil {
-		log.Fatalf("cluster %q: no addons with name %q", cluster.Name, cluster.Addons)
-	}
-
-	clusterAsMap := asMap(cluster)
-	clusterAsMap["kubernetes_svc_ip"] = cluster.KubernetesSvcIP().String()
-	clusterAsMap["dns_svc_ip"] = cluster.DNSSvcIP().String()
-
-	buf := &bytes.Buffer{}
-
-	for _, addon := range addons {
-		fmt.Fprintf(buf, "---\n# addon: %s\n", addon.Name)
-		err := addon.Execute(buf, clusterAsMap, nil)
-
-		if err != nil {
-			log.Fatalf("cluster %q: addons %q: failed to render %q: %v",
-				cluster.Name, cluster.Addons, addon.Name, err)
-		}
-
-		fmt.Fprintln(buf)
-	}
-
-	return buf.String()
-}

cmd/dkl-dir2config/main_test.go

@@ -0,0 +1,76 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+var (
+	testDir    = "testdata"
+	goldenFile = "config.yaml.golden"
+	outFile    = "config.yaml"
+
+	binName = "dkl-dir2config"
+)
+
+/*
+Build and run the code with default parameters and testdata
+*/
+func TestMain(m *testing.M) {
+	fmt.Println("Building...")
+	if runtime.GOOS == "windows" {
+		binName += ".exe"
+	}
+
+	build := exec.Command("go", "build", "-o", filepath.Join(testDir, binName))
+	if err := build.Run(); err != nil {
+		fmt.Fprintf(os.Stderr, "Cannot build : %v", err)
+		os.Exit(1)
+	}
+
+	fmt.Println("Running Tests...")
+	result := m.Run()
+
+	fmt.Println("Cleaning Up ... ")
+	os.Remove(binName)
+	os.Exit(result)
+}
+
+func TestRunMain(t *testing.T) {
+	err := os.Chdir(testDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Run("RunWithNoArgument", func(t *testing.T) {
+		cmd := exec.Command("./" + binName)
+
+		if err := cmd.Run(); err != nil {
+			t.Fatal(err)
+		}
+	})
+	t.Run("CompareOutputs", func(t *testing.T) {
+		cmd := exec.Command("./"+binName, "-out", outFile)
+
+		if err := cmd.Run(); err != nil {
+			t.Fatal(err)
+		}
+
+		output, err := os.ReadFile(outFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+		expected, err := os.ReadFile(goldenFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if ret := bytes.Compare(output, expected); ret != 0 {
+			t.Fatalf("Output (%v) of length %d is different than expected (%v) of length %d", outFile, len(output), goldenFile, len(expected))
+		}
+	})
+}

cmd/dkl-dir2config/render-cluster.go

@@ -0,0 +1,222 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"path"
+
+	yaml "gopkg.in/yaml.v2"
+
+	"novit.nc/direktil/local-server/pkg/clustersconfig"
+)
+
+func clusterFuncs(clusterSpec *clustersconfig.Cluster) map[string]interface{} {
+	cluster := clusterSpec.Name
+
+	return map[string]interface{}{
+		"password": func(name string) (s string) {
+			return fmt.Sprintf("{{ password %q %q }}", cluster, name)
+		},
+
+		"token": func(name string) (s string) {
+			return fmt.Sprintf("{{ token %q %q }}", cluster, name)
+		},
+
+		"ca_key": func(name string) (s string, err error) {
+			// TODO check CA exists
+			// ?ctx.clusterConfig.CA(name)
+			return fmt.Sprintf("{{ ca_key %q %q }}", cluster, name), nil
+		},
+
+		"ca_crt": func(name string) (s string, err error) {
+			// TODO check CA exists
+			return fmt.Sprintf("{{ ca_crt %q %q }}", cluster, name), nil
+		},
+
+		"ca_dir": func(name string) (s string, err error) {
+			return fmt.Sprintf("{{ ca_dir %q %q }}", cluster, name), nil
+		},
+
+		"hosts_by_cluster": func(cluster string) (hosts []interface{}) {
+			for _, host := range src.Hosts {
+				if host.Cluster == cluster {
+					hosts = append(hosts, asMap(host))
+				}
+			}
+
+			if len(hosts) == 0 {
+				log.Printf("WARNING: no hosts in cluster %q", cluster)
+			}
+
+			return
+		},
+
+		"hosts_by_group": func(group string) (hosts []interface{}) {
+			for _, host := range src.Hosts {
+				if host.Group == group {
+					hosts = append(hosts, asMap(host))
+				}
+			}
+
+			if len(hosts) == 0 {
+				log.Printf("WARNING: no hosts in group %q", group)
+			}
+
+			return
+		},
+	}
+}
+
+func renderClusterTemplates(cluster *clustersconfig.Cluster, setName string,
+	templates []*clustersconfig.Template) []byte {
+	clusterAsMap := asMap(cluster)
+	clusterAsMap["kubernetes_svc_ip"] = cluster.KubernetesSvcIP().String()
+	clusterAsMap["dns_svc_ip"] = cluster.DNSSvcIP().String()
+
+	funcs := clusterFuncs(cluster)
+
+	log.Print("rendering cluster templates in ", setName)
+
+	buf := &bytes.Buffer{}
+
+	contextName := "cluster:" + cluster.Name
+
+	for _, t := range templates {
+		log.Print("- template: ", setName, ": ", t.Name)
+		fmt.Fprintf(buf, "---\n# %s: %s\n", setName, t.Name)
+		err := t.Execute(contextName, path.Join(setName, t.Name), buf, clusterAsMap, funcs)
+
+		if err != nil {
+			log.Fatalf("cluster %q: %s: failed to render %q: %v",
+				cluster.Name, setName, t.Name, err)
+		}
+
+		fmt.Fprintln(buf)
+	}
+
+	return buf.Bytes()
+}
+
+func renderAddons(cluster *clustersconfig.Cluster) string {
+	if len(cluster.Addons) == 0 {
+		return ""
+	}
+
+	addons := src.Addons[cluster.Addons]
+	if addons == nil {
+		log.Fatalf("cluster %q: no addons with name %q", cluster.Name, cluster.Addons)
+	}
+
+	return string(renderClusterTemplates(cluster, "addons", addons))
+}
+
+type namePod struct {
+	Namespace string
+	Name      string
+	Pod       map[string]interface{}
+}
+
+func renderBootstrapPods(cluster *clustersconfig.Cluster) (pods []namePod) {
+	if cluster.BootstrapPods == "" {
+		return nil
+	}
+
+	bootstrapPods := src.BootstrapPods[cluster.BootstrapPods]
+	if bootstrapPods == nil {
+		log.Fatalf("no bootstrap pods template named %q", cluster.BootstrapPods)
+	}
+
+	// render bootstrap pods
+	parts := bytes.Split(renderClusterTemplates(cluster, "bootstrap-pods", bootstrapPods), []byte("\n---\n"))
+	for _, part := range parts {
+		buf := bytes.NewBuffer(part)
+		dec := yaml.NewDecoder(buf)
+
+		for n := 0; ; n++ {
+			str := buf.String()
+
+			podMap := map[string]interface{}{}
+			err := dec.Decode(podMap)
+
+			if err == io.EOF {
+				break
+			} else if err != nil {
+				log.Fatalf("bootstrap pod %d: failed to parse: %v\n%s", n, err, str)
+			}
+
+			if len(podMap) == 0 {
+				continue
+			}
+
+			if podMap["metadata"] == nil {
+				log.Fatalf("bootstrap pod %d: no metadata\n%s", n, buf.String())
+			}
+
+			md := podMap["metadata"].(map[interface{}]interface{})
+
+			namespace := md["namespace"].(string)
+			name := md["name"].(string)
+
+			pods = append(pods, namePod{namespace, name, podMap})
+		}
+	}
+
+	return
+}
+
+func renderBootstrapPodsDS(cluster *clustersconfig.Cluster) string {
+	buf := &bytes.Buffer{}
+	enc := yaml.NewEncoder(buf)
+	for _, namePod := range renderBootstrapPods(cluster) {
+		pod := namePod.Pod
+
+		md := pod["metadata"].(map[interface{}]interface{})
+		labels := md["labels"]
+
+		if labels == nil {
+			labels = map[string]interface{}{
+				"app": namePod.Name,
+			}
+			md["labels"] = labels
+		}
+
+		ann := md["annotations"]
+		annotations := map[interface{}]interface{}{}
+		if ann != nil {
+			annotations = ann.(map[interface{}]interface{})
+		}
+		annotations["node.kubernetes.io/bootstrap-checkpoint"] = "true"
+
+		md["annotations"] = annotations
+
+		delete(md, "name")
+		delete(md, "namespace")
+
+		err := enc.Encode(map[string]interface{}{
+			"apiVersion": "apps/v1",
+			"kind":       "DaemonSet",
+			"metadata": map[string]interface{}{
+				"namespace": namePod.Namespace,
+				"name":      namePod.Name,
+				"labels":    labels,
+			},
+			"spec": map[string]interface{}{
+				"minReadySeconds": 60,
+				"selector": map[string]interface{}{
+					"matchLabels": labels,
+				},
+				"template": map[string]interface{}{
+					"metadata": pod["metadata"],
+					"spec":     pod["spec"],
+				},
+			},
+		})
+
+		if err != nil {
+			panic(err)
+		}
+	}
+	return buf.String()
+}

cmd/dkl-dir2config/render-context.go

@@ -2,15 +2,23 @@ package main
 
 import (
 	"bytes"
+	"crypto/sha1"
+	"encoding/hex"
 	"fmt"
 	"log"
+	"path"
+	"reflect"
 
 	yaml "gopkg.in/yaml.v2"
 
 	"novit.nc/direktil/local-server/pkg/clustersconfig"
+	"novit.nc/direktil/pkg/config"
 )
 
 type renderContext struct {
+	Labels      map[string]string
+	Annotations map[string]string
+
 	Host               *clustersconfig.Host
 	Group              *clustersconfig.Group
 	Cluster            *clustersconfig.Cluster
@@ -41,12 +49,13 @@ func newRenderContext(host *clustersconfig.Host, cfg *clustersconfig.Config) (ct
 		group.Vars,
 		host.Vars,
 	} {
-		for k, v := range oVars {
-			vars[k] = v
-		}
+		mapMerge(vars, oVars)
 	}
 
 	return &renderContext{
+		Labels:      mergeLabels(cluster.Labels, group.Labels, host.Labels),
+		Annotations: mergeLabels(cluster.Annotations, group.Annotations, host.Annotations),
+
 		Host:               host,
 		Group:              group,
 		Cluster:            cluster,
@@ -58,18 +67,87 @@ func newRenderContext(host *clustersconfig.Host, cfg *clustersconfig.Config) (ct
 	}, nil
 }
 
+func mergeLabels(sources ...map[string]string) map[string]string {
+	ret := map[string]string{}
+
+	for _, src := range sources {
+		for k, v := range src {
+			ret[k] = v
+		}
+	}
+
+	return ret
+}
+
+func mapMerge(target, source map[string]interface{}) {
+	for k, v := range source {
+		target[k] = genericMerge(target[k], v)
+	}
+}
+
+func genericMerge(target, source interface{}) (result interface{}) {
+	srcV := reflect.ValueOf(source)
+	tgtV := reflect.ValueOf(target)
+
+	if srcV.Kind() == reflect.Map && tgtV.Kind() == reflect.Map {
+		// XXX maybe more specific later
+		result = map[interface{}]interface{}{}
+		resultV := reflect.ValueOf(result)
+
+		tgtIt := tgtV.MapRange()
+		for tgtIt.Next() {
+			sv := srcV.MapIndex(tgtIt.Key())
+			if sv.Kind() == 0 {
+				resultV.SetMapIndex(tgtIt.Key(), tgtIt.Value())
+				continue
+			}
+
+			merged := genericMerge(tgtIt.Value().Interface(), sv.Interface())
+			resultV.SetMapIndex(tgtIt.Key(), reflect.ValueOf(merged))
+		}
+
+		srcIt := srcV.MapRange()
+		for srcIt.Next() {
+			if resultV.MapIndex(srcIt.Key()).Kind() != 0 {
+				continue // already done
+			}
+
+			resultV.SetMapIndex(srcIt.Key(), srcIt.Value())
+		}
+
+		return
+	}
+
+	return source
+}
+
+func (ctx *renderContext) Name() string {
+	switch {
+	case ctx.Host != nil:
+		return "host:" + ctx.Host.Name
+	case ctx.Group != nil:
+		return "group:" + ctx.Group.Name
+	case ctx.Cluster != nil:
+		return "cluster:" + ctx.Cluster.Name
+	default:
+		return "unknown"
+	}
+}
+
 func (ctx *renderContext) Config() string {
 	if ctx.ConfigTemplate == nil {
 		log.Fatalf("no such config: %q", ctx.Group.Config)
 	}
 
+	ctxName := ctx.Name()
+
 	ctxMap := ctx.asMap()
 
 	templateFuncs := ctx.templateFuncs(ctxMap)
 
 	render := func(what string, t *clustersconfig.Template) (s string, err error) {
 		buf := &bytes.Buffer{}
-		err = t.Execute(buf, ctxMap, templateFuncs)
+		err = t.Execute(ctxName, what, buf, ctxMap, templateFuncs)
 		if err != nil {
 			log.Printf("host %s: failed to render %s [%q]: %v", ctx.Host.Name, what, t.Name, err)
 			return
@@ -92,11 +170,40 @@ func (ctx *renderContext) Config() string {
 			return "", fmt.Errorf("no static pods template named %q", name)
 		}
 
-		return render("static pods", t)
+		return render("static-pods", t)
+	}
+
+	extraFuncs["bootstrap_pods_files"] = func(dir string) (string, error) {
+		namePods := renderBootstrapPods(ctx.Cluster)
+
+		defs := make([]config.FileDef, 0)
+
+		for _, namePod := range namePods {
+			name := namePod.Namespace + "_" + namePod.Name
+
+			ba, err := yaml.Marshal(namePod.Pod)
+			if err != nil {
+				return "", fmt.Errorf("bootstrap pod %s: failed to render: %v", name, err)
+			}
+
+			defs = append(defs, config.FileDef{
+				Path:    path.Join(dir, name+".yaml"),
+				Mode:    0640,
+				Content: string(ba),
+			})
+		}
+
+		ba, err := yaml.Marshal(defs)
+		return string(ba), err
+	}
+
+	extraFuncs["machine_id"] = func() string {
+		ba := sha1.Sum([]byte(ctx.Cluster.Name + "/" + ctx.Host.Name)) // TODO: check semantics of machine-id
+		return hex.EncodeToString(ba[:])
 	}
 
 	buf := bytes.NewBuffer(make([]byte, 0, 4096))
-	if err := ctx.ConfigTemplate.Execute(buf, ctxMap, extraFuncs); err != nil {
+	if err := ctx.ConfigTemplate.Execute(ctxName, "config", buf, ctxMap, extraFuncs); err != nil {
 		log.Fatalf("failed to render config %q for host %q: %v", ctx.Group.Config, ctx.Host.Name, err)
 	}
 
@@ -111,7 +218,7 @@ func (ctx *renderContext) StaticPods() (ba []byte, err error) {
 	ctxMap := ctx.asMap()
 
 	buf := bytes.NewBuffer(make([]byte, 0, 4096))
-	if err = ctx.StaticPodsTemplate.Execute(buf, ctxMap, ctx.templateFuncs(ctxMap)); err != nil {
+	if err = ctx.StaticPodsTemplate.Execute(ctx.Name(), "static-pods", buf, ctxMap, ctx.templateFuncs(ctxMap)); err != nil {
 		return
 	}
 
@@ -135,7 +242,7 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]interface{}) map[strin
 		}
 
 		buf := &bytes.Buffer{}
-		err = req.Execute(buf, ctxMap, nil)
+		err = req.Execute(ctx.Name(), "req:"+name, buf, ctxMap, nil)
 		if err != nil {
 			return
 		}
@@ -159,26 +266,8 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]interface{}) map[strin
 		return
 	}
 
-	return map[string]interface{}{
-		"token": func(name string) (s string) {
-			return fmt.Sprintf("{{ token %q %q }}", cluster, name)
-		},
-
-		"ca_key": func(name string) (s string, err error) {
-			// TODO check CA exists
-			// ?ctx.clusterConfig.CA(name)
-			return fmt.Sprintf("{{ ca_key %q %q }}", cluster, name), nil
-		},
-
-		"ca_crt": func(name string) (s string, err error) {
-			// TODO check CA exists
-			return fmt.Sprintf("{{ ca_crt %q %q }}", cluster, name), nil
-		},
-
-		"ca_dir": func(name string) (s string, err error) {
-			return fmt.Sprintf("{{ ca_dir %q %q }}", cluster, name), nil
-		},
-
+	funcs := clusterFuncs(ctx.Cluster)
+	for k, v := range map[string]interface{}{
 		"tls_key": func(name string) (string, error) {
 			return getKeyCert(name, "tls_key")
 		},
@@ -191,6 +280,11 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]interface{}) map[strin
 			return getKeyCert(name, "tls_dir")
 		},
 
+		"ssh_host_keys": func(dir string) (s string) {
+			return fmt.Sprintf("{{ ssh_host_keys %q %q %q}}",
+				dir, cluster, ctx.Host.Name)
+		},
+
 		"hosts_of_group": func() (hosts []interface{}) {
 			hosts = make([]interface{}, 0)
 
@@ -213,7 +307,10 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]interface{}) map[strin
 			}
 			return
 		},
+	} {
+		funcs[k] = v
 	}
+	return funcs
 }
 
 func (ctx *renderContext) asMap() map[string]interface{} {

cmd/dkl-dir2config/render-context_test.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"testing"
+
+	yaml "gopkg.in/yaml.v2"
+)
+
+func TestMerge(t *testing.T) {
+	if v := genericMerge("a", "b"); v != "b" {
+		t.Errorf("got %q", v)
+	}
+
+    if v := unparse(genericMerge(parse(`
+a: t
+b: t
+m:
+  a1: t
+  b1: t
+`), parse(`
+a: s
+c: s
+m:
+  a1: s
+  c1: s
+`))); "\n"+v != `
+a: s
+b: t
+c: s
+m:
+  a1: s
+  b1: t
+  c1: s
+` {
+    t.Errorf("got\n%s", v)
+}
+}
+
+func parse(s string) (r interface{}) {
+	r = map[string]interface{}{}
+	err := yaml.Unmarshal([]byte(s), r)
+	if err != nil {
+		panic(err)
+	}
+	return
+}
+
+func unparse(v interface{}) (s string) {
+	ba, err := yaml.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return string(ba)
+}

cmd/dkl-dir2config/testdata/cert-requests.yaml

@@ -0,0 +1,39 @@
+- name: etcd-server
+  ca: etcd
+  profile: server
+  per_host: true
+  template: |
+    {"CN":"{{.host.name}}","hosts":["127.0.0.1","{{.host.ip}}"],"key":{"algo":"ecdsa","size":256}}
+- name: etcd-peer
+  ca: etcd
+  profile: peer
+  per_host: true
+  template: |
+    {"CN":"{{.host.name}}","hosts":["127.0.0.1","{{.host.ip}}"],"key":{"algo":"ecdsa","size":256}}
+- name: etcd-client
+  ca: etcd
+  profile: client
+  template: |
+    {"CN":"client","hosts":["*"],"key":{"algo":"ecdsa","size":256}}
+
+- name: apiserver
+  ca: cluster
+  profile: server
+  per_host: true
+  template: |
+    {"CN":"{{.host.name}}","hosts":[
+        "kubernetes", "kubernetes.default", "kubernetes.default.svc.{{.cluster.domain}}","{{.host.name}}",
+        "127.0.0.1","{{.cluster.kubernetes_svc_ip}}","{{.vars.public_vip}}",
+        {{- if .vars.apiserver_vip }}"{{.vars.apiserver_vip}}",{{ end }}
+        "{{.host.ip}}"
+    ],"key":{"algo":"ecdsa","size":521}}
+- name: cluster-client
+  ca: cluster
+  profile: client
+  template: |
+    {"CN":"client","hosts":["*"],"key":{"algo":"ecdsa","size":256}}
+- name: kubelet-client
+  ca: cluster
+  profile: client
+  template: |
+    {"CN":"kubelet-client","names":[{"O":"system:masters"}],"hosts":["*"],"key":{"algo":"ecdsa","size":256}}

cmd/dkl-dir2config/testdata/clusters/test.yaml

@@ -0,0 +1 @@
+from: v1.19:test

cmd/dkl-dir2config/testdata/groups/test-master.yaml

@@ -0,0 +1 @@
+from: v1.19:master

cmd/dkl-dir2config/testdata/hosts/test1.yaml

@@ -0,0 +1,3 @@
+ip: 172.16.0.1
+cluster: test
+group: test-master

cmd/dkl-dir2config/testdata/hosts/test2.yaml

@@ -0,0 +1,3 @@
+ip: 172.16.0.2
+cluster: test
+group: test-master

cmd/dkl-dir2config/testdata/hosts/test3.yaml

@@ -0,0 +1,3 @@
+ip: 172.16.0.3
+cluster: test
+group: test-master

cmd/dkl-dir2config/testdata/ssl-config.json

@@ -0,0 +1,34 @@
+{
+    "signing": {
+        "default": {
+            "expiry": "43800h"
+        },
+        "profiles": {
+            "server": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                    "key encipherment",
+                    "server auth"
+                ]
+            },
+            "client": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                    "key encipherment",
+                    "client auth"
+                ]
+            },
+            "peer": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                    "key encipherment",
+                    "server auth",
+                    "client auth"
+                ]
+            }
+        }
+    }
+}

cmd/dkl-local-server/boot-img.go

@@ -81,7 +81,10 @@ func setupBootImage(bootImg *os.File, ctx *renderContext) (err error) {
 		return
 	}
 
-	devb, err := exec.Command("losetup", "--find", "--show", "--partscan", bootImg.Name()).CombinedOutput()
+	log.Print("running losetup...")
+	cmd := exec.Command("losetup", "--find", "--show", "--partscan", bootImg.Name())
+	cmd.Stderr = os.Stderr
+	devb, err := cmd.Output()
 	if err != nil {
 		return
 	}

cmd/dkl-local-server/boot-iso.go

@@ -57,7 +57,7 @@ insmod all_video
 set timeout=3
 
 menuentry "Direktil" {
-    linux  /vmlinuz direktil.boot=DEVNAME=sr0 direktil.boot.fs=iso9660
+    linux  /vmlinuz direktil.boot=DEVNAME=sr0 direktil.boot.fs=iso9660 `+ctx.CmdLine+`
     initrd /initrd
 }
 `), 0644)

cmd/dkl-local-server/cas-cleaner.go

@@ -25,7 +25,7 @@ func casCleaner() {
 func cleanCAS() error {
 	cfg, err := readConfig()
 	if err != nil {
-		return err
+		return nil
 	}
 
 	activeTags := make([]string, len(cfg.Hosts))

cmd/dkl-local-server/cluster-render-context.go

@@ -0,0 +1,168 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"path"
+
+	"github.com/cloudflare/cfssl/csr"
+	yaml "gopkg.in/yaml.v2"
+	"novit.nc/direktil/pkg/config"
+)
+
+var templateFuncs = map[string]interface{}{
+	"password": func(cluster, name string) (password string, err error) {
+		password = secretData.Password(cluster, name)
+		if len(password) == 0 {
+			err = fmt.Errorf("password %q not defined for cluster %q", name, cluster)
+		}
+		return
+	},
+
+	"token": func(cluster, name string) (s string, err error) {
+		return secretData.Token(cluster, name)
+	},
+
+	"ca_key": func(cluster, name string) (s string, err error) {
+		ca, err := secretData.CA(cluster, name)
+		if err != nil {
+			return
+		}
+
+		s = string(ca.Key)
+		return
+	},
+
+	"ca_crt": func(cluster, name string) (s string, err error) {
+		ca, err := secretData.CA(cluster, name)
+		if err != nil {
+			return
+		}
+
+		s = string(ca.Cert)
+		return
+	},
+
+	"ca_dir": func(cluster, name string) (s string, err error) {
+		ca, err := secretData.CA(cluster, name)
+		if err != nil {
+			return
+		}
+
+		dir := "/etc/tls-ca/" + name
+
+		return asYaml([]config.FileDef{
+			{
+				Path:    path.Join(dir, "ca.crt"),
+				Mode:    0644,
+				Content: string(ca.Cert),
+			},
+			{
+				Path:    path.Join(dir, "ca.key"),
+				Mode:    0600,
+				Content: string(ca.Key),
+			},
+		})
+	},
+
+	"tls_key": func(cluster, caName, name, profile, label, reqJson string) (s string, err error) {
+		kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
+		if err != nil {
+			return
+		}
+
+		s = string(kc.Key)
+		return
+	},
+
+	"tls_crt": func(cluster, caName, name, profile, label, reqJson string) (s string, err error) {
+		kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
+		if err != nil {
+			return
+		}
+
+		s = string(kc.Cert)
+		return
+	},
+
+	"tls_dir": func(dir, cluster, caName, name, profile, label, reqJson string) (s string, err error) {
+		ca, err := secretData.CA(cluster, caName)
+		if err != nil {
+			return
+		}
+
+		kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
+		if err != nil {
+			return
+		}
+
+		return asYaml([]config.FileDef{
+			{
+				Path:    path.Join(dir, "ca.crt"),
+				Mode:    0644,
+				Content: string(ca.Cert),
+			},
+			{
+				Path:    path.Join(dir, "tls.crt"),
+				Mode:    0644,
+				Content: string(kc.Cert),
+			},
+			{
+				Path:    path.Join(dir, "tls.key"),
+				Mode:    0600,
+				Content: string(kc.Key),
+			},
+		})
+	},
+
+	"ssh_host_keys": func(dir, cluster, host string) (s string, err error) {
+		pairs, err := secretData.SSHKeyPairs(cluster, host)
+		if err != nil {
+			return
+		}
+
+		files := make([]config.FileDef, 0, len(pairs)*2)
+
+		for _, pair := range pairs {
+			basePath := path.Join(dir, "ssh_host_"+pair.Type+"_key")
+			files = append(files, []config.FileDef{
+				{
+					Path:    basePath,
+					Mode:    0600,
+					Content: pair.Private,
+				},
+				{
+					Path:    basePath + ".pub",
+					Mode:    0644,
+					Content: pair.Public,
+				},
+			}...)
+		}
+
+		return asYaml(files)
+	},
+}
+
+func getKeyCert(cluster, caName, name, profile, label, reqJson string) (kc *KeyCert, err error) {
+	certReq := &csr.CertificateRequest{
+		KeyRequest: csr.NewBasicKeyRequest(),
+	}
+
+	err = json.Unmarshal([]byte(reqJson), certReq)
+	if err != nil {
+		log.Print("CSR unmarshal failed on: ", reqJson)
+		return
+	}
+
+	return secretData.KeyCert(cluster, caName, name, profile, label, certReq)
+}
+
+func asYaml(v interface{}) (string, error) {
+	ba, err := yaml.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+
+	return string(ba), nil
+}

cmd/dkl-local-server/main.go

@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 
 	restful "github.com/emicklei/go-restful"
-	"github.com/mcluseau/go-swagger-ui"
+	swaggerui "github.com/mcluseau/go-swagger-ui"
 	"novit.nc/direktil/pkg/cas"
 
 	"novit.nc/direktil/local-server/pkg/apiutils"
@@ -27,6 +27,8 @@ var (
 )
 
 func main() {
+	log.SetFlags(log.LstdFlags | log.Lshortfile)
+
 	flag.Parse()
 
 	if *address == "" && *tlsAddress == "" {
@@ -37,7 +39,7 @@ func main() {
 	go casCleaner()
 
 	apiutils.Setup(func() {
-		restful.Add(buildWS())
+		registerWS(restful.DefaultContainer)
 	})
 
 	swaggerui.HandleAt("/swagger-ui/")

cmd/dkl-local-server/render-context.go

@@ -4,36 +4,45 @@ import (
 	"bytes"
 	"crypto/sha256"
 	"encoding/hex"
-	"encoding/json"
 	"io"
 	"log"
 	"net/http"
-	"path"
+	"net/url"
 	"path/filepath"
 	"text/template"
 
 	cfsslconfig "github.com/cloudflare/cfssl/config"
-	"github.com/cloudflare/cfssl/csr"
+	restful "github.com/emicklei/go-restful"
 	yaml "gopkg.in/yaml.v2"
 
 	"novit.nc/direktil/pkg/config"
 	"novit.nc/direktil/pkg/localconfig"
 )
 
+var cmdlineParam = restful.QueryParameter("cmdline", "Linux kernel cmdline addition")
+
 type renderContext struct {
 	Host      *localconfig.Host
 	SSLConfig string
+
+	// Linux kernel extra cmdline
+	CmdLine string `yaml:"-"`
 }
 
 func renderCtx(w http.ResponseWriter, r *http.Request, ctx *renderContext, what string,
 	create func(out io.Writer, ctx *renderContext) error) error {
-	log.Printf("sending %s for %q", what, ctx.Host.Name)
 
 	tag, err := ctx.Tag()
 	if err != nil {
 		return err
 	}
 
+	ctx.CmdLine = r.URL.Query().Get(cmdlineParam.Data().Name)
+
+	if ctx.CmdLine != "" {
+		what = what + "?cmdline=" + url.QueryEscape(ctx.CmdLine)
+	}
+
 	// get it or create it
 	content, meta, err := casStore.GetOrCreate(tag, what, func(out io.Writer) error {
 		log.Printf("building %s for %q", what, ctx.Host.Name)
@@ -45,6 +54,7 @@ func renderCtx(w http.ResponseWriter, r *http.Request, ctx *renderContext, what
 	}
 
 	// serve it
+	log.Printf("sending %s for %q", what, ctx.Host.Name)
 	http.ServeContent(w, r, what, meta.ModTime(), content)
 	return nil
 }
@@ -80,7 +90,7 @@ func newRenderContext(host *localconfig.Host, cfg *localconfig.Config) (ctx *ren
 
 func (ctx *renderContext) Config() (ba []byte, cfg *config.Config, err error) {
 	tmpl, err := template.New(ctx.Host.Name + "/config").
-		Funcs(ctx.templateFuncs()).
+		Funcs(templateFuncs).
 		Parse(ctx.Host.Config)
 
 	if err != nil {
@@ -110,129 +120,6 @@ func (ctx *renderContext) Config() (ba []byte, cfg *config.Config, err error) {
 	return
 }
 
-func (ctx *renderContext) templateFuncs() map[string]interface{} {
-	getKeyCert := func(cluster, caName, name, profile, label, reqJson string) (kc *KeyCert, err error) {
-		certReq := &csr.CertificateRequest{
-			KeyRequest: csr.NewBasicKeyRequest(),
-		}
-
-		err = json.Unmarshal([]byte(reqJson), certReq)
-		if err != nil {
-			log.Print("CSR unmarshal failed on: ", reqJson)
-			return
-		}
-
-		return secretData.KeyCert(cluster, caName, name, profile, label, certReq)
-	}
-
-	asYaml := func(v interface{}) (string, error) {
-		ba, err := yaml.Marshal(v)
-		if err != nil {
-			return "", err
-		}
-
-		return string(ba), nil
-	}
-
-	return map[string]interface{}{
-		"token": func(cluster, name string) (s string, err error) {
-			return secretData.Token(cluster, name)
-		},
-
-		"ca_key": func(cluster, name string) (s string, err error) {
-			ca, err := secretData.CA(cluster, name)
-			if err != nil {
-				return
-			}
-
-			s = string(ca.Key)
-			return
-		},
-
-		"ca_crt": func(cluster, name string) (s string, err error) {
-			ca, err := secretData.CA(cluster, name)
-			if err != nil {
-				return
-			}
-
-			s = string(ca.Cert)
-			return
-		},
-
-		"ca_dir": func(cluster, name string) (s string, err error) {
-			ca, err := secretData.CA(cluster, name)
-			if err != nil {
-				return
-			}
-
-			dir := "/etc/tls-ca/" + name
-
-			return asYaml([]config.FileDef{
-				{
-					Path:    path.Join(dir, "ca.crt"),
-					Mode:    0644,
-					Content: string(ca.Cert),
-				},
-				{
-					Path:    path.Join(dir, "ca.key"),
-					Mode:    0600,
-					Content: string(ca.Key),
-				},
-			})
-		},
-
-		"tls_key": func(cluster, caName, name, profile, label, reqJson string) (s string, err error) {
-			kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
-			if err != nil {
-				return
-			}
-
-			s = string(kc.Key)
-			return
-		},
-
-		"tls_crt": func(cluster, caName, name, profile, label, reqJson string) (s string, err error) {
-			kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
-			if err != nil {
-				return
-			}
-
-			s = string(kc.Cert)
-			return
-		},
-
-		"tls_dir": func(dir, cluster, caName, name, profile, label, reqJson string) (s string, err error) {
-			ca, err := secretData.CA(cluster, caName)
-			if err != nil {
-				return
-			}
-
-			kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
-			if err != nil {
-				return
-			}
-
-			return asYaml([]config.FileDef{
-				{
-					Path:    path.Join(dir, "ca.crt"),
-					Mode:    0644,
-					Content: string(ca.Cert),
-				},
-				{
-					Path:    path.Join(dir, "tls.crt"),
-					Mode:    0644,
-					Content: string(kc.Cert),
-				},
-				{
-					Path:    path.Join(dir, "tls.key"),
-					Mode:    0600,
-					Content: string(kc.Key),
-				},
-			})
-		},
-	}
-}
-
 func (ctx *renderContext) distFilePath(path ...string) string {
 	return filepath.Join(append([]string{*dataDir, "dist"}, path...)...)
 }

cmd/dkl-local-server/secrets.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"crypto"
 	"crypto/rand"
+	"crypto/x509"
 	"encoding/base32"
 	"encoding/json"
 	"errors"
@@ -10,8 +12,12 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"sort"
 	"sync"
+	"time"
 
+	"github.com/cespare/xxhash"
+	"github.com/cloudflare/cfssl/certinfo"
 	"github.com/cloudflare/cfssl/config"
 	"github.com/cloudflare/cfssl/csr"
 	"github.com/cloudflare/cfssl/helpers"
@@ -25,11 +31,14 @@ import (
 
 var (
 	secretData *SecretData
+	DontSave   = false
 )
 
 type SecretData struct {
 	l sync.Mutex
 
+	prevHash uint64
+
 	clusters map[string]*ClusterSecrets
 	changed  bool
 	config   *config.Config
@@ -38,6 +47,8 @@ type SecretData struct {
 type ClusterSecrets struct {
 	CAs         map[string]*CA
 	Tokens      map[string]string
+	Passwords   map[string]string
+	SSHKeyPairs map[string][]SSHKeyPair
 }
 
 type CA struct {
@@ -81,6 +92,8 @@ func loadSecretData(config *config.Config) (err error) {
 		return
 	}
 
+	sd.prevHash = xxhash.Sum64(ba)
+
 	secretData = sd
 	return
 }
@@ -89,16 +102,40 @@ func (sd *SecretData) Changed() bool {
 	return sd.changed
 }
 
-func (sd *SecretData) Save() error {
+func (sd *SecretData) Save() (err error) {
+	if DontSave {
+		return
+	}
+
 	sd.l.Lock()
 	defer sd.l.Unlock()
 
-	log.Info("Saving secret data")
 	ba, err := json.Marshal(sd.clusters)
 	if err != nil {
-		return err
+		return
+	}
+
+	h := xxhash.Sum64(ba)
+	if h == sd.prevHash {
+		return
+	}
+
+	log.Info("Saving secret data")
+	err = ioutil.WriteFile(secretDataPath(), ba, 0600)
+
+	if err == nil {
+		sd.prevHash = h
+	}
+
+	return
+}
+
+func newClusterSecrets() *ClusterSecrets {
+	return &ClusterSecrets{
+		CAs:       make(map[string]*CA),
+		Tokens:    make(map[string]string),
+		Passwords: make(map[string]string),
 	}
-	return ioutil.WriteFile(secretDataPath(), ba, 0600)
 }
 
 func (sd *SecretData) cluster(name string) (cs *ClusterSecrets) {
@@ -112,15 +149,47 @@ func (sd *SecretData) cluster(name string) (cs *ClusterSecrets) {
 
 	log.Info("secret-data: new cluster: ", name)
 
-	cs = &ClusterSecrets{
-		CAs:    make(map[string]*CA),
-		Tokens: make(map[string]string),
-	}
+	cs = newClusterSecrets()
 	sd.clusters[name] = cs
 	sd.changed = true
 	return
 }
 
+func (sd *SecretData) Passwords(cluster string) (passwords []string) {
+	cs := sd.cluster(cluster)
+
+	passwords = make([]string, 0, len(cs.Passwords))
+	for name := range cs.Passwords {
+		passwords = append(passwords, name)
+	}
+
+	sort.Strings(passwords)
+
+	return
+}
+
+func (sd *SecretData) Password(cluster, name string) (password string) {
+	cs := sd.cluster(cluster)
+
+	if cs.Passwords == nil {
+		cs.Passwords = make(map[string]string)
+	}
+
+	password = cs.Passwords[name]
+	return
+}
+
+func (sd *SecretData) SetPassword(cluster, name, password string) {
+	cs := sd.cluster(cluster)
+
+	if cs.Passwords == nil {
+		cs.Passwords = make(map[string]string)
+	}
+
+	cs.Passwords[name] = password
+	sd.changed = true
+}
+
 func (sd *SecretData) Token(cluster, name string) (token string, err error) {
 	cs := sd.cluster(cluster)
 
@@ -147,11 +216,49 @@ func (sd *SecretData) Token(cluster, name string) (token string, err error) {
 	return
 }
 
+func (sd *SecretData) RenewCACert(cluster, name string) (err error) {
+	cs := sd.cluster(cluster)
+
+	ca := cs.CAs[name]
+
+	var cert *x509.Certificate
+	cert, err = helpers.ParseCertificatePEM(ca.Cert)
+	if err != nil {
+		return
+	}
+
+	var signer crypto.Signer
+	signer, err = helpers.ParsePrivateKeyPEM(ca.Key)
+	if err != nil {
+		return
+	}
+
+	newCert, err := initca.RenewFromSigner(cert, signer)
+	if err != nil {
+		return
+	}
+
+	sd.l.Lock()
+	defer sd.l.Unlock()
+
+	cs.CAs[name].Cert = newCert
+	sd.changed = true
+
+	return
+}
+
 func (sd *SecretData) CA(cluster, name string) (ca *CA, err error) {
 	cs := sd.cluster(cluster)
 
 	ca, ok := cs.CAs[name]
 	if ok {
+		checkErr := checkCertUsable(ca.Cert)
+		if checkErr != nil {
+			log.Infof("secret-data cluster %s: CA %s: regenerating certificate: %v", cluster, name, checkErr)
+
+			err = sd.RenewCACert(cluster, name)
+		}
+
 		return
 	}
 
@@ -191,6 +298,22 @@ func (sd *SecretData) CA(cluster, name string) (ca *CA, err error) {
 	return
 }
 
+func checkCertUsable(certPEM []byte) error {
+	cert, err := certinfo.ParseCertificatePEM(certPEM)
+	if err != nil {
+		return err
+	}
+
+	certDuration := cert.NotAfter.Sub(cert.NotBefore)
+	delayBeforeRegen := certDuration / 3 // TODO allow configuration
+
+	if cert.NotAfter.Sub(time.Now()) < delayBeforeRegen {
+		return errors.New("too old")
+	}
+
+	return nil
+}
+
 func (sd *SecretData) KeyCert(cluster, caName, name, profile, label string, req *csr.CertificateRequest) (kc *KeyCert, err error) {
 	for idx, host := range req.Hosts {
 		if ip := net.ParseIP(host); ip != nil {
@@ -223,15 +346,21 @@ func (sd *SecretData) KeyCert(cluster, caName, name, profile, label string, req
 		return
 	}
 
+	logPrefix := fmt.Sprintf("secret-data: cluster %s: CA %s:", cluster, caName)
+
 	rh := hash(req)
 	kc, ok := ca.Signed[name]
 	if ok && rh == kc.ReqHash {
+		err = checkCertUsable(kc.Cert)
+		if err == nil {
 			return
+		}
+		log.Infof("%s regenerating certificate: ", err)
+
 	} else if ok {
-		log.Infof("secret-data: cluster %s: CA %s: CSR changed for %s: hash=%q previous=%q",
-			cluster, caName, name, rh, kc.ReqHash)
+		log.Infof("%s CSR changed for %s: hash=%q previous=%q", name, rh, kc.ReqHash)
 	} else {
-		log.Infof("secret-data: cluster %s: CA %s: new CSR for %s", cluster, caName, name)
+		log.Infof("%s new CSR for %s", logPrefix, name)
 	}
 
 	sd.l.Lock()

cmd/dkl-local-server/ssh-secrets.go

@@ -0,0 +1,167 @@
+package main
+
+import (
+	"crypto/dsa"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/asn1"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/exec"
+)
+
+type SSHKeyPair struct {
+	Type    string
+	Public  string
+	Private string
+}
+
+func (sd *SecretData) SSHKeyPairs(cluster, host string) (pairs []SSHKeyPair, err error) {
+	cs := sd.cluster(cluster)
+
+	if cs.SSHKeyPairs == nil {
+		cs.SSHKeyPairs = map[string][]SSHKeyPair{}
+	}
+
+	outFile, err := ioutil.TempFile("/tmp", "dls-key.")
+	if err != nil {
+		return
+	}
+
+	outPath := outFile.Name()
+
+	removeTemp := func() {
+		os.Remove(outPath)
+		os.Remove(outPath + ".pub")
+	}
+
+	defer removeTemp()
+
+	pairs = cs.SSHKeyPairs[host]
+
+	didGenerate := false
+
+genLoop:
+	for _, keyType := range []string{
+		"rsa",
+		"dsa",
+		"ecdsa",
+		"ed25519",
+	} {
+		for _, pair := range pairs {
+			if pair.Type == keyType {
+				continue genLoop
+			}
+		}
+
+		didGenerate = true
+
+		removeTemp()
+
+		var out, privKey, pubKey []byte
+
+		out, err = exec.Command("ssh-keygen",
+			"-N", "",
+			"-C", "root@"+host,
+			"-f", outPath,
+			"-t", keyType).CombinedOutput()
+		if err != nil {
+			err = fmt.Errorf("ssh-keygen failed: %v: %s", err, string(out))
+			return
+		}
+
+		privKey, err = ioutil.ReadFile(outPath)
+		if err != nil {
+			return
+		}
+
+		os.Remove(outPath)
+
+		pubKey, err = ioutil.ReadFile(outPath + ".pub")
+		if err != nil {
+			return
+		}
+
+		os.Remove(outPath + ".pub")
+
+		pairs = append(pairs, SSHKeyPair{
+			Type:    keyType,
+			Public:  string(pubKey),
+			Private: string(privKey),
+		})
+	}
+
+	if didGenerate {
+		cs.SSHKeyPairs[host] = pairs
+		err = sd.Save()
+	}
+
+	return
+}
+
+func sshKeyGenDSA() (data []byte, pubKey interface{}, err error) {
+	privKey := &dsa.PrivateKey{}
+
+	err = dsa.GenerateParameters(&privKey.Parameters, rand.Reader, dsa.L1024N160)
+	if err != nil {
+		return
+	}
+
+	err = dsa.GenerateKey(privKey, rand.Reader)
+	if err != nil {
+		return
+	}
+
+	data, err = asn1.Marshal(*privKey)
+	//data, err = x509.MarshalPKCS8PrivateKey(privKey)
+	if err != nil {
+		return
+	}
+
+	pubKey = privKey.PublicKey
+	return
+}
+
+func sshKeyGenRSA() (data []byte, pubKey interface{}, err error) {
+	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return
+	}
+
+	data = x509.MarshalPKCS1PrivateKey(privKey)
+	pubKey = privKey.Public()
+
+	return
+}
+
+func sshKeyGenECDSA() (data []byte, pubKey interface{}, err error) {
+	privKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	if err != nil {
+		return
+	}
+
+	data, err = x509.MarshalPKCS8PrivateKey(privKey)
+	if err != nil {
+		return
+	}
+
+	pubKey = privKey.Public()
+
+	return
+}
+
+func sshKeyGenED25519() (data []byte, pubKey interface{}, err error) {
+	pubKey, privKey, err := ed25519.GenerateKey(rand.Reader)
+
+	data, err = x509.MarshalPKCS8PrivateKey(privKey)
+	if err != nil {
+		return
+	}
+
+	return
+}

cmd/dkl-local-server/ssh-secrets_test.go

@@ -0,0 +1,17 @@
+package main
+
+import "testing"
+
+func init() {
+	DontSave = true
+}
+
+func TestSSHKeyGet(t *testing.T) {
+	sd := &SecretData{
+		clusters: make(map[string]*ClusterSecrets),
+	}
+
+	if _, err := sd.SSHKeyPairs("test", "host"); err != nil {
+		t.Error(err)
+	}
+}

cmd/dkl-local-server/upstream.go

@@ -1,14 +1,21 @@
 package main
 
 import (
+	"crypto/sha1"
+	"encoding/hex"
 	"flag"
+	"fmt"
 	"io"
 	"log"
 	"net/http"
 	"os"
 	gopath "path"
 	"path/filepath"
+	"strconv"
 	"time"
+
+	"github.com/dustin/go-humanize"
+	"github.com/miolini/datacounter"
 )
 
 var (
@@ -39,42 +46,82 @@ func (ctx *renderContext) distFetch(path ...string) (outPath string, err error)
 		return
 	}
 
-	tempOutPath := filepath.Join(filepath.Dir(outPath), "._part_"+filepath.Base(outPath))
-
-	done := make(chan error, 1)
-	go func() {
 	defer resp.Body.Close()
-		defer close(done)
 
-		out, err := os.Create(tempOutPath)
-		if err != nil {
-			done <- err
+	if resp.StatusCode != 200 {
+		err = fmt.Errorf("wrong status: %s", resp.Status)
 		return
 	}
 
-		defer out.Close()
+	length, _ := strconv.Atoi(resp.Header.Get("Content-Length"))
+
+	fOut, err := os.Create(filepath.Join(filepath.Dir(outPath), "._part_"+filepath.Base(outPath)))
+	if err != nil {
+		return
+	}
+
+	hash := sha1.New()
+
+	body := datacounter.NewReaderCounter(resp.Body)
+	out := io.MultiWriter(fOut, hash)
+
+	done := make(chan error, 1)
+	go func() {
+		_, err = io.Copy(out, body)
+		fOut.Close()
+
+		if err != nil {
+			os.Remove(fOut.Name())
+		}
 
-		_, err = io.Copy(out, resp.Body)
 		done <- err
+		close(done)
 	}()
 
+	start := time.Now()
+
 wait:
 	select {
 	case <-time.After(10 * time.Second):
-		log.Print("still fetching ", subPath, "...")
+		status := ""
+		if length != 0 {
+			count := body.Count()
+			elapsedDuration := time.Since(start)
+
+			progress := float64(count) / float64(length)
+
+			elapsed := float64(elapsedDuration)
+			remaining := time.Duration(elapsed/progress - elapsed)
+
+			status = fmt.Sprintf(" (%.2f%%, ETA %v, %s/s)",
+				progress*100,
+				remaining.Truncate(time.Second),
+				humanize.Bytes(uint64(float64(count)/elapsedDuration.Seconds())))
+		}
+		log.Printf("still fetching %s%s...", subPath, status)
 		goto wait
 
 	case err = <-done:
 		if err != nil {
 			log.Print("fetch of ", subPath, " failed: ", err)
-			os.Remove(tempOutPath)
 			return
 		}
-
-		log.Print("fetch of ", subPath, " finished")
 	}
 
-	err = os.Rename(tempOutPath, outPath)
+	hexSum := hex.EncodeToString(hash.Sum(nil))
+	log.Printf("fetch of %s finished (SHA1 checksum: %s)", subPath, hexSum)
+
+	if remoteSum := resp.Header.Get("X-Content-SHA1"); remoteSum != "" {
+		log.Printf("fetch of %s: remote SHA1 checksum: %s", subPath, remoteSum)
+		if remoteSum != hexSum {
+			err = fmt.Errorf("wrong SHA1 checksum: server=%s local=%s", remoteSum, hexSum)
+			log.Print("fetch of ", subPath, ": ", err)
+			os.Remove(fOut.Name())
+			return
+		}
+	}
+
+	err = os.Rename(fOut.Name(), outPath)
 
 	return
 }

cmd/dkl-local-server/ws-clusters.go

@@ -2,8 +2,10 @@ package main
 
 import (
 	"log"
+	"sort"
 
 	restful "github.com/emicklei/go-restful"
+
 	"novit.nc/direktil/pkg/localconfig"
 )
 
@@ -59,5 +61,148 @@ func wsClusterAddons(req *restful.Request, resp *restful.Response) {
 		return
 	}
 
-	resp.Write([]byte(cluster.Addons))
+	wsRender(resp, cluster.Addons, cluster)
+}
+
+func wsClusterPasswords(req *restful.Request, resp *restful.Response) {
+	cluster := wsReadCluster(req, resp)
+	if cluster == nil {
+		return
+	}
+
+	resp.WriteEntity(secretData.Passwords(cluster.Name))
+}
+
+func wsClusterPassword(req *restful.Request, resp *restful.Response) {
+	cluster := wsReadCluster(req, resp)
+	if cluster == nil {
+		return
+	}
+
+	name := req.PathParameter("password-name")
+
+	resp.WriteEntity(secretData.Password(cluster.Name, name))
+}
+
+func wsClusterSetPassword(req *restful.Request, resp *restful.Response) {
+	cluster := wsReadCluster(req, resp)
+	if cluster == nil {
+		return
+	}
+
+	name := req.PathParameter("password-name")
+
+	var password string
+	if err := req.ReadEntity(&password); err != nil {
+		wsError(resp, err) // FIXME this is a BadRequest
+		return
+	}
+
+	secretData.SetPassword(cluster.Name, name, password)
+
+	if err := secretData.Save(); err != nil {
+		wsError(resp, err)
+		return
+	}
+}
+
+func wsClusterToken(req *restful.Request, resp *restful.Response) {
+	cluster := wsReadCluster(req, resp)
+	if cluster == nil {
+		return
+	}
+
+	name := req.PathParameter("token-name")
+
+	token, err := secretData.Token(cluster.Name, name)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	resp.WriteEntity(token)
+}
+
+func wsClusterBootstrapPods(req *restful.Request, resp *restful.Response) {
+	cluster := wsReadCluster(req, resp)
+	if cluster == nil {
+		return
+	}
+
+	if len(cluster.BootstrapPods) == 0 {
+		log.Printf("cluster %q has no bootstrap pods defined", cluster.Name)
+		wsNotFound(req, resp)
+		return
+	}
+
+	wsRender(resp, cluster.BootstrapPods, cluster)
+}
+
+func wsClusterCAs(req *restful.Request, resp *restful.Response) {
+	cs := secretData.clusters[req.PathParameter("cluster-name")]
+	if cs == nil {
+		wsNotFound(req, resp)
+		return
+	}
+
+	keys := make([]string, 0, len(cs.CAs))
+	for k := range cs.CAs {
+		keys = append(keys, k)
+	}
+
+	sort.Strings(keys)
+
+	resp.WriteJson(keys, restful.MIME_JSON)
+}
+
+func wsClusterCACert(req *restful.Request, resp *restful.Response) {
+	cs := secretData.clusters[req.PathParameter("cluster-name")]
+	if cs == nil {
+		wsNotFound(req, resp)
+		return
+	}
+
+	ca := cs.CAs[req.PathParameter("ca-name")]
+	if ca == nil {
+		wsNotFound(req, resp)
+		return
+	}
+
+	resp.Write(ca.Cert)
+}
+
+func wsClusterSignedCert(req *restful.Request, resp *restful.Response) {
+	cs := secretData.clusters[req.PathParameter("cluster-name")]
+	if cs == nil {
+		wsNotFound(req, resp)
+		return
+	}
+
+	ca := cs.CAs[req.PathParameter("ca-name")]
+	if ca == nil {
+		wsNotFound(req, resp)
+		return
+	}
+
+	name := req.QueryParameter("name")
+
+	if name == "" {
+		keys := make([]string, 0, len(ca.Signed))
+		for k := range ca.Signed {
+			keys = append(keys, k)
+		}
+
+		sort.Strings(keys)
+
+		resp.WriteJson(keys, restful.MIME_JSON)
+		return
+	}
+
+	kc := ca.Signed[name]
+	if kc == nil {
+		wsNotFound(req, resp)
+		return
+	}
+
+	resp.Write(kc.Cert)
 }

cmd/dkl-local-server/ws-configs.go

@@ -35,8 +35,21 @@ func writeNewConfig(reader io.Reader) (err error) {
 		return
 	}
 
-	archivesPath := filepath.Join(*dataDir, "archives")
 	cfgPath := configFilePath()
+	in, err := os.Open(cfgPath)
+
+	if err == nil {
+		err = backupCurrentConfig(in)
+	} else if !os.IsNotExist(err) {
+		return
+	}
+
+	err = os.Rename(out.Name(), cfgPath)
+	return
+}
+
+func backupCurrentConfig(in io.ReadCloser) (err error) {
+	archivesPath := filepath.Join(*dataDir, "archives")
 
 	err = os.MkdirAll(archivesPath, 0700)
 	if err != nil {
@@ -52,11 +65,6 @@ func writeNewConfig(reader io.Reader) (err error) {
 
 	defer bck.Close()
 
-	in, err := os.Open(cfgPath)
-	if err != nil {
-		return
-	}
-
 	gz, err := gzip.NewWriterLevel(bck, 2)
 	if err != nil {
 		return
@@ -66,10 +74,5 @@ func writeNewConfig(reader io.Reader) (err error) {
 	gz.Close()
 	in.Close()
 
-	if err != nil {
-		return
-	}
-
-	err = os.Rename(out.Name(), cfgPath)
 	return
 }

cmd/dkl-local-server/ws-host.go

@@ -27,7 +27,8 @@ func (ws *wsHost) register(rws *restful.WebService, alterRB func(*restful.RouteB
 
 	for _, rb := range []*restful.RouteBuilder{
 		rws.GET(ws.prefix).To(ws.get).
-			Doc("Get the " + ws.hostDoc + "'s details"),
+			Doc("Get the "+ws.hostDoc+"'s details").
+			Returns(200, "OK", localconfig.Host{}),
 
 		// raw configuration
 		b("config").
@@ -58,6 +59,7 @@ func (ws *wsHost) register(rws *restful.WebService, alterRB func(*restful.RouteB
 		// read-only ISO support
 		b("boot.iso").
 			Produces(mime.ISO).
+			Param(cmdlineParam).
 			Doc("Get the " + ws.hostDoc + "'s boot CD-ROM image"),
 
 		// netboot support

cmd/dkl-local-server/ws-ssh-acls.go

@@ -0,0 +1,44 @@
+package main
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+
+	restful "github.com/emicklei/go-restful"
+	yaml "gopkg.in/yaml.v2"
+)
+
+type SSH_ACL struct {
+	Keys     []string
+	Clusters []string
+	Groups   []string
+	Hosts    []string
+}
+
+func loadSSH_ACLs() (acls []SSH_ACL, err error) {
+	f, err := os.Open(filepath.Join(*dataDir, "ssh-acls.yaml"))
+	if err != nil {
+		return
+	}
+
+	defer f.Close()
+
+	err = yaml.NewDecoder(f).Decode(&acls)
+	return
+}
+
+func wsSSH_ACL_List(req *restful.Request, resp *restful.Response) {
+	// TODO
+	http.NotFound(resp.ResponseWriter, req.Request)
+}
+
+func wsSSH_ACL_Get(req *restful.Request, resp *restful.Response) {
+	// TODO
+	http.NotFound(resp.ResponseWriter, req.Request)
+}
+
+func wsSSH_ACL_Set(req *restful.Request, resp *restful.Response) {
+	// TODO
+	http.NotFound(resp.ResponseWriter, req.Request)
+}

cmd/dkl-local-server/ws.go

@@ -1,47 +1,70 @@
 package main
 
 import (
+	"fmt"
 	"log"
 	"net"
 	"net/http"
 	"strings"
+	"text/template"
 
 	"github.com/emicklei/go-restful"
+
 	"novit.nc/direktil/local-server/pkg/mime"
 	"novit.nc/direktil/pkg/localconfig"
 )
 
-func buildWS() *restful.WebService {
+func registerWS(rest *restful.Container) {
+	// Admin-level APIs
 	ws := &restful.WebService{}
+	ws.Filter(adminAuth).
+		HeaderParameter("Authorization", "Admin bearer token")
 
-	// configs API
-	ws.Route(ws.POST("/configs").Filter(adminAuth).To(wsUploadConfig).
+	// - configs API
+	ws.Route(ws.POST("/configs").To(wsUploadConfig).
 		Doc("Upload a new current configuration, archiving the previous one"))
 
-	// clusters API
-	ws.Route(ws.GET("/clusters").Filter(adminAuth).To(wsListClusters).
+	// - clusters API
+	ws.Route(ws.GET("/clusters").To(wsListClusters).
 		Doc("List clusters"))
 
-	ws.Route(ws.GET("/clusters/{cluster-name}").Filter(adminAuth).To(wsCluster).
+	ws.Route(ws.GET("/clusters/{cluster-name}").To(wsCluster).
 		Doc("Get cluster details"))
 
-	ws.Route(ws.GET("/clusters/{cluster-name}/addons").Filter(adminAuth).To(wsClusterAddons).
+	ws.Route(ws.GET("/clusters/{cluster-name}/addons").To(wsClusterAddons).
 		Produces(mime.YAML).
 		Doc("Get cluster addons").
 		Returns(http.StatusOK, "OK", nil).
 		Returns(http.StatusNotFound, "The cluster does not exists or does not have addons defined", nil))
 
-	// hosts API
-	ws.Route(ws.GET("/hosts").Filter(hostsAuth).To(wsListHosts).
-		Doc("List hosts"))
+	ws.Route(ws.GET("/clusters/{cluster-name}/bootstrap-pods").To(wsClusterBootstrapPods).
+		Produces(mime.YAML).
+		Doc("Get cluster bootstrap pods YAML definitions").
+		Returns(http.StatusOK, "OK", nil).
+		Returns(http.StatusNotFound, "The cluster does not exists or does not have bootstrap pods defined", nil))
 
-	(&wsHost{
-		prefix:  "/me",
-		hostDoc: "detected host",
-		getHost: detectHost,
-	}).register(ws, func(rb *restful.RouteBuilder) {
-		rb.Notes("In this case, the host is detected from the remote IP")
-	})
+	ws.Route(ws.GET("/clusters/{cluster-name}/passwords").To(wsClusterPasswords).
+		Doc("List cluster's passwords"))
+	ws.Route(ws.GET("/clusters/{cluster-name}/passwords/{password-name}").To(wsClusterPassword).
+		Doc("Get cluster's password"))
+	ws.Route(ws.PUT("/clusters/{cluster-name}/passwords/{password-name}").To(wsClusterSetPassword).
+		Doc("Set cluster's password"))
+
+	ws.Route(ws.GET("/clusters/{cluster-name}/ca").To(wsClusterCAs).
+		Doc("Get cluster CAs"))
+	ws.Route(ws.GET("/clusters/{cluster-name}/ca/{ca-name}/certificate").To(wsClusterCACert).
+		Produces(mime.CACERT).
+		Doc("Get cluster CA's certificate"))
+	ws.Route(ws.GET("/clusters/{cluster-name}/ca/{ca-name}/signed").To(wsClusterSignedCert).
+		Produces(mime.CERT).
+		Param(ws.QueryParameter("name", "signed reference name").Required(true)).
+		Doc("Get cluster's certificate signed by the CA"))
+
+	ws.Route(ws.GET("/clusters/{cluster-name}/tokens/{token-name}").To(wsClusterToken).
+		Doc("Get cluster's token"))
+
+	ws.Route(ws.GET("/hosts").To(wsListHosts).
+		Doc("List hosts"))
 
 	(&wsHost{
 		prefix:  "/hosts/{host-name}",
@@ -50,10 +73,28 @@ func buildWS() *restful.WebService {
 			return req.PathParameter("host-name")
 		},
 	}).register(ws, func(rb *restful.RouteBuilder) {
-		rb.Filter(adminAuth)
 	})
 
-	return ws
+	ws.Route(ws.GET("/ssh-acls").To(wsSSH_ACL_List))
+	ws.Route(ws.GET("/ssh-acls/{acl-name}").To(wsSSH_ACL_Get))
+	ws.Route(ws.PUT("/ssh-acls/{acl-name}").To(wsSSH_ACL_Set))
+
+	rest.Add(ws)
+
+	// Hosts API
+	ws = &restful.WebService{}
+	ws.Path("/me")
+	ws.Filter(hostsAuth).
+		HeaderParameter("Authorization", "Host or admin bearer token")
+
+	(&wsHost{
+		hostDoc: "detected host",
+		getHost: detectHost,
+	}).register(ws, func(rb *restful.RouteBuilder) {
+		rb.Notes("In this case, the host is detected from the remote IP")
+	})
+
+	rest.Add(ws)
 }
 
 func detectHost(req *restful.Request) string {
@@ -103,8 +144,22 @@ func wsNotFound(req *restful.Request, resp *restful.Response) {
 }
 
 func wsError(resp *restful.Response, err error) {
-	log.Print("request failed: ", err)
+	log.Output(2, fmt.Sprint("request failed: ", err))
 	resp.WriteErrorString(
 		http.StatusInternalServerError,
 		http.StatusText(http.StatusInternalServerError))
 }
+
+func wsRender(resp *restful.Response, tmplStr string, value interface{}) {
+	tmpl, err := template.New("wsRender").Funcs(templateFuncs).Parse(tmplStr)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+
+	err = tmpl.Execute(resp, value)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+}

go.mod

@@ -1,34 +1,55 @@
 module novit.nc/direktil/local-server
 
+go 1.17
+
 require (
 	github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e
+	github.com/cespare/xxhash v1.1.0
 	github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e
-	github.com/coreos/etcd v3.3.11+incompatible // indirect
-	github.com/emicklei/go-restful v2.8.1+incompatible
-	github.com/emicklei/go-restful-openapi v1.0.0
-	github.com/go-openapi/jsonpointer v0.18.0 // indirect
-	github.com/go-openapi/jsonreference v0.18.0 // indirect
-	github.com/go-openapi/spec v0.18.0 // indirect
-	github.com/go-openapi/swag v0.18.0 // indirect
-	github.com/gobuffalo/buffalo-plugins v1.12.1 // indirect
+	github.com/dustin/go-humanize v1.0.0
+	github.com/emicklei/go-restful v2.10.0+incompatible
+	github.com/emicklei/go-restful-openapi v1.2.0
+	github.com/mcluseau/go-swagger-ui v0.0.0-20191019002626-fd9128c24a34
+	github.com/miolini/datacounter v1.0.1
+	github.com/oklog/ulid v1.3.1
+	github.com/pierrec/lz4 v2.3.0+incompatible
+	gopkg.in/src-d/go-billy.v4 v4.3.2
+	gopkg.in/src-d/go-git.v4 v4.13.1
+	gopkg.in/yaml.v2 v2.2.4
+	k8s.io/apimachinery v0.0.0-20191203211716-adc6f4cd9e7d
+	novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2
+)
+
+require (
+	github.com/PuerkitoBio/purell v1.1.1 // indirect
+	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
+	github.com/emirpasic/gods v1.12.0 // indirect
+	github.com/frankban/quicktest v1.5.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.3 // indirect
+	github.com/go-openapi/jsonreference v0.19.3 // indirect
+	github.com/go-openapi/spec v0.19.3 // indirect
+	github.com/go-openapi/swag v0.19.5 // indirect
+	github.com/gobuffalo/envy v1.7.1 // indirect
+	github.com/gobuffalo/packd v0.3.0 // indirect
+	github.com/gobuffalo/packr v1.30.1 // indirect
+	github.com/golang/protobuf v1.3.2 // indirect
 	github.com/google/certificate-transparency-go v1.0.21 // indirect
-	github.com/json-iterator/go v1.1.5 // indirect
-	github.com/markbates/going v1.0.3 // indirect
-	github.com/mcluseau/go-swagger-ui v0.0.0-20190204031235-fc4ac9154422
+	github.com/google/go-cmp v0.3.1 // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/joho/godotenv v1.3.0 // indirect
+	github.com/json-iterator/go v1.1.8 // indirect
+	github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd // indirect
+	github.com/mailru/easyjson v0.7.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.1 // indirect
-	github.com/oklog/ulid v1.3.1
-	github.com/pierrec/lz4 v2.0.5+incompatible
-	github.com/spf13/afero v1.2.1 // indirect
-	github.com/src-d/go-git v4.7.0+incompatible // indirect
-	github.com/ugorji/go/codec v0.0.0-20190128213124-ee1426cffec0 // indirect
-	golang.org/x/crypto v0.0.0-20190131182504-b8fe1690c613 // indirect
-	golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3 // indirect
-	golang.org/x/sys v0.0.0-20190203050204-7ae0202eb74c // indirect
-	golang.org/x/tools v0.0.0-20190202235157-7414d4c1f71c // indirect
-	gopkg.in/src-d/go-billy.v4 v4.3.0
-	gopkg.in/src-d/go-git.v4 v4.10.0
-	gopkg.in/yaml.v2 v2.2.2
-	k8s.io/apimachinery v0.0.0-20190201131811-df262fa1a1ba
-	novit.nc/direktil/pkg v0.0.0-20181210211743-9dc80cd34b09
+	github.com/rogpeppe/go-internal v1.5.0 // indirect
+	github.com/sergi/go-diff v1.0.0 // indirect
+	github.com/src-d/gcfg v1.4.0 // indirect
+	github.com/xanzy/ssh-agent v0.2.1 // indirect
+	golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 // indirect
+	golang.org/x/net v0.0.0-20191014212845-da9a3fd4c582 // indirect
+	golang.org/x/sys v0.0.0-20191018095205-727590c5006e // indirect
+	golang.org/x/text v0.3.2 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
 )

go.sum

@@ -1,690 +1,270 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
-github.com/PuerkitoBio/purell v1.1.0 h1:rmGxhojJlM0tuKtfdvliR84CFHljx9ag64t2xmVkjK4=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/ajg/form v0.0.0-20160822230020-523a5da1a92f/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
 github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7 h1:uSoVVbwJiQipAclBbw+8quDsfcvFjOpI5iCf4p/cqCs=
 github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
+github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239 h1:kFOfPq6dUM1hTo4JG6LR5AXSUEsOjtdm0kw0FtQtMJA=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
-github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e h1:mep9E//vzfjmtYUVBAvRMIW5BKTL88nidNZc8RF2lhA=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e h1:hHg27A0RSSp2Om9lubZpiMgVbvn39bsUmW9U5h0twqc=
 github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e/go.mod h1:oDpT4efm8tSYHXV5tHSdRvBet/b/QzxZ+XyyPehvm3A=
-github.com/cloudflare/cfssl v0.0.0-20180705210102-ff56ab5eb62a h1:wbCZ8e4WG5hcfVKSyaqobgvEe/uZeVvkbUBX1zgr9kw=
-github.com/cloudflare/cfssl v0.0.0-20180705210102-ff56ab5eb62a/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/cfssl v0.0.0-20181102015659-ea4033a214e7 h1:ROpiky+uT1fstFCMZCka5Cr9GmtpTakLMmvwFsVOtJA=
-github.com/cloudflare/cfssl v0.0.0-20181102015659-ea4033a214e7/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e h1:Qux+lbuMaRzkQyTdzgtz8MgzPtzmaPQy6DXmxpdxT3U=
 github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c/go.mod h1:XGLbWH/ujMcbPbhZq52Nv6UrCghb1yGn//133kEsvDk=
-github.com/codegangsta/negroni v1.0.0/go.mod h1:v0y3T5G7Y1UlFfyxFn/QLRU4a2EuNau2iZY63YTKWo0=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/etcd v3.3.11+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
+github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dustin/go-humanize v0.0.0-20180713052910-9f541cc9db5d/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/emicklei/go-restful v2.8.1+incompatible h1:AyDqLHbJ1quqbWr/OWDw+PlIP8ZFoTmYrGYaxzrLbNg=
-github.com/emicklei/go-restful v2.8.1+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful-openapi v1.0.0 h1:ZFk3RuCl8ZmG1yUAF/mSbXRi5cuyA/k5+EpHayuuTXM=
-github.com/emicklei/go-restful-openapi v1.0.0/go.mod h1:Q+bHVYfUWv1fvC4FNTsz2AVvFSsXAC7RCiWjF1Sva1A=
-github.com/emirpasic/gods v1.9.0 h1:rUF4PuzEjMChMiNsVjdI+SyLu7rEqpQ5reNFnhC7oFo=
-github.com/emirpasic/gods v1.9.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/structs v1.0.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
+github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.9.6+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.10.0+incompatible h1:l6Soi8WCOOVAeCo4W98iBFC6Og7/X8bpRt51oNLZ2C8=
+github.com/emicklei/go-restful v2.10.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful-openapi v1.2.0 h1:ohRZ1yEZERGzqaozBgxa3A0lt6c6KF14xhs3IL9ECwg=
+github.com/emicklei/go-restful-openapi v1.2.0/go.mod h1:cy7o3Ge8ZWZ5E90mpEY81sJZZFs2pkuYcLvfngYy1l0=
+github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
+github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
+github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/frankban/quicktest v1.5.0 h1:Tb4jWdSpdjKzTUicPnY61PZxKbDoGa7ABbrReT3gQVY=
+github.com/frankban/quicktest v1.5.0/go.mod h1:jaStnuzAqU1AJdCO0l53JDCJrVDKcS03DbaAcR7Ks/o=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-openapi/jsonpointer v0.17.0 h1:nH6xp8XdXHx8dqveo0ZuJBluCO2qGrPbDNZ0dwoRHP0=
-github.com/go-openapi/jsonpointer v0.17.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
-github.com/go-openapi/jsonpointer v0.18.0 h1:KVRzjXpMzgdM4GEMDmDTnGcY5yBwGWreJwmmk4k35yU=
-github.com/go-openapi/jsonpointer v0.18.0/go.mod h1:cOnomiV+CVVwFLk0A/MExoFMjwdsUdVpsRhURCKh+3M=
-github.com/go-openapi/jsonreference v0.17.0 h1:yJW3HCkTHg7NOA+gZ83IPHzUSnUzGXhGmsdiCcMexbA=
-github.com/go-openapi/jsonreference v0.17.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
-github.com/go-openapi/jsonreference v0.18.0 h1:oP2OUNdG1l2r5kYhrfVMXO54gWmzcfAwP/GFuHpNTkE=
-github.com/go-openapi/jsonreference v0.18.0/go.mod h1:g4xxGn04lDIRh0GJb5QlpE3HfopLOL6uZrK/VgnsK9I=
-github.com/go-openapi/spec v0.18.0 h1:aIjeyG5mo5/FrvDkpKKEGZPmF9MPHahS72mzfVqeQXQ=
-github.com/go-openapi/spec v0.18.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
-github.com/go-openapi/swag v0.17.0 h1:iqrgMg7Q7SvtbWLlltPrkMs0UBJI6oTSs79JFRUi880=
-github.com/go-openapi/swag v0.17.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
-github.com/go-openapi/swag v0.18.0 h1:1DU8Km1MRGv9Pj7BNLmkA+umwTStwDHttXvx3NhJA70=
-github.com/go-openapi/swag v0.18.0/go.mod h1:AByQ+nYG6gQg71GINrmuDXCPWdL640yX49/kXLo40Tg=
-github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/gobuffalo/buffalo v0.12.8-0.20181004233540-fac9bb505aa8/go.mod h1:sLyT7/dceRXJUxSsE813JTQtA3Eb1vjxWfo/N//vXIY=
-github.com/gobuffalo/buffalo v0.13.0/go.mod h1:Mjn1Ba9wpIbpbrD+lIDMy99pQ0H0LiddMIIDGse7qT4=
-github.com/gobuffalo/buffalo v0.13.1/go.mod h1:K9c22KLfDz7obgxvHv1amvJtCQEZNiox9+q6FDJ1Zcs=
-github.com/gobuffalo/buffalo v0.13.2/go.mod h1:vA8I4Dwcfkx7RAzIRHVDZxfS3QJR7muiOjX4r8P2/GE=
-github.com/gobuffalo/buffalo v0.13.4/go.mod h1:y2jbKkO0k49OrNIOAkbWQiPBqxAFpHn5OKnkc7BDh+I=
-github.com/gobuffalo/buffalo v0.13.5/go.mod h1:hPcP12TkFSZmT3gUVHZ24KRhTX3deSgu6QSgn0nbWf4=
-github.com/gobuffalo/buffalo v0.13.6/go.mod h1:/Pm0MPLusPhWDayjRD+/vKYnelScIiv0sX9YYek0wpg=
-github.com/gobuffalo/buffalo v0.13.7/go.mod h1:3gQwZhI8DSbqmDqlFh7kfwuv/wd40rqdVxXtFWlCQHw=
-github.com/gobuffalo/buffalo v0.13.9/go.mod h1:vIItiQkTHq46D1p+bw8mFc5w3BwrtJhMvYjSIYK3yjE=
-github.com/gobuffalo/buffalo v0.13.10/go.mod h1:t/G4NHciI1PxWBUrPlW+6HGfgStmk7cozRIRt5O0674=
-github.com/gobuffalo/buffalo v0.13.12/go.mod h1:Y9e0p0cdo/eI+lHm7EFzlkc9YzjwGo5QeDj+FbsyqVA=
-github.com/gobuffalo/buffalo v0.13.13/go.mod h1:WAL36xBN8OkU71lNjuYv6llmgl0o8twjlY+j7oGUmYw=
-github.com/gobuffalo/buffalo-plugins v1.0.2/go.mod h1:pOp/uF7X3IShFHyobahTkTLZaeUXwb0GrUTb9ngJWTs=
-github.com/gobuffalo/buffalo-plugins v1.0.4/go.mod h1:pWS1vjtQ6uD17MVFWf7i3zfThrEKWlI5+PYLw/NaDB4=
-github.com/gobuffalo/buffalo-plugins v1.4.3/go.mod h1:uCzTY0woez4nDMdQjkcOYKanngeUVRO2HZi7ezmAjWY=
-github.com/gobuffalo/buffalo-plugins v1.5.1/go.mod h1:jbmwSZK5+PiAP9cC09VQOrGMZFCa/P0UMlIS3O12r5w=
-github.com/gobuffalo/buffalo-plugins v1.6.1/go.mod h1:/XZt7UuuDnx5P4v3cStK0+XoYiNOA2f0wDIsm1oLJQA=
-github.com/gobuffalo/buffalo-plugins v1.6.4/go.mod h1:/+N1aophkA2jZ1ifB2O3Y9yGwu6gKOVMtUmJnbg+OZI=
-github.com/gobuffalo/buffalo-plugins v1.6.5/go.mod h1:0HVkbgrVs/MnPZ/FOseDMVanCTm2RNcdM0PuXcL1NNI=
-github.com/gobuffalo/buffalo-plugins v1.6.6/go.mod h1:hSWAEkJyL9RENJlmanMivgnNkrQ9RC4xJARz8dQryi0=
-github.com/gobuffalo/buffalo-plugins v1.6.7/go.mod h1:ZGZRkzz2PiKWHs0z7QsPBOTo2EpcGRArMEym6ghKYgk=
-github.com/gobuffalo/buffalo-plugins v1.6.9/go.mod h1:yYlYTrPdMCz+6/+UaXg5Jm4gN3xhsvsQ2ygVatZV5vw=
-github.com/gobuffalo/buffalo-plugins v1.6.10/go.mod h1:HxzPZjAEzh9H0gnHelObxxrut9O+1dxydf7U93SYsc8=
-github.com/gobuffalo/buffalo-plugins v1.6.11/go.mod h1:eAA6xJIL8OuynJZ8amXjRmHND6YiusVAaJdHDN1Lu8Q=
-github.com/gobuffalo/buffalo-plugins v1.7.2/go.mod h1:vEbx30cLFeeZ48gBA/rkhbqC2M/2JpsKs5CoESWhkPw=
-github.com/gobuffalo/buffalo-plugins v1.8.1/go.mod h1:vu71J3fD4b7KKywJQ1tyaJGtahG837Cj6kgbxX0e4UI=
-github.com/gobuffalo/buffalo-plugins v1.8.2/go.mod h1:9te6/VjEQ7pKp7lXlDIMqzxgGpjlKoAcAANdCgoR960=
-github.com/gobuffalo/buffalo-plugins v1.8.3/go.mod h1:IAWq6vjZJVXebIq2qGTLOdlXzmpyTZ5iJG5b59fza5U=
-github.com/gobuffalo/buffalo-plugins v1.9.3/go.mod h1:BNRunDThMZKjqx6R+n14Rk3sRSOWgbMuzCKXLqbd7m0=
-github.com/gobuffalo/buffalo-plugins v1.9.4/go.mod h1:grCV6DGsQlVzQwk6XdgcL3ZPgLm9BVxlBmXPMF8oBHI=
-github.com/gobuffalo/buffalo-plugins v1.10.0/go.mod h1:4osg8d9s60txLuGwXnqH+RCjPHj9K466cDFRl3PErHI=
-github.com/gobuffalo/buffalo-plugins v1.11.0/go.mod h1:rtIvAYRjYibgmWhnjKmo7OadtnxuMG5ZQLr25ozAzjg=
-github.com/gobuffalo/buffalo-plugins v1.12.0/go.mod h1:kw4Mj2vQXqe4X5TI36PEQgswbL30heGQwJEeDKd1v+4=
-github.com/gobuffalo/buffalo-plugins v1.12.1/go.mod h1:Y9nH2VwHVkeKhmdM380ulNXmhhD5On81nRVeD+WlDTQ=
-github.com/gobuffalo/buffalo-pop v1.0.5/go.mod h1:Fw/LfFDnSmB/vvQXPvcXEjzP98Tc+AudyNWUBWKCwQ8=
-github.com/gobuffalo/buffalo-pop v1.1.2/go.mod h1:czNLXcYbg5/fjr+uht0NyjZaQ0V2W23H1jzyORgCzQ4=
-github.com/gobuffalo/buffalo-pop v1.1.5/go.mod h1:H01JIg42XwOHS4gRMhSeDZqBovNVlfBUsVXckU617s4=
-github.com/gobuffalo/buffalo-pop v1.1.8/go.mod h1:1uaxOFzzVud/zR5f1OEBr21tMVLQS3OZpQ1A5cr0svE=
-github.com/gobuffalo/buffalo-pop v1.1.13/go.mod h1:47GQoBjCMcl5Pw40iCWHQYJvd0HsT9kdaOPWgnzHzk4=
-github.com/gobuffalo/buffalo-pop v1.1.14/go.mod h1:sAMh6+s7wytCn5cHqZIuItJbAqzvs6M7FemLexl+pwc=
-github.com/gobuffalo/buffalo-pop v1.1.15/go.mod h1:vnvvxhbEFAaEbac9E2ZPjsBeL7WHkma2UyKNVA4y9Wo=
-github.com/gobuffalo/buffalo-pop v1.2.1/go.mod h1:SHqojN0bVzaAzCbQDdWtsib202FDIxqwmCO8VDdweF4=
-github.com/gobuffalo/buffalo-pop v1.3.0/go.mod h1:P0PhA225dRGyv0WkgYjYKqgoxPdDPDFZDvHj60AGF5w=
-github.com/gobuffalo/buffalo-pop v1.4.0/go.mod h1:DYpTPbPFvMZYirNkWQkbwmsBOD5V7c/74V+LfCY6LXQ=
-github.com/gobuffalo/buffalo-pop v1.6.0/go.mod h1:vrEVNOBKe042HjSNMj72J4FgER/VG6lt4xW6WMpTdlY=
-github.com/gobuffalo/envy v1.6.4/go.mod h1:Abh+Jfw475/NWtYMEt+hnJWRiC8INKWibIMyNt1w2Mc=
-github.com/gobuffalo/envy v1.6.5/go.mod h1:N+GkhhZ/93bGZc6ZKhJLP6+m+tCNPKwgSpH9kaifseQ=
-github.com/gobuffalo/envy v1.6.6/go.mod h1:N+GkhhZ/93bGZc6ZKhJLP6+m+tCNPKwgSpH9kaifseQ=
-github.com/gobuffalo/envy v1.6.7 h1:XMZGuFqTupAXhZTriQ+qO38QvNOSU/0rl3hEPCFci/4=
-github.com/gobuffalo/envy v1.6.7/go.mod h1:N+GkhhZ/93bGZc6ZKhJLP6+m+tCNPKwgSpH9kaifseQ=
-github.com/gobuffalo/envy v1.6.8/go.mod h1:N+GkhhZ/93bGZc6ZKhJLP6+m+tCNPKwgSpH9kaifseQ=
-github.com/gobuffalo/envy v1.6.9/go.mod h1:N+GkhhZ/93bGZc6ZKhJLP6+m+tCNPKwgSpH9kaifseQ=
-github.com/gobuffalo/envy v1.6.10/go.mod h1:X0CFllQjTV5ogsnUrg+Oks2yTI+PU2dGYBJOEI2D1Uo=
-github.com/gobuffalo/envy v1.6.11/go.mod h1:Fiq52W7nrHGDggFPhn2ZCcHw4u/rqXkqo+i7FB6EAcg=
-github.com/gobuffalo/envy v1.6.12 h1:zkhss8DXz/pty2HAyA8BnvWMTYxo4gjd4+WCnYovoxY=
-github.com/gobuffalo/envy v1.6.12/go.mod h1:qJNrJhKkZpEW0glh5xP2syQHH5kgdmgsKss2Kk8PTP0=
-github.com/gobuffalo/events v1.0.3/go.mod h1:Txo8WmqScapa7zimEQIwgiJBvMECMe9gJjsKNPN3uZw=
-github.com/gobuffalo/events v1.0.7/go.mod h1:z8txf6H9jWhQ5Scr7YPLWg/cgXBRj8Q4uYI+rsVCCSQ=
-github.com/gobuffalo/events v1.0.8/go.mod h1:A5KyqT1sA+3GJiBE4QKZibse9mtOcI9nw8gGrDdqYGs=
-github.com/gobuffalo/events v1.1.1/go.mod h1:Ia9OgHMco9pEhJaPrPQJ4u4+IZlkxYVco2VbJ2XgnAE=
-github.com/gobuffalo/events v1.1.3/go.mod h1:9yPGWYv11GENtzrIRApwQRMYSbUgCsZ1w6R503fCfrk=
-github.com/gobuffalo/events v1.1.4/go.mod h1:09/YRRgZHEOts5Isov+g9X2xajxdvOAcUuAHIX/O//A=
-github.com/gobuffalo/events v1.1.5/go.mod h1:3YUSzgHfYctSjEjLCWbkXP6djH2M+MLaVRzb4ymbAK0=
-github.com/gobuffalo/events v1.1.6/go.mod h1:H/3ZB9BA+WorMb/0F79UvU6u0Cyo2hU97WA51bG2ONY=
-github.com/gobuffalo/events v1.1.7/go.mod h1:6fGqxH2ing5XMb3EYRq9LEkVlyPGs4oO/eLzh+S8CxY=
-github.com/gobuffalo/events v1.1.8/go.mod h1:UFy+W6X6VbCWS8k2iT81HYX65dMtiuVycMy04cplt/8=
-github.com/gobuffalo/events v1.1.9/go.mod h1:/0nf8lMtP5TkgNbzYxR6Bl4GzBy5s5TebgNTdRfRbPM=
-github.com/gobuffalo/events v1.2.0/go.mod h1:pxvpvsKXKZNPtHuIxUV3K+g+KP5o4forzaeFj++bh68=
-github.com/gobuffalo/fizz v1.0.12/go.mod h1:C0sltPxpYK8Ftvf64kbsQa2yiCZY4RZviurNxXdAKwc=
-github.com/gobuffalo/fizz v1.0.15/go.mod h1:EI3mEpjImuji6Bwu++N2uXhljQwOhwtimZQJ89zwyF4=
-github.com/gobuffalo/fizz v1.0.16/go.mod h1:EI3mEpjImuji6Bwu++N2uXhljQwOhwtimZQJ89zwyF4=
-github.com/gobuffalo/fizz v1.1.2/go.mod h1:THqzNTlNxNaF5hq3ddp16SnEcl2m83bTeTzJEoD+kqc=
-github.com/gobuffalo/fizz v1.1.3/go.mod h1:THqzNTlNxNaF5hq3ddp16SnEcl2m83bTeTzJEoD+kqc=
-github.com/gobuffalo/fizz v1.3.0/go.mod h1:THqzNTlNxNaF5hq3ddp16SnEcl2m83bTeTzJEoD+kqc=
-github.com/gobuffalo/fizz v1.5.0/go.mod h1:Uu3ch14M4S7LDU7LAP1GQ+KNCRmZYd05Gqasc96XLa0=
-github.com/gobuffalo/flect v0.0.0-20180907193754-dc14d8acaf9f/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181002182613-4571df4b1daf/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181007231023-ae7ed6bfe683/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181018182602-fd24a256709f/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181019110701-3d6f0b585514/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181024204909-8f6be1a8c6c2/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181104133451-1f6e9779237a/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181108195648-8fe1b44cfe32/go.mod h1:rCiQgmAE4axgBNl3jZWzS5rETRYTGOsrixTRaCPzNdA=
-github.com/gobuffalo/flect v0.0.0-20181109221320-179d36177b5b/go.mod h1:0HvNbHdfh+WOvDSIASqJOSxTOWSxCCUF++k/Y53v9rI=
-github.com/gobuffalo/flect v0.0.0-20181114183036-47375f6d8328/go.mod h1:0HvNbHdfh+WOvDSIASqJOSxTOWSxCCUF++k/Y53v9rI=
-github.com/gobuffalo/flect v0.0.0-20181210151238-24a2b68e0316/go.mod h1:en58vff74S9b99Eg42Dr+/9yPu437QjlNsO/hBYPuOk=
-github.com/gobuffalo/flect v0.0.0-20190104192022-4af577e09bf2/go.mod h1:en58vff74S9b99Eg42Dr+/9yPu437QjlNsO/hBYPuOk=
-github.com/gobuffalo/flect v0.0.0-20190117212819-a62e61d96794/go.mod h1:397QT6v05LkZkn07oJXXT6y9FCfwC8Pug0WA2/2mE9k=
-github.com/gobuffalo/genny v0.0.0-20180924032338-7af3a40f2252/go.mod h1:tUTQOogrr7tAQnhajMSH6rv1BVev34H2sa1xNHMy94g=
-github.com/gobuffalo/genny v0.0.0-20181003150629-3786a0744c5d/go.mod h1:WAd8HmjMVrnkAZbmfgH5dLBUchsZfqzp/WS5sQz+uTM=
-github.com/gobuffalo/genny v0.0.0-20181005145118-318a41a134cc/go.mod h1:WAd8HmjMVrnkAZbmfgH5dLBUchsZfqzp/WS5sQz+uTM=
-github.com/gobuffalo/genny v0.0.0-20181007153042-b8de7d566757/go.mod h1:+oG5Ljrw04czAHbPXREwaFojJbpUvcIy4DiOnbEJFTA=
-github.com/gobuffalo/genny v0.0.0-20181012161047-33e5f43d83a6/go.mod h1:+oG5Ljrw04czAHbPXREwaFojJbpUvcIy4DiOnbEJFTA=
-github.com/gobuffalo/genny v0.0.0-20181017160347-90a774534246/go.mod h1:+oG5Ljrw04czAHbPXREwaFojJbpUvcIy4DiOnbEJFTA=
-github.com/gobuffalo/genny v0.0.0-20181019144442-df0a36fdd146/go.mod h1:IyRrGrQb/sbHu/0z9i5mbpZroIsdxjCYfj+zFiFiWZQ=
-github.com/gobuffalo/genny v0.0.0-20181024195656-51392254bf53/go.mod h1:o9GEH5gn5sCKLVB5rHFC4tq40rQ3VRUzmx6WwmaqISE=
-github.com/gobuffalo/genny v0.0.0-20181025145300-af3f81d526b8/go.mod h1:uZ1fFYvdcP8mu0B/Ynarf6dsGvp7QFIpk/QACUuFUVI=
-github.com/gobuffalo/genny v0.0.0-20181027191429-94d6cfb5c7fc/go.mod h1:x7SkrQQBx204Y+O9EwRXeszLJDTaWN0GnEasxgLrQTA=
-github.com/gobuffalo/genny v0.0.0-20181027195209-3887b7171c4f/go.mod h1:JbKx8HSWICu5zyqWOa0dVV1pbbXOHusrSzQUprW6g+w=
-github.com/gobuffalo/genny v0.0.0-20181030163439-ed103521b8ec/go.mod h1:3Xm9z7/2oRxlB7PSPLxvadZ60/0UIek1YWmcC7QSaVs=
-github.com/gobuffalo/genny v0.0.0-20181106193839-7dcb0924caf1/go.mod h1:x61yHxvbDCgQ/7cOAbJCacZQuHgB0KMSzoYcw5debjU=
-github.com/gobuffalo/genny v0.0.0-20181107223128-f18346459dbe/go.mod h1:utQD3aKKEsdb03oR+Vi/6ztQb1j7pO10N3OBoowRcSU=
-github.com/gobuffalo/genny v0.0.0-20181109163038-9539921b620f/go.mod h1:118bnhJR2oviiji++mZj0IH/IaFBCzwkWHaI4OQq5hQ=
-github.com/gobuffalo/genny v0.0.0-20181110202416-7b7d8756a9e2/go.mod h1:118bnhJR2oviiji++mZj0IH/IaFBCzwkWHaI4OQq5hQ=
-github.com/gobuffalo/genny v0.0.0-20181111200257-599b33630ab4/go.mod h1:w+iD/cdtIpPDFax6LlUFuCdXFD0DLRUXsfp3IeT/Doc=
-github.com/gobuffalo/genny v0.0.0-20181114215459-0a4decd77f5d/go.mod h1:kN2KZ8VgXF9VIIOj/GM0Eo7YK+un4Q3tTreKOf0q1ng=
-github.com/gobuffalo/genny v0.0.0-20181119162812-e8ff4adce8bb/go.mod h1:BA9htSe4bZwBDJLe8CUkoqkypq3hn3+CkoHqVOW718E=
-github.com/gobuffalo/genny v0.0.0-20181127225641-2d959acc795b/go.mod h1:l54xLXNkteX/PdZ+HlgPk1qtcrgeOr3XUBBPDbH+7CQ=
-github.com/gobuffalo/genny v0.0.0-20181128191930-77e34f71ba2a/go.mod h1:FW/D9p7cEEOqxYA71/hnrkOWm62JZ5ZNxcNIVJEaWBU=
-github.com/gobuffalo/genny v0.0.0-20181203165245-fda8bcce96b1/go.mod h1:wpNSANu9UErftfiaAlz1pDZclrYzLtO5lALifODyjuM=
-github.com/gobuffalo/genny v0.0.0-20181203201232-849d2c9534ea/go.mod h1:wpNSANu9UErftfiaAlz1pDZclrYzLtO5lALifODyjuM=
-github.com/gobuffalo/genny v0.0.0-20181206121324-d6fb8a0dbe36/go.mod h1:wpNSANu9UErftfiaAlz1pDZclrYzLtO5lALifODyjuM=
-github.com/gobuffalo/genny v0.0.0-20181207164119-84844398a37d/go.mod h1:y0ysCHGGQf2T3vOhCrGHheYN54Y/REj0ayd0Suf4C/8=
-github.com/gobuffalo/genny v0.0.0-20181207183327-0a63325ed5db/go.mod h1:TWply4MiCmzG1s2mKgxIdzqZjBSX4ibOMC8JaP+/Vm4=
-github.com/gobuffalo/genny v0.0.0-20181207193730-587570ab2cf7/go.mod h1:sHnK+ZSU4e2feXP3PA29ouij6PUEiN+RCwECjCTB3yM=
-github.com/gobuffalo/genny v0.0.0-20181211165820-e26c8466f14d/go.mod h1:sHnK+ZSU4e2feXP3PA29ouij6PUEiN+RCwECjCTB3yM=
-github.com/gobuffalo/genny v0.0.0-20190104222617-a71664fc38e7/go.mod h1:QPsQ1FnhEsiU8f+O0qKWXz2RE4TiDqLVChWkBuh1WaY=
-github.com/gobuffalo/genny v0.0.0-20190112155932-f31a84fcacf5/go.mod h1:CIaHCrSIuJ4il6ka3Hub4DR4adDrGoXGEEt2FbBxoIo=
-github.com/gobuffalo/genny v0.0.0-20190124191459-3310289fa4b4/go.mod h1:yIRqxhZV2sAzb+B3iPUMLauTRrYP8tJUlZ1zV9teKik=
-github.com/gobuffalo/genny v0.0.0-20190131150032-1045e97d19fb/go.mod h1:yIRqxhZV2sAzb+B3iPUMLauTRrYP8tJUlZ1zV9teKik=
-github.com/gobuffalo/genny v0.0.0-20190131190646-008a76242145/go.mod h1:NJvPZJxb9M4z790P6N2SMZKSUYpASpEvLuUWnHGKzb4=
-github.com/gobuffalo/github_flavored_markdown v1.0.4/go.mod h1:uRowCdK+q8d/RF0Kt3/DSalaIXbb0De/dmTqMQdkQ4I=
-github.com/gobuffalo/github_flavored_markdown v1.0.5/go.mod h1:U0643QShPF+OF2tJvYNiYDLDGDuQmJZXsf/bHOJPsMY=
-github.com/gobuffalo/github_flavored_markdown v1.0.7/go.mod h1:w93Pd9Lz6LvyQXEG6DktTPHkOtCbr+arAD5mkwMzXLI=
-github.com/gobuffalo/httptest v1.0.2/go.mod h1:7T1IbSrg60ankme0aDLVnEY0h056g9M1/ZvpVThtB7E=
-github.com/gobuffalo/httptest v1.0.3/go.mod h1:7T1IbSrg60ankme0aDLVnEY0h056g9M1/ZvpVThtB7E=
-github.com/gobuffalo/httptest v1.0.4/go.mod h1:7T1IbSrg60ankme0aDLVnEY0h056g9M1/ZvpVThtB7E=
-github.com/gobuffalo/httptest v1.0.5/go.mod h1:7T1IbSrg60ankme0aDLVnEY0h056g9M1/ZvpVThtB7E=
-github.com/gobuffalo/httptest v1.0.6/go.mod h1:7T1IbSrg60ankme0aDLVnEY0h056g9M1/ZvpVThtB7E=
-github.com/gobuffalo/licenser v0.0.0-20180924033006-eae28e638a42/go.mod h1:Ubo90Np8gpsSZqNScZZkVXXAo5DGhTb+WYFIjlnog8w=
-github.com/gobuffalo/licenser v0.0.0-20181025145548-437d89de4f75/go.mod h1:x3lEpYxkRG/XtGCUNkio+6RZ/dlOvLzTI9M1auIwFcw=
-github.com/gobuffalo/licenser v0.0.0-20181027200154-58051a75da95/go.mod h1:BzhaaxGd1tq1+OLKObzgdCV9kqVhbTulxOpYbvMQWS0=
-github.com/gobuffalo/licenser v0.0.0-20181109171355-91a2a7aac9a7/go.mod h1:m+Ygox92pi9bdg+gVaycvqE8RVSjZp7mWw75+K5NPHk=
-github.com/gobuffalo/licenser v0.0.0-20181116224424-1b7fd3f9cbb4/go.mod h1:icHYfF2FVDi6CpI8BK9Sy1ChkSijz/0GNN7Qzzdk6JE=
-github.com/gobuffalo/licenser v0.0.0-20181128165715-cc7305f8abed/go.mod h1:oU9F9UCE+AzI/MueCKZamsezGOOHfSirltllOVeRTAE=
-github.com/gobuffalo/licenser v0.0.0-20181128170751-82cc989582b9/go.mod h1:oU9F9UCE+AzI/MueCKZamsezGOOHfSirltllOVeRTAE=
-github.com/gobuffalo/licenser v0.0.0-20181203160806-fe900bbede07/go.mod h1:ph6VDNvOzt1CdfaWC+9XwcBnlSTBz2j49PBwum6RFaU=
-github.com/gobuffalo/licenser v0.0.0-20181211173111-f8a311c51159/go.mod h1:ve/Ue99DRuvnTaLq2zKa6F4KtHiYf7W046tDjuGYPfM=
-github.com/gobuffalo/logger v0.0.0-20181022175615-46cfb361fc27/go.mod h1:8sQkgyhWipz1mIctHF4jTxmJh1Vxhp7mP8IqbljgJZo=
-github.com/gobuffalo/logger v0.0.0-20181027144941-73d08d2bb969/go.mod h1:7uGg2duHKpWnN4+YmyKBdLXfhopkAdVM6H3nKbyFbz8=
-github.com/gobuffalo/logger v0.0.0-20181027193913-9cf4dd0efe46/go.mod h1:7uGg2duHKpWnN4+YmyKBdLXfhopkAdVM6H3nKbyFbz8=
-github.com/gobuffalo/logger v0.0.0-20181109185836-3feeab578c17/go.mod h1:oNErH0xLe+utO+OW8ptXMSA5DkiSEDW1u3zGIt8F9Ew=
-github.com/gobuffalo/logger v0.0.0-20181117211126-8e9b89b7c264/go.mod h1:5etB91IE0uBlw9k756fVKZJdS+7M7ejVhmpXXiSFj0I=
-github.com/gobuffalo/logger v0.0.0-20181127160119-5b956e21995c/go.mod h1:+HxKANrR9VGw9yN3aOAppJKvhO05ctDi63w4mDnKv2U=
-github.com/gobuffalo/makr v1.1.5/go.mod h1:Y+o0btAH1kYAMDJW/TX3+oAXEu0bmSLLoC9mIFxtzOw=
-github.com/gobuffalo/mapi v1.0.0/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
-github.com/gobuffalo/mapi v1.0.1/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
-github.com/gobuffalo/meta v0.0.0-20181018155829-df62557efcd3/go.mod h1:XTTOhwMNryif3x9LkTTBO/Llrveezd71u3quLd0u7CM=
-github.com/gobuffalo/meta v0.0.0-20181018192820-8c6cef77dab3/go.mod h1:E94EPzx9NERGCY69UWlcj6Hipf2uK/vnfrF4QD0plVE=
-github.com/gobuffalo/meta v0.0.0-20181025145500-3a985a084b0a/go.mod h1:YDAKBud2FP7NZdruCSlmTmDOZbVSa6bpK7LJ/A/nlKg=
-github.com/gobuffalo/meta v0.0.0-20181109154556-f76929ccd5fa/go.mod h1:1rYI5QsanV6cLpT1BlTAkrFi9rtCZrGkvSK8PglwfS8=
-github.com/gobuffalo/meta v0.0.0-20181114191255-b130ebedd2f7/go.mod h1:K6cRZ29ozr4Btvsqkjvg5nDFTLOgTqf03KA70Ks0ypE=
-github.com/gobuffalo/meta v0.0.0-20181116202903-8850e47774f5/go.mod h1:K6cRZ29ozr4Btvsqkjvg5nDFTLOgTqf03KA70Ks0ypE=
-github.com/gobuffalo/meta v0.0.0-20181127070345-0d7e59dd540b/go.mod h1:RLO7tMvE0IAKAM8wny1aN12pvEKn7EtkBLkUZR00Qf8=
-github.com/gobuffalo/meta v0.0.0-20190120163247-50bbb1fa260d/go.mod h1:KKsH44nIK2gA8p0PJmRT9GvWJUdphkDUA8AJEvFWiqM=
-github.com/gobuffalo/meta v0.0.0-20190121163014-ecaa953cbfb3/go.mod h1:KLfkGnS+Tucc+iTkUcAUBtxpwOJGfhw2pHRLddPxMQY=
-github.com/gobuffalo/meta v0.0.0-20190126124307-c8fb6f4eb5a9/go.mod h1:zoh6GLgkk9+iI/62dST4amAuVAczZrBXoAk/t64n7Ew=
-github.com/gobuffalo/mw-basicauth v1.0.3/go.mod h1:dg7+ilMZOKnQFHDefUzUHufNyTswVUviCBgF244C1+0=
-github.com/gobuffalo/mw-basicauth v1.0.6/go.mod h1:RFyeGeDLZlVgp/eBflqu2eavFqyv0j0fVVP87WPYFwY=
-github.com/gobuffalo/mw-basicauth v1.0.7/go.mod h1:xJ9/OSiOWl+kZkjaSun62srODr3Cx8OB4AKr+G4FlS4=
-github.com/gobuffalo/mw-contenttype v0.0.0-20180802152300-74f5a47f4d56/go.mod h1:7EvcmzBbeCvFtQm5GqF9ys6QnCxz2UM1x0moiWLq1No=
-github.com/gobuffalo/mw-contenttype v0.0.0-20190129203934-2554e742333b/go.mod h1:7x87+mDrr9Peh7AqhOtESyJLanMd2zQNz2Hts+vtBoE=
-github.com/gobuffalo/mw-csrf v0.0.0-20180802151833-446ff26e108b/go.mod h1:sbGtb8DmDZuDUQoxjr8hG1ZbLtZboD9xsn6p77ppcHo=
-github.com/gobuffalo/mw-csrf v0.0.0-20190129204204-25460a055517/go.mod h1:o5u+nnN0Oa7LBeDYH9QP36qeMPnXV9qbVnbZ4D+Kb0Q=
-github.com/gobuffalo/mw-forcessl v0.0.0-20180802152810-73921ae7a130/go.mod h1:JvNHRj7bYNAMUr/5XMkZaDcw3jZhUZpsmzhd//FFWmQ=
-github.com/gobuffalo/mw-i18n v0.0.0-20180802152014-e3060b7e13d6/go.mod h1:91AQfukc52A6hdfIfkxzyr+kpVYDodgAeT5cjX1UIj4=
-github.com/gobuffalo/mw-i18n v0.0.0-20181027200759-09e0c99be4d3/go.mod h1:1PpGPgqP8VsfUppgBA9FrTOXjI6X9gjqhh/8dmg48lg=
-github.com/gobuffalo/mw-i18n v0.0.0-20190129204410-552713a3ebb4/go.mod h1:rBg2eHxsyxVjtYra6fGy4GSF5C8NysOvz+Znnzk42EM=
-github.com/gobuffalo/mw-paramlogger v0.0.0-20181005191442-d6ee392ec72e/go.mod h1:6OJr6VwSzgJMqWMj7TYmRUqzNe2LXu/W1rRW4MAz/ME=
-github.com/gobuffalo/mw-paramlogger v0.0.0-20190129202837-395da1998525/go.mod h1:gEo/ABCsKqvpp/KCxN2AIzDEe0OJUXbJ9293FYrXw+w=
-github.com/gobuffalo/mw-tokenauth v0.0.0-20181001105134-8545f626c189/go.mod h1:UqBF00IfKvd39ni5+yI5MLMjAf4gX7cDKN/26zDOD6c=
-github.com/gobuffalo/mw-tokenauth v0.0.0-20181227153927-0ac66122b3fa/go.mod h1:UqBF00IfKvd39ni5+yI5MLMjAf4gX7cDKN/26zDOD6c=
-github.com/gobuffalo/mw-tokenauth v0.0.0-20190129201951-95847f29c5c8/go.mod h1:n2oa93LHGD94hGI+PoJO+6cf60DNrXrAIv9L/Ke3GXc=
-github.com/gobuffalo/packd v0.0.0-20181027182251-01ad393492c8/go.mod h1:SmdBdhj6uhOsg1Ui4SFAyrhuc7U4VCildosO5IDJ3lc=
-github.com/gobuffalo/packd v0.0.0-20181027190505-aafc0d02c411/go.mod h1:SmdBdhj6uhOsg1Ui4SFAyrhuc7U4VCildosO5IDJ3lc=
-github.com/gobuffalo/packd v0.0.0-20181027194105-7ae579e6d213/go.mod h1:SmdBdhj6uhOsg1Ui4SFAyrhuc7U4VCildosO5IDJ3lc=
-github.com/gobuffalo/packd v0.0.0-20181028162033-6d52e0eabf41/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181029140631-cf76bd87a5a6/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181031195726-c82734870264 h1:roWyi0eEdiFreSqW9V1wT9pNOVzrpo2NWsxja53slX0=
-github.com/gobuffalo/packd v0.0.0-20181031195726-c82734870264/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181103221656-16c4ed88b296/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181104210303-d376b15f8e96/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181111195323-b2e760a5f0ff/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181114190715-f25c5d2471d7/go.mod h1:Yf2toFaISlyQrr5TfO3h6DB9pl9mZRmyvBGQb/aQ/pI=
-github.com/gobuffalo/packd v0.0.0-20181124090624-311c6248e5fb/go.mod h1:Foenia9ZvITEvG05ab6XpiD5EfBHPL8A6hush8SJ0o8=
-github.com/gobuffalo/packd v0.0.0-20181207120301-c49825f8f6f4/go.mod h1:LYc0TGKFBBFTRC9dg2pcRcMqGCTMD7T2BIMP7OBuQAA=
-github.com/gobuffalo/packd v0.0.0-20181212173646-eca3b8fd6687 h1:uZ+G4JprR0UEq0aHZs+6eP7TEZuFfrIkmQWejIBV/QQ=
-github.com/gobuffalo/packd v0.0.0-20181212173646-eca3b8fd6687/go.mod h1:LYc0TGKFBBFTRC9dg2pcRcMqGCTMD7T2BIMP7OBuQAA=
-github.com/gobuffalo/packr v1.13.7/go.mod h1:KkinLIn/n6+3tVXMwg6KkNvWwVsrRAz4ph+jgpk3Z24=
-github.com/gobuffalo/packr v1.15.0/go.mod h1:t5gXzEhIviQwVlNx/+3SfS07GS+cZ2hn76WLzPp6MGI=
-github.com/gobuffalo/packr v1.15.1/go.mod h1:IeqicJ7jm8182yrVmNbM6PR4g79SjN9tZLH8KduZZwE=
-github.com/gobuffalo/packr v1.16.0/go.mod h1:Yx/lcR/7mDLXhuJSzsz2MauD/HUwSc+EK6oigMRGGsM=
-github.com/gobuffalo/packr v1.19.0 h1:3UDmBDxesCOPF8iZdMDBBWKfkBoYujIMIZePnobqIUI=
-github.com/gobuffalo/packr v1.19.0/go.mod h1:MstrNkfCQhd5o+Ct4IJ0skWlxN8emOq8DsoT1G98VIU=
-github.com/gobuffalo/packr v1.20.0/go.mod h1:JDytk1t2gP+my1ig7iI4NcVaXr886+N0ecUga6884zw=
-github.com/gobuffalo/packr v1.21.0/go.mod h1:H00jGfj1qFKxscFJSw8wcL4hpQtPe1PfU2wa6sg/SR0=
-github.com/gobuffalo/packr v1.21.5/go.mod h1:zCvDxrZzFmq5Xd7Jw4vaGe/OYwzuXnma31D2EbTHMWk=
-github.com/gobuffalo/packr v1.21.7/go.mod h1:73tmYjwi4Cvb1eNiAwpmrzZ0gxVA4KBqVSZ2FNeJodM=
-github.com/gobuffalo/packr v1.21.8/go.mod h1:aRZXyERYmMgohDp5wDWnbgn5KiWuCKG19WnWZcAqeII=
-github.com/gobuffalo/packr v1.21.9 h1:zBaEhCmJpYy/UdHGAGIC3vO5Uh7RW091le41+Ydcg4E=
-github.com/gobuffalo/packr v1.21.9/go.mod h1:GC76q6nMzRtR+AEN/VV4w0z2/4q7SOaEmXh3Ooa8sOE=
-github.com/gobuffalo/packr v1.22.0 h1:/YVd/GRGsu0QuoCJtlcWSVllobs4q3Xvx3nqxTvPyN0=
-github.com/gobuffalo/packr v1.22.0/go.mod h1:Qr3Wtxr3+HuQEwWqlLnNW4t1oTvK+7Gc/Rnoi/lDFvA=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.5/go.mod h1:e6gmOfhf3KmT4zl2X/NDRSfBXk2oV4TXZ+NNOM0xwt8=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.7/go.mod h1:BzhceHWfF3DMAkbPUONHYWs63uacCZxygFY1b4H9N2A=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.8/go.mod h1:y60QCdzwuMwO2R49fdQhsjCPv7tLQFR0ayzxxla9zes=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.9/go.mod h1:fQqADRfZpEsgkc7c/K7aMew3n4aF1Kji7+lIZeR98Fc=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.10/go.mod h1:4CWWn4I5T3v4c1OsJ55HbHlUEKNWMITG5iIkdr4Px4w=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.11/go.mod h1:JoieH/3h3U4UmatmV93QmqyPUdf4wVM9HELaHEu+3fk=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.12/go.mod h1:FV1zZTsVFi1DSCboO36Xgs4pzCZBjB/tDV9Cz/lSaR8=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.13/go.mod h1:2Mp7GhBFMdJlOK8vGfl7SYtfMP3+5roE39ejlfjw0rA=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.14/go.mod h1:06otbrNvDKO1eNQ3b8hst+1010UooI2MFg+B2Ze4MV8=
-github.com/gobuffalo/packr/v2 v2.0.0-rc.15/go.mod h1:IMe7H2nJvcKXSF90y4X1rjYIRlNMJYCxEhssBXNZwWs=
-github.com/gobuffalo/packr/v2 v2.0.0/go.mod h1:7McfLpSxaPUoSQm7gYpTZRQSK63mX8EKzzYSEFKvfkM=
-github.com/gobuffalo/plush v3.7.16+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.20+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.21+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.22+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.23+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.30+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.31+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.32+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plush v3.7.33+incompatible/go.mod h1:rQ4zdtUUyZNqULlc6bqd5scsPfLKfT0+TGMChgduDvI=
-github.com/gobuffalo/plushgen v0.0.0-20181128164830-d29dcb966cb2/go.mod h1:r9QwptTFnuvSaSRjpSp4S2/4e2D3tJhARYbvEBcKSb4=
-github.com/gobuffalo/plushgen v0.0.0-20181203163832-9fc4964505c2/go.mod h1:opEdT33AA2HdrIwK1aibqnTJDVVKXC02Bar/GT1YRVs=
-github.com/gobuffalo/plushgen v0.0.0-20181207152837-eedb135bd51b/go.mod h1:Lcw7HQbEVm09sAQrCLzIxuhFbB3nAgp4c55E+UlynR0=
-github.com/gobuffalo/plushgen v0.0.0-20190104222512-177cd2b872b3/go.mod h1:tYxCozi8X62bpZyKXYHw1ncx2ZtT2nFvG42kuLwYjoc=
-github.com/gobuffalo/pop v4.8.2+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.8.3+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.8.4+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.8.5+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.8.7+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.8.8+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.0+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.1+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.2+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.3+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.4+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.5+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/pop v4.9.6+incompatible/go.mod h1:DwBz3SD5SsHpTZiTubcsFWcVDpJWGsxjVjMPnkiThWg=
-github.com/gobuffalo/release v1.0.35/go.mod h1:VtHFAKs61vO3wboCec5xr9JPTjYyWYcvaM3lclkc4x4=
-github.com/gobuffalo/release v1.0.38/go.mod h1:VtHFAKs61vO3wboCec5xr9JPTjYyWYcvaM3lclkc4x4=
-github.com/gobuffalo/release v1.0.42/go.mod h1:RPs7EtafH4oylgetOJpGP0yCZZUiO4vqHfTHJjSdpug=
-github.com/gobuffalo/release v1.0.51/go.mod h1:RPs7EtafH4oylgetOJpGP0yCZZUiO4vqHfTHJjSdpug=
-github.com/gobuffalo/release v1.0.52/go.mod h1:RPs7EtafH4oylgetOJpGP0yCZZUiO4vqHfTHJjSdpug=
-github.com/gobuffalo/release v1.0.53/go.mod h1:FdF257nd8rqhNaqtDWFGhxdJ/Ig4J7VcS3KL7n/a+aA=
-github.com/gobuffalo/release v1.0.54/go.mod h1:Pe5/RxRa/BE8whDpGfRqSI7D1a0evGK1T4JDm339tJc=
-github.com/gobuffalo/release v1.0.61/go.mod h1:mfIO38ujUNVDlBziIYqXquYfBF+8FDHUjKZgYC1Hj24=
-github.com/gobuffalo/release v1.0.63/go.mod h1:/7hQAikt0l8Iu/tAX7slC1qiOhD6Nb+3KMmn/htiUfc=
-github.com/gobuffalo/release v1.0.72/go.mod h1:NP5NXgg/IX3M5XmHmWR99D687/3Dt9qZtTK/Lbwc1hU=
-github.com/gobuffalo/release v1.0.74/go.mod h1:NP5NXgg/IX3M5XmHmWR99D687/3Dt9qZtTK/Lbwc1hU=
-github.com/gobuffalo/release v1.1.1/go.mod h1:Sluak1Xd6kcp6snkluR1jeXAogdJZpFFRzTYRs/2uwg=
-github.com/gobuffalo/release v1.1.3/go.mod h1:CuXc5/m+4zuq8idoDt1l4va0AXAn/OSs08uHOfMVr8E=
-github.com/gobuffalo/release v1.1.6/go.mod h1:18naWa3kBsqO0cItXZNJuefCKOENpbbUIqRL1g+p6z0=
-github.com/gobuffalo/shoulders v1.0.1/go.mod h1:V33CcVmaQ4gRUmHKwq1fiTXuf8Gp/qjQBUL5tHPmvbA=
-github.com/gobuffalo/syncx v0.0.0-20181120191700-98333ab04150/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
-github.com/gobuffalo/syncx v0.0.0-20181120194010-558ac7de985f h1:S5EeH1reN93KR0L6TQvkRpu9YggCYXrUqFh1iEgvdC0=
-github.com/gobuffalo/syncx v0.0.0-20181120194010-558ac7de985f/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
-github.com/gobuffalo/tags v2.0.11+incompatible/go.mod h1:9XmhOkyaB7UzvuY4UoZO4s67q8/xRMVJEaakauVQYeY=
-github.com/gobuffalo/tags v2.0.14+incompatible/go.mod h1:9XmhOkyaB7UzvuY4UoZO4s67q8/xRMVJEaakauVQYeY=
-github.com/gobuffalo/tags v2.0.15+incompatible/go.mod h1:9XmhOkyaB7UzvuY4UoZO4s67q8/xRMVJEaakauVQYeY=
-github.com/gobuffalo/uuid v2.0.3+incompatible/go.mod h1:ErhIzkRhm0FtRuiE/PeORqcw4cVi1RtSpnwYrxuvkfE=
-github.com/gobuffalo/uuid v2.0.4+incompatible/go.mod h1:ErhIzkRhm0FtRuiE/PeORqcw4cVi1RtSpnwYrxuvkfE=
-github.com/gobuffalo/uuid v2.0.5+incompatible/go.mod h1:ErhIzkRhm0FtRuiE/PeORqcw4cVi1RtSpnwYrxuvkfE=
-github.com/gobuffalo/validate v2.0.3+incompatible/go.mod h1:N+EtDe0J8252BgfzQUChBgfd6L93m9weay53EWFVsMM=
-github.com/gobuffalo/x v0.0.0-20181003152136-452098b06085/go.mod h1:WevpGD+5YOreDJznWevcn8NTmQEW5STSBgIkpkjzqXc=
-github.com/gobuffalo/x v0.0.0-20181007152206-913e47c59ca7/go.mod h1:9rDPXaB3kXdKWzMc4odGQQdG2e2DIEmANy5aSJ9yesY=
-github.com/gobuffalo/x v0.0.0-20181025165825-f204f550da9d/go.mod h1:Qh2Pb/Ak1Ko2mzHlGPigrnxkhO4WTTCI1jJM58sbgtE=
-github.com/gobuffalo/x v0.0.0-20181025192250-1ef645d63fe8/go.mod h1:AIlnMGlYXOCsoCntLPFLYtrJNS/pc2HD4IdSXH62TpU=
-github.com/gobuffalo/x v0.0.0-20181109195216-5b3131238124/go.mod h1:GpdLUY6/Ztf/3FfxfwsLkDqAGZ0brhlh7LzIibHyZp0=
-github.com/gobuffalo/x v0.0.0-20181110221217-14085ca3e1a9/go.mod h1:ig5vdn4+5IPtxgESlZWo1SSDyHKKef8EjVVKhY9kkIQ=
-github.com/gofrs/uuid v3.1.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/golang/go v0.0.0-20181209142756-11ce6eabd607 h1:JXKFLjiDtu/VfNLWGhu5G/MGmn/sqEuw6+wDyD9pnvY=
-github.com/golang/protobuf v1.1.0 h1:0iH4Ffd/meGoXqF2lSAhZHt8X+cPgkfn/cb6Cce5Vpc=
-github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gliderlabs/ssh v0.2.2 h1:6zsha5zo/TWhRhwqCD3+EarCAgZ2yN28ipRnGPnwkI0=
+github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonpointer v0.0.0-20180322222829-3a0015ad55fa/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3 h1:gihV7YNZK1iK6Tgwwsxo2rJbD1GTbdm72325Bq8FI3w=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/jsonreference v0.0.0-20180322222742-3fb327e6747d/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/jsonreference v0.19.3 h1:5cxNfTy0UVC3X8JL5ymxzyoUZmo8iZb+jeTWn7tUa8o=
+github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/spec v0.0.0-20180415031709-bcff419492ee/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/spec v0.19.3 h1:0XRyw8kguri6Yw4SxhsQA/atC88yqrk0+G4YhI2wabc=
+github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-openapi/swag v0.0.0-20180405201759-811b1089cde9/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5 h1:lTz6Ys4CmqqCQmZPBlbQENR1/GucA2bzYTE12Pw4tFY=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/gobuffalo/envy v1.7.0/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
+github.com/gobuffalo/envy v1.7.1 h1:OQl5ys5MBea7OGCdvPbBJWRgnhC/fGona6QKfvFeau8=
+github.com/gobuffalo/envy v1.7.1/go.mod h1:FurDp9+EDPE4aIUS3ZLyD+7/9fpx7YRt/ukY6jIHf0w=
+github.com/gobuffalo/logger v1.0.0/go.mod h1:2zbswyIUa45I+c+FLXuWl9zSWEiVuthsk8ze5s8JvPs=
+github.com/gobuffalo/packd v0.3.0 h1:eMwymTkA1uXsqxS0Tpoop3Lc0u3kTfiMBE6nKtQU4g4=
+github.com/gobuffalo/packd v0.3.0/go.mod h1:zC7QkmNkYVGKPw4tHpBQ+ml7W/3tIebgeo1b36chA3Q=
+github.com/gobuffalo/packr v1.30.1 h1:hu1fuVR3fXEZR7rXNW3h8rqSML8EVAf6KNm0NKO/wKg=
+github.com/gobuffalo/packr v1.30.1/go.mod h1:ljMyFO2EcrnzsHsN99cvbq055Y9OhRrIaviy289eRuk=
+github.com/gobuffalo/packr/v2 v2.5.1/go.mod h1:8f9c96ITobJlPzI44jj+4tHnEKNt0xXWSVlXRN9X1Iw=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/google/certificate-transparency-go v1.0.20 h1:azETE79toaBOyp+StoEBy8atzQujL0PyBPEmsEeDCXI=
-github.com/google/certificate-transparency-go v1.0.20/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/certificate-transparency-go v1.0.21 h1:Yf1aXowfZ2nuboBsg7iYGLmwsOARdV86pfH3g95wXmE=
 github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
-github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/pat v0.0.0-20180118222023-199c85a7f6d1/go.mod h1:YeAe0gNeiNT5hoiZRI4yiOky6jVdNvfO2N6Kav/HmxY=
-github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
-github.com/gorilla/sessions v1.1.2/go.mod h1:8KCfur6+4Mqcc6S0FEfKuN15Vl5MgXW92AE8ovaJD0w=
-github.com/gorilla/sessions v1.1.3/go.mod h1:8KCfur6+4Mqcc6S0FEfKuN15Vl5MgXW92AE8ovaJD0w=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jackc/fake v0.0.0-20150926172116-812a484cc733/go.mod h1:WrMFNQdiFJ80sQsxDoMokWK1W5TQtxBFNpzWTD84ibQ=
-github.com/jackc/pgx v3.2.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
-github.com/jackc/pgx v3.3.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jessevdk/go-flags v1.4.0 h1:4IU2WS7AumrZ/40jfhf4QVDMsQwqA7VEHozFRrGARJA=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0/go.mod h1:IiEW3SEiiErVyFdH8NTuWjSifiEQKUoyK3LNqr2kCHU=
-github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks=
-github.com/joho/godotenv v1.2.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
-github.com/json-iterator/go v1.1.5 h1:gL2yXlmiIo4+t+y32d4WGwOjKGYcGOuyrg46vadswDE=
-github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/karrick/godirwalk v1.7.5/go.mod h1:2c9FRhkDxdIbgkOnCEvnSWs71Bhugbl46shStcFDJ34=
-github.com/karrick/godirwalk v1.7.7/go.mod h1:2c9FRhkDxdIbgkOnCEvnSWs71Bhugbl46shStcFDJ34=
-github.com/karrick/godirwalk v1.7.8/go.mod h1:2c9FRhkDxdIbgkOnCEvnSWs71Bhugbl46shStcFDJ34=
-github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kevinburke/ssh_config v0.0.0-20180830205328-81db2a75821e h1:RgQk53JHp/Cjunrr1WlsXSZpqXn+uREuHvUVcK82CV8=
-github.com/kevinburke/ssh_config v0.0.0-20180830205328-81db2a75821e/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/konsorten/go-windows-terminal-sequences v0.0.0-20180402223658-b729f2633dfe/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.8 h1:QiWkFLKq0T7mpzwOTu6BzNDbfTE8OLrYhVKYMLF46Ok=
+github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/karrick/godirwalk v1.10.12/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
+github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd h1:Coekwdh0v2wtGp9Gmz1Ze3eVRAWJMLokvN3QjdzCHLY=
+github.com/kevinburke/ssh_config v0.0.0-20190725054713-01f96b0aa0cd/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
+github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329 h1:2gxZ0XQIU/5z3Z3bUBu+FXuk2pFbkN6tcwi/pjyaDic=
-github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/markbates/deplist v1.0.4/go.mod h1:gRRbPbbuA8TmMiRvaOzUlRfzfjeCCBqX2A6arxN01MM=
-github.com/markbates/deplist v1.0.5/go.mod h1:gRRbPbbuA8TmMiRvaOzUlRfzfjeCCBqX2A6arxN01MM=
-github.com/markbates/going v1.0.2/go.mod h1:UWCk3zm0UKefHZ7l8BNqi26UyiEMniznk8naLdTcy6c=
-github.com/markbates/going v1.0.3/go.mod h1:fQiT6v6yQar9UD6bd/D4Z5Afbk9J6BBVBtLiyY4gp2o=
-github.com/markbates/grift v1.0.4/go.mod h1:wbmtW74veyx+cgfwFhlnnMWqhoz55rnHR47oMXzsyVs=
-github.com/markbates/grift v1.0.5/go.mod h1:EHmVIjOQoj/OOBDzlZ8RW0ZkvOtQ4xRHjrPvmfoiFaU=
-github.com/markbates/hmax v1.0.0/go.mod h1:cOkR9dktiESxIMu+65oc/r/bdY4bE8zZw3OLhLx0X2c=
-github.com/markbates/inflect v1.0.0/go.mod h1:oTeZL2KHA7CUX6X+fovmK9OvIOFuqu0TwdQrZjLTh88=
-github.com/markbates/inflect v1.0.1/go.mod h1:uv3UVNBe5qBIfCm8O8Q+DW+S1EopeyINj+Ikhc7rnCk=
-github.com/markbates/inflect v1.0.3/go.mod h1:1fR9+pO2KHEO9ZRtto13gDwwZaAKstQzferVeWqbgNs=
-github.com/markbates/inflect v1.0.4/go.mod h1:1fR9+pO2KHEO9ZRtto13gDwwZaAKstQzferVeWqbgNs=
-github.com/markbates/oncer v0.0.0-20180924031910-e862a676800b/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
-github.com/markbates/oncer v0.0.0-20180924034138-723ad0170a46/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
-github.com/markbates/oncer v0.0.0-20181014194634-05fccaae8fc4 h1:Mlji5gkcpzkqTROyE4ZxZ8hN7osunMb2RuGVrbvMvCc=
-github.com/markbates/oncer v0.0.0-20181014194634-05fccaae8fc4/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
-github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2 h1:JgVTCPf0uBVcUSWpyXmGpgOc62nK5HWUBKAGc3Qqa5k=
-github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
-github.com/markbates/refresh v1.4.10/go.mod h1:NDPHvotuZmTmesXxr95C9bjlw1/0frJwtME2dzcVKhc=
-github.com/markbates/refresh v1.4.11/go.mod h1:awpJuyo4zgexB/JaHfmBX0sRdvOjo2dXwIayWIz9i3g=
-github.com/markbates/refresh v1.5.0/go.mod h1:ZYMLkxV+x7wXQ2Xd7bXAPyF0EXiEWAMfiy/4URYb1+M=
-github.com/markbates/refresh v1.6.0/go.mod h1:p8jWGABFUaFf/cSw0pxbo0MQVujiz5NTQ0bmCHLC4ac=
-github.com/markbates/safe v1.0.0/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
-github.com/markbates/sigtx v1.0.0/go.mod h1:QF1Hv6Ic6Ca6W+T+DL0Y/ypborFKyvUY9HmuCD4VeTc=
-github.com/markbates/willie v1.0.9/go.mod h1:fsrFVWl91+gXpx/6dv715j7i11fYPfZ9ZGfH0DQzY7w=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/mattn/go-sqlite3 v1.10.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204022431-4c0c5c22c37e h1:wJFQrIkhbw1j3d+nOLUhGAciBnK6nD7Uhk4aaiTKSSE=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204022431-4c0c5c22c37e/go.mod h1:8/2Amku7IP+NNr3JUnduD8QjOK9mdpf+pj2fV8D4Hmw=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204022916-8c056deefc42 h1:1AyLGyOEvYWBNqo8Axma+yOkm0dCliJfso8NmDpdLzM=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204022916-8c056deefc42/go.mod h1:OllM1HVcFzek2effrrgC8BLKfG73mSKfrh41kEuhvMk=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204024002-84343d2c0eda h1:ykEyzlC7E/TOOIUdj8cmpDF2yb6bhzPK7S0Ee2Z+vSI=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204024002-84343d2c0eda/go.mod h1:OllM1HVcFzek2effrrgC8BLKfG73mSKfrh41kEuhvMk=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204025501-38c0b18f1edd h1:knS7/g8ffqSDiRaPlgb/5AnPPO26Z8emO9CC9OOlntg=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204025501-38c0b18f1edd/go.mod h1:OllM1HVcFzek2effrrgC8BLKfG73mSKfrh41kEuhvMk=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204030159-200d6ab398a9 h1:pPFPrmHOzd64dzF8kONrA41LvwzOf94RSLUku3cWsto=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204030159-200d6ab398a9/go.mod h1:OllM1HVcFzek2effrrgC8BLKfG73mSKfrh41kEuhvMk=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204031235-fc4ac9154422 h1:LduQ+iywUCm8L3S4BGs775iJSsB83pLfxF4eOT8kw34=
-github.com/mcluseau/go-swagger-ui v0.0.0-20190204031235-fc4ac9154422/go.mod h1:OllM1HVcFzek2effrrgC8BLKfG73mSKfrh41kEuhvMk=
-github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
-github.com/microcosm-cc/bluemonday v1.0.2/go.mod h1:iVP4YcDBq+n/5fb23BhYFvIMq/leAFZyRl6bYmGDlGc=
-github.com/mitchellh/go-homedir v1.0.0 h1:vKb8ShqSby24Yrqr/yDYkuFz8d0WUjys40rvnGC8aR0=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20180323154445-8b799c424f57/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.0 h1:aizVhC/NAAcKWb+5QsU1iNOZb4Yws5UO2I+aIprQITM=
+github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/mcluseau/go-swagger-ui v0.0.0-20191019002626-fd9128c24a34 h1:F3u4DKQ4T30mlBNFmSGzTqdkmVqbfVORv34ZRvc7PuE=
+github.com/mcluseau/go-swagger-ui v0.0.0-20191019002626-fd9128c24a34/go.mod h1:lcyE8C83VRamH/oTpikU4+yVCCxLthWgDOqjHSsu+ZY=
+github.com/miolini/datacounter v1.0.1 h1:4hs8Sc03o2jADLol/aWgesWS565mV9h8314QGA+gss4=
+github.com/miolini/datacounter v1.0.1/go.mod h1:C45dc2hBumHjDpEU64IqPwR6TDyPVpzOqqRTN7zmBUA=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/mapstructure v1.0.0/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/monoculum/formam v0.0.0-20180901015400-4e68be1d79ba/go.mod h1:RKgILGEJq24YyJ2ban8EO0RUVSJlF1pGsEvoLEACr/Q=
-github.com/nicksnyder/go-i18n v1.10.0/go.mod h1:HrK7VCrbOvQoUAQ7Vpy7i87N7JZZZ7R2xBGjv0j365Q=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/gomega v1.4.1/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v1.4.2/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/pelletier/go-buffruneio v0.2.0 h1:U4t4R6YkofJ5xHm3dJzuRpPZ0mr5MMCoAWooScCR7aA=
+github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/pelletier/go-buffruneio v0.2.0/go.mod h1:JkE26KsDizTr40EUHkXVtNPvgGtbSNq5BcowyYOWdKo=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pierrec/lz4 v2.0.5+incompatible h1:2xWsjqPFWcplujydGg4WmhC/6fZqK42wMM8aXeqhl0I=
-github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pierrec/lz4 v2.3.0+incompatible h1:CZzRn4Ut9GbUkHlQ7jqBXeZQV41ZSKWFc302ZU6lUTk=
+github.com/pierrec/lz4 v2.3.0+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.0.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.1.0 h1:g0fH8RicVgNl+zVZDCDfbdWxAWoAEJyI7I3TZYXFiig=
 github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.3.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.5.0 h1:Usqs0/lDK/NqTkvrmKSwA/3XkZAs7ZAW/eLeQ2MVBTw=
+github.com/rogpeppe/go-internal v1.5.0/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
 github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
-github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
-github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go v0.0.0-20181202030253-914043390fc6/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go v0.0.0-20181215222900-0143a8f55f04/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go v0.0.0-20190121191506-3fef8c783dec/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
-github.com/shurcooL/highlight_diff v0.0.0-20170515013008-09bb4053de1b/go.mod h1:ZpfEhSmds4ytuByIcDnOLkTHGUI6KNqRNPDLHDk+mUU=
-github.com/shurcooL/highlight_diff v0.0.0-20181222201841-111da2e7d480/go.mod h1:ZpfEhSmds4ytuByIcDnOLkTHGUI6KNqRNPDLHDk+mUU=
-github.com/shurcooL/highlight_go v0.0.0-20170515013102-78fb10f4a5f8/go.mod h1:UDKB5a1T23gOMUJrI+uSuH0VRDStOiUVSjBTRDVBVag=
-github.com/shurcooL/highlight_go v0.0.0-20181028180052-98c3abbbae20/go.mod h1:UDKB5a1T23gOMUJrI+uSuH0VRDStOiUVSjBTRDVBVag=
-github.com/shurcooL/highlight_go v0.0.0-20181215221002-9d8641ddf2e1/go.mod h1:UDKB5a1T23gOMUJrI+uSuH0VRDStOiUVSjBTRDVBVag=
-github.com/shurcooL/octicon v0.0.0-20180602230221-c42b0e3b24d9/go.mod h1:eWdoE5JD4R5UVWDucdOPg1g2fqQRq78IQa9zlOV1vpQ=
-github.com/shurcooL/octicon v0.0.0-20181028054416-fa4f57f9efb2/go.mod h1:eWdoE5JD4R5UVWDucdOPg1g2fqQRq78IQa9zlOV1vpQ=
-github.com/shurcooL/octicon v0.0.0-20181222203144-9ff1a4cf27f4/go.mod h1:eWdoE5JD4R5UVWDucdOPg1g2fqQRq78IQa9zlOV1vpQ=
-github.com/shurcooL/sanitized_anchor_name v0.0.0-20170918181015-86672fcb3f95/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
-github.com/sirupsen/logrus v1.1.0/go.mod h1:zrgwTnHtNr00buQ1vSptGe8m1f/BbgsPukg8qsT7A+A=
-github.com/sirupsen/logrus v1.1.1/go.mod h1:zrgwTnHtNr00buQ1vSptGe8m1f/BbgsPukg8qsT7A+A=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
-github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/afero v1.2.0/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/cast v1.2.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/viper v1.2.1/go.mod h1:P4AexN0a+C9tGAnUFNwDMYYZv3pjFuvmeiMyKRaNVlI=
-github.com/spf13/viper v1.3.0/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
-github.com/spf13/viper v1.3.1/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/src-d/gcfg v1.4.0 h1:xXbNR5AlLSA315x2UO+fTSSAXCDf+Ar38/6oyGbDKQ4=
 github.com/src-d/gcfg v1.4.0/go.mod h1:p/UMsR43ujA89BJY9duynAwIpvqEujIH/jFlfL7jWoI=
-github.com/src-d/go-git v4.7.0+incompatible h1:IYSSnbAHeKmsfbQFi9ozbid+KNh0bKjlorMfQehQbcE=
-github.com/src-d/go-git v4.7.0+incompatible/go.mod h1:1bQciz+hn0jzPQNsYj0hDFZHLJBdV7gXE2mWhC7EkFk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/ugorji/go v1.1.2/go.mod h1:hnLbHMwcvSihnDhEfx2/BzKp2xb0Y+ErdfYcrs9tkJQ=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ugorji/go/codec v0.0.0-20181209151446-772ced7fd4c2/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ugorji/go/codec v0.0.0-20190128213124-ee1426cffec0/go.mod h1:iT03XoTwV7xq/+UGwKO3UbC1nNNlopQiY61beSdrtOA=
-github.com/ulikunitz/xz v0.5.4/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
-github.com/ulikunitz/xz v0.5.5/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
-github.com/unrolled/secure v0.0.0-20180918153822-f340ee86eb8b/go.mod h1:mnPT77IAdsi/kV7+Es7y+pXALeV3h7G6dQF6mNYjcLA=
-github.com/unrolled/secure v0.0.0-20181005190816-ff9db2ff917f/go.mod h1:mnPT77IAdsi/kV7+Es7y+pXALeV3h7G6dQF6mNYjcLA=
-github.com/unrolled/secure v0.0.0-20181022170031-4b6b7cf51606/go.mod h1:mnPT77IAdsi/kV7+Es7y+pXALeV3h7G6dQF6mNYjcLA=
-github.com/unrolled/secure v0.0.0-20190103195806-76e6d4e9b90c/go.mod h1:mnPT77IAdsi/kV7+Es7y+pXALeV3h7G6dQF6mNYjcLA=
-github.com/xanzy/ssh-agent v0.2.0 h1:Adglfbi5p9Z0BmK2oKU9nTG+zKfniSfnaMYB+ULd+Ro=
-github.com/xanzy/ssh-agent v0.2.0/go.mod h1:0NyE30eGUDliuLEHJgYte/zncp2zdTStcOnWhgSqHD8=
+github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
+github.com/xanzy/ssh-agent v0.2.1 h1:TCbipTQL2JiiCprBWx9frJ2eJlCYT00NmctrHxVAr70=
+github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-golang.org/x/crypto v0.0.0-20180621125126-a49355c7e3f8 h1:h7zdf0RiEvWbYBKIx4b+q41xoUVnMmvsGZnIVE5syG8=
-golang.org/x/crypto v0.0.0-20180621125126-a49355c7e3f8/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20180910181607-0e37d006457b/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181001203147-e3636079e1a4/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181015023909-0c41d7ab0a0e/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181024171144-74cb1d3d52f4/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181025113841-85e1b3f9139a/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181025213731-e84da0312774/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181106171534-e4dc69e5b2fd/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181112202954-3d3f9f413869/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181127143415-eb0de9b17e85/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9 h1:mKdxBk7AujPs8kU4m80U72y/zjbZ3UcXC7dClwKbUI0=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190102171810-8d7daa0c54b3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190103213133-ff983b9c42bc h1:F5tKCVGp+MUAHhKp5MZtGqAlGX3+oCsiL1Q629FL90M=
-golang.org/x/crypto v0.0.0-20190103213133-ff983b9c42bc/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190122013713-64072686203f/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190129210102-ccddf3741a0c h1:MWY7h75sb9ioBR+s5Zgq1JYXxhbZvrSP2okwLi3ItmI=
-golang.org/x/crypto v0.0.0-20190129210102-ccddf3741a0c/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190130090550-b01c7a725664/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190131182504-b8fe1690c613 h1:MQ/ZZiDsUapFFiMS+vzwXkCTeEKaum+Do5rINYJDmxc=
-golang.org/x/crypto v0.0.0-20190131182504-b8fe1690c613/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180816102801-aaf60122140d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190621222207-cc06ce4a13d4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180921000356-2f5d2388922f/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180926154720-4dfa2610cdf3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181005035420-146acd28ed58/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181017193950-04a2e542c03f/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181029044818-c44066c5c816/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181102091132-c10e9556a7bc h1:ZMCWScCvS2fUVFw8LOpxyUUW5qiviqr4Dg5NdjLeiLU=
-golang.org/x/net v0.0.0-20181102091132-c10e9556a7bc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181106065722-10aee1819953/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181108082009-03003ca0c849/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181207154023-610586996380 h1:zPQexyRtNYBc7bcHmehl1dH6TB3qn8zytv8cBGLDNY0=
-golang.org/x/net v0.0.0-20181207154023-610586996380/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181213202711-891ebc4b82d6/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190119204137-ed066c81e75e h1:MDa3fSUp6MdYHouVmCCNz/zaH2a6CRcxY3VhT/K3C5Q=
-golang.org/x/net v0.0.0-20190119204137-ed066c81e75e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3 h1:ulvT7fqt0yHWzpJwI57MezWnYDVpCAYBVuYst/L+fAY=
-golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191014212845-da9a3fd4c582 h1:p9xBe/w/OzkeYVKm234g55gMdD1nSIooTir5kV11kfA=
+golang.org/x/net v0.0.0-20191014212845-da9a3fd4c582/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180903190138-2b024373dcd9/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180906133057-8cf3aee42992/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180921163948-d47a0f339242/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180927150500-dad3d9fb7b6e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181005133103-4497e2df6f9e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181011152604-fa43e7bc11ba/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181019084534-8f1d3d21f81b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181022134430-8a28ead16f52/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181024145615-5cd93ef61a7c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181025063200-d989b31c8746/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026064943-731415f00dce/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181030150119-7e31e0c00fa0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181106135930-3a76605856fd/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181128092732-4ed8d59d0b35/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181206074257-70b957f3b65e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181210030007-2a47403f2ae5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181213150753-586ba8c9bb14/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181213200352-4d1cda033e06/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181221143128-b4a75ba826a6/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190102155601-82a175fd1598/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190116161447-11f53e031339/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190122071731-054c452bb702/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190203050204-7ae0202eb74c h1:YeMXU0KQqExdpG959DFhAhfpY8myIsnfqj8lhNFRzzE=
-golang.org/x/sys v0.0.0-20190203050204-7ae0202eb74c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190221075227-b4e8571b14e0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190515120540-06a5c4944438/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191018095205-727590c5006e h1:ZtoklVMHQy6BFRHkbG6JzK+S6rX82//Yeok1vMlizfQ=
+golang.org/x/sys v0.0.0-20191018095205-727590c5006e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181003024731-2f84ea8ef872/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181006002542-f60d9635b16a/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181008205924-a2b3f7f249e9/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181013182035-5e66757b835f/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181017214349-06f26fdaaa28/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181019005945-6adeb8aab2de/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181024171208-a2dc47679d30/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181026183834-f60e5f99f081/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030151751-bb28844c46df/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181102223251-96e9e165b75e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181105230042-78dc5bac0cac/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181107215632-34b416bd17b3/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181109152631-138c20b93253/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181109202920-92d8274bd7b8/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181111003725-6d71ab8aade0/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181114190951-94339b83286c/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181119130350-139d099f6620/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181120060634-fc4f04983f62/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181122213734-04b5d21e00f1/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181127195227-b4e97c0ed882/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181127232545-e782529d0ddd/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181201035826-d0ca3933b724/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181203210056-e5f3ab76ea4b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181205224935-3576414c54a4/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181206194817-bcd4e47d0288/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181207183836-8bc39b988060/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181207222222-4c874b978acb/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181210202511-1d424dbce8dd/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181212172921-837e80568c09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181213190329-bbccd8cae4a9/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181221235234-d00ac6d27372/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190102213336-ca9055ed7d04/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190104182027-498d95493402/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190111214448-fc1d57b08d7b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190118193359-16909d206f00/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190122202912-9c309ee22fab/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190124004107-78ee07aa9465/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190130015043-a06a922acc1b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190131142011-8dbcc66f33bb/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190202235157-7414d4c1f71c/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
-gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190624180213-70d37148ca0c/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190729092621-ff9f1409240a/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
-gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
-gopkg.in/mail.v2 v2.0.0-20180731213649-a0242b2233b4/go.mod h1:htwXN1Qh09vZJ1NVKxQqHPBaCBbzKhp5GzuJEA4VJWw=
-gopkg.in/mail.v2 v2.3.1/go.mod h1:htwXN1Qh09vZJ1NVKxQqHPBaCBbzKhp5GzuJEA4VJWw=
-gopkg.in/src-d/go-billy.v4 v4.2.1/go.mod h1:tm33zBoOwxjYHZIE+OV8bxTWFMJLrconzFMd38aARFk=
-gopkg.in/src-d/go-billy.v4 v4.3.0 h1:KtlZ4c1OWbIs4jCv5ZXrTqG8EQocr0g/d4DjNg70aek=
-gopkg.in/src-d/go-billy.v4 v4.3.0/go.mod h1:tm33zBoOwxjYHZIE+OV8bxTWFMJLrconzFMd38aARFk=
-gopkg.in/src-d/go-git-fixtures.v3 v3.1.1 h1:XWW/s5W18RaJpmo1l0IYGqXKuJITWRFuA45iOf1dKJs=
-gopkg.in/src-d/go-git-fixtures.v3 v3.1.1/go.mod h1:dLBcvytrw/TYZsNTWCnkNF2DSIlzWYqTe3rJR56Ac7g=
-gopkg.in/src-d/go-git.v4 v4.10.0 h1:NWjTJTQnk8UpIGlssuefyDZ6JruEjo5s88vm88uASbw=
-gopkg.in/src-d/go-git.v4 v4.10.0/go.mod h1:Vtut8izDyrM8BUVQnzJ+YvmNcem2J89EmfZYCkLokZk=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/src-d/go-billy.v4 v4.3.2 h1:0SQA1pRztfTFx2miS8sA97XvooFeNOmvUenF4o0EcVg=
+gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
+gopkg.in/src-d/go-git-fixtures.v3 v3.5.0 h1:ivZFOIltbce2Mo8IjzUHAFoq/IylO9WHhNOAJK+LsJg=
+gopkg.in/src-d/go-git-fixtures.v3 v3.5.0/go.mod h1:dLBcvytrw/TYZsNTWCnkNF2DSIlzWYqTe3rJR56Ac7g=
+gopkg.in/src-d/go-git.v4 v4.13.1 h1:SRtFyV8Kxc0UP7aCHcijOMQGPxHSmMOPrzulQWolkYE=
+gopkg.in/src-d/go-git.v4 v4.13.1/go.mod h1:nx5NYcxdKxq5fpltdHnPa2Exj4Sx0EclMWZQbYDu2z8=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-k8s.io/apimachinery v0.0.0-20180808233214-a7b7e4de06b2 h1:w/5Dvht2Wf4vRaXFDb4cWInymI8NkaMJtrs8UsJyZLI=
-k8s.io/apimachinery v0.0.0-20180808233214-a7b7e4de06b2/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
-k8s.io/apimachinery v0.0.0-20181207080347-f1a02064268b h1:NJFXh9cP1kqYx/N6RWK070lDco+UEChRMHlR62deTKI=
-k8s.io/apimachinery v0.0.0-20181207080347-f1a02064268b/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
-k8s.io/apimachinery v0.0.0-20190119020841-d41becfba9ee h1:3MH/wGFP+9PjyLIMnPN2GYatdJosd+5TnSO2BzQqqo4=
-k8s.io/apimachinery v0.0.0-20190119020841-d41becfba9ee/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
-k8s.io/apimachinery v0.0.0-20190126155707-0e6dcdd1b5ce h1:CzCioXa348Dzt9UuYrvxRrLGpL1ZV50QpyBHt01SYj4=
-k8s.io/apimachinery v0.0.0-20190126155707-0e6dcdd1b5ce/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
-k8s.io/apimachinery v0.0.0-20190201131811-df262fa1a1ba h1:HEhywVhwcfpe9vpG7nc3wxA/YG6pb1W9zkvmFxs+320=
-k8s.io/apimachinery v0.0.0-20190201131811-df262fa1a1ba/go.mod h1:ccL7Eh7zubPUSh9A3USN90/OzHNSVN6zxzde07TDCL0=
-novit.nc/direktil/pkg v0.0.0-20180707011528-e82b59c0324d h1:DMk2j7F+mXAQdZD5ouIxWVosY55RmpRevgCWSikRRzU=
-novit.nc/direktil/pkg v0.0.0-20180707011528-e82b59c0324d/go.mod h1:rbcL+fuxazzipTdJV8t9MW39YsdaK3pSvvhTdI9SXsc=
-novit.nc/direktil/pkg v0.0.0-20181210105214-68c87509f2eb h1:TP4vRMGiZDsL82xUmbV1cI2+mxZ2BV/3Zvl56sc/vvk=
-novit.nc/direktil/pkg v0.0.0-20181210105214-68c87509f2eb/go.mod h1:z5JgQ2ybqxBC1ZE5xC9FgH4rE9whqa7Gft+iP9J9jzo=
-novit.nc/direktil/pkg v0.0.0-20181210211743-9dc80cd34b09 h1:Y5GRTymITxgwaV5JVqKaxZ8U9qbLo+9jdhsGHxf/K2E=
-novit.nc/direktil/pkg v0.0.0-20181210211743-9dc80cd34b09/go.mod h1:z5JgQ2ybqxBC1ZE5xC9FgH4rE9whqa7Gft+iP9J9jzo=
+gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+k8s.io/apimachinery v0.0.0-20191203211716-adc6f4cd9e7d h1:q+OZmYewHJeMCzwpHkXlNTtk5bvaUMPCikKvf77RBlo=
+k8s.io/apimachinery v0.0.0-20191203211716-adc6f4cd9e7d/go.mod h1:b9qmWdKlLuU9EBh+06BtLcSf/Mu89rWL33naRxs1uZg=
+k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
+novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2 h1:LN3K19gAJ1GamJXkzXAQmjbl8xCV7utqdxTTrM89MMc=
+novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2/go.mod h1:zwTVO6U0tXFEaga73megQIBK7yVIKZJVePaIh/UtdfU=
+sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=

govc.env

@@ -0,0 +1,8 @@
+export GOVC_DATACENTER=
+export GOVC_PASSWORD=
+export GOVC_URL=
+export GOVC_USERNAME=
+export GOVC_INSECURE=1
+export GOVC_DATASTORE=
+export NOVIT_VM_FOLDER=
+export NOVIT_ISO_FOLDER=

modd.conf

@@ -1,6 +1,10 @@
-**/*.go Dockerfile {
+**/*.go go.mod go.sum Dockerfile {
   prep: go test ./...
-  prep: go install ./cmd/...
-  prep: docker build -t dls .
+  prep: go install -trimpath ./cmd/...
+  prep: docker build --build-arg GOPROXY=$GOPROXY -t dls .
   #daemon +sigterm: /var/lib/direktil/test-run
 }
+
+**/*.proto !dist/**/* {
+  prep: for mod in @mods; do protoc -I ./ --go_out=plugins=grpc,paths=source_relative:. $mod; done
+}

pkg/clustersconfig/clustersconfig.go

@@ -1,22 +1,35 @@
 package clustersconfig
 
 import (
+	"flag"
 	"fmt"
 	"io"
 	"io/ioutil"
+	"log"
 	"net"
+	"os"
+	"path/filepath"
 	"strings"
 	"text/template"
 
 	yaml "gopkg.in/yaml.v2"
 )
 
+var (
+	templateDetailsDir = flag.String("template-details-dir",
+		filepath.Join(os.TempDir(), "dkl-dir2config"),
+		"write details of template execute in this dir")
+
+	templateID = 0
+)
+
 type Config struct {
 	Hosts         []*Host
 	Groups        []*Group
 	Clusters      []*Cluster
 	Configs       []*Template
 	StaticPods    []*Template            `yaml:"static_pods"`
+	BootstrapPods map[string][]*Template `yaml:"bootstrap_pods"`
 	Addons        map[string][]*Template
 	SSLConfig     string         `yaml:"ssl_config"`
 	CertRequests  []*CertRequest `yaml:"cert_requests"`
@@ -137,7 +150,7 @@ type Template struct {
 	parsedTemplate *template.Template
 }
 
-func (t *Template) Execute(wr io.Writer, data interface{}, extraFuncs map[string]interface{}) error {
+func (t *Template) Execute(contextName, elementName string, wr io.Writer, data interface{}, extraFuncs map[string]interface{}) error {
 	if t.parsedTemplate == nil {
 		var templateFuncs = map[string]interface{}{
 			"indent": func(indent, s string) (indented string) {
@@ -159,13 +172,49 @@ func (t *Template) Execute(wr io.Writer, data interface{}, extraFuncs map[string
 		t.parsedTemplate = tmpl
 	}
 
+	if *templateDetailsDir != "" {
+		templateID++
+
+		base := filepath.Join(*templateDetailsDir, contextName, fmt.Sprintf("%s-%03d", elementName, templateID))
+		os.MkdirAll(base, 0700)
+
+		base += string(filepath.Separator)
+		log.Print("writing template details: ", base, "{in,data,out}")
+
+		if err := ioutil.WriteFile(base+"in", []byte(t.Template), 0600); err != nil {
+			return err
+		}
+
+		yamlBytes, err := yaml.Marshal(data)
+		if err != nil {
+			return err
+		}
+
+		if err := ioutil.WriteFile(base+"data", yamlBytes, 0600); err != nil {
+			return err
+		}
+
+		out, err := os.Create(base + "out")
+		if err != nil {
+			return err
+		}
+
+		defer out.Close()
+
+		wr = io.MultiWriter(wr, out)
+	}
+
 	return t.parsedTemplate.Execute(wr, data)
 }
 
 // Host represents a host served by this server.
 type Host struct {
 	WithRev
+
 	Name        string
+	Labels      map[string]string
+	Annotations map[string]string
+
 	MAC     string
 	IP      string
 	IPs     []string
@@ -177,7 +226,11 @@ type Host struct {
 // Group represents a group of hosts and provides their configuration.
 type Group struct {
 	WithRev
+
 	Name        string
+	Labels      map[string]string
+	Annotations map[string]string
+
 	Master     bool
 	IPXE       string
 	Kernel     string
@@ -194,9 +247,14 @@ type Vars map[string]interface{}
 // Cluster represents a cluster of hosts, allowing for cluster-wide variables.
 type Cluster struct {
 	WithRev
+
 	Name        string
+	Labels      map[string]string
+	Annotations map[string]string
+
 	Domain        string
 	Addons        string
+	BootstrapPods string `yaml:"bootstrap_pods"`
 	Subnets       struct {
 		Services string
 		Pods     string

pkg/clustersconfig/defaults.go

@@ -70,6 +70,7 @@ func (d *Defaults) Load(dir, suffix string, value Rev, data []byte) (err error)
 }
 
 func (d *Defaults) Open(rev, filePath string) (rd io.Reader, err error) {
+	log.Printf("openning defaults at %s:%s", rev, filePath)
 	tree, err := d.treeAt(rev)
 	if err != nil {
 		return
@@ -94,12 +95,17 @@ func (d *Defaults) ReadAll(rev, filePath string) (ba []byte, err error) {
 }
 
 func (d *Defaults) List(rev, dir string) (names []string, err error) {
+	log.Printf("listing defaults at %s:%s", rev, dir)
 	tree, err := d.treeAt(rev)
 	if err != nil {
 		return
 	}
 
+	dirPrefix := dir + "/"
 	err = tree.Files().ForEach(func(f *object.File) (err error) {
+		if !strings.HasPrefix(f.Name, dirPrefix) {
+			return
+		}
 		if !strings.HasSuffix(f.Name, ".yaml") {
 			return
 		}
@@ -126,6 +132,11 @@ func (d *Defaults) treeAt(rev string) (tree *object.Tree, err error) {
 			obj, err = o.Object()
 
 		case *object.Commit: // commit -> tree
+			msg := o.Message
+			if len(msg) > 30 {
+				msg = msg[:27] + "..."
+			}
+			log.Printf("open defaults at commit %s: %s", o.Hash.String()[:7], msg)
 			return o.Tree()
 
 		default:

pkg/clustersconfig/dir.go

@@ -37,7 +37,10 @@ func FromDir(dirPath, defaultsPath string) (*Config, error) {
 		return nil
 	}
 
-	config := &Config{Addons: make(map[string][]*Template)}
+	config := &Config{
+		Addons:        make(map[string][]*Template),
+		BootstrapPods: make(map[string][]*Template),
+	}
 
 	// load clusters
 	names, err := store.List("clusters")
@@ -127,7 +130,8 @@ func FromDir(dirPath, defaultsPath string) (*Config, error) {
 		}
 
 		if Debug {
-			log.Printf("group %q: config=%q static_pods=%q", group.Name, group.Config, group.StaticPods)
+			log.Printf("group %q: config=%q static_pods=%q",
+				group.Name, group.Config, group.StaticPods)
 		}
 
 		group.StaticPods, err = template(group.Rev(), "static-pods", group.StaticPods, &config.StaticPods)
@@ -189,6 +193,7 @@ func FromDir(dirPath, defaultsPath string) (*Config, error) {
 		return nil
 	}
 
+	// cluster addons
 	for _, cluster := range config.Clusters {
 		addonSet := cluster.Addons
 		if len(addonSet) == 0 {
@@ -207,6 +212,25 @@ func FromDir(dirPath, defaultsPath string) (*Config, error) {
 		config.Addons[addonSet] = templates
 	}
 
+	// cluster bootstrap pods
+	for _, cluster := range config.Clusters {
+		bpSet := cluster.BootstrapPods
+		if bpSet == "" {
+			continue
+		}
+
+		if _, ok := config.BootstrapPods[bpSet]; ok {
+			continue
+		}
+
+		templates := make([]*Template, 0)
+		if err = loadTemplates(cluster.Rev(), path.Join("bootstrap-pods", bpSet), &templates); err != nil {
+			return nil, err
+		}
+
+		config.BootstrapPods[bpSet] = templates
+	}
+
 	// load SSL configuration
 	if ba, err := ioutil.ReadFile(filepath.Join(dirPath, "ssl-config.json")); err == nil {
 		config.SSLConfig = string(ba)

pkg/mime/mime.go

@@ -7,4 +7,6 @@ const (
 	ISO    = "application/x-iso9660-image"
 	IPXE   = "text/x-ipxe"
 	OCTET  = "application/octet-stream"
+	CERT   = "application/x-x509-user-cert"
+	CACERT = "application/x-x509-ca-cert"
 )

update-boot.sh

@@ -0,0 +1,19 @@
+#! /bin/bash
+
+dls_url="$1"
+
+set -ex
+
+mount -o remount,rw /boot
+
+if [ -e /boot/previous ]; then
+    rm -fr /boot/previous
+fi
+
+if [ -e /boot/current ]; then
+    mv /boot/current /boot/previous
+fi
+
+curl $dls_url/me/boot.tar |tar xv -C /boot
+sync
+

upload-vmware.sh

@@ -0,0 +1,27 @@
+set -e
+
+dir=/var/lib/direktil/
+PATH=$PATH:$dir
+cd $dir
+
+if [ ! -f govc.env ]; then
+    echo ERROR: govc.env file not found in dir $dir ; exit 1
+fi
+source govc.env
+
+if [ $# != 2 ]; then
+    echo "Usage: $0 <VM_NAME> <NOVIT_HOST>" ; exit 1
+fi
+
+if [[ -z $NOVIT_VM_FOLDER || -z $NOVIT_ISO_FOLDER ]]; then
+    echo "ERROR: All GOVC env vars (including NOVIT_VM_FOLDER and NOVIT_ISO_FOLDER) must be provided" ; exit 1
+fi
+
+VM=$1
+HOST=$2
+
+govc vm.power -off "$NOVIT_VM_FOLDER/$VM" || true
+sleep 5
+curl localhost:7606/hosts/$HOST/boot.iso | govc datastore.upload - "$NOVIT_ISO_FOLDER/$VM.iso"
+sleep 5
+govc vm.power -on "$NOVIT_VM_FOLDER/$VM"

vendor/github.com/PuerkitoBio/purell/.gitignore

@@ -1,5 +0,0 @@
-*.sublime-*
-.DS_Store
-*.swp
-*.swo
-tags

vendor/github.com/PuerkitoBio/purell/.travis.yml

@@ -1,7 +0,0 @@
-language: go
-
-go:
-    - 1.4
-    - 1.5
-    - 1.6
-    - tip

vendor/github.com/PuerkitoBio/purell/LICENSE

@@ -1,12 +0,0 @@
-Copyright (c) 2012, Martin Angers
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
-* Neither the name of the author nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/PuerkitoBio/purell/README.md

@@ -1,187 +0,0 @@
-# Purell
-
-Purell is a tiny Go library to normalize URLs. It returns a pure URL. Pure-ell. Sanitizer and all. Yeah, I know...
-
-Based on the [wikipedia paper][wiki] and the [RFC 3986 document][rfc].
-
-[![build status](https://secure.travis-ci.org/PuerkitoBio/purell.png)](http://travis-ci.org/PuerkitoBio/purell)
-
-## Install
-
-`go get github.com/PuerkitoBio/purell`
-
-## Changelog
-
-*    **2016-11-14 (v1.1.0)** : IDN: Conform to RFC 5895: Fold character width (thanks to @beeker1121).
-*    **2016-07-27 (v1.0.0)** : Normalize IDN to ASCII (thanks to @zenovich).
-*    **2015-02-08** : Add fix for relative paths issue ([PR #5][pr5]) and add fix for unnecessary encoding of reserved characters ([see issue #7][iss7]).
-*    **v0.2.0** : Add benchmarks, Attempt IDN support.
-*    **v0.1.0** : Initial release.
-
-## Examples
-
-From `example_test.go` (note that in your code, you would import "github.com/PuerkitoBio/purell", and would prefix references to its methods and constants with "purell."):
-
-```go
-package purell
-
-import (
-  "fmt"
-  "net/url"
-)
-
-func ExampleNormalizeURLString() {
-  if normalized, err := NormalizeURLString("hTTp://someWEBsite.com:80/Amazing%3f/url/",
-    FlagLowercaseScheme|FlagLowercaseHost|FlagUppercaseEscapes); err != nil {
-    panic(err)
-  } else {
-    fmt.Print(normalized)
-  }
-  // Output: http://somewebsite.com:80/Amazing%3F/url/
-}
-
-func ExampleMustNormalizeURLString() {
-  normalized := MustNormalizeURLString("hTTpS://someWEBsite.com:443/Amazing%fa/url/",
-    FlagsUnsafeGreedy)
-  fmt.Print(normalized)
-
-  // Output: http://somewebsite.com/Amazing%FA/url
-}
-
-func ExampleNormalizeURL() {
-  if u, err := url.Parse("Http://SomeUrl.com:8080/a/b/.././c///g?c=3&a=1&b=9&c=0#target"); err != nil {
-    panic(err)
-  } else {
-    normalized := NormalizeURL(u, FlagsUsuallySafeGreedy|FlagRemoveDuplicateSlashes|FlagRemoveFragment)
-    fmt.Print(normalized)
-  }
-
-  // Output: http://someurl.com:8080/a/c/g?c=3&a=1&b=9&c=0
-}
-```
-
-## API
-
-As seen in the examples above, purell offers three methods, `NormalizeURLString(string, NormalizationFlags) (string, error)`, `MustNormalizeURLString(string, NormalizationFlags) (string)` and `NormalizeURL(*url.URL, NormalizationFlags) (string)`. They all normalize the provided URL based on the specified flags. Here are the available flags:
-
-```go
-const (
-	// Safe normalizations
-	FlagLowercaseScheme           NormalizationFlags = 1 << iota // HTTP://host -> http://host, applied by default in Go1.1
-	FlagLowercaseHost                                            // http://HOST -> http://host
-	FlagUppercaseEscapes                                         // http://host/t%ef -> http://host/t%EF
-	FlagDecodeUnnecessaryEscapes                                 // http://host/t%41 -> http://host/tA
-	FlagEncodeNecessaryEscapes                                   // http://host/!"#$ -> http://host/%21%22#$
-	FlagRemoveDefaultPort                                        // http://host:80 -> http://host
-	FlagRemoveEmptyQuerySeparator                                // http://host/path? -> http://host/path
-
-	// Usually safe normalizations
-	FlagRemoveTrailingSlash // http://host/path/ -> http://host/path
-	FlagAddTrailingSlash    // http://host/path -> http://host/path/ (should choose only one of these add/remove trailing slash flags)
-	FlagRemoveDotSegments   // http://host/path/./a/b/../c -> http://host/path/a/c
-
-	// Unsafe normalizations
-	FlagRemoveDirectoryIndex   // http://host/path/index.html -> http://host/path/
-	FlagRemoveFragment         // http://host/path#fragment -> http://host/path
-	FlagForceHTTP              // https://host -> http://host
-	FlagRemoveDuplicateSlashes // http://host/path//a///b -> http://host/path/a/b
-	FlagRemoveWWW              // http://www.host/ -> http://host/
-	FlagAddWWW                 // http://host/ -> http://www.host/ (should choose only one of these add/remove WWW flags)
-	FlagSortQuery              // http://host/path?c=3&b=2&a=1&b=1 -> http://host/path?a=1&b=1&b=2&c=3
-
-	// Normalizations not in the wikipedia article, required to cover tests cases
-	// submitted by jehiah
-	FlagDecodeDWORDHost           // http://1113982867 -> http://66.102.7.147
-	FlagDecodeOctalHost           // http://0102.0146.07.0223 -> http://66.102.7.147
-	FlagDecodeHexHost             // http://0x42660793 -> http://66.102.7.147
-	FlagRemoveUnnecessaryHostDots // http://.host../path -> http://host/path
-	FlagRemoveEmptyPortSeparator  // http://host:/path -> http://host/path
-
-	// Convenience set of safe normalizations
-	FlagsSafe NormalizationFlags = FlagLowercaseHost | FlagLowercaseScheme | FlagUppercaseEscapes | FlagDecodeUnnecessaryEscapes | FlagEncodeNecessaryEscapes | FlagRemoveDefaultPort | FlagRemoveEmptyQuerySeparator
-
-	// For convenience sets, "greedy" uses the "remove trailing slash" and "remove www. prefix" flags,
-	// while "non-greedy" uses the "add (or keep) the trailing slash" and "add www. prefix".
-
-	// Convenience set of usually safe normalizations (includes FlagsSafe)
-	FlagsUsuallySafeGreedy    NormalizationFlags = FlagsSafe | FlagRemoveTrailingSlash | FlagRemoveDotSegments
-	FlagsUsuallySafeNonGreedy NormalizationFlags = FlagsSafe | FlagAddTrailingSlash | FlagRemoveDotSegments
-
-	// Convenience set of unsafe normalizations (includes FlagsUsuallySafe)
-	FlagsUnsafeGreedy    NormalizationFlags = FlagsUsuallySafeGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagRemoveWWW | FlagSortQuery
-	FlagsUnsafeNonGreedy NormalizationFlags = FlagsUsuallySafeNonGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagAddWWW | FlagSortQuery
-
-	// Convenience set of all available flags
-	FlagsAllGreedy    = FlagsUnsafeGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-	FlagsAllNonGreedy = FlagsUnsafeNonGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-)
-```
-
-For convenience, the set of flags `FlagsSafe`, `FlagsUsuallySafe[Greedy|NonGreedy]`, `FlagsUnsafe[Greedy|NonGreedy]` and `FlagsAll[Greedy|NonGreedy]` are provided for the similarly grouped normalizations on [wikipedia's URL normalization page][wiki]. You can add (using the bitwise OR `|` operator) or remove (using the bitwise AND NOT `&^` operator) individual flags from the sets if required, to build your own custom set.
-
-The [full godoc reference is available on gopkgdoc][godoc].
-
-Some things to note:
-
-*    `FlagDecodeUnnecessaryEscapes`, `FlagEncodeNecessaryEscapes`, `FlagUppercaseEscapes` and `FlagRemoveEmptyQuerySeparator` are always implicitly set, because internally, the URL string is parsed as an URL object, which automatically decodes unnecessary escapes, uppercases and encodes necessary ones, and removes empty query separators (an unnecessary `?` at the end of the url). So this operation cannot **not** be done. For this reason, `FlagRemoveEmptyQuerySeparator` (as well as the other three) has been included in the `FlagsSafe` convenience set, instead of `FlagsUnsafe`, where Wikipedia puts it.
-
-*    The `FlagDecodeUnnecessaryEscapes` decodes the following escapes (*from -> to*):
-    -    %24 -> $
-    -    %26 -> &
-    -    %2B-%3B -> +,-./0123456789:;
-    -    %3D -> =
-    -    %40-%5A -> @ABCDEFGHIJKLMNOPQRSTUVWXYZ
-    -    %5F -> _
-    -    %61-%7A -> abcdefghijklmnopqrstuvwxyz
-    -    %7E -> ~
-
-
-*    When the `NormalizeURL` function is used (passing an URL object), this source URL object is modified (that is, after the call, the URL object will be modified to reflect the normalization).
-
-*    The *replace IP with domain name* normalization (`http://208.77.188.166/ → http://www.example.com/`) is obviously not possible for a library without making some network requests. This is not implemented in purell.
-
-*    The *remove unused query string parameters* and *remove default query parameters* are also not implemented, since this is a very case-specific normalization, and it is quite trivial to do with an URL object.
-
-### Safe vs Usually Safe vs Unsafe
-
-Purell allows you to control the level of risk you take while normalizing an URL. You can aggressively normalize, play it totally safe, or anything in between.
-
-Consider the following URL:
-
-`HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid`
-
-Normalizing with the `FlagsSafe` gives:
-
-`https://www.root.com/toto/tE%1F///a/./b/../c/?z=3&w=2&a=4&w=1#invalid`
-
-With the `FlagsUsuallySafeGreedy`:
-
-`https://www.root.com/toto/tE%1F///a/c?z=3&w=2&a=4&w=1#invalid`
-
-And with `FlagsUnsafeGreedy`:
-
-`http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3`
-
-## TODOs
-
-*    Add a class/default instance to allow specifying custom directory index names? At the moment, removing directory index removes `(^|/)((?:default|index)\.\w{1,4})$`.
-
-## Thanks / Contributions
-
-@rogpeppe
-@jehiah
-@opennota
-@pchristopher1275
-@zenovich
-@beeker1121
-
-## License
-
-The [BSD 3-Clause license][bsd].
-
-[bsd]: http://opensource.org/licenses/BSD-3-Clause
-[wiki]: http://en.wikipedia.org/wiki/URL_normalization
-[rfc]: http://tools.ietf.org/html/rfc3986#section-6
-[godoc]: http://go.pkgdoc.org/github.com/PuerkitoBio/purell
-[pr5]: https://github.com/PuerkitoBio/purell/pull/5
-[iss7]: https://github.com/PuerkitoBio/purell/issues/7

vendor/github.com/PuerkitoBio/purell/purell.go

@@ -1,379 +0,0 @@
-/*
-Package purell offers URL normalization as described on the wikipedia page:
-http://en.wikipedia.org/wiki/URL_normalization
-*/
-package purell
-
-import (
-	"bytes"
-	"fmt"
-	"net/url"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/PuerkitoBio/urlesc"
-	"golang.org/x/net/idna"
-	"golang.org/x/text/unicode/norm"
-	"golang.org/x/text/width"
-)
-
-// A set of normalization flags determines how a URL will
-// be normalized.
-type NormalizationFlags uint
-
-const (
-	// Safe normalizations
-	FlagLowercaseScheme           NormalizationFlags = 1 << iota // HTTP://host -> http://host, applied by default in Go1.1
-	FlagLowercaseHost                                            // http://HOST -> http://host
-	FlagUppercaseEscapes                                         // http://host/t%ef -> http://host/t%EF
-	FlagDecodeUnnecessaryEscapes                                 // http://host/t%41 -> http://host/tA
-	FlagEncodeNecessaryEscapes                                   // http://host/!"#$ -> http://host/%21%22#$
-	FlagRemoveDefaultPort                                        // http://host:80 -> http://host
-	FlagRemoveEmptyQuerySeparator                                // http://host/path? -> http://host/path
-
-	// Usually safe normalizations
-	FlagRemoveTrailingSlash // http://host/path/ -> http://host/path
-	FlagAddTrailingSlash    // http://host/path -> http://host/path/ (should choose only one of these add/remove trailing slash flags)
-	FlagRemoveDotSegments   // http://host/path/./a/b/../c -> http://host/path/a/c
-
-	// Unsafe normalizations
-	FlagRemoveDirectoryIndex   // http://host/path/index.html -> http://host/path/
-	FlagRemoveFragment         // http://host/path#fragment -> http://host/path
-	FlagForceHTTP              // https://host -> http://host
-	FlagRemoveDuplicateSlashes // http://host/path//a///b -> http://host/path/a/b
-	FlagRemoveWWW              // http://www.host/ -> http://host/
-	FlagAddWWW                 // http://host/ -> http://www.host/ (should choose only one of these add/remove WWW flags)
-	FlagSortQuery              // http://host/path?c=3&b=2&a=1&b=1 -> http://host/path?a=1&b=1&b=2&c=3
-
-	// Normalizations not in the wikipedia article, required to cover tests cases
-	// submitted by jehiah
-	FlagDecodeDWORDHost           // http://1113982867 -> http://66.102.7.147
-	FlagDecodeOctalHost           // http://0102.0146.07.0223 -> http://66.102.7.147
-	FlagDecodeHexHost             // http://0x42660793 -> http://66.102.7.147
-	FlagRemoveUnnecessaryHostDots // http://.host../path -> http://host/path
-	FlagRemoveEmptyPortSeparator  // http://host:/path -> http://host/path
-
-	// Convenience set of safe normalizations
-	FlagsSafe NormalizationFlags = FlagLowercaseHost | FlagLowercaseScheme | FlagUppercaseEscapes | FlagDecodeUnnecessaryEscapes | FlagEncodeNecessaryEscapes | FlagRemoveDefaultPort | FlagRemoveEmptyQuerySeparator
-
-	// For convenience sets, "greedy" uses the "remove trailing slash" and "remove www. prefix" flags,
-	// while "non-greedy" uses the "add (or keep) the trailing slash" and "add www. prefix".
-
-	// Convenience set of usually safe normalizations (includes FlagsSafe)
-	FlagsUsuallySafeGreedy    NormalizationFlags = FlagsSafe | FlagRemoveTrailingSlash | FlagRemoveDotSegments
-	FlagsUsuallySafeNonGreedy NormalizationFlags = FlagsSafe | FlagAddTrailingSlash | FlagRemoveDotSegments
-
-	// Convenience set of unsafe normalizations (includes FlagsUsuallySafe)
-	FlagsUnsafeGreedy    NormalizationFlags = FlagsUsuallySafeGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagRemoveWWW | FlagSortQuery
-	FlagsUnsafeNonGreedy NormalizationFlags = FlagsUsuallySafeNonGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagAddWWW | FlagSortQuery
-
-	// Convenience set of all available flags
-	FlagsAllGreedy    = FlagsUnsafeGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-	FlagsAllNonGreedy = FlagsUnsafeNonGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-)
-
-const (
-	defaultHttpPort  = ":80"
-	defaultHttpsPort = ":443"
-)
-
-// Regular expressions used by the normalizations
-var rxPort = regexp.MustCompile(`(:\d+)/?$`)
-var rxDirIndex = regexp.MustCompile(`(^|/)((?:default|index)\.\w{1,4})$`)
-var rxDupSlashes = regexp.MustCompile(`/{2,}`)
-var rxDWORDHost = regexp.MustCompile(`^(\d+)((?:\.+)?(?:\:\d*)?)$`)
-var rxOctalHost = regexp.MustCompile(`^(0\d*)\.(0\d*)\.(0\d*)\.(0\d*)((?:\.+)?(?:\:\d*)?)$`)
-var rxHexHost = regexp.MustCompile(`^0x([0-9A-Fa-f]+)((?:\.+)?(?:\:\d*)?)$`)
-var rxHostDots = regexp.MustCompile(`^(.+?)(:\d+)?$`)
-var rxEmptyPort = regexp.MustCompile(`:+$`)
-
-// Map of flags to implementation function.
-// FlagDecodeUnnecessaryEscapes has no action, since it is done automatically
-// by parsing the string as an URL. Same for FlagUppercaseEscapes and FlagRemoveEmptyQuerySeparator.
-
-// Since maps have undefined traversing order, make a slice of ordered keys
-var flagsOrder = []NormalizationFlags{
-	FlagLowercaseScheme,
-	FlagLowercaseHost,
-	FlagRemoveDefaultPort,
-	FlagRemoveDirectoryIndex,
-	FlagRemoveDotSegments,
-	FlagRemoveFragment,
-	FlagForceHTTP, // Must be after remove default port (because https=443/http=80)
-	FlagRemoveDuplicateSlashes,
-	FlagRemoveWWW,
-	FlagAddWWW,
-	FlagSortQuery,
-	FlagDecodeDWORDHost,
-	FlagDecodeOctalHost,
-	FlagDecodeHexHost,
-	FlagRemoveUnnecessaryHostDots,
-	FlagRemoveEmptyPortSeparator,
-	FlagRemoveTrailingSlash, // These two (add/remove trailing slash) must be last
-	FlagAddTrailingSlash,
-}
-
-// ... and then the map, where order is unimportant
-var flags = map[NormalizationFlags]func(*url.URL){
-	FlagLowercaseScheme:           lowercaseScheme,
-	FlagLowercaseHost:             lowercaseHost,
-	FlagRemoveDefaultPort:         removeDefaultPort,
-	FlagRemoveDirectoryIndex:      removeDirectoryIndex,
-	FlagRemoveDotSegments:         removeDotSegments,
-	FlagRemoveFragment:            removeFragment,
-	FlagForceHTTP:                 forceHTTP,
-	FlagRemoveDuplicateSlashes:    removeDuplicateSlashes,
-	FlagRemoveWWW:                 removeWWW,
-	FlagAddWWW:                    addWWW,
-	FlagSortQuery:                 sortQuery,
-	FlagDecodeDWORDHost:           decodeDWORDHost,
-	FlagDecodeOctalHost:           decodeOctalHost,
-	FlagDecodeHexHost:             decodeHexHost,
-	FlagRemoveUnnecessaryHostDots: removeUnncessaryHostDots,
-	FlagRemoveEmptyPortSeparator:  removeEmptyPortSeparator,
-	FlagRemoveTrailingSlash:       removeTrailingSlash,
-	FlagAddTrailingSlash:          addTrailingSlash,
-}
-
-// MustNormalizeURLString returns the normalized string, and panics if an error occurs.
-// It takes an URL string as input, as well as the normalization flags.
-func MustNormalizeURLString(u string, f NormalizationFlags) string {
-	result, e := NormalizeURLString(u, f)
-	if e != nil {
-		panic(e)
-	}
-	return result
-}
-
-// NormalizeURLString returns the normalized string, or an error if it can't be parsed into an URL object.
-// It takes an URL string as input, as well as the normalization flags.
-func NormalizeURLString(u string, f NormalizationFlags) (string, error) {
-	parsed, err := url.Parse(u)
-	if err != nil {
-		return "", err
-	}
-
-	if f&FlagLowercaseHost == FlagLowercaseHost {
-		parsed.Host = strings.ToLower(parsed.Host)
-	}
-
-	// The idna package doesn't fully conform to RFC 5895
-	// (https://tools.ietf.org/html/rfc5895), so we do it here.
-	// Taken from Go 1.8 cycle source, courtesy of bradfitz.
-	// TODO: Remove when (if?) idna package conforms to RFC 5895.
-	parsed.Host = width.Fold.String(parsed.Host)
-	parsed.Host = norm.NFC.String(parsed.Host)
-	if parsed.Host, err = idna.ToASCII(parsed.Host); err != nil {
-		return "", err
-	}
-
-	return NormalizeURL(parsed, f), nil
-}
-
-// NormalizeURL returns the normalized string.
-// It takes a parsed URL object as input, as well as the normalization flags.
-func NormalizeURL(u *url.URL, f NormalizationFlags) string {
-	for _, k := range flagsOrder {
-		if f&k == k {
-			flags[k](u)
-		}
-	}
-	return urlesc.Escape(u)
-}
-
-func lowercaseScheme(u *url.URL) {
-	if len(u.Scheme) > 0 {
-		u.Scheme = strings.ToLower(u.Scheme)
-	}
-}
-
-func lowercaseHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		u.Host = strings.ToLower(u.Host)
-	}
-}
-
-func removeDefaultPort(u *url.URL) {
-	if len(u.Host) > 0 {
-		scheme := strings.ToLower(u.Scheme)
-		u.Host = rxPort.ReplaceAllStringFunc(u.Host, func(val string) string {
-			if (scheme == "http" && val == defaultHttpPort) || (scheme == "https" && val == defaultHttpsPort) {
-				return ""
-			}
-			return val
-		})
-	}
-}
-
-func removeTrailingSlash(u *url.URL) {
-	if l := len(u.Path); l > 0 {
-		if strings.HasSuffix(u.Path, "/") {
-			u.Path = u.Path[:l-1]
-		}
-	} else if l = len(u.Host); l > 0 {
-		if strings.HasSuffix(u.Host, "/") {
-			u.Host = u.Host[:l-1]
-		}
-	}
-}
-
-func addTrailingSlash(u *url.URL) {
-	if l := len(u.Path); l > 0 {
-		if !strings.HasSuffix(u.Path, "/") {
-			u.Path += "/"
-		}
-	} else if l = len(u.Host); l > 0 {
-		if !strings.HasSuffix(u.Host, "/") {
-			u.Host += "/"
-		}
-	}
-}
-
-func removeDotSegments(u *url.URL) {
-	if len(u.Path) > 0 {
-		var dotFree []string
-		var lastIsDot bool
-
-		sections := strings.Split(u.Path, "/")
-		for _, s := range sections {
-			if s == ".." {
-				if len(dotFree) > 0 {
-					dotFree = dotFree[:len(dotFree)-1]
-				}
-			} else if s != "." {
-				dotFree = append(dotFree, s)
-			}
-			lastIsDot = (s == "." || s == "..")
-		}
-		// Special case if host does not end with / and new path does not begin with /
-		u.Path = strings.Join(dotFree, "/")
-		if u.Host != "" && !strings.HasSuffix(u.Host, "/") && !strings.HasPrefix(u.Path, "/") {
-			u.Path = "/" + u.Path
-		}
-		// Special case if the last segment was a dot, make sure the path ends with a slash
-		if lastIsDot && !strings.HasSuffix(u.Path, "/") {
-			u.Path += "/"
-		}
-	}
-}
-
-func removeDirectoryIndex(u *url.URL) {
-	if len(u.Path) > 0 {
-		u.Path = rxDirIndex.ReplaceAllString(u.Path, "$1")
-	}
-}
-
-func removeFragment(u *url.URL) {
-	u.Fragment = ""
-}
-
-func forceHTTP(u *url.URL) {
-	if strings.ToLower(u.Scheme) == "https" {
-		u.Scheme = "http"
-	}
-}
-
-func removeDuplicateSlashes(u *url.URL) {
-	if len(u.Path) > 0 {
-		u.Path = rxDupSlashes.ReplaceAllString(u.Path, "/")
-	}
-}
-
-func removeWWW(u *url.URL) {
-	if len(u.Host) > 0 && strings.HasPrefix(strings.ToLower(u.Host), "www.") {
-		u.Host = u.Host[4:]
-	}
-}
-
-func addWWW(u *url.URL) {
-	if len(u.Host) > 0 && !strings.HasPrefix(strings.ToLower(u.Host), "www.") {
-		u.Host = "www." + u.Host
-	}
-}
-
-func sortQuery(u *url.URL) {
-	q := u.Query()
-
-	if len(q) > 0 {
-		arKeys := make([]string, len(q))
-		i := 0
-		for k, _ := range q {
-			arKeys[i] = k
-			i++
-		}
-		sort.Strings(arKeys)
-		buf := new(bytes.Buffer)
-		for _, k := range arKeys {
-			sort.Strings(q[k])
-			for _, v := range q[k] {
-				if buf.Len() > 0 {
-					buf.WriteRune('&')
-				}
-				buf.WriteString(fmt.Sprintf("%s=%s", k, urlesc.QueryEscape(v)))
-			}
-		}
-
-		// Rebuild the raw query string
-		u.RawQuery = buf.String()
-	}
-}
-
-func decodeDWORDHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxDWORDHost.FindStringSubmatch(u.Host); len(matches) > 2 {
-			var parts [4]int64
-
-			dword, _ := strconv.ParseInt(matches[1], 10, 0)
-			for i, shift := range []uint{24, 16, 8, 0} {
-				parts[i] = dword >> shift & 0xFF
-			}
-			u.Host = fmt.Sprintf("%d.%d.%d.%d%s", parts[0], parts[1], parts[2], parts[3], matches[2])
-		}
-	}
-}
-
-func decodeOctalHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxOctalHost.FindStringSubmatch(u.Host); len(matches) > 5 {
-			var parts [4]int64
-
-			for i := 1; i <= 4; i++ {
-				parts[i-1], _ = strconv.ParseInt(matches[i], 8, 0)
-			}
-			u.Host = fmt.Sprintf("%d.%d.%d.%d%s", parts[0], parts[1], parts[2], parts[3], matches[5])
-		}
-	}
-}
-
-func decodeHexHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxHexHost.FindStringSubmatch(u.Host); len(matches) > 2 {
-			// Conversion is safe because of regex validation
-			parsed, _ := strconv.ParseInt(matches[1], 16, 0)
-			// Set host as DWORD (base 10) encoded host
-			u.Host = fmt.Sprintf("%d%s", parsed, matches[2])
-			// The rest is the same as decoding a DWORD host
-			decodeDWORDHost(u)
-		}
-	}
-}
-
-func removeUnncessaryHostDots(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxHostDots.FindStringSubmatch(u.Host); len(matches) > 1 {
-			// Trim the leading and trailing dots
-			u.Host = strings.Trim(matches[1], ".")
-			if len(matches) > 2 {
-				u.Host += matches[2]
-			}
-		}
-	}
-}
-
-func removeEmptyPortSeparator(u *url.URL) {
-	if len(u.Host) > 0 {
-		u.Host = rxEmptyPort.ReplaceAllString(u.Host, "")
-	}
-}

vendor/github.com/PuerkitoBio/urlesc/.travis.yml

@@ -1,15 +0,0 @@
-language: go
-
-go:
-  - 1.4.x
-  - 1.5.x
-  - 1.6.x
-  - 1.7.x
-  - 1.8.x
-  - tip
-
-install:
-  - go build .
-
-script:
-  - go test -v

vendor/github.com/PuerkitoBio/urlesc/LICENSE

@@ -1,27 +0,0 @@
-Copyright (c) 2012 The Go Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/PuerkitoBio/urlesc/README.md

@@ -1,16 +0,0 @@
-urlesc [![Build Status](https://travis-ci.org/PuerkitoBio/urlesc.svg?branch=master)](https://travis-ci.org/PuerkitoBio/urlesc) [![GoDoc](http://godoc.org/github.com/PuerkitoBio/urlesc?status.svg)](http://godoc.org/github.com/PuerkitoBio/urlesc)
-======
-
-Package urlesc implements query escaping as per RFC 3986.
-
-It contains some parts of the net/url package, modified so as to allow
-some reserved characters incorrectly escaped by net/url (see [issue 5684](https://github.com/golang/go/issues/5684)).
-
-## Install
-
-    go get github.com/PuerkitoBio/urlesc
-
-## License
-
-Go license (BSD-3-Clause)
-

vendor/github.com/PuerkitoBio/urlesc/urlesc.go

@@ -1,180 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package urlesc implements query escaping as per RFC 3986.
-// It contains some parts of the net/url package, modified so as to allow
-// some reserved characters incorrectly escaped by net/url.
-// See https://github.com/golang/go/issues/5684
-package urlesc
-
-import (
-	"bytes"
-	"net/url"
-	"strings"
-)
-
-type encoding int
-
-const (
-	encodePath encoding = 1 + iota
-	encodeUserPassword
-	encodeQueryComponent
-	encodeFragment
-)
-
-// Return true if the specified character should be escaped when
-// appearing in a URL string, according to RFC 3986.
-func shouldEscape(c byte, mode encoding) bool {
-	// §2.3 Unreserved characters (alphanum)
-	if 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z' || '0' <= c && c <= '9' {
-		return false
-	}
-
-	switch c {
-	case '-', '.', '_', '~': // §2.3 Unreserved characters (mark)
-		return false
-
-	// §2.2 Reserved characters (reserved)
-	case ':', '/', '?', '#', '[', ']', '@', // gen-delims
-		'!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=': // sub-delims
-		// Different sections of the URL allow a few of
-		// the reserved characters to appear unescaped.
-		switch mode {
-		case encodePath: // §3.3
-			// The RFC allows sub-delims and : @.
-			// '/', '[' and ']' can be used to assign meaning to individual path
-			// segments.  This package only manipulates the path as a whole,
-			// so we allow those as well.  That leaves only ? and # to escape.
-			return c == '?' || c == '#'
-
-		case encodeUserPassword: // §3.2.1
-			// The RFC allows : and sub-delims in
-			// userinfo.  The parsing of userinfo treats ':' as special so we must escape
-			// all the gen-delims.
-			return c == ':' || c == '/' || c == '?' || c == '#' || c == '[' || c == ']' || c == '@'
-
-		case encodeQueryComponent: // §3.4
-			// The RFC allows / and ?.
-			return c != '/' && c != '?'
-
-		case encodeFragment: // §4.1
-			// The RFC text is silent but the grammar allows
-			// everything, so escape nothing but #
-			return c == '#'
-		}
-	}
-
-	// Everything else must be escaped.
-	return true
-}
-
-// QueryEscape escapes the string so it can be safely placed
-// inside a URL query.
-func QueryEscape(s string) string {
-	return escape(s, encodeQueryComponent)
-}
-
-func escape(s string, mode encoding) string {
-	spaceCount, hexCount := 0, 0
-	for i := 0; i < len(s); i++ {
-		c := s[i]
-		if shouldEscape(c, mode) {
-			if c == ' ' && mode == encodeQueryComponent {
-				spaceCount++
-			} else {
-				hexCount++
-			}
-		}
-	}
-
-	if spaceCount == 0 && hexCount == 0 {
-		return s
-	}
-
-	t := make([]byte, len(s)+2*hexCount)
-	j := 0
-	for i := 0; i < len(s); i++ {
-		switch c := s[i]; {
-		case c == ' ' && mode == encodeQueryComponent:
-			t[j] = '+'
-			j++
-		case shouldEscape(c, mode):
-			t[j] = '%'
-			t[j+1] = "0123456789ABCDEF"[c>>4]
-			t[j+2] = "0123456789ABCDEF"[c&15]
-			j += 3
-		default:
-			t[j] = s[i]
-			j++
-		}
-	}
-	return string(t)
-}
-
-var uiReplacer = strings.NewReplacer(
-	"%21", "!",
-	"%27", "'",
-	"%28", "(",
-	"%29", ")",
-	"%2A", "*",
-)
-
-// unescapeUserinfo unescapes some characters that need not to be escaped as per RFC3986.
-func unescapeUserinfo(s string) string {
-	return uiReplacer.Replace(s)
-}
-
-// Escape reassembles the URL into a valid URL string.
-// The general form of the result is one of:
-//
-//	scheme:opaque
-//	scheme://userinfo@host/path?query#fragment
-//
-// If u.Opaque is non-empty, String uses the first form;
-// otherwise it uses the second form.
-//
-// In the second form, the following rules apply:
-//	- if u.Scheme is empty, scheme: is omitted.
-//	- if u.User is nil, userinfo@ is omitted.
-//	- if u.Host is empty, host/ is omitted.
-//	- if u.Scheme and u.Host are empty and u.User is nil,
-//	   the entire scheme://userinfo@host/ is omitted.
-//	- if u.Host is non-empty and u.Path begins with a /,
-//	   the form host/path does not add its own /.
-//	- if u.RawQuery is empty, ?query is omitted.
-//	- if u.Fragment is empty, #fragment is omitted.
-func Escape(u *url.URL) string {
-	var buf bytes.Buffer
-	if u.Scheme != "" {
-		buf.WriteString(u.Scheme)
-		buf.WriteByte(':')
-	}
-	if u.Opaque != "" {
-		buf.WriteString(u.Opaque)
-	} else {
-		if u.Scheme != "" || u.Host != "" || u.User != nil {
-			buf.WriteString("//")
-			if ui := u.User; ui != nil {
-				buf.WriteString(unescapeUserinfo(ui.String()))
-				buf.WriteByte('@')
-			}
-			if h := u.Host; h != "" {
-				buf.WriteString(h)
-			}
-		}
-		if u.Path != "" && u.Path[0] != '/' && u.Host != "" {
-			buf.WriteByte('/')
-		}
-		buf.WriteString(escape(u.Path, encodePath))
-	}
-	if u.RawQuery != "" {
-		buf.WriteByte('?')
-		buf.WriteString(u.RawQuery)
-	}
-	if u.Fragment != "" {
-		buf.WriteByte('#')
-		buf.WriteString(escape(u.Fragment, encodeFragment))
-	}
-	return buf.String()
-}

vendor/github.com/cavaliercoder/go-cpio/.gitignore

@@ -1,3 +0,0 @@
-.fuzz/
-*.zip
-

vendor/github.com/cavaliercoder/go-cpio/.travis.yml

@@ -1,10 +0,0 @@
-language: go
-
-go:
-  - 1.4.3
-  - 1.5.4
-  - 1.6.4
-  - 1.7.6
-  - 1.8.3
-
-script: make check

vendor/github.com/cavaliercoder/go-cpio/LICENSE

@@ -1,26 +0,0 @@
-Copyright (c) 2017 Ryan Armstrong. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without modification,
-are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-3. Neither the name of the copyright holder nor the names of its contributors
-   may be used to endorse or promote products derived from this software without
-   specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
-ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/cavaliercoder/go-cpio/Makefile

@@ -1,18 +0,0 @@
-PACKAGE = github.com/cavaliercoder/go-cpio
-
-all: check
-
-check:
-	go test -v
-
-cpio-fuzz.zip: *.go
-	go-fuzz-build $(PACKAGE)
-
-fuzz: cpio-fuzz.zip
-	go-fuzz -bin=./cpio-fuzz.zip -workdir=.fuzz/
-
-clean-fuzz:
-	rm -rf cpio-fuzz.zip .fuzz/crashers/* .fuzz/suppressions/*
-
-
-.PHONY: all check

vendor/github.com/cavaliercoder/go-cpio/README.md

@@ -1,62 +0,0 @@
-# go-cpio [![GoDoc](https://godoc.org/github.com/cavaliercoder/go-cpio?status.svg)](https://godoc.org/github.com/cavaliercoder/go-cpio) [![Build Status](https://travis-ci.org/cavaliercoder/go-cpio.svg?branch=master)](https://travis-ci.org/cavaliercoder/go-cpio) [![Go Report Card](https://goreportcard.com/badge/github.com/cavaliercoder/go-cpio)](https://goreportcard.com/report/github.com/cavaliercoder/go-cpio)
-
-This package provides a Go native implementation of the CPIO archive file
-format.
-
-Currently, only the SVR4 (New ASCII) format is supported, both with and without
-checksums.
-
-```go
-// Create a buffer to write our archive to.
-buf := new(bytes.Buffer)
-
-// Create a new cpio archive.
-w := cpio.NewWriter(buf)
-
-// Add some files to the archive.
-var files = []struct {
-  Name, Body string
-}{
-  {"readme.txt", "This archive contains some text files."},
-  {"gopher.txt", "Gopher names:\nGeorge\nGeoffrey\nGonzo"},
-  {"todo.txt", "Get animal handling license."},
-}
-for _, file := range files {
-  hdr := &cpio.Header{
-    Name: file.Name,
-    Mode: 0600,
-    Size: int64(len(file.Body)),
-  }
-  if err := w.WriteHeader(hdr); err != nil {
-    log.Fatalln(err)
-  }
-  if _, err := w.Write([]byte(file.Body)); err != nil {
-    log.Fatalln(err)
-  }
-}
-// Make sure to check the error on Close.
-if err := w.Close(); err != nil {
-  log.Fatalln(err)
-}
-
-// Open the cpio archive for reading.
-b := bytes.NewReader(buf.Bytes())
-r := cpio.NewReader(b)
-
-// Iterate through the files in the archive.
-for {
-  hdr, err := r.Next()
-  if err == io.EOF {
-    // end of cpio archive
-    break
-  }
-  if err != nil {
-    log.Fatalln(err)
-  }
-  fmt.Printf("Contents of %s:\n", hdr.Name)
-  if _, err := io.Copy(os.Stdout, r); err != nil {
-    log.Fatalln(err)
-  }
-  fmt.Println()
-}
-```

vendor/github.com/cavaliercoder/go-cpio/cpio.go

@@ -1,8 +0,0 @@
-/*
-Package cpio implements access to CPIO archives. Currently, only the SVR4 (New
-ASCII) format is supported, both with and without checksums.
-
-References:
-		https://www.freebsd.org/cgi/man.cgi?query=cpio&sektion=5
-*/
-package cpio

vendor/github.com/cavaliercoder/go-cpio/fileinfo.go

@@ -1,75 +0,0 @@
-package cpio
-
-import (
-	"os"
-	"path"
-	"time"
-)
-
-// headerFileInfo implements os.FileInfo.
-type headerFileInfo struct {
-	h *Header
-}
-
-// Name returns the base name of the file.
-func (fi headerFileInfo) Name() string {
-	if fi.IsDir() {
-		return path.Base(path.Clean(fi.h.Name))
-	}
-	return path.Base(fi.h.Name)
-}
-
-func (fi headerFileInfo) Size() int64        { return fi.h.Size }
-func (fi headerFileInfo) IsDir() bool        { return fi.Mode().IsDir() }
-func (fi headerFileInfo) ModTime() time.Time { return fi.h.ModTime }
-func (fi headerFileInfo) Sys() interface{}   { return fi.h }
-
-func (fi headerFileInfo) Mode() (mode os.FileMode) {
-	// Set file permission bits.
-	mode = os.FileMode(fi.h.Mode).Perm()
-
-	// Set setuid, setgid and sticky bits.
-	if fi.h.Mode&ModeSetuid != 0 {
-		// setuid
-		mode |= os.ModeSetuid
-	}
-	if fi.h.Mode&ModeSetgid != 0 {
-		// setgid
-		mode |= os.ModeSetgid
-	}
-	if fi.h.Mode&ModeSticky != 0 {
-		// sticky
-		mode |= os.ModeSticky
-	}
-
-	// Set file mode bits.
-	// clear perm, setuid, setgid and sticky bits.
-	m := os.FileMode(fi.h.Mode) & 0170000
-	if m == ModeDir {
-		// directory
-		mode |= os.ModeDir
-	}
-	if m == ModeNamedPipe {
-		// named pipe (FIFO)
-		mode |= os.ModeNamedPipe
-	}
-	if m == ModeSymlink {
-		// symbolic link
-		mode |= os.ModeSymlink
-	}
-	if m == ModeDevice {
-		// device file
-		mode |= os.ModeDevice
-	}
-	if m == ModeCharDevice {
-		// Unix character device
-		mode |= os.ModeDevice
-		mode |= os.ModeCharDevice
-	}
-	if m == ModeSocket {
-		// Unix domain socket
-		mode |= os.ModeSocket
-	}
-
-	return mode
-}

vendor/github.com/cavaliercoder/go-cpio/fuzz.go

@@ -1,35 +0,0 @@
-// +build gofuzz
-
-package cpio
-
-import "bytes"
-import "io"
-
-// Fuzz tests the parsing and error handling of random byte arrays using
-// https://github.com/dvyukov/go-fuzz.
-func Fuzz(data []byte) int {
-	r := NewReader(bytes.NewReader(data))
-	h := NewHash()
-	for {
-		hdr, err := r.Next()
-		if err != nil {
-			if hdr != nil {
-				panic("hdr != nil on error")
-			}
-			if err == io.EOF {
-				// everything worked with random input... interesting
-				return 1
-			}
-			// error returned for random input. Good!
-			return -1
-		}
-
-		// hash file
-		h.Reset()
-		io.CopyN(h, r, hdr.Size)
-		h.Sum32()
-
-		// convert file header
-		FileInfoHeader(hdr.FileInfo())
-	}
-}

vendor/github.com/cavaliercoder/go-cpio/hash.go

@@ -1,45 +0,0 @@
-package cpio
-
-import (
-	"encoding/binary"
-	"hash"
-)
-
-type digest struct {
-	sum uint32
-}
-
-// NewHash returns a new hash.Hash32 computing the SVR4 checksum.
-func NewHash() hash.Hash32 {
-	return &digest{}
-}
-
-func (d *digest) Write(p []byte) (n int, err error) {
-	for _, b := range p {
-		d.sum += uint32(b & 0xFF)
-	}
-
-	return len(p), nil
-}
-
-func (d *digest) Sum(b []byte) []byte {
-	out := [4]byte{}
-	binary.LittleEndian.PutUint32(out[:], d.sum)
-	return append(b, out[:]...)
-}
-
-func (d *digest) Sum32() uint32 {
-	return d.sum
-}
-
-func (d *digest) Reset() {
-	d.sum = 0
-}
-
-func (d *digest) Size() int {
-	return 4
-}
-
-func (d *digest) BlockSize() int {
-	return 1
-}

vendor/github.com/cavaliercoder/go-cpio/header.go

@@ -1,153 +0,0 @@
-package cpio
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"time"
-)
-
-// Mode constants from the cpio spec.
-const (
-	ModeSetuid     = 04000   // Set uid
-	ModeSetgid     = 02000   // Set gid
-	ModeSticky     = 01000   // Save text (sticky bit)
-	ModeDir        = 040000  // Directory
-	ModeNamedPipe  = 010000  // FIFO
-	ModeRegular    = 0100000 // Regular file
-	ModeSymlink    = 0120000 // Symbolic link
-	ModeDevice     = 060000  // Block special file
-	ModeCharDevice = 020000  // Character special file
-	ModeSocket     = 0140000 // Socket
-
-	ModeType = 0170000 // Mask for the type bits
-	ModePerm = 0777    // Unix permission bits
-)
-
-const (
-	// headerEOF is the value of the filename of the last header in a CPIO archive.
-	headerEOF = "TRAILER!!!"
-)
-
-var (
-	ErrHeader = errors.New("cpio: invalid cpio header")
-)
-
-// A FileMode represents a file's mode and permission bits.
-type FileMode int64
-
-func (m FileMode) String() string {
-	return fmt.Sprintf("%#o", m)
-}
-
-// IsDir reports whether m describes a directory. That is, it tests for the
-// ModeDir bit being set in m.
-func (m FileMode) IsDir() bool {
-	return m&ModeDir != 0
-}
-
-// IsRegular reports whether m describes a regular file. That is, it tests for
-// the ModeRegular bit being set in m.
-func (m FileMode) IsRegular() bool {
-	return m&^ModePerm == ModeRegular
-}
-
-// Perm returns the Unix permission bits in m.
-func (m FileMode) Perm() FileMode {
-	return m & ModePerm
-}
-
-// Checksum is the sum of all bytes	in the file data. This sum is computed
-// treating all bytes as unsigned values and using unsigned arithmetic. Only
-// the least-significant 32 bits of the sum are stored. Use NewHash to compute
-// the actual checksum of an archived file.
-type Checksum uint32
-
-func (c Checksum) String() string {
-	return fmt.Sprintf("%08X", uint32(c))
-}
-
-// A Header represents a single header in a CPIO archive.
-type Header struct {
-	DeviceID int
-	Inode    int64     // inode number
-	Mode     FileMode  // permission and mode bits
-	UID      int       // user id of the owner
-	GID      int       // group id of the owner
-	Links    int       // number of inbound links
-	ModTime  time.Time // modified time
-	Size     int64     // size in bytes
-	Name     string    // filename
-	Linkname string    // target name of link
-	Checksum Checksum  // computed checksum
-
-	pad int64 // bytes to pad before next header
-}
-
-// FileInfo returns an os.FileInfo for the Header.
-func (h *Header) FileInfo() os.FileInfo {
-	return headerFileInfo{h}
-}
-
-// FileInfoHeader creates a partially-populated Header from fi.
-// If fi describes a symlink, FileInfoHeader records link as the link target.
-// If fi describes a directory, a slash is appended to the name.
-// Because os.FileInfo's Name method returns only the base name of
-// the file it describes, it may be necessary to modify the Name field
-// of the returned header to provide the full path name of the file.
-func FileInfoHeader(fi os.FileInfo, link string) (*Header, error) {
-	if fi == nil {
-		return nil, errors.New("cpio: FileInfo is nil")
-	}
-
-	if sys, ok := fi.Sys().(*Header); ok {
-		// This FileInfo came from a Header (not the OS). Return a copy of the
-		// original Header.
-		h := &Header{}
-		*h = *sys
-		return h, nil
-	}
-
-	fm := fi.Mode()
-	h := &Header{
-		Name:    fi.Name(),
-		Mode:    FileMode(fi.Mode().Perm()), // or'd with Mode* constants later
-		ModTime: fi.ModTime(),
-		Size:    fi.Size(),
-	}
-
-	switch {
-	case fm.IsRegular():
-		h.Mode |= ModeRegular
-	case fi.IsDir():
-		h.Mode |= ModeDir
-		h.Name += "/"
-		h.Size = 0
-	case fm&os.ModeSymlink != 0:
-		h.Mode |= ModeSymlink
-		h.Linkname = link
-	case fm&os.ModeDevice != 0:
-		if fm&os.ModeCharDevice != 0 {
-			h.Mode |= ModeCharDevice
-		} else {
-			h.Mode |= ModeDevice
-		}
-	case fm&os.ModeNamedPipe != 0:
-		h.Mode |= ModeNamedPipe
-	case fm&os.ModeSocket != 0:
-		h.Mode |= ModeSocket
-	default:
-		return nil, fmt.Errorf("cpio: unknown file mode %v", fm)
-	}
-	if fm&os.ModeSetuid != 0 {
-		h.Mode |= ModeSetuid
-	}
-	if fm&os.ModeSetgid != 0 {
-		h.Mode |= ModeSetgid
-	}
-	if fm&os.ModeSticky != 0 {
-		h.Mode |= ModeSticky
-	}
-
-	return h, nil
-}

vendor/github.com/cavaliercoder/go-cpio/reader.go

@@ -1,72 +0,0 @@
-package cpio
-
-import (
-	"io"
-	"io/ioutil"
-)
-
-// A Reader provides sequential access to the contents of a CPIO archive. A CPIO
-// archive consists of a sequence of files. The Next method advances to the next
-// file in the archive (including the first), and then it can be treated as an
-// io.Reader to access the file's data.
-type Reader struct {
-	r   io.Reader // underlying file reader
-	hdr *Header   // current Header
-	eof int64     // bytes until the end of the current file
-}
-
-// NewReader creates a new Reader reading from r.
-func NewReader(r io.Reader) *Reader {
-	return &Reader{
-		r: r,
-	}
-}
-
-// Read reads from the current entry in the CPIO archive. It returns 0, io.EOF
-// when it reaches the end of that entry, until Next is called to advance to the
-// next entry.
-func (r *Reader) Read(p []byte) (n int, err error) {
-	if r.hdr == nil || r.eof == 0 {
-		return 0, io.EOF
-	}
-	rn := len(p)
-	if r.eof < int64(rn) {
-		rn = int(r.eof)
-	}
-	n, err = r.r.Read(p[0:rn])
-	r.eof -= int64(n)
-	return
-}
-
-// Next advances to the next entry in the CPIO archive.
-// io.EOF is returned at the end of the input.
-func (r *Reader) Next() (*Header, error) {
-	if r.hdr == nil {
-		return r.next()
-	}
-	skp := r.eof + r.hdr.pad
-	if skp > 0 {
-		_, err := io.CopyN(ioutil.Discard, r.r, skp)
-		if err != nil {
-			return nil, err
-		}
-	}
-	return r.next()
-}
-
-func (r *Reader) next() (*Header, error) {
-	r.eof = 0
-	hdr, err := readHeader(r.r)
-	if err != nil {
-		return nil, err
-	}
-	r.hdr = hdr
-	r.eof = hdr.Size
-	return hdr, nil
-}
-
-// ReadHeader creates a new Header, reading from r.
-func readHeader(r io.Reader) (*Header, error) {
-	// currently only SVR4 format is supported
-	return readSVR4Header(r)
-}

vendor/github.com/cavaliercoder/go-cpio/svr4.go

@@ -1,152 +0,0 @@
-package cpio
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"strconv"
-	"time"
-)
-
-const (
-	svr4MaxNameSize = 4096 // MAX_PATH
-	svr4MaxFileSize = 4294967295
-)
-
-var svr4Magic = []byte{0x30, 0x37, 0x30, 0x37, 0x30, 0x31} // 070701
-
-func readHex(s string) int64 {
-	// errors are ignored and 0 returned
-	i, _ := strconv.ParseInt(s, 16, 64)
-	return i
-}
-
-func writeHex(b []byte, i int64) {
-	// i needs to be in range of uint32
-	copy(b, fmt.Sprintf("%08X", i))
-}
-
-func readSVR4Header(r io.Reader) (*Header, error) {
-	var buf [110]byte
-	if _, err := io.ReadFull(r, buf[:]); err != nil {
-		return nil, err
-	}
-
-	// TODO: check endianness
-
-	// check magic
-	hasCRC := false
-	if !bytes.HasPrefix(buf[:], svr4Magic[:5]) {
-		return nil, ErrHeader
-	}
-	if buf[5] == 0x32 { // '2'
-		hasCRC = true
-	} else if buf[5] != 0x31 { // '1'
-		return nil, ErrHeader
-	}
-
-	asc := string(buf[:])
-	hdr := &Header{}
-
-	hdr.Inode = readHex(asc[6:14])
-	hdr.Mode = FileMode(readHex(asc[14:22]))
-	hdr.UID = int(readHex(asc[22:30]))
-	hdr.GID = int(readHex(asc[30:38]))
-	hdr.Links = int(readHex(asc[38:46]))
-	hdr.ModTime = time.Unix(readHex(asc[46:54]), 0)
-	hdr.Size = readHex(asc[54:62])
-	if hdr.Size > svr4MaxFileSize {
-		return nil, ErrHeader
-	}
-	nameSize := readHex(asc[94:102])
-	if nameSize < 1 || nameSize > svr4MaxNameSize {
-		return nil, ErrHeader
-	}
-	hdr.Checksum = Checksum(readHex(asc[102:110]))
-	if !hasCRC && hdr.Checksum != 0 {
-		return nil, ErrHeader
-	}
-
-	name := make([]byte, nameSize)
-	if _, err := io.ReadFull(r, name); err != nil {
-		return nil, err
-	}
-	hdr.Name = string(name[:nameSize-1])
-	if hdr.Name == headerEOF {
-		return nil, io.EOF
-	}
-
-	// store padding between end of file and next header
-	hdr.pad = (4 - (hdr.Size % 4)) % 4
-
-	// skip to end of header/start of file
-	pad := (4 - (len(buf)+len(name))%4) % 4
-	if pad > 0 {
-		if _, err := io.ReadFull(r, buf[:pad]); err != nil {
-			return nil, err
-		}
-	}
-
-	// read link name
-	if hdr.Mode&^ModePerm == ModeSymlink {
-		if hdr.Size < 1 || hdr.Size > svr4MaxNameSize {
-			return nil, ErrHeader
-		}
-		b := make([]byte, hdr.Size)
-		if _, err := io.ReadFull(r, b); err != nil {
-			return nil, err
-		}
-		hdr.Linkname = string(b)
-		hdr.Size = 0
-	}
-
-	return hdr, nil
-}
-
-func writeSVR4Header(w io.Writer, hdr *Header) (pad int64, err error) {
-	var hdrBuf [110]byte
-	for i := 0; i < len(hdrBuf); i++ {
-		hdrBuf[i] = '0'
-	}
-	magic := svr4Magic
-	if hdr.Checksum != 0 {
-		magic[5] = 0x32
-	}
-	copy(hdrBuf[:], magic)
-	writeHex(hdrBuf[6:14], hdr.Inode)
-	writeHex(hdrBuf[14:22], int64(hdr.Mode))
-	writeHex(hdrBuf[22:30], int64(hdr.UID))
-	writeHex(hdrBuf[30:38], int64(hdr.GID))
-	writeHex(hdrBuf[38:46], int64(hdr.Links))
-	if !hdr.ModTime.IsZero() {
-		writeHex(hdrBuf[46:54], hdr.ModTime.Unix())
-	}
-	writeHex(hdrBuf[54:62], hdr.Size)
-	writeHex(hdrBuf[94:102], int64(len(hdr.Name)+1))
-	if hdr.Checksum != 0 {
-		writeHex(hdrBuf[102:110], int64(hdr.Checksum))
-	}
-
-	// write header
-	_, err = w.Write(hdrBuf[:])
-	if err != nil {
-		return
-	}
-
-	// write filename
-	_, err = io.WriteString(w, hdr.Name+"\x00")
-	if err != nil {
-		return
-	}
-
-	// pad to end of filename
-	npad := (4 - ((len(hdrBuf) + len(hdr.Name) + 1) % 4)) % 4
-	_, err = w.Write(zeroBlock[:npad])
-	if err != nil {
-		return
-	}
-
-	// compute padding to end of file
-	pad = (4 - (hdr.Size % 4)) % 4
-	return
-}

vendor/github.com/cavaliercoder/go-cpio/writer.go

@@ -1,128 +0,0 @@
-package cpio
-
-import (
-	"errors"
-	"fmt"
-	"io"
-)
-
-var (
-	ErrWriteTooLong    = errors.New("cpio: write too long")
-	ErrWriteAfterClose = errors.New("cpio: write after close")
-)
-
-var trailer = &Header{
-	Name:  string(headerEOF),
-	Links: 1,
-}
-
-var zeroBlock [4]byte
-
-// A Writer provides sequential writing of a CPIO archive. A CPIO archive
-// consists of a sequence of files. Call WriteHeader to begin a new file, and
-// then call Write to supply that file's data, writing at most hdr.Size bytes in
-// total.
-type Writer struct {
-	w      io.Writer
-	nb     int64 // number of unwritten bytes for current file entry
-	pad    int64 // amount of padding to write after current file entry
-	inode  int64
-	err    error
-	closed bool
-}
-
-// NewWriter creates a new Writer writing to w.
-func NewWriter(w io.Writer) *Writer {
-	return &Writer{w: w}
-}
-
-// Flush finishes writing the current file (optional).
-func (w *Writer) Flush() error {
-	if w.nb > 0 {
-		w.err = fmt.Errorf("cpio: missed writing %d bytes", w.nb)
-		return w.err
-	}
-	_, w.err = w.w.Write(zeroBlock[:w.pad])
-	if w.err != nil {
-		return w.err
-	}
-	w.nb = 0
-	w.pad = 0
-	return w.err
-}
-
-// WriteHeader writes hdr and prepares to accept the file's contents.
-// WriteHeader calls Flush if it is not the first header. Calling after a Close
-// will return ErrWriteAfterClose.
-func (w *Writer) WriteHeader(hdr *Header) (err error) {
-	if w.closed {
-		return ErrWriteAfterClose
-	}
-	if w.err == nil {
-		w.Flush()
-	}
-	if w.err != nil {
-		return w.err
-	}
-
-	if hdr.Name != headerEOF {
-		// TODO: should we be mutating hdr here?
-		// ensure all inodes are unique
-		w.inode++
-		if hdr.Inode == 0 {
-			hdr.Inode = w.inode
-		}
-
-		// ensure file type is set
-		if hdr.Mode&^ModePerm == 0 {
-			hdr.Mode |= ModeRegular
-		}
-
-		// ensure regular files have at least 1 inbound link
-		if hdr.Links < 1 && hdr.Mode.IsRegular() {
-			hdr.Links = 1
-		}
-	}
-
-	w.nb = hdr.Size
-	w.pad, w.err = writeSVR4Header(w.w, hdr)
-	return
-}
-
-// Write writes to the current entry in the CPIO archive. Write returns the
-// error ErrWriteTooLong if more than hdr.Size bytes are written after
-// WriteHeader.
-func (w *Writer) Write(p []byte) (n int, err error) {
-	if w.closed {
-		err = ErrWriteAfterClose
-		return
-	}
-	overwrite := false
-	if int64(len(p)) > w.nb {
-		p = p[0:w.nb]
-		overwrite = true
-	}
-	n, err = w.w.Write(p)
-	w.nb -= int64(n)
-	if err == nil && overwrite {
-		err = ErrWriteTooLong
-		return
-	}
-	w.err = err
-	return
-}
-
-// Close closes the CPIO archive, flushing any unwritten data to the underlying
-// writer.
-func (w *Writer) Close() error {
-	if w.err != nil || w.closed {
-		return w.err
-	}
-	w.err = w.WriteHeader(trailer)
-	if w.err != nil {
-		return w.err
-	}
-	w.Flush()
-	w.closed = true
-	return w.err
-}

vendor/github.com/cloudflare/cfssl/LICENSE

@@ -1,24 +0,0 @@
-Copyright (c) 2014 CloudFlare Inc.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-Redistributions of source code must retain the above copyright notice,
-this list of conditions and the following disclaimer.
-
-Redistributions in binary form must reproduce the above copyright notice,
-this list of conditions and the following disclaimer in the documentation
-and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
-TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/cloudflare/cfssl/auth/auth.go

@@ -1,94 +0,0 @@
-// Package auth implements an interface for providing CFSSL
-// authentication. This is meant to authenticate a client CFSSL to a
-// remote CFSSL in order to prevent unauthorised use of the signature
-// capabilities. This package provides both the interface and a
-// standard HMAC-based implementation.
-package auth
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"strings"
-)
-
-// An AuthenticatedRequest contains a request and authentication
-// token. The Provider may determine whether to validate the timestamp
-// and remote address.
-type AuthenticatedRequest struct {
-	// An Authenticator decides whether to use this field.
-	Timestamp     int64  `json:"timestamp,omitempty"`
-	RemoteAddress []byte `json:"remote_address,omitempty"`
-	Token         []byte `json:"token"`
-	Request       []byte `json:"request"`
-}
-
-// A Provider can generate tokens from a request and verify a
-// request. The handling of additional authentication data (such as
-// the IP address) is handled by the concrete type, as is any
-// serialisation and state-keeping.
-type Provider interface {
-	Token(req []byte) (token []byte, err error)
-	Verify(aReq *AuthenticatedRequest) bool
-}
-
-// Standard implements an HMAC-SHA-256 authentication provider. It may
-// be supplied additional data at creation time that will be used as
-// request || additional-data with the HMAC.
-type Standard struct {
-	key []byte
-	ad  []byte
-}
-
-// New generates a new standard authentication provider from the key
-// and additional data. The additional data will be used when
-// generating a new token.
-func New(key string, ad []byte) (*Standard, error) {
-	if splitKey := strings.SplitN(key, ":", 2); len(splitKey) == 2 {
-		switch splitKey[0] {
-		case "env":
-			key = os.Getenv(splitKey[1])
-		case "file":
-			data, err := ioutil.ReadFile(splitKey[1])
-			if err != nil {
-				return nil, err
-			}
-			key = strings.TrimSpace(string(data))
-		default:
-			return nil, fmt.Errorf("unknown key prefix: %s", splitKey[0])
-		}
-	}
-
-	keyBytes, err := hex.DecodeString(key)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Standard{keyBytes, ad}, nil
-}
-
-// Token generates a new authentication token from the request.
-func (p Standard) Token(req []byte) (token []byte, err error) {
-	h := hmac.New(sha256.New, p.key)
-	h.Write(req)
-	h.Write(p.ad)
-	return h.Sum(nil), nil
-}
-
-// Verify determines whether an authenticated request is valid.
-func (p Standard) Verify(ad *AuthenticatedRequest) bool {
-	if ad == nil {
-		return false
-	}
-
-	// Standard token generation returns no error.
-	token, _ := p.Token(ad.Request)
-	if len(ad.Token) != len(token) {
-		return false
-	}
-
-	return hmac.Equal(token, ad.Token)
-}

vendor/github.com/cloudflare/cfssl/certdb/README.md

@@ -1,75 +0,0 @@
-# certdb usage
-
-Using a database enables additional functionality for existing commands when a
-db config is provided:
-
- - `sign` and `gencert` add a certificate to the certdb after signing it
- - `serve` enables database functionality for the sign and revoke endpoints
-
-A database is required for the following:
-
- - `revoke` marks certificates revoked in the database with an optional reason
- - `ocsprefresh` refreshes the table of cached OCSP responses
- - `ocspdump` outputs cached OCSP responses in a concatenated base64-encoded format
-
-## Setup/Migration
-
-This directory stores [goose](https://bitbucket.org/liamstask/goose/) db migration scripts for various DB backends.
-Currently supported:
- - MySQL in mysql
- - PostgreSQL in pg
- - SQLite in sqlite
-
-### Get goose
-
-    go get bitbucket.org/liamstask/goose/cmd/goose
-
-### Use goose to start and terminate a MySQL DB
-To start a MySQL using goose:
-
-    goose -path $GOPATH/src/github.com/cloudflare/cfssl/certdb/mysql up
-
-To tear down a MySQL DB using goose
-
-    goose -path $GOPATH/src/github.com/cloudflare/cfssl/certdb/mysql down
-
-Note: the administration of MySQL DB is not included. We assume
-the databases being connected to are already created and access control
-is properly handled.
-
-### Use goose to start and terminate a PostgreSQL DB
-To start a PostgreSQL using goose:
-
-    goose -path $GOPATH/src/github.com/cloudflare/cfssl/certdb/pg up
-
-To tear down a PostgreSQL DB using goose
-
-    goose -path $GOPATH/src/github.com/cloudflare/cfssl/certdb/pg down
-
-Note: the administration of PostgreSQL DB is not included. We assume
-the databases being connected to are already created and access control
-is properly handled.
-
-### Use goose to start and terminate a SQLite DB
-To start a SQLite DB using goose:
-
-    goose -path $GOPATH/src/github.com/cloudflare/cfssl/certdb/sqlite up
-
-To tear down a SQLite DB using goose
-
-    goose -path $GOPATH/src/github.com/cloudflare/cfssl/certdb/sqlite down
-
-## CFSSL Configuration
-
-Several cfssl commands take a -db-config flag. Create a file with a
-JSON dictionary:
-
-    {"driver":"sqlite3","data_source":"certs.db"}
-
-or
-
-    {"driver":"postgres","data_source":"postgres://user:password@host/db"}
- 
-or
-
-    {"driver":"mysql","data_source":"user:password@tcp(hostname:3306)/db?parseTime=true"}

vendor/github.com/cloudflare/cfssl/certdb/certdb.go

@@ -1,42 +0,0 @@
-package certdb
-
-import (
-	"time"
-)
-
-// CertificateRecord encodes a certificate and its metadata
-// that will be recorded in a database.
-type CertificateRecord struct {
-	Serial    string    `db:"serial_number"`
-	AKI       string    `db:"authority_key_identifier"`
-	CALabel   string    `db:"ca_label"`
-	Status    string    `db:"status"`
-	Reason    int       `db:"reason"`
-	Expiry    time.Time `db:"expiry"`
-	RevokedAt time.Time `db:"revoked_at"`
-	PEM       string    `db:"pem"`
-}
-
-// OCSPRecord encodes a OCSP response body and its metadata
-// that will be recorded in a database.
-type OCSPRecord struct {
-	Serial string    `db:"serial_number"`
-	AKI    string    `db:"authority_key_identifier"`
-	Body   string    `db:"body"`
-	Expiry time.Time `db:"expiry"`
-}
-
-// Accessor abstracts the CRUD of certdb objects from a DB.
-type Accessor interface {
-	InsertCertificate(cr CertificateRecord) error
-	GetCertificate(serial, aki string) ([]CertificateRecord, error)
-	GetUnexpiredCertificates() ([]CertificateRecord, error)
-	GetRevokedAndUnexpiredCertificates() ([]CertificateRecord, error)
-	GetRevokedAndUnexpiredCertificatesByLabel(label string) ([]CertificateRecord, error)
-	RevokeCertificate(serial, aki string, reasonCode int) error
-	InsertOCSP(rr OCSPRecord) error
-	GetOCSP(serial, aki string) ([]OCSPRecord, error)
-	GetUnexpiredOCSPs() ([]OCSPRecord, error)
-	UpdateOCSP(serial, aki, body string, expiry time.Time) error
-	UpsertOCSP(serial, aki, body string, expiry time.Time) error
-}

vendor/github.com/cloudflare/cfssl/config/config.go

@@ -1,659 +0,0 @@
-// Package config contains the configuration logic for CFSSL.
-package config
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/asn1"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"regexp"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/cloudflare/cfssl/auth"
-	cferr "github.com/cloudflare/cfssl/errors"
-	"github.com/cloudflare/cfssl/helpers"
-	"github.com/cloudflare/cfssl/log"
-	ocspConfig "github.com/cloudflare/cfssl/ocsp/config"
-)
-
-// A CSRWhitelist stores booleans for fields in the CSR. If a CSRWhitelist is
-// not present in a SigningProfile, all of these fields may be copied from the
-// CSR into the signed certificate. If a CSRWhitelist *is* present in a
-// SigningProfile, only those fields with a `true` value in the CSRWhitelist may
-// be copied from the CSR to the signed certificate. Note that some of these
-// fields, like Subject, can be provided or partially provided through the API.
-// Since API clients are expected to be trusted, but CSRs are not, fields
-// provided through the API are not subject to whitelisting through this
-// mechanism.
-type CSRWhitelist struct {
-	Subject, PublicKeyAlgorithm, PublicKey, SignatureAlgorithm bool
-	DNSNames, IPAddresses, EmailAddresses, URIs                bool
-}
-
-// OID is our own version of asn1's ObjectIdentifier, so we can define a custom
-// JSON marshal / unmarshal.
-type OID asn1.ObjectIdentifier
-
-// CertificatePolicy represents the ASN.1 PolicyInformation structure from
-// https://tools.ietf.org/html/rfc3280.html#page-106.
-// Valid values of Type are "id-qt-unotice" and "id-qt-cps"
-type CertificatePolicy struct {
-	ID         OID
-	Qualifiers []CertificatePolicyQualifier
-}
-
-// CertificatePolicyQualifier represents a single qualifier from an ASN.1
-// PolicyInformation structure.
-type CertificatePolicyQualifier struct {
-	Type  string
-	Value string
-}
-
-// AuthRemote is an authenticated remote signer.
-type AuthRemote struct {
-	RemoteName  string `json:"remote"`
-	AuthKeyName string `json:"auth_key"`
-}
-
-// CAConstraint specifies various CA constraints on the signed certificate.
-// CAConstraint would verify against (and override) the CA
-// extensions in the given CSR.
-type CAConstraint struct {
-	IsCA           bool `json:"is_ca"`
-	MaxPathLen     int  `json:"max_path_len"`
-	MaxPathLenZero bool `json:"max_path_len_zero"`
-}
-
-// A SigningProfile stores information that the CA needs to store
-// signature policy.
-type SigningProfile struct {
-	Usage               []string     `json:"usages"`
-	IssuerURL           []string     `json:"issuer_urls"`
-	OCSP                string       `json:"ocsp_url"`
-	CRL                 string       `json:"crl_url"`
-	CAConstraint        CAConstraint `json:"ca_constraint"`
-	OCSPNoCheck         bool         `json:"ocsp_no_check"`
-	ExpiryString        string       `json:"expiry"`
-	BackdateString      string       `json:"backdate"`
-	AuthKeyName         string       `json:"auth_key"`
-	RemoteName          string       `json:"remote"`
-	NotBefore           time.Time    `json:"not_before"`
-	NotAfter            time.Time    `json:"not_after"`
-	NameWhitelistString string       `json:"name_whitelist"`
-	AuthRemote          AuthRemote   `json:"auth_remote"`
-	CTLogServers        []string     `json:"ct_log_servers"`
-	AllowedExtensions   []OID        `json:"allowed_extensions"`
-	CertStore           string       `json:"cert_store"`
-
-	Policies                    []CertificatePolicy
-	Expiry                      time.Duration
-	Backdate                    time.Duration
-	Provider                    auth.Provider
-	RemoteProvider              auth.Provider
-	RemoteServer                string
-	RemoteCAs                   *x509.CertPool
-	ClientCert                  *tls.Certificate
-	CSRWhitelist                *CSRWhitelist
-	NameWhitelist               *regexp.Regexp
-	ExtensionWhitelist          map[string]bool
-	ClientProvidesSerialNumbers bool
-}
-
-// UnmarshalJSON unmarshals a JSON string into an OID.
-func (oid *OID) UnmarshalJSON(data []byte) (err error) {
-	if data[0] != '"' || data[len(data)-1] != '"' {
-		return errors.New("OID JSON string not wrapped in quotes." + string(data))
-	}
-	data = data[1 : len(data)-1]
-	parsedOid, err := parseObjectIdentifier(string(data))
-	if err != nil {
-		return err
-	}
-	*oid = OID(parsedOid)
-	return
-}
-
-// MarshalJSON marshals an oid into a JSON string.
-func (oid OID) MarshalJSON() ([]byte, error) {
-	return []byte(fmt.Sprintf(`"%v"`, asn1.ObjectIdentifier(oid))), nil
-}
-
-func parseObjectIdentifier(oidString string) (oid asn1.ObjectIdentifier, err error) {
-	validOID, err := regexp.MatchString("\\d(\\.\\d+)*", oidString)
-	if err != nil {
-		return
-	}
-	if !validOID {
-		err = errors.New("Invalid OID")
-		return
-	}
-
-	segments := strings.Split(oidString, ".")
-	oid = make(asn1.ObjectIdentifier, len(segments))
-	for i, intString := range segments {
-		oid[i], err = strconv.Atoi(intString)
-		if err != nil {
-			return
-		}
-	}
-	return
-}
-
-const timeFormat = "2006-01-02T15:04:05"
-
-// populate is used to fill in the fields that are not in JSON
-//
-// First, the ExpiryString parameter is needed to parse
-// expiration timestamps from JSON. The JSON decoder is not able to
-// decode a string time duration to a time.Duration, so this is called
-// when loading the configuration to properly parse and fill out the
-// Expiry parameter.
-// This function is also used to create references to the auth key
-// and default remote for the profile.
-// It returns true if ExpiryString is a valid representation of a
-// time.Duration, and the AuthKeyString and RemoteName point to
-// valid objects. It returns false otherwise.
-func (p *SigningProfile) populate(cfg *Config) error {
-	if p == nil {
-		return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, errors.New("can't parse nil profile"))
-	}
-
-	var err error
-	if p.RemoteName == "" && p.AuthRemote.RemoteName == "" {
-		log.Debugf("parse expiry in profile")
-		if p.ExpiryString == "" {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, errors.New("empty expiry string"))
-		}
-
-		dur, err := time.ParseDuration(p.ExpiryString)
-		if err != nil {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, err)
-		}
-
-		log.Debugf("expiry is valid")
-		p.Expiry = dur
-
-		if p.BackdateString != "" {
-			dur, err = time.ParseDuration(p.BackdateString)
-			if err != nil {
-				return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, err)
-			}
-
-			p.Backdate = dur
-		}
-
-		if !p.NotBefore.IsZero() && !p.NotAfter.IsZero() && p.NotAfter.Before(p.NotBefore) {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, err)
-		}
-
-		if len(p.Policies) > 0 {
-			for _, policy := range p.Policies {
-				for _, qualifier := range policy.Qualifiers {
-					if qualifier.Type != "" && qualifier.Type != "id-qt-unotice" && qualifier.Type != "id-qt-cps" {
-						return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-							errors.New("invalid policy qualifier type"))
-					}
-				}
-			}
-		}
-	} else if p.RemoteName != "" {
-		log.Debug("match remote in profile to remotes section")
-		if p.AuthRemote.RemoteName != "" {
-			log.Error("profile has both a remote and an auth remote specified")
-			return cferr.New(cferr.PolicyError, cferr.InvalidPolicy)
-		}
-		if remote := cfg.Remotes[p.RemoteName]; remote != "" {
-			if err := p.updateRemote(remote); err != nil {
-				return err
-			}
-		} else {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-				errors.New("failed to find remote in remotes section"))
-		}
-	} else {
-		log.Debug("match auth remote in profile to remotes section")
-		if remote := cfg.Remotes[p.AuthRemote.RemoteName]; remote != "" {
-			if err := p.updateRemote(remote); err != nil {
-				return err
-			}
-		} else {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-				errors.New("failed to find remote in remotes section"))
-		}
-	}
-
-	if p.AuthKeyName != "" {
-		log.Debug("match auth key in profile to auth_keys section")
-		if key, ok := cfg.AuthKeys[p.AuthKeyName]; ok == true {
-			if key.Type == "standard" {
-				p.Provider, err = auth.New(key.Key, nil)
-				if err != nil {
-					log.Debugf("failed to create new standard auth provider: %v", err)
-					return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-						errors.New("failed to create new standard auth provider"))
-				}
-			} else {
-				log.Debugf("unknown authentication type %v", key.Type)
-				return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-					errors.New("unknown authentication type"))
-			}
-		} else {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-				errors.New("failed to find auth_key in auth_keys section"))
-		}
-	}
-
-	if p.AuthRemote.AuthKeyName != "" {
-		log.Debug("match auth remote key in profile to auth_keys section")
-		if key, ok := cfg.AuthKeys[p.AuthRemote.AuthKeyName]; ok == true {
-			if key.Type == "standard" {
-				p.RemoteProvider, err = auth.New(key.Key, nil)
-				if err != nil {
-					log.Debugf("failed to create new standard auth provider: %v", err)
-					return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-						errors.New("failed to create new standard auth provider"))
-				}
-			} else {
-				log.Debugf("unknown authentication type %v", key.Type)
-				return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-					errors.New("unknown authentication type"))
-			}
-		} else {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-				errors.New("failed to find auth_remote's auth_key in auth_keys section"))
-		}
-	}
-
-	if p.NameWhitelistString != "" {
-		log.Debug("compiling whitelist regular expression")
-		rule, err := regexp.Compile(p.NameWhitelistString)
-		if err != nil {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-				errors.New("failed to compile name whitelist section"))
-		}
-		p.NameWhitelist = rule
-	}
-
-	p.ExtensionWhitelist = map[string]bool{}
-	for _, oid := range p.AllowedExtensions {
-		p.ExtensionWhitelist[asn1.ObjectIdentifier(oid).String()] = true
-	}
-
-	return nil
-}
-
-// updateRemote takes a signing profile and initializes the remote server object
-// to the hostname:port combination sent by remote.
-func (p *SigningProfile) updateRemote(remote string) error {
-	if remote != "" {
-		p.RemoteServer = remote
-	}
-	return nil
-}
-
-// OverrideRemotes takes a signing configuration and updates the remote server object
-// to the hostname:port combination sent by remote
-func (p *Signing) OverrideRemotes(remote string) error {
-	if remote != "" {
-		var err error
-		for _, profile := range p.Profiles {
-			err = profile.updateRemote(remote)
-			if err != nil {
-				return err
-			}
-		}
-		err = p.Default.updateRemote(remote)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// SetClientCertKeyPairFromFile updates the properties to set client certificates for mutual
-// authenticated TLS remote requests
-func (p *Signing) SetClientCertKeyPairFromFile(certFile string, keyFile string) error {
-	if certFile != "" && keyFile != "" {
-		cert, err := helpers.LoadClientCertificate(certFile, keyFile)
-		if err != nil {
-			return err
-		}
-		for _, profile := range p.Profiles {
-			profile.ClientCert = cert
-		}
-		p.Default.ClientCert = cert
-	}
-	return nil
-}
-
-// SetRemoteCAsFromFile reads root CAs from file and updates the properties to set remote CAs for TLS
-// remote requests
-func (p *Signing) SetRemoteCAsFromFile(caFile string) error {
-	if caFile != "" {
-		remoteCAs, err := helpers.LoadPEMCertPool(caFile)
-		if err != nil {
-			return err
-		}
-		p.SetRemoteCAs(remoteCAs)
-	}
-	return nil
-}
-
-// SetRemoteCAs updates the properties to set remote CAs for TLS
-// remote requests
-func (p *Signing) SetRemoteCAs(remoteCAs *x509.CertPool) {
-	for _, profile := range p.Profiles {
-		profile.RemoteCAs = remoteCAs
-	}
-	p.Default.RemoteCAs = remoteCAs
-}
-
-// NeedsRemoteSigner returns true if one of the profiles has a remote set
-func (p *Signing) NeedsRemoteSigner() bool {
-	for _, profile := range p.Profiles {
-		if profile.RemoteServer != "" {
-			return true
-		}
-	}
-
-	if p.Default.RemoteServer != "" {
-		return true
-	}
-
-	return false
-}
-
-// NeedsLocalSigner returns true if one of the profiles doe not have a remote set
-func (p *Signing) NeedsLocalSigner() bool {
-	for _, profile := range p.Profiles {
-		if profile.RemoteServer == "" {
-			return true
-		}
-	}
-
-	if p.Default.RemoteServer == "" {
-		return true
-	}
-
-	return false
-}
-
-// Usages parses the list of key uses in the profile, translating them
-// to a list of X.509 key usages and extended key usages.  The unknown
-// uses are collected into a slice that is also returned.
-func (p *SigningProfile) Usages() (ku x509.KeyUsage, eku []x509.ExtKeyUsage, unk []string) {
-	for _, keyUse := range p.Usage {
-		if kuse, ok := KeyUsage[keyUse]; ok {
-			ku |= kuse
-		} else if ekuse, ok := ExtKeyUsage[keyUse]; ok {
-			eku = append(eku, ekuse)
-		} else {
-			unk = append(unk, keyUse)
-		}
-	}
-	return
-}
-
-// A valid profile must be a valid local profile or a valid remote profile.
-// A valid local profile has defined at least key usages to be used, and a
-// valid local default profile has defined at least a default expiration.
-// A valid remote profile (default or not) has remote signer initialized.
-// In addition, a remote profile must has a valid auth provider if auth
-// key defined.
-func (p *SigningProfile) validProfile(isDefault bool) bool {
-	if p == nil {
-		return false
-	}
-
-	if p.AuthRemote.RemoteName == "" && p.AuthRemote.AuthKeyName != "" {
-		log.Debugf("invalid auth remote profile: no remote signer specified")
-		return false
-	}
-
-	if p.RemoteName != "" {
-		log.Debugf("validate remote profile")
-
-		if p.RemoteServer == "" {
-			log.Debugf("invalid remote profile: no remote signer specified")
-			return false
-		}
-
-		if p.AuthKeyName != "" && p.Provider == nil {
-			log.Debugf("invalid remote profile: auth key name is defined but no auth provider is set")
-			return false
-		}
-
-		if p.AuthRemote.RemoteName != "" {
-			log.Debugf("invalid remote profile: auth remote is also specified")
-			return false
-		}
-	} else if p.AuthRemote.RemoteName != "" {
-		log.Debugf("validate auth remote profile")
-		if p.RemoteServer == "" {
-			log.Debugf("invalid auth remote profile: no remote signer specified")
-			return false
-		}
-
-		if p.AuthRemote.AuthKeyName == "" || p.RemoteProvider == nil {
-			log.Debugf("invalid auth remote profile: no auth key is defined")
-			return false
-		}
-	} else {
-		log.Debugf("validate local profile")
-		if !isDefault {
-			if len(p.Usage) == 0 {
-				log.Debugf("invalid local profile: no usages specified")
-				return false
-			} else if _, _, unk := p.Usages(); len(unk) == len(p.Usage) {
-				log.Debugf("invalid local profile: no valid usages")
-				return false
-			}
-		} else {
-			if p.Expiry == 0 {
-				log.Debugf("invalid local profile: no expiry set")
-				return false
-			}
-		}
-	}
-
-	log.Debugf("profile is valid")
-	return true
-}
-
-// This checks if the SigningProfile object contains configurations that are only effective with a local signer
-// which has access to CA private key.
-func (p *SigningProfile) hasLocalConfig() bool {
-	if p.Usage != nil ||
-		p.IssuerURL != nil ||
-		p.OCSP != "" ||
-		p.ExpiryString != "" ||
-		p.BackdateString != "" ||
-		p.CAConstraint.IsCA != false ||
-		!p.NotBefore.IsZero() ||
-		!p.NotAfter.IsZero() ||
-		p.NameWhitelistString != "" ||
-		len(p.CTLogServers) != 0 {
-		return true
-	}
-	return false
-}
-
-// warnSkippedSettings prints a log warning message about skipped settings
-// in a SigningProfile, usually due to remote signer.
-func (p *Signing) warnSkippedSettings() {
-	const warningMessage = `The configuration value by "usages", "issuer_urls", "ocsp_url", "crl_url", "ca_constraint", "expiry", "backdate", "not_before", "not_after", "cert_store" and "ct_log_servers" are skipped`
-	if p == nil {
-		return
-	}
-
-	if (p.Default.RemoteName != "" || p.Default.AuthRemote.RemoteName != "") && p.Default.hasLocalConfig() {
-		log.Warning("default profile points to a remote signer: ", warningMessage)
-	}
-
-	for name, profile := range p.Profiles {
-		if (profile.RemoteName != "" || profile.AuthRemote.RemoteName != "") && profile.hasLocalConfig() {
-			log.Warningf("Profiles[%s] points to a remote signer: %s", name, warningMessage)
-		}
-	}
-}
-
-// Signing codifies the signature configuration policy for a CA.
-type Signing struct {
-	Profiles map[string]*SigningProfile `json:"profiles"`
-	Default  *SigningProfile            `json:"default"`
-}
-
-// Config stores configuration information for the CA.
-type Config struct {
-	Signing  *Signing           `json:"signing"`
-	OCSP     *ocspConfig.Config `json:"ocsp"`
-	AuthKeys map[string]AuthKey `json:"auth_keys,omitempty"`
-	Remotes  map[string]string  `json:"remotes,omitempty"`
-}
-
-// Valid ensures that Config is a valid configuration. It should be
-// called immediately after parsing a configuration file.
-func (c *Config) Valid() bool {
-	return c.Signing.Valid()
-}
-
-// Valid checks the signature policies, ensuring they are valid
-// policies. A policy is valid if it has defined at least key usages
-// to be used, and a valid default profile has defined at least a
-// default expiration.
-func (p *Signing) Valid() bool {
-	if p == nil {
-		return false
-	}
-
-	log.Debugf("validating configuration")
-	if !p.Default.validProfile(true) {
-		log.Debugf("default profile is invalid")
-		return false
-	}
-
-	for _, sp := range p.Profiles {
-		if !sp.validProfile(false) {
-			log.Debugf("invalid profile")
-			return false
-		}
-	}
-
-	p.warnSkippedSettings()
-
-	return true
-}
-
-// KeyUsage contains a mapping of string names to key usages.
-var KeyUsage = map[string]x509.KeyUsage{
-	"signing":            x509.KeyUsageDigitalSignature,
-	"digital signature":  x509.KeyUsageDigitalSignature,
-	"content commitment": x509.KeyUsageContentCommitment,
-	"key encipherment":   x509.KeyUsageKeyEncipherment,
-	"key agreement":      x509.KeyUsageKeyAgreement,
-	"data encipherment":  x509.KeyUsageDataEncipherment,
-	"cert sign":          x509.KeyUsageCertSign,
-	"crl sign":           x509.KeyUsageCRLSign,
-	"encipher only":      x509.KeyUsageEncipherOnly,
-	"decipher only":      x509.KeyUsageDecipherOnly,
-}
-
-// ExtKeyUsage contains a mapping of string names to extended key
-// usages.
-var ExtKeyUsage = map[string]x509.ExtKeyUsage{
-	"any":              x509.ExtKeyUsageAny,
-	"server auth":      x509.ExtKeyUsageServerAuth,
-	"client auth":      x509.ExtKeyUsageClientAuth,
-	"code signing":     x509.ExtKeyUsageCodeSigning,
-	"email protection": x509.ExtKeyUsageEmailProtection,
-	"s/mime":           x509.ExtKeyUsageEmailProtection,
-	"ipsec end system": x509.ExtKeyUsageIPSECEndSystem,
-	"ipsec tunnel":     x509.ExtKeyUsageIPSECTunnel,
-	"ipsec user":       x509.ExtKeyUsageIPSECUser,
-	"timestamping":     x509.ExtKeyUsageTimeStamping,
-	"ocsp signing":     x509.ExtKeyUsageOCSPSigning,
-	"microsoft sgc":    x509.ExtKeyUsageMicrosoftServerGatedCrypto,
-	"netscape sgc":     x509.ExtKeyUsageNetscapeServerGatedCrypto,
-}
-
-// An AuthKey contains an entry for a key used for authentication.
-type AuthKey struct {
-	// Type contains information needed to select the appropriate
-	// constructor. For example, "standard" for HMAC-SHA-256,
-	// "standard-ip" for HMAC-SHA-256 incorporating the client's
-	// IP.
-	Type string `json:"type"`
-	// Key contains the key information, such as a hex-encoded
-	// HMAC key.
-	Key string `json:"key"`
-}
-
-// DefaultConfig returns a default configuration specifying basic key
-// usage and a 1 year expiration time. The key usages chosen are
-// signing, key encipherment, client auth and server auth.
-func DefaultConfig() *SigningProfile {
-	d := helpers.OneYear
-	return &SigningProfile{
-		Usage:        []string{"signing", "key encipherment", "server auth", "client auth"},
-		Expiry:       d,
-		ExpiryString: "8760h",
-	}
-}
-
-// LoadFile attempts to load the configuration file stored at the path
-// and returns the configuration. On error, it returns nil.
-func LoadFile(path string) (*Config, error) {
-	log.Debugf("loading configuration file from %s", path)
-	if path == "" {
-		return nil, cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, errors.New("invalid path"))
-	}
-
-	body, err := ioutil.ReadFile(path)
-	if err != nil {
-		return nil, cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, errors.New("could not read configuration file"))
-	}
-
-	return LoadConfig(body)
-}
-
-// LoadConfig attempts to load the configuration from a byte slice.
-// On error, it returns nil.
-func LoadConfig(config []byte) (*Config, error) {
-	var cfg = &Config{}
-	err := json.Unmarshal(config, &cfg)
-	if err != nil {
-		return nil, cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy,
-			errors.New("failed to unmarshal configuration: "+err.Error()))
-	}
-
-	if cfg.Signing == nil {
-		return nil, errors.New("No \"signing\" field present")
-	}
-
-	if cfg.Signing.Default == nil {
-		log.Debugf("no default given: using default config")
-		cfg.Signing.Default = DefaultConfig()
-	} else {
-		if err := cfg.Signing.Default.populate(cfg); err != nil {
-			return nil, err
-		}
-	}
-
-	for k := range cfg.Signing.Profiles {
-		if err := cfg.Signing.Profiles[k].populate(cfg); err != nil {
-			return nil, err
-		}
-	}
-
-	if !cfg.Valid() {
-		return nil, cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, errors.New("invalid configuration"))
-	}
-
-	log.Debugf("configuration ok")
-	return cfg, nil
-}

vendor/github.com/cloudflare/cfssl/crypto/pkcs7/pkcs7.go

@@ -1,188 +0,0 @@
-// Package pkcs7 implements the subset of the CMS PKCS #7 datatype that is typically
-// used to package certificates and CRLs.  Using openssl, every certificate converted
-// to PKCS #7 format from another encoding such as PEM conforms to this implementation.
-// reference: https://www.openssl.org/docs/man1.1.0/apps/crl2pkcs7.html
-//
-//			PKCS #7 Data type, reference: https://tools.ietf.org/html/rfc2315
-//
-// The full pkcs#7 cryptographic message syntax allows for cryptographic enhancements,
-// for example data can be encrypted and signed and then packaged through pkcs#7 to be
-// sent over a network and then verified and decrypted.  It is asn1, and the type of
-// PKCS #7 ContentInfo, which comprises the PKCS #7 structure, is:
-//
-//			ContentInfo ::= SEQUENCE {
-//				contentType ContentType,
-//				content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
-//			}
-//
-// There are 6 possible ContentTypes, data, signedData, envelopedData,
-// signedAndEnvelopedData, digestedData, and encryptedData.  Here signedData, Data, and encrypted
-// Data are implemented, as the degenerate case of signedData without a signature is the typical
-// format for transferring certificates and CRLS, and Data and encryptedData are used in PKCS #12
-// formats.
-// The ContentType signedData has the form:
-//
-//
-//			signedData ::= SEQUENCE {
-//				version Version,
-//				digestAlgorithms DigestAlgorithmIdentifiers,
-//				contentInfo ContentInfo,
-//				certificates [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL
-//				crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
-//				signerInfos SignerInfos
-//			}
-//
-// As of yet signerInfos and digestAlgorithms are not parsed, as they are not relevant to
-// this system's use of PKCS #7 data.  Version is an integer type, note that PKCS #7 is
-// recursive, this second layer of ContentInfo is similar ignored for our degenerate
-// usage.  The ExtendedCertificatesAndCertificates type consists of a sequence of choices
-// between PKCS #6 extended certificates and x509 certificates.  Any sequence consisting
-// of any number of extended certificates is not yet supported in this implementation.
-//
-// The ContentType Data is simply a raw octet string and is parsed directly into a Go []byte slice.
-//
-// The ContentType encryptedData is the most complicated and its form can be gathered by
-// the go type below.  It essentially contains a raw octet string of encrypted data and an
-// algorithm identifier for use in decrypting this data.
-package pkcs7
-
-import (
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"errors"
-
-	cferr "github.com/cloudflare/cfssl/errors"
-)
-
-// Types used for asn1 Unmarshaling.
-
-type signedData struct {
-	Version          int
-	DigestAlgorithms asn1.RawValue
-	ContentInfo      asn1.RawValue
-	Certificates     asn1.RawValue `asn1:"optional" asn1:"tag:0"`
-	Crls             asn1.RawValue `asn1:"optional"`
-	SignerInfos      asn1.RawValue
-}
-
-type initPKCS7 struct {
-	Raw         asn1.RawContent
-	ContentType asn1.ObjectIdentifier
-	Content     asn1.RawValue `asn1:"tag:0,explicit,optional"`
-}
-
-// Object identifier strings of the three implemented PKCS7 types.
-const (
-	ObjIDData          = "1.2.840.113549.1.7.1"
-	ObjIDSignedData    = "1.2.840.113549.1.7.2"
-	ObjIDEncryptedData = "1.2.840.113549.1.7.6"
-)
-
-// PKCS7 represents the ASN1 PKCS #7 Content type.  It contains one of three
-// possible types of Content objects, as denoted by the object identifier in
-// the ContentInfo field, the other two being nil.  SignedData
-// is the degenerate SignedData Content info without signature used
-// to hold certificates and crls.  Data is raw bytes, and EncryptedData
-// is as defined in PKCS #7 standard.
-type PKCS7 struct {
-	Raw         asn1.RawContent
-	ContentInfo string
-	Content     Content
-}
-
-// Content implements three of the six possible PKCS7 data types.  Only one is non-nil.
-type Content struct {
-	Data          []byte
-	SignedData    SignedData
-	EncryptedData EncryptedData
-}
-
-// SignedData defines the typical carrier of certificates and crls.
-type SignedData struct {
-	Raw          asn1.RawContent
-	Version      int
-	Certificates []*x509.Certificate
-	Crl          *pkix.CertificateList
-}
-
-// Data contains raw bytes.  Used as a subtype in PKCS12.
-type Data struct {
-	Bytes []byte
-}
-
-// EncryptedData contains encrypted data.  Used as a subtype in PKCS12.
-type EncryptedData struct {
-	Raw                  asn1.RawContent
-	Version              int
-	EncryptedContentInfo EncryptedContentInfo
-}
-
-// EncryptedContentInfo is a subtype of PKCS7EncryptedData.
-type EncryptedContentInfo struct {
-	Raw                        asn1.RawContent
-	ContentType                asn1.ObjectIdentifier
-	ContentEncryptionAlgorithm pkix.AlgorithmIdentifier
-	EncryptedContent           []byte `asn1:"tag:0,optional"`
-}
-
-// ParsePKCS7 attempts to parse the DER encoded bytes of a
-// PKCS7 structure.
-func ParsePKCS7(raw []byte) (msg *PKCS7, err error) {
-
-	var pkcs7 initPKCS7
-	_, err = asn1.Unmarshal(raw, &pkcs7)
-	if err != nil {
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-	}
-
-	msg = new(PKCS7)
-	msg.Raw = pkcs7.Raw
-	msg.ContentInfo = pkcs7.ContentType.String()
-	switch {
-	case msg.ContentInfo == ObjIDData:
-		msg.ContentInfo = "Data"
-		_, err = asn1.Unmarshal(pkcs7.Content.Bytes, &msg.Content.Data)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-		}
-	case msg.ContentInfo == ObjIDSignedData:
-		msg.ContentInfo = "SignedData"
-		var signedData signedData
-		_, err = asn1.Unmarshal(pkcs7.Content.Bytes, &signedData)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-		}
-		if len(signedData.Certificates.Bytes) != 0 {
-			msg.Content.SignedData.Certificates, err = x509.ParseCertificates(signedData.Certificates.Bytes)
-			if err != nil {
-				return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-			}
-		}
-		if len(signedData.Crls.Bytes) != 0 {
-			msg.Content.SignedData.Crl, err = x509.ParseDERCRL(signedData.Crls.Bytes)
-			if err != nil {
-				return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-			}
-		}
-		msg.Content.SignedData.Version = signedData.Version
-		msg.Content.SignedData.Raw = pkcs7.Content.Bytes
-	case msg.ContentInfo == ObjIDEncryptedData:
-		msg.ContentInfo = "EncryptedData"
-		var encryptedData EncryptedData
-		_, err = asn1.Unmarshal(pkcs7.Content.Bytes, &encryptedData)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-		}
-		if encryptedData.Version != 0 {
-			return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, errors.New("Only support for PKCS #7 encryptedData version 0"))
-		}
-		msg.Content.EncryptedData = encryptedData
-
-	default:
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, errors.New("Attempt to parse PKCS# 7 Content not of type data, signed data or encrypted data"))
-	}
-
-	return msg, nil
-
-}

vendor/github.com/cloudflare/cfssl/csr/csr.go

@@ -1,438 +0,0 @@
-// Package csr implements certificate requests for CFSSL.
-package csr
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"encoding/pem"
-	"errors"
-	"net"
-	"net/mail"
-	"net/url"
-	"strings"
-
-	cferr "github.com/cloudflare/cfssl/errors"
-	"github.com/cloudflare/cfssl/helpers"
-	"github.com/cloudflare/cfssl/log"
-)
-
-const (
-	curveP256 = 256
-	curveP384 = 384
-	curveP521 = 521
-)
-
-// A Name contains the SubjectInfo fields.
-type Name struct {
-	C            string // Country
-	ST           string // State
-	L            string // Locality
-	O            string // OrganisationName
-	OU           string // OrganisationalUnitName
-	SerialNumber string
-}
-
-// A KeyRequest is a generic request for a new key.
-type KeyRequest interface {
-	Algo() string
-	Size() int
-	Generate() (crypto.PrivateKey, error)
-	SigAlgo() x509.SignatureAlgorithm
-}
-
-// A BasicKeyRequest contains the algorithm and key size for a new private key.
-type BasicKeyRequest struct {
-	A string `json:"algo" yaml:"algo"`
-	S int    `json:"size" yaml:"size"`
-}
-
-// NewBasicKeyRequest returns a default BasicKeyRequest.
-func NewBasicKeyRequest() *BasicKeyRequest {
-	return &BasicKeyRequest{"ecdsa", curveP256}
-}
-
-// Algo returns the requested key algorithm represented as a string.
-func (kr *BasicKeyRequest) Algo() string {
-	return kr.A
-}
-
-// Size returns the requested key size.
-func (kr *BasicKeyRequest) Size() int {
-	return kr.S
-}
-
-// Generate generates a key as specified in the request. Currently,
-// only ECDSA and RSA are supported.
-func (kr *BasicKeyRequest) Generate() (crypto.PrivateKey, error) {
-	log.Debugf("generate key from request: algo=%s, size=%d", kr.Algo(), kr.Size())
-	switch kr.Algo() {
-	case "rsa":
-		if kr.Size() < 2048 {
-			return nil, errors.New("RSA key is too weak")
-		}
-		if kr.Size() > 8192 {
-			return nil, errors.New("RSA key size too large")
-		}
-		return rsa.GenerateKey(rand.Reader, kr.Size())
-	case "ecdsa":
-		var curve elliptic.Curve
-		switch kr.Size() {
-		case curveP256:
-			curve = elliptic.P256()
-		case curveP384:
-			curve = elliptic.P384()
-		case curveP521:
-			curve = elliptic.P521()
-		default:
-			return nil, errors.New("invalid curve")
-		}
-		return ecdsa.GenerateKey(curve, rand.Reader)
-	default:
-		return nil, errors.New("invalid algorithm")
-	}
-}
-
-// SigAlgo returns an appropriate X.509 signature algorithm given the
-// key request's type and size.
-func (kr *BasicKeyRequest) SigAlgo() x509.SignatureAlgorithm {
-	switch kr.Algo() {
-	case "rsa":
-		switch {
-		case kr.Size() >= 4096:
-			return x509.SHA512WithRSA
-		case kr.Size() >= 3072:
-			return x509.SHA384WithRSA
-		case kr.Size() >= 2048:
-			return x509.SHA256WithRSA
-		default:
-			return x509.SHA1WithRSA
-		}
-	case "ecdsa":
-		switch kr.Size() {
-		case curveP521:
-			return x509.ECDSAWithSHA512
-		case curveP384:
-			return x509.ECDSAWithSHA384
-		case curveP256:
-			return x509.ECDSAWithSHA256
-		default:
-			return x509.ECDSAWithSHA1
-		}
-	default:
-		return x509.UnknownSignatureAlgorithm
-	}
-}
-
-// CAConfig is a section used in the requests initialising a new CA.
-type CAConfig struct {
-	PathLength  int    `json:"pathlen" yaml:"pathlen"`
-	PathLenZero bool   `json:"pathlenzero" yaml:"pathlenzero"`
-	Expiry      string `json:"expiry" yaml:"expiry"`
-	Backdate    string `json:"backdate" yaml:"backdate"`
-}
-
-// A CertificateRequest encapsulates the API interface to the
-// certificate request functionality.
-type CertificateRequest struct {
-	CN           string
-	Names        []Name     `json:"names" yaml:"names"`
-	Hosts        []string   `json:"hosts" yaml:"hosts"`
-	KeyRequest   KeyRequest `json:"key,omitempty" yaml:"key,omitempty"`
-	CA           *CAConfig  `json:"ca,omitempty" yaml:"ca,omitempty"`
-	SerialNumber string     `json:"serialnumber,omitempty" yaml:"serialnumber,omitempty"`
-}
-
-// New returns a new, empty CertificateRequest with a
-// BasicKeyRequest.
-func New() *CertificateRequest {
-	return &CertificateRequest{
-		KeyRequest: NewBasicKeyRequest(),
-	}
-}
-
-// appendIf appends to a if s is not an empty string.
-func appendIf(s string, a *[]string) {
-	if s != "" {
-		*a = append(*a, s)
-	}
-}
-
-// Name returns the PKIX name for the request.
-func (cr *CertificateRequest) Name() pkix.Name {
-	var name pkix.Name
-	name.CommonName = cr.CN
-
-	for _, n := range cr.Names {
-		appendIf(n.C, &name.Country)
-		appendIf(n.ST, &name.Province)
-		appendIf(n.L, &name.Locality)
-		appendIf(n.O, &name.Organization)
-		appendIf(n.OU, &name.OrganizationalUnit)
-	}
-	name.SerialNumber = cr.SerialNumber
-	return name
-}
-
-// BasicConstraints CSR information RFC 5280, 4.2.1.9
-type BasicConstraints struct {
-	IsCA       bool `asn1:"optional"`
-	MaxPathLen int  `asn1:"optional,default:-1"`
-}
-
-// ParseRequest takes a certificate request and generates a key and
-// CSR from it. It does no validation -- caveat emptor. It will,
-// however, fail if the key request is not valid (i.e., an unsupported
-// curve or RSA key size). The lack of validation was specifically
-// chosen to allow the end user to define a policy and validate the
-// request appropriately before calling this function.
-func ParseRequest(req *CertificateRequest) (csr, key []byte, err error) {
-	log.Info("received CSR")
-	if req.KeyRequest == nil {
-		req.KeyRequest = NewBasicKeyRequest()
-	}
-
-	log.Infof("generating key: %s-%d", req.KeyRequest.Algo(), req.KeyRequest.Size())
-	priv, err := req.KeyRequest.Generate()
-	if err != nil {
-		err = cferr.Wrap(cferr.PrivateKeyError, cferr.GenerationFailed, err)
-		return
-	}
-
-	switch priv := priv.(type) {
-	case *rsa.PrivateKey:
-		key = x509.MarshalPKCS1PrivateKey(priv)
-		block := pem.Block{
-			Type:  "RSA PRIVATE KEY",
-			Bytes: key,
-		}
-		key = pem.EncodeToMemory(&block)
-	case *ecdsa.PrivateKey:
-		key, err = x509.MarshalECPrivateKey(priv)
-		if err != nil {
-			err = cferr.Wrap(cferr.PrivateKeyError, cferr.Unknown, err)
-			return
-		}
-		block := pem.Block{
-			Type:  "EC PRIVATE KEY",
-			Bytes: key,
-		}
-		key = pem.EncodeToMemory(&block)
-	default:
-		panic("Generate should have failed to produce a valid key.")
-	}
-
-	csr, err = Generate(priv.(crypto.Signer), req)
-	if err != nil {
-		log.Errorf("failed to generate a CSR: %v", err)
-		err = cferr.Wrap(cferr.CSRError, cferr.BadRequest, err)
-	}
-	return
-}
-
-// ExtractCertificateRequest extracts a CertificateRequest from
-// x509.Certificate. It is aimed to used for generating a new certificate
-// from an existing certificate. For a root certificate, the CA expiry
-// length is calculated as the duration between cert.NotAfter and cert.NotBefore.
-func ExtractCertificateRequest(cert *x509.Certificate) *CertificateRequest {
-	req := New()
-	req.CN = cert.Subject.CommonName
-	req.Names = getNames(cert.Subject)
-	req.Hosts = getHosts(cert)
-	req.SerialNumber = cert.Subject.SerialNumber
-
-	if cert.IsCA {
-		req.CA = new(CAConfig)
-		// CA expiry length is calculated based on the input cert
-		// issue date and expiry date.
-		req.CA.Expiry = cert.NotAfter.Sub(cert.NotBefore).String()
-		req.CA.PathLength = cert.MaxPathLen
-		req.CA.PathLenZero = cert.MaxPathLenZero
-	}
-
-	return req
-}
-
-func getHosts(cert *x509.Certificate) []string {
-	var hosts []string
-	for _, ip := range cert.IPAddresses {
-		hosts = append(hosts, ip.String())
-	}
-	for _, dns := range cert.DNSNames {
-		hosts = append(hosts, dns)
-	}
-	for _, email := range cert.EmailAddresses {
-		hosts = append(hosts, email)
-	}
-	for _, uri := range cert.URIs {
-		hosts = append(hosts, uri.String())
-	}
-
-	return hosts
-}
-
-// getNames returns an array of Names from the certificate
-// It onnly cares about Country, Organization, OrganizationalUnit, Locality, Province
-func getNames(sub pkix.Name) []Name {
-	// anonymous func for finding the max of a list of interger
-	max := func(v1 int, vn ...int) (max int) {
-		max = v1
-		for i := 0; i < len(vn); i++ {
-			if vn[i] > max {
-				max = vn[i]
-			}
-		}
-		return max
-	}
-
-	nc := len(sub.Country)
-	norg := len(sub.Organization)
-	nou := len(sub.OrganizationalUnit)
-	nl := len(sub.Locality)
-	np := len(sub.Province)
-
-	n := max(nc, norg, nou, nl, np)
-
-	names := make([]Name, n)
-	for i := range names {
-		if i < nc {
-			names[i].C = sub.Country[i]
-		}
-		if i < norg {
-			names[i].O = sub.Organization[i]
-		}
-		if i < nou {
-			names[i].OU = sub.OrganizationalUnit[i]
-		}
-		if i < nl {
-			names[i].L = sub.Locality[i]
-		}
-		if i < np {
-			names[i].ST = sub.Province[i]
-		}
-	}
-	return names
-}
-
-// A Generator is responsible for validating certificate requests.
-type Generator struct {
-	Validator func(*CertificateRequest) error
-}
-
-// ProcessRequest validates and processes the incoming request. It is
-// a wrapper around a validator and the ParseRequest function.
-func (g *Generator) ProcessRequest(req *CertificateRequest) (csr, key []byte, err error) {
-
-	log.Info("generate received request")
-	err = g.Validator(req)
-	if err != nil {
-		log.Warningf("invalid request: %v", err)
-		return nil, nil, err
-	}
-
-	csr, key, err = ParseRequest(req)
-	if err != nil {
-		return nil, nil, err
-	}
-	return
-}
-
-// IsNameEmpty returns true if the name has no identifying information in it.
-func IsNameEmpty(n Name) bool {
-	empty := func(s string) bool { return strings.TrimSpace(s) == "" }
-
-	if empty(n.C) && empty(n.ST) && empty(n.L) && empty(n.O) && empty(n.OU) {
-		return true
-	}
-	return false
-}
-
-// Regenerate uses the provided CSR as a template for signing a new
-// CSR using priv.
-func Regenerate(priv crypto.Signer, csr []byte) ([]byte, error) {
-	req, extra, err := helpers.ParseCSR(csr)
-	if err != nil {
-		return nil, err
-	} else if len(extra) > 0 {
-		return nil, errors.New("csr: trailing data in certificate request")
-	}
-
-	return x509.CreateCertificateRequest(rand.Reader, req, priv)
-}
-
-// Generate creates a new CSR from a CertificateRequest structure and
-// an existing key. The KeyRequest field is ignored.
-func Generate(priv crypto.Signer, req *CertificateRequest) (csr []byte, err error) {
-	sigAlgo := helpers.SignerAlgo(priv)
-	if sigAlgo == x509.UnknownSignatureAlgorithm {
-		return nil, cferr.New(cferr.PrivateKeyError, cferr.Unavailable)
-	}
-
-	var tpl = x509.CertificateRequest{
-		Subject:            req.Name(),
-		SignatureAlgorithm: sigAlgo,
-	}
-
-	for i := range req.Hosts {
-		if ip := net.ParseIP(req.Hosts[i]); ip != nil {
-			tpl.IPAddresses = append(tpl.IPAddresses, ip)
-		} else if email, err := mail.ParseAddress(req.Hosts[i]); err == nil && email != nil {
-			tpl.EmailAddresses = append(tpl.EmailAddresses, email.Address)
-		} else if uri, err := url.ParseRequestURI(req.Hosts[i]); err == nil && uri != nil {
-			tpl.URIs = append(tpl.URIs, uri)
-		} else {
-			tpl.DNSNames = append(tpl.DNSNames, req.Hosts[i])
-		}
-	}
-
-	if req.CA != nil {
-		err = appendCAInfoToCSR(req.CA, &tpl)
-		if err != nil {
-			err = cferr.Wrap(cferr.CSRError, cferr.GenerationFailed, err)
-			return
-		}
-	}
-
-	csr, err = x509.CreateCertificateRequest(rand.Reader, &tpl, priv)
-	if err != nil {
-		log.Errorf("failed to generate a CSR: %v", err)
-		err = cferr.Wrap(cferr.CSRError, cferr.BadRequest, err)
-		return
-	}
-	block := pem.Block{
-		Type:  "CERTIFICATE REQUEST",
-		Bytes: csr,
-	}
-
-	log.Info("encoded CSR")
-	csr = pem.EncodeToMemory(&block)
-	return
-}
-
-// appendCAInfoToCSR appends CAConfig BasicConstraint extension to a CSR
-func appendCAInfoToCSR(reqConf *CAConfig, csr *x509.CertificateRequest) error {
-	pathlen := reqConf.PathLength
-	if pathlen == 0 && !reqConf.PathLenZero {
-		pathlen = -1
-	}
-	val, err := asn1.Marshal(BasicConstraints{true, pathlen})
-
-	if err != nil {
-		return err
-	}
-
-	csr.ExtraExtensions = []pkix.Extension{
-		{
-			Id:       asn1.ObjectIdentifier{2, 5, 29, 19},
-			Value:    val,
-			Critical: true,
-		},
-	}
-
-	return nil
-}

vendor/github.com/cloudflare/cfssl/errors/doc.go

@@ -1,46 +0,0 @@
-/*
-Package errors provides error types returned in CF SSL.
-
-1. Type Error is intended for errors produced by CF SSL packages.
-It formats to a json object that consists of an error message and a 4-digit code for error reasoning.
-
-Example: {"code":1002, "message": "Failed to decode certificate"}
-
-The index of codes are listed below:
-	1XXX: CertificateError
-	    1000: Unknown
-	    1001: ReadFailed
-	    1002: DecodeFailed
-	    1003: ParseFailed
-	    1100: SelfSigned
-	    12XX: VerifyFailed
-	        121X: CertificateInvalid
-	            1210: NotAuthorizedToSign
-	            1211: Expired
-	            1212: CANotAuthorizedForThisName
-	            1213: TooManyIntermediates
-	            1214: IncompatibleUsage
-	        1220: UnknownAuthority
-	2XXX: PrivatekeyError
-	    2000: Unknown
-	    2001: ReadFailed
-	    2002: DecodeFailed
-	    2003: ParseFailed
-	    2100: Encrypted
-	    2200: NotRSA
-	    2300: KeyMismatch
-	    2400: GenerationFailed
-	    2500: Unavailable
-	3XXX: IntermediatesError
-	4XXX: RootError
-	5XXX: PolicyError
-	    5100: NoKeyUsages
-	    5200: InvalidPolicy
-	    5300: InvalidRequest
-	    5400: UnknownProfile
-	    6XXX: DialError
-
-2. Type HttpError is intended for CF SSL API to consume. It contains a HTTP status code that will be read and returned
-by the API server.
-*/
-package errors

vendor/github.com/cloudflare/cfssl/errors/error.go

@@ -1,438 +0,0 @@
-package errors
-
-import (
-	"crypto/x509"
-	"encoding/json"
-	"fmt"
-)
-
-// Error is the error type usually returned by functions in CF SSL package.
-// It contains a 4-digit error code where the most significant digit
-// describes the category where the error occurred and the rest 3 digits
-// describe the specific error reason.
-type Error struct {
-	ErrorCode int    `json:"code"`
-	Message   string `json:"message"`
-}
-
-// Category is the most significant digit of the error code.
-type Category int
-
-// Reason is the last 3 digits of the error code.
-type Reason int
-
-const (
-	// Success indicates no error occurred.
-	Success Category = 1000 * iota // 0XXX
-
-	// CertificateError indicates a fault in a certificate.
-	CertificateError // 1XXX
-
-	// PrivateKeyError indicates a fault in a private key.
-	PrivateKeyError // 2XXX
-
-	// IntermediatesError indicates a fault in an intermediate.
-	IntermediatesError // 3XXX
-
-	// RootError indicates a fault in a root.
-	RootError // 4XXX
-
-	// PolicyError indicates an error arising from a malformed or
-	// non-existent policy, or a breach of policy.
-	PolicyError // 5XXX
-
-	// DialError indicates a network fault.
-	DialError // 6XXX
-
-	// APIClientError indicates a problem with the API client.
-	APIClientError // 7XXX
-
-	// OCSPError indicates a problem with OCSP signing
-	OCSPError // 8XXX
-
-	// CSRError indicates a problem with CSR parsing
-	CSRError // 9XXX
-
-	// CTError indicates a problem with the certificate transparency process
-	CTError // 10XXX
-
-	// CertStoreError indicates a problem with the certificate store
-	CertStoreError // 11XXX
-)
-
-// None is a non-specified error.
-const (
-	None Reason = iota
-)
-
-// Warning code for a success
-const (
-	BundleExpiringBit      int = 1 << iota // 0x01
-	BundleNotUbiquitousBit                 // 0x02
-)
-
-// Parsing errors
-const (
-	Unknown      Reason = iota // X000
-	ReadFailed                 // X001
-	DecodeFailed               // X002
-	ParseFailed                // X003
-)
-
-// The following represent certificate non-parsing errors, and must be
-// specified along with CertificateError.
-const (
-	// SelfSigned indicates that a certificate is self-signed and
-	// cannot be used in the manner being attempted.
-	SelfSigned Reason = 100 * (iota + 1) // Code 11XX
-
-	// VerifyFailed is an X.509 verification failure. The least two
-	// significant digits of 12XX is determined as the actual x509
-	// error is examined.
-	VerifyFailed // Code 12XX
-
-	// BadRequest indicates that the certificate request is invalid.
-	BadRequest // Code 13XX
-
-	// MissingSerial indicates that the profile specified
-	// 'ClientProvidesSerialNumbers', but the SignRequest did not include a serial
-	// number.
-	MissingSerial // Code 14XX
-)
-
-const (
-	certificateInvalid = 10 * (iota + 1) //121X
-	unknownAuthority                     //122x
-)
-
-// The following represent private-key non-parsing errors, and must be
-// specified with PrivateKeyError.
-const (
-	// Encrypted indicates that the private key is a PKCS #8 encrypted
-	// private key. At this time, CFSSL does not support decrypting
-	// these keys.
-	Encrypted Reason = 100 * (iota + 1) //21XX
-
-	// NotRSAOrECC indicates that they key is not an RSA or ECC
-	// private key; these are the only two private key types supported
-	// at this time by CFSSL.
-	NotRSAOrECC //22XX
-
-	// KeyMismatch indicates that the private key does not match
-	// the public key or certificate being presented with the key.
-	KeyMismatch //23XX
-
-	// GenerationFailed indicates that a private key could not
-	// be generated.
-	GenerationFailed //24XX
-
-	// Unavailable indicates that a private key mechanism (such as
-	// PKCS #11) was requested but support for that mechanism is
-	// not available.
-	Unavailable
-)
-
-// The following are policy-related non-parsing errors, and must be
-// specified along with PolicyError.
-const (
-	// NoKeyUsages indicates that the profile does not permit any
-	// key usages for the certificate.
-	NoKeyUsages Reason = 100 * (iota + 1) // 51XX
-
-	// InvalidPolicy indicates that policy being requested is not
-	// a valid policy or does not exist.
-	InvalidPolicy // 52XX
-
-	// InvalidRequest indicates a certificate request violated the
-	// constraints of the policy being applied to the request.
-	InvalidRequest // 53XX
-
-	// UnknownProfile indicates that the profile does not exist.
-	UnknownProfile // 54XX
-
-	UnmatchedWhitelist // 55xx
-)
-
-// The following are API client related errors, and should be
-// specified with APIClientError.
-const (
-	// AuthenticationFailure occurs when the client is unable
-	// to obtain an authentication token for the request.
-	AuthenticationFailure Reason = 100 * (iota + 1)
-
-	// JSONError wraps an encoding/json error.
-	JSONError
-
-	// IOError wraps an io/ioutil error.
-	IOError
-
-	// ClientHTTPError wraps a net/http error.
-	ClientHTTPError
-
-	// ServerRequestFailed covers any other failures from the API
-	// client.
-	ServerRequestFailed
-)
-
-// The following are OCSP related errors, and should be
-// specified with OCSPError
-const (
-	// IssuerMismatch ocurs when the certificate in the OCSP signing
-	// request was not issued by the CA that this responder responds for.
-	IssuerMismatch Reason = 100 * (iota + 1) // 81XX
-
-	// InvalidStatus occurs when the OCSP signing requests includes an
-	// invalid value for the certificate status.
-	InvalidStatus
-)
-
-// Certificate transparency related errors specified with CTError
-const (
-	// PrecertSubmissionFailed occurs when submitting a precertificate to
-	// a log server fails
-	PrecertSubmissionFailed = 100 * (iota + 1)
-	// CTClientConstructionFailed occurs when the construction of a new
-	// github.com/google/certificate-transparency client fails.
-	CTClientConstructionFailed
-	// PrecertMissingPoison occurs when a precert is passed to SignFromPrecert
-	// and is missing the CT poison extension.
-	PrecertMissingPoison
-	// PrecertInvalidPoison occurs when a precert is passed to SignFromPrecert
-	// and has a invalid CT poison extension value or the extension is not
-	// critical.
-	PrecertInvalidPoison
-)
-
-// Certificate persistence related errors specified with CertStoreError
-const (
-	// InsertionFailed occurs when a SQL insert query failes to complete.
-	InsertionFailed = 100 * (iota + 1)
-	// RecordNotFound occurs when a SQL query targeting on one unique
-	// record failes to update the specified row in the table.
-	RecordNotFound
-)
-
-// The error interface implementation, which formats to a JSON object string.
-func (e *Error) Error() string {
-	marshaled, err := json.Marshal(e)
-	if err != nil {
-		panic(err)
-	}
-	return string(marshaled)
-
-}
-
-// New returns an error that contains  an error code and message derived from
-// the given category, reason. Currently, to avoid confusion, it is not
-// allowed to create an error of category Success
-func New(category Category, reason Reason) *Error {
-	errorCode := int(category) + int(reason)
-	var msg string
-	switch category {
-	case OCSPError:
-		switch reason {
-		case ReadFailed:
-			msg = "No certificate provided"
-		case IssuerMismatch:
-			msg = "Certificate not issued by this issuer"
-		case InvalidStatus:
-			msg = "Invalid revocation status"
-		}
-	case CertificateError:
-		switch reason {
-		case Unknown:
-			msg = "Unknown certificate error"
-		case ReadFailed:
-			msg = "Failed to read certificate"
-		case DecodeFailed:
-			msg = "Failed to decode certificate"
-		case ParseFailed:
-			msg = "Failed to parse certificate"
-		case SelfSigned:
-			msg = "Certificate is self signed"
-		case VerifyFailed:
-			msg = "Unable to verify certificate"
-		case BadRequest:
-			msg = "Invalid certificate request"
-		case MissingSerial:
-			msg = "Missing serial number in request"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category CertificateError.",
-				reason))
-
-		}
-	case PrivateKeyError:
-		switch reason {
-		case Unknown:
-			msg = "Unknown private key error"
-		case ReadFailed:
-			msg = "Failed to read private key"
-		case DecodeFailed:
-			msg = "Failed to decode private key"
-		case ParseFailed:
-			msg = "Failed to parse private key"
-		case Encrypted:
-			msg = "Private key is encrypted."
-		case NotRSAOrECC:
-			msg = "Private key algorithm is not RSA or ECC"
-		case KeyMismatch:
-			msg = "Private key does not match public key"
-		case GenerationFailed:
-			msg = "Failed to new private key"
-		case Unavailable:
-			msg = "Private key is unavailable"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category PrivateKeyError.",
-				reason))
-		}
-	case IntermediatesError:
-		switch reason {
-		case Unknown:
-			msg = "Unknown intermediate certificate error"
-		case ReadFailed:
-			msg = "Failed to read intermediate certificate"
-		case DecodeFailed:
-			msg = "Failed to decode intermediate certificate"
-		case ParseFailed:
-			msg = "Failed to parse intermediate certificate"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category IntermediatesError.",
-				reason))
-		}
-	case RootError:
-		switch reason {
-		case Unknown:
-			msg = "Unknown root certificate error"
-		case ReadFailed:
-			msg = "Failed to read root certificate"
-		case DecodeFailed:
-			msg = "Failed to decode root certificate"
-		case ParseFailed:
-			msg = "Failed to parse root certificate"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category RootError.",
-				reason))
-		}
-	case PolicyError:
-		switch reason {
-		case Unknown:
-			msg = "Unknown policy error"
-		case NoKeyUsages:
-			msg = "Invalid policy: no key usage available"
-		case InvalidPolicy:
-			msg = "Invalid or unknown policy"
-		case InvalidRequest:
-			msg = "Policy violation request"
-		case UnknownProfile:
-			msg = "Unknown policy profile"
-		case UnmatchedWhitelist:
-			msg = "Request does not match policy whitelist"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category PolicyError.",
-				reason))
-		}
-	case DialError:
-		switch reason {
-		case Unknown:
-			msg = "Failed to dial remote server"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category DialError.",
-				reason))
-		}
-	case APIClientError:
-		switch reason {
-		case AuthenticationFailure:
-			msg = "API client authentication failure"
-		case JSONError:
-			msg = "API client JSON config error"
-		case ClientHTTPError:
-			msg = "API client HTTP error"
-		case IOError:
-			msg = "API client IO error"
-		case ServerRequestFailed:
-			msg = "API client error: Server request failed"
-		default:
-			panic(fmt.Sprintf("Unsupported CFSSL error reason %d under category APIClientError.",
-				reason))
-		}
-	case CSRError:
-		switch reason {
-		case Unknown:
-			msg = "CSR parsing failed due to unknown error"
-		case ReadFailed:
-			msg = "CSR file read failed"
-		case ParseFailed:
-			msg = "CSR Parsing failed"
-		case DecodeFailed:
-			msg = "CSR Decode failed"
-		case BadRequest:
-			msg = "CSR Bad request"
-		default:
-			panic(fmt.Sprintf("Unsupported CF-SSL error reason %d under category APIClientError.", reason))
-		}
-	case CTError:
-		switch reason {
-		case Unknown:
-			msg = "Certificate transparency parsing failed due to unknown error"
-		case PrecertSubmissionFailed:
-			msg = "Certificate transparency precertificate submission failed"
-		case PrecertMissingPoison:
-			msg = "Precertificate is missing CT poison extension"
-		case PrecertInvalidPoison:
-			msg = "Precertificate contains an invalid CT poison extension"
-		default:
-			panic(fmt.Sprintf("Unsupported CF-SSL error reason %d under category CTError.", reason))
-		}
-	case CertStoreError:
-		switch reason {
-		case Unknown:
-			msg = "Certificate store action failed due to unknown error"
-		default:
-			panic(fmt.Sprintf("Unsupported CF-SSL error reason %d under category CertStoreError.", reason))
-		}
-
-	default:
-		panic(fmt.Sprintf("Unsupported CFSSL error type: %d.",
-			category))
-	}
-	return &Error{ErrorCode: errorCode, Message: msg}
-}
-
-// Wrap returns an error that contains the given error and an error code derived from
-// the given category, reason and the error. Currently, to avoid confusion, it is not
-// allowed to create an error of category Success
-func Wrap(category Category, reason Reason, err error) *Error {
-	errorCode := int(category) + int(reason)
-	if err == nil {
-		panic("Wrap needs a supplied error to initialize.")
-	}
-
-	// do not double wrap a error
-	switch err.(type) {
-	case *Error:
-		panic("Unable to wrap a wrapped error.")
-	}
-
-	switch category {
-	case CertificateError:
-		// given VerifyFailed , report the status with more detailed status code
-		// for some certificate errors we care.
-		if reason == VerifyFailed {
-			switch errorType := err.(type) {
-			case x509.CertificateInvalidError:
-				errorCode += certificateInvalid + int(errorType.Reason)
-			case x509.UnknownAuthorityError:
-				errorCode += unknownAuthority
-			}
-		}
-	case PrivateKeyError, IntermediatesError, RootError, PolicyError, DialError,
-		APIClientError, CSRError, CTError, CertStoreError, OCSPError:
-	// no-op, just use the error
-	default:
-		panic(fmt.Sprintf("Unsupported CFSSL error type: %d.",
-			category))
-	}
-
-	return &Error{ErrorCode: errorCode, Message: err.Error()}
-
-}

vendor/github.com/cloudflare/cfssl/errors/http.go

@@ -1,47 +0,0 @@
-package errors
-
-import (
-	"errors"
-	"net/http"
-)
-
-// HTTPError is an augmented error with a HTTP status code.
-type HTTPError struct {
-	StatusCode int
-	error
-}
-
-// Error implements the error interface.
-func (e *HTTPError) Error() string {
-	return e.error.Error()
-}
-
-// NewMethodNotAllowed returns an appropriate error in the case that
-// an HTTP client uses an invalid method (i.e. a GET in place of a POST)
-// on an API endpoint.
-func NewMethodNotAllowed(method string) *HTTPError {
-	return &HTTPError{http.StatusMethodNotAllowed, errors.New(`Method is not allowed:"` + method + `"`)}
-}
-
-// NewBadRequest creates a HttpError with the given error and error code 400.
-func NewBadRequest(err error) *HTTPError {
-	return &HTTPError{http.StatusBadRequest, err}
-}
-
-// NewBadRequestString returns a HttpError with the supplied message
-// and error code 400.
-func NewBadRequestString(s string) *HTTPError {
-	return NewBadRequest(errors.New(s))
-}
-
-// NewBadRequestMissingParameter returns a 400 HttpError as a required
-// parameter is missing in the HTTP request.
-func NewBadRequestMissingParameter(s string) *HTTPError {
-	return NewBadRequestString(`Missing parameter "` + s + `"`)
-}
-
-// NewBadRequestUnwantedParameter returns a 400 HttpError as a unnecessary
-// parameter is present in the HTTP request.
-func NewBadRequestUnwantedParameter(s string) *HTTPError {
-	return NewBadRequestString(`Unwanted parameter "` + s + `"`)
-}

vendor/github.com/cloudflare/cfssl/helpers/derhelpers/derhelpers.go

@@ -1,48 +0,0 @@
-// Package derhelpers implements common functionality
-// on DER encoded data
-package derhelpers
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/rsa"
-	"crypto/x509"
-
-	cferr "github.com/cloudflare/cfssl/errors"
-	"golang.org/x/crypto/ed25519"
-)
-
-// ParsePrivateKeyDER parses a PKCS #1, PKCS #8, ECDSA, or Ed25519 DER-encoded
-// private key. The key must not be in PEM format.
-func ParsePrivateKeyDER(keyDER []byte) (key crypto.Signer, err error) {
-	generalKey, err := x509.ParsePKCS8PrivateKey(keyDER)
-	if err != nil {
-		generalKey, err = x509.ParsePKCS1PrivateKey(keyDER)
-		if err != nil {
-			generalKey, err = x509.ParseECPrivateKey(keyDER)
-			if err != nil {
-				generalKey, err = ParseEd25519PrivateKey(keyDER)
-				if err != nil {
-					// We don't include the actual error into
-					// the final error. The reason might be
-					// we don't want to leak any info about
-					// the private key.
-					return nil, cferr.New(cferr.PrivateKeyError,
-						cferr.ParseFailed)
-				}
-			}
-		}
-	}
-
-	switch generalKey.(type) {
-	case *rsa.PrivateKey:
-		return generalKey.(*rsa.PrivateKey), nil
-	case *ecdsa.PrivateKey:
-		return generalKey.(*ecdsa.PrivateKey), nil
-	case ed25519.PrivateKey:
-		return generalKey.(ed25519.PrivateKey), nil
-	}
-
-	// should never reach here
-	return nil, cferr.New(cferr.PrivateKeyError, cferr.ParseFailed)
-}

vendor/github.com/cloudflare/cfssl/helpers/derhelpers/ed25519.go

@@ -1,133 +0,0 @@
-package derhelpers
-
-import (
-	"crypto"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"errors"
-
-	"golang.org/x/crypto/ed25519"
-)
-
-var errEd25519WrongID = errors.New("incorrect object identifier")
-var errEd25519WrongKeyType = errors.New("incorrect key type")
-
-// ed25519OID is the OID for the Ed25519 signature scheme: see
-// https://datatracker.ietf.org/doc/draft-ietf-curdle-pkix-04.
-var ed25519OID = asn1.ObjectIdentifier{1, 3, 101, 112}
-
-// subjectPublicKeyInfo reflects the ASN.1 object defined in the X.509 standard.
-//
-// This is defined in crypto/x509 as "publicKeyInfo".
-type subjectPublicKeyInfo struct {
-	Algorithm pkix.AlgorithmIdentifier
-	PublicKey asn1.BitString
-}
-
-// MarshalEd25519PublicKey creates a DER-encoded SubjectPublicKeyInfo for an
-// ed25519 public key, as defined in
-// https://tools.ietf.org/html/draft-ietf-curdle-pkix-04. This is analagous to
-// MarshalPKIXPublicKey in crypto/x509, which doesn't currently support Ed25519.
-func MarshalEd25519PublicKey(pk crypto.PublicKey) ([]byte, error) {
-	pub, ok := pk.(ed25519.PublicKey)
-	if !ok {
-		return nil, errEd25519WrongKeyType
-	}
-
-	spki := subjectPublicKeyInfo{
-		Algorithm: pkix.AlgorithmIdentifier{
-			Algorithm: ed25519OID,
-		},
-		PublicKey: asn1.BitString{
-			BitLength: len(pub) * 8,
-			Bytes:     pub,
-		},
-	}
-
-	return asn1.Marshal(spki)
-}
-
-// ParseEd25519PublicKey returns the Ed25519 public key encoded by the input.
-func ParseEd25519PublicKey(der []byte) (crypto.PublicKey, error) {
-	var spki subjectPublicKeyInfo
-	if rest, err := asn1.Unmarshal(der, &spki); err != nil {
-		return nil, err
-	} else if len(rest) > 0 {
-		return nil, errors.New("SubjectPublicKeyInfo too long")
-	}
-
-	if !spki.Algorithm.Algorithm.Equal(ed25519OID) {
-		return nil, errEd25519WrongID
-	}
-
-	if spki.PublicKey.BitLength != ed25519.PublicKeySize*8 {
-		return nil, errors.New("SubjectPublicKeyInfo PublicKey length mismatch")
-	}
-
-	return ed25519.PublicKey(spki.PublicKey.Bytes), nil
-}
-
-// oneAsymmetricKey reflects the ASN.1 structure for storing private keys in
-// https://tools.ietf.org/html/draft-ietf-curdle-pkix-04, excluding the optional
-// fields, which we don't use here.
-//
-// This is identical to pkcs8 in crypto/x509.
-type oneAsymmetricKey struct {
-	Version    int
-	Algorithm  pkix.AlgorithmIdentifier
-	PrivateKey []byte
-}
-
-// curvePrivateKey is the innter type of the PrivateKey field of
-// oneAsymmetricKey.
-type curvePrivateKey []byte
-
-// MarshalEd25519PrivateKey returns a DER encdoing of the input private key as
-// specified in https://tools.ietf.org/html/draft-ietf-curdle-pkix-04.
-func MarshalEd25519PrivateKey(sk crypto.PrivateKey) ([]byte, error) {
-	priv, ok := sk.(ed25519.PrivateKey)
-	if !ok {
-		return nil, errEd25519WrongKeyType
-	}
-
-	// Marshal the innter CurvePrivateKey.
-	curvePrivateKey, err := asn1.Marshal(priv.Seed())
-	if err != nil {
-		return nil, err
-	}
-
-	// Marshal the OneAsymmetricKey.
-	asym := oneAsymmetricKey{
-		Version: 0,
-		Algorithm: pkix.AlgorithmIdentifier{
-			Algorithm: ed25519OID,
-		},
-		PrivateKey: curvePrivateKey,
-	}
-	return asn1.Marshal(asym)
-}
-
-// ParseEd25519PrivateKey returns the Ed25519 private key encoded by the input.
-func ParseEd25519PrivateKey(der []byte) (crypto.PrivateKey, error) {
-	asym := new(oneAsymmetricKey)
-	if rest, err := asn1.Unmarshal(der, asym); err != nil {
-		return nil, err
-	} else if len(rest) > 0 {
-		return nil, errors.New("OneAsymmetricKey too long")
-	}
-
-	// Check that the key type is correct.
-	if !asym.Algorithm.Algorithm.Equal(ed25519OID) {
-		return nil, errEd25519WrongID
-	}
-
-	// Unmarshal the inner CurvePrivateKey.
-	seed := new(curvePrivateKey)
-	if rest, err := asn1.Unmarshal(asym.PrivateKey, seed); err != nil {
-		return nil, err
-	} else if len(rest) > 0 {
-		return nil, errors.New("CurvePrivateKey too long")
-	}
-
-	return ed25519.NewKeyFromSeed(*seed), nil
-}

vendor/github.com/cloudflare/cfssl/helpers/helpers.go

@@ -1,590 +0,0 @@
-// Package helpers implements utility functionality common to many
-// CFSSL packages.
-package helpers
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"os"
-
-	"github.com/google/certificate-transparency-go"
-	cttls "github.com/google/certificate-transparency-go/tls"
-	ctx509 "github.com/google/certificate-transparency-go/x509"
-	"golang.org/x/crypto/ocsp"
-
-	"strings"
-	"time"
-
-	"github.com/cloudflare/cfssl/crypto/pkcs7"
-	cferr "github.com/cloudflare/cfssl/errors"
-	"github.com/cloudflare/cfssl/helpers/derhelpers"
-	"github.com/cloudflare/cfssl/log"
-	"golang.org/x/crypto/pkcs12"
-)
-
-// OneYear is a time.Duration representing a year's worth of seconds.
-const OneYear = 8760 * time.Hour
-
-// OneDay is a time.Duration representing a day's worth of seconds.
-const OneDay = 24 * time.Hour
-
-// InclusiveDate returns the time.Time representation of a date - 1
-// nanosecond. This allows time.After to be used inclusively.
-func InclusiveDate(year int, month time.Month, day int) time.Time {
-	return time.Date(year, month, day, 0, 0, 0, 0, time.UTC).Add(-1 * time.Nanosecond)
-}
-
-// Jul2012 is the July 2012 CAB Forum deadline for when CAs must stop
-// issuing certificates valid for more than 5 years.
-var Jul2012 = InclusiveDate(2012, time.July, 01)
-
-// Apr2015 is the April 2015 CAB Forum deadline for when CAs must stop
-// issuing certificates valid for more than 39 months.
-var Apr2015 = InclusiveDate(2015, time.April, 01)
-
-// KeyLength returns the bit size of ECDSA or RSA PublicKey
-func KeyLength(key interface{}) int {
-	if key == nil {
-		return 0
-	}
-	if ecdsaKey, ok := key.(*ecdsa.PublicKey); ok {
-		return ecdsaKey.Curve.Params().BitSize
-	} else if rsaKey, ok := key.(*rsa.PublicKey); ok {
-		return rsaKey.N.BitLen()
-	}
-
-	return 0
-}
-
-// ExpiryTime returns the time when the certificate chain is expired.
-func ExpiryTime(chain []*x509.Certificate) (notAfter time.Time) {
-	if len(chain) == 0 {
-		return
-	}
-
-	notAfter = chain[0].NotAfter
-	for _, cert := range chain {
-		if notAfter.After(cert.NotAfter) {
-			notAfter = cert.NotAfter
-		}
-	}
-	return
-}
-
-// MonthsValid returns the number of months for which a certificate is valid.
-func MonthsValid(c *x509.Certificate) int {
-	issued := c.NotBefore
-	expiry := c.NotAfter
-	years := (expiry.Year() - issued.Year())
-	months := years*12 + int(expiry.Month()) - int(issued.Month())
-
-	// Round up if valid for less than a full month
-	if expiry.Day() > issued.Day() {
-		months++
-	}
-	return months
-}
-
-// ValidExpiry determines if a certificate is valid for an acceptable
-// length of time per the CA/Browser Forum baseline requirements.
-// See https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.pdf
-func ValidExpiry(c *x509.Certificate) bool {
-	issued := c.NotBefore
-
-	var maxMonths int
-	switch {
-	case issued.After(Apr2015):
-		maxMonths = 39
-	case issued.After(Jul2012):
-		maxMonths = 60
-	case issued.Before(Jul2012):
-		maxMonths = 120
-	}
-
-	if MonthsValid(c) > maxMonths {
-		return false
-	}
-	return true
-}
-
-// SignatureString returns the TLS signature string corresponding to
-// an X509 signature algorithm.
-func SignatureString(alg x509.SignatureAlgorithm) string {
-	switch alg {
-	case x509.MD2WithRSA:
-		return "MD2WithRSA"
-	case x509.MD5WithRSA:
-		return "MD5WithRSA"
-	case x509.SHA1WithRSA:
-		return "SHA1WithRSA"
-	case x509.SHA256WithRSA:
-		return "SHA256WithRSA"
-	case x509.SHA384WithRSA:
-		return "SHA384WithRSA"
-	case x509.SHA512WithRSA:
-		return "SHA512WithRSA"
-	case x509.DSAWithSHA1:
-		return "DSAWithSHA1"
-	case x509.DSAWithSHA256:
-		return "DSAWithSHA256"
-	case x509.ECDSAWithSHA1:
-		return "ECDSAWithSHA1"
-	case x509.ECDSAWithSHA256:
-		return "ECDSAWithSHA256"
-	case x509.ECDSAWithSHA384:
-		return "ECDSAWithSHA384"
-	case x509.ECDSAWithSHA512:
-		return "ECDSAWithSHA512"
-	default:
-		return "Unknown Signature"
-	}
-}
-
-// HashAlgoString returns the hash algorithm name contains in the signature
-// method.
-func HashAlgoString(alg x509.SignatureAlgorithm) string {
-	switch alg {
-	case x509.MD2WithRSA:
-		return "MD2"
-	case x509.MD5WithRSA:
-		return "MD5"
-	case x509.SHA1WithRSA:
-		return "SHA1"
-	case x509.SHA256WithRSA:
-		return "SHA256"
-	case x509.SHA384WithRSA:
-		return "SHA384"
-	case x509.SHA512WithRSA:
-		return "SHA512"
-	case x509.DSAWithSHA1:
-		return "SHA1"
-	case x509.DSAWithSHA256:
-		return "SHA256"
-	case x509.ECDSAWithSHA1:
-		return "SHA1"
-	case x509.ECDSAWithSHA256:
-		return "SHA256"
-	case x509.ECDSAWithSHA384:
-		return "SHA384"
-	case x509.ECDSAWithSHA512:
-		return "SHA512"
-	default:
-		return "Unknown Hash Algorithm"
-	}
-}
-
-// StringTLSVersion returns underlying enum values from human names for TLS
-// versions, defaults to current golang default of TLS 1.0
-func StringTLSVersion(version string) uint16 {
-	switch version {
-	case "1.2":
-		return tls.VersionTLS12
-	case "1.1":
-		return tls.VersionTLS11
-	default:
-		return tls.VersionTLS10
-	}
-}
-
-// EncodeCertificatesPEM encodes a number of x509 certificates to PEM
-func EncodeCertificatesPEM(certs []*x509.Certificate) []byte {
-	var buffer bytes.Buffer
-	for _, cert := range certs {
-		pem.Encode(&buffer, &pem.Block{
-			Type:  "CERTIFICATE",
-			Bytes: cert.Raw,
-		})
-	}
-
-	return buffer.Bytes()
-}
-
-// EncodeCertificatePEM encodes a single x509 certificates to PEM
-func EncodeCertificatePEM(cert *x509.Certificate) []byte {
-	return EncodeCertificatesPEM([]*x509.Certificate{cert})
-}
-
-// ParseCertificatesPEM parses a sequence of PEM-encoded certificate and returns them,
-// can handle PEM encoded PKCS #7 structures.
-func ParseCertificatesPEM(certsPEM []byte) ([]*x509.Certificate, error) {
-	var certs []*x509.Certificate
-	var err error
-	certsPEM = bytes.TrimSpace(certsPEM)
-	for len(certsPEM) > 0 {
-		var cert []*x509.Certificate
-		cert, certsPEM, err = ParseOneCertificateFromPEM(certsPEM)
-		if err != nil {
-
-			return nil, cferr.New(cferr.CertificateError, cferr.ParseFailed)
-		} else if cert == nil {
-			break
-		}
-
-		certs = append(certs, cert...)
-	}
-	if len(certsPEM) > 0 {
-		return nil, cferr.New(cferr.CertificateError, cferr.DecodeFailed)
-	}
-	return certs, nil
-}
-
-// ParseCertificatesDER parses a DER encoding of a certificate object and possibly private key,
-// either PKCS #7, PKCS #12, or raw x509.
-func ParseCertificatesDER(certsDER []byte, password string) (certs []*x509.Certificate, key crypto.Signer, err error) {
-	certsDER = bytes.TrimSpace(certsDER)
-	pkcs7data, err := pkcs7.ParsePKCS7(certsDER)
-	if err != nil {
-		var pkcs12data interface{}
-		certs = make([]*x509.Certificate, 1)
-		pkcs12data, certs[0], err = pkcs12.Decode(certsDER, password)
-		if err != nil {
-			certs, err = x509.ParseCertificates(certsDER)
-			if err != nil {
-				return nil, nil, cferr.New(cferr.CertificateError, cferr.DecodeFailed)
-			}
-		} else {
-			key = pkcs12data.(crypto.Signer)
-		}
-	} else {
-		if pkcs7data.ContentInfo != "SignedData" {
-			return nil, nil, cferr.Wrap(cferr.CertificateError, cferr.DecodeFailed, errors.New("can only extract certificates from signed data content info"))
-		}
-		certs = pkcs7data.Content.SignedData.Certificates
-	}
-	if certs == nil {
-		return nil, key, cferr.New(cferr.CertificateError, cferr.DecodeFailed)
-	}
-	return certs, key, nil
-}
-
-// ParseSelfSignedCertificatePEM parses a PEM-encoded certificate and check if it is self-signed.
-func ParseSelfSignedCertificatePEM(certPEM []byte) (*x509.Certificate, error) {
-	cert, err := ParseCertificatePEM(certPEM)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := cert.CheckSignature(cert.SignatureAlgorithm, cert.RawTBSCertificate, cert.Signature); err != nil {
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.VerifyFailed, err)
-	}
-	return cert, nil
-}
-
-// ParseCertificatePEM parses and returns a PEM-encoded certificate,
-// can handle PEM encoded PKCS #7 structures.
-func ParseCertificatePEM(certPEM []byte) (*x509.Certificate, error) {
-	certPEM = bytes.TrimSpace(certPEM)
-	cert, rest, err := ParseOneCertificateFromPEM(certPEM)
-	if err != nil {
-		// Log the actual parsing error but throw a default parse error message.
-		log.Debugf("Certificate parsing error: %v", err)
-		return nil, cferr.New(cferr.CertificateError, cferr.ParseFailed)
-	} else if cert == nil {
-		return nil, cferr.New(cferr.CertificateError, cferr.DecodeFailed)
-	} else if len(rest) > 0 {
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, errors.New("the PEM file should contain only one object"))
-	} else if len(cert) > 1 {
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, errors.New("the PKCS7 object in the PEM file should contain only one certificate"))
-	}
-	return cert[0], nil
-}
-
-// ParseOneCertificateFromPEM attempts to parse one PEM encoded certificate object,
-// either a raw x509 certificate or a PKCS #7 structure possibly containing
-// multiple certificates, from the top of certsPEM, which itself may
-// contain multiple PEM encoded certificate objects.
-func ParseOneCertificateFromPEM(certsPEM []byte) ([]*x509.Certificate, []byte, error) {
-
-	block, rest := pem.Decode(certsPEM)
-	if block == nil {
-		return nil, rest, nil
-	}
-
-	cert, err := x509.ParseCertificate(block.Bytes)
-	if err != nil {
-		pkcs7data, err := pkcs7.ParsePKCS7(block.Bytes)
-		if err != nil {
-			return nil, rest, err
-		}
-		if pkcs7data.ContentInfo != "SignedData" {
-			return nil, rest, errors.New("only PKCS #7 Signed Data Content Info supported for certificate parsing")
-		}
-		certs := pkcs7data.Content.SignedData.Certificates
-		if certs == nil {
-			return nil, rest, errors.New("PKCS #7 structure contains no certificates")
-		}
-		return certs, rest, nil
-	}
-	var certs = []*x509.Certificate{cert}
-	return certs, rest, nil
-}
-
-// LoadPEMCertPool loads a pool of PEM certificates from file.
-func LoadPEMCertPool(certsFile string) (*x509.CertPool, error) {
-	if certsFile == "" {
-		return nil, nil
-	}
-	pemCerts, err := ioutil.ReadFile(certsFile)
-	if err != nil {
-		return nil, err
-	}
-
-	return PEMToCertPool(pemCerts)
-}
-
-// PEMToCertPool concerts PEM certificates to a CertPool.
-func PEMToCertPool(pemCerts []byte) (*x509.CertPool, error) {
-	if len(pemCerts) == 0 {
-		return nil, nil
-	}
-
-	certPool := x509.NewCertPool()
-	if !certPool.AppendCertsFromPEM(pemCerts) {
-		return nil, errors.New("failed to load cert pool")
-	}
-
-	return certPool, nil
-}
-
-// ParsePrivateKeyPEM parses and returns a PEM-encoded private
-// key. The private key may be either an unencrypted PKCS#8, PKCS#1,
-// or elliptic private key.
-func ParsePrivateKeyPEM(keyPEM []byte) (key crypto.Signer, err error) {
-	return ParsePrivateKeyPEMWithPassword(keyPEM, nil)
-}
-
-// ParsePrivateKeyPEMWithPassword parses and returns a PEM-encoded private
-// key. The private key may be a potentially encrypted PKCS#8, PKCS#1,
-// or elliptic private key.
-func ParsePrivateKeyPEMWithPassword(keyPEM []byte, password []byte) (key crypto.Signer, err error) {
-	keyDER, err := GetKeyDERFromPEM(keyPEM, password)
-	if err != nil {
-		return nil, err
-	}
-
-	return derhelpers.ParsePrivateKeyDER(keyDER)
-}
-
-// GetKeyDERFromPEM parses a PEM-encoded private key and returns DER-format key bytes.
-func GetKeyDERFromPEM(in []byte, password []byte) ([]byte, error) {
-	keyDER, _ := pem.Decode(in)
-	if keyDER != nil {
-		if procType, ok := keyDER.Headers["Proc-Type"]; ok {
-			if strings.Contains(procType, "ENCRYPTED") {
-				if password != nil {
-					return x509.DecryptPEMBlock(keyDER, password)
-				}
-				return nil, cferr.New(cferr.PrivateKeyError, cferr.Encrypted)
-			}
-		}
-		return keyDER.Bytes, nil
-	}
-
-	return nil, cferr.New(cferr.PrivateKeyError, cferr.DecodeFailed)
-}
-
-// ParseCSR parses a PEM- or DER-encoded PKCS #10 certificate signing request.
-func ParseCSR(in []byte) (csr *x509.CertificateRequest, rest []byte, err error) {
-	in = bytes.TrimSpace(in)
-	p, rest := pem.Decode(in)
-	if p != nil {
-		if p.Type != "NEW CERTIFICATE REQUEST" && p.Type != "CERTIFICATE REQUEST" {
-			return nil, rest, cferr.New(cferr.CSRError, cferr.BadRequest)
-		}
-
-		csr, err = x509.ParseCertificateRequest(p.Bytes)
-	} else {
-		csr, err = x509.ParseCertificateRequest(in)
-	}
-
-	if err != nil {
-		return nil, rest, err
-	}
-
-	err = csr.CheckSignature()
-	if err != nil {
-		return nil, rest, err
-	}
-
-	return csr, rest, nil
-}
-
-// ParseCSRPEM parses a PEM-encoded certificate signing request.
-// It does not check the signature. This is useful for dumping data from a CSR
-// locally.
-func ParseCSRPEM(csrPEM []byte) (*x509.CertificateRequest, error) {
-	block, _ := pem.Decode([]byte(csrPEM))
-	if block == nil {
-		return nil, cferr.New(cferr.CSRError, cferr.DecodeFailed)
-	}
-	csrObject, err := x509.ParseCertificateRequest(block.Bytes)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return csrObject, nil
-}
-
-// SignerAlgo returns an X.509 signature algorithm from a crypto.Signer.
-func SignerAlgo(priv crypto.Signer) x509.SignatureAlgorithm {
-	switch pub := priv.Public().(type) {
-	case *rsa.PublicKey:
-		bitLength := pub.N.BitLen()
-		switch {
-		case bitLength >= 4096:
-			return x509.SHA512WithRSA
-		case bitLength >= 3072:
-			return x509.SHA384WithRSA
-		case bitLength >= 2048:
-			return x509.SHA256WithRSA
-		default:
-			return x509.SHA1WithRSA
-		}
-	case *ecdsa.PublicKey:
-		switch pub.Curve {
-		case elliptic.P521():
-			return x509.ECDSAWithSHA512
-		case elliptic.P384():
-			return x509.ECDSAWithSHA384
-		case elliptic.P256():
-			return x509.ECDSAWithSHA256
-		default:
-			return x509.ECDSAWithSHA1
-		}
-	default:
-		return x509.UnknownSignatureAlgorithm
-	}
-}
-
-// LoadClientCertificate load key/certificate from pem files
-func LoadClientCertificate(certFile string, keyFile string) (*tls.Certificate, error) {
-	if certFile != "" && keyFile != "" {
-		cert, err := tls.LoadX509KeyPair(certFile, keyFile)
-		if err != nil {
-			log.Critical("Unable to read client certificate from file: %s or key from file: %s", certFile, keyFile)
-			return nil, err
-		}
-		log.Debug("Client certificate loaded ")
-		return &cert, nil
-	}
-	return nil, nil
-}
-
-// CreateTLSConfig creates a tls.Config object from certs and roots
-func CreateTLSConfig(remoteCAs *x509.CertPool, cert *tls.Certificate) *tls.Config {
-	var certs []tls.Certificate
-	if cert != nil {
-		certs = []tls.Certificate{*cert}
-	}
-	return &tls.Config{
-		Certificates: certs,
-		RootCAs:      remoteCAs,
-	}
-}
-
-// SerializeSCTList serializes a list of SCTs.
-func SerializeSCTList(sctList []ct.SignedCertificateTimestamp) ([]byte, error) {
-	list := ctx509.SignedCertificateTimestampList{}
-	for _, sct := range sctList {
-		sctBytes, err := cttls.Marshal(sct)
-		if err != nil {
-			return nil, err
-		}
-		list.SCTList = append(list.SCTList, ctx509.SerializedSCT{Val: sctBytes})
-	}
-	return cttls.Marshal(list)
-}
-
-// DeserializeSCTList deserializes a list of SCTs.
-func DeserializeSCTList(serializedSCTList []byte) ([]ct.SignedCertificateTimestamp, error) {
-	var sctList ctx509.SignedCertificateTimestampList
-	rest, err := cttls.Unmarshal(serializedSCTList, &sctList)
-	if err != nil {
-		return nil, err
-	}
-	if len(rest) != 0 {
-		return nil, cferr.Wrap(cferr.CTError, cferr.Unknown, errors.New("serialized SCT list contained trailing garbage"))
-	}
-	list := make([]ct.SignedCertificateTimestamp, len(sctList.SCTList))
-	for i, serializedSCT := range sctList.SCTList {
-		var sct ct.SignedCertificateTimestamp
-		rest, err := cttls.Unmarshal(serializedSCT.Val, &sct)
-		if err != nil {
-			return nil, err
-		}
-		if len(rest) != 0 {
-			return nil, cferr.Wrap(cferr.CTError, cferr.Unknown, errors.New("serialized SCT contained trailing garbage"))
-		}
-		list[i] = sct
-	}
-	return list, nil
-}
-
-// SCTListFromOCSPResponse extracts the SCTList from an ocsp.Response,
-// returning an empty list if the SCT extension was not found or could not be
-// unmarshalled.
-func SCTListFromOCSPResponse(response *ocsp.Response) ([]ct.SignedCertificateTimestamp, error) {
-	// This loop finds the SCTListExtension in the OCSP response.
-	var SCTListExtension, ext pkix.Extension
-	for _, ext = range response.Extensions {
-		// sctExtOid is the ObjectIdentifier of a Signed Certificate Timestamp.
-		sctExtOid := asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 5}
-		if ext.Id.Equal(sctExtOid) {
-			SCTListExtension = ext
-			break
-		}
-	}
-
-	// This code block extracts the sctList from the SCT extension.
-	var sctList []ct.SignedCertificateTimestamp
-	var err error
-	if numBytes := len(SCTListExtension.Value); numBytes != 0 {
-		var serializedSCTList []byte
-		rest := make([]byte, numBytes)
-		copy(rest, SCTListExtension.Value)
-		for len(rest) != 0 {
-			rest, err = asn1.Unmarshal(rest, &serializedSCTList)
-			if err != nil {
-				return nil, cferr.Wrap(cferr.CTError, cferr.Unknown, err)
-			}
-		}
-		sctList, err = DeserializeSCTList(serializedSCTList)
-	}
-	return sctList, err
-}
-
-// ReadBytes reads a []byte either from a file or an environment variable.
-// If valFile has a prefix of 'env:', the []byte is read from the environment
-// using the subsequent name. If the prefix is 'file:' the []byte is read from
-// the subsequent file. If no prefix is provided, valFile is assumed to be a
-// file path.
-func ReadBytes(valFile string) ([]byte, error) {
-	switch splitVal := strings.SplitN(valFile, ":", 2); len(splitVal) {
-	case 1:
-		return ioutil.ReadFile(valFile)
-	case 2:
-		switch splitVal[0] {
-		case "env":
-			return []byte(os.Getenv(splitVal[1])), nil
-		case "file":
-			return ioutil.ReadFile(splitVal[1])
-		default:
-			return nil, fmt.Errorf("unknown prefix: %s", splitVal[0])
-		}
-	default:
-		return nil, fmt.Errorf("multiple prefixes: %s",
-			strings.Join(splitVal[:len(splitVal)-1], ", "))
-	}
-}

vendor/github.com/cloudflare/cfssl/info/info.go

@@ -1,15 +0,0 @@
-// Package info contains the definitions for the info endpoint
-package info
-
-// Req is the request struct for an info API request.
-type Req struct {
-	Label   string `json:"label"`
-	Profile string `json:"profile"`
-}
-
-// Resp is the response for an Info API request.
-type Resp struct {
-	Certificate  string   `json:"certificate"`
-	Usage        []string `json:"usages"`
-	ExpiryString string   `json:"expiry"`
-}

vendor/github.com/cloudflare/cfssl/initca/initca.go

@@ -1,249 +0,0 @@
-// Package initca contains code to initialise a certificate authority,
-// generating a new root key and certificate.
-package initca
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/pem"
-	"errors"
-	"time"
-
-	"github.com/cloudflare/cfssl/config"
-	"github.com/cloudflare/cfssl/csr"
-	cferr "github.com/cloudflare/cfssl/errors"
-	"github.com/cloudflare/cfssl/helpers"
-	"github.com/cloudflare/cfssl/log"
-	"github.com/cloudflare/cfssl/signer"
-	"github.com/cloudflare/cfssl/signer/local"
-)
-
-// validator contains the default validation logic for certificate
-// authority certificates. The only requirement here is that the
-// certificate have a non-empty subject field.
-func validator(req *csr.CertificateRequest) error {
-	if req.CN != "" {
-		return nil
-	}
-
-	if len(req.Names) == 0 {
-		return cferr.Wrap(cferr.PolicyError, cferr.InvalidRequest, errors.New("missing subject information"))
-	}
-
-	for i := range req.Names {
-		if csr.IsNameEmpty(req.Names[i]) {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidRequest, errors.New("missing subject information"))
-		}
-	}
-
-	return nil
-}
-
-// New creates a new root certificate from the certificate request.
-func New(req *csr.CertificateRequest) (cert, csrPEM, key []byte, err error) {
-	policy := CAPolicy()
-	if req.CA != nil {
-		if req.CA.Expiry != "" {
-			policy.Default.ExpiryString = req.CA.Expiry
-			policy.Default.Expiry, err = time.ParseDuration(req.CA.Expiry)
-			if err != nil {
-				return
-			}
-		}
-
-		if req.CA.Backdate != "" {
-			policy.Default.Backdate, err = time.ParseDuration(req.CA.Backdate)
-			if err != nil {
-				return
-			}
-		}
-
-		policy.Default.CAConstraint.MaxPathLen = req.CA.PathLength
-		if req.CA.PathLength != 0 && req.CA.PathLenZero {
-			log.Infof("ignore invalid 'pathlenzero' value")
-		} else {
-			policy.Default.CAConstraint.MaxPathLenZero = req.CA.PathLenZero
-		}
-	}
-
-	g := &csr.Generator{Validator: validator}
-	csrPEM, key, err = g.ProcessRequest(req)
-	if err != nil {
-		log.Errorf("failed to process request: %v", err)
-		key = nil
-		return
-	}
-
-	priv, err := helpers.ParsePrivateKeyPEM(key)
-	if err != nil {
-		log.Errorf("failed to parse private key: %v", err)
-		return
-	}
-
-	s, err := local.NewSigner(priv, nil, signer.DefaultSigAlgo(priv), policy)
-	if err != nil {
-		log.Errorf("failed to create signer: %v", err)
-		return
-	}
-
-	signReq := signer.SignRequest{Hosts: req.Hosts, Request: string(csrPEM)}
-	cert, err = s.Sign(signReq)
-
-	return
-
-}
-
-// NewFromPEM creates a new root certificate from the key file passed in.
-func NewFromPEM(req *csr.CertificateRequest, keyFile string) (cert, csrPEM []byte, err error) {
-	privData, err := helpers.ReadBytes(keyFile)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	priv, err := helpers.ParsePrivateKeyPEM(privData)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return NewFromSigner(req, priv)
-}
-
-// RenewFromPEM re-creates a root certificate from the CA cert and key
-// files. The resulting root certificate will have the input CA certificate
-// as the template and have the same expiry length. E.g. the existing CA
-// is valid for a year from Jan 01 2015 to Jan 01 2016, the renewed certificate
-// will be valid from now and expire in one year as well.
-func RenewFromPEM(caFile, keyFile string) ([]byte, error) {
-	caBytes, err := helpers.ReadBytes(caFile)
-	if err != nil {
-		return nil, err
-	}
-
-	ca, err := helpers.ParseCertificatePEM(caBytes)
-	if err != nil {
-		return nil, err
-	}
-
-	keyBytes, err := helpers.ReadBytes(keyFile)
-	if err != nil {
-		return nil, err
-	}
-
-	key, err := helpers.ParsePrivateKeyPEM(keyBytes)
-	if err != nil {
-		return nil, err
-	}
-
-	return RenewFromSigner(ca, key)
-}
-
-// NewFromSigner creates a new root certificate from a crypto.Signer.
-func NewFromSigner(req *csr.CertificateRequest, priv crypto.Signer) (cert, csrPEM []byte, err error) {
-	policy := CAPolicy()
-	if req.CA != nil {
-		if req.CA.Expiry != "" {
-			policy.Default.ExpiryString = req.CA.Expiry
-			policy.Default.Expiry, err = time.ParseDuration(req.CA.Expiry)
-			if err != nil {
-				return nil, nil, err
-			}
-		}
-
-		policy.Default.CAConstraint.MaxPathLen = req.CA.PathLength
-		if req.CA.PathLength != 0 && req.CA.PathLenZero == true {
-			log.Infof("ignore invalid 'pathlenzero' value")
-		} else {
-			policy.Default.CAConstraint.MaxPathLenZero = req.CA.PathLenZero
-		}
-	}
-
-	csrPEM, err = csr.Generate(priv, req)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	s, err := local.NewSigner(priv, nil, signer.DefaultSigAlgo(priv), policy)
-	if err != nil {
-		log.Errorf("failed to create signer: %v", err)
-		return
-	}
-
-	signReq := signer.SignRequest{Request: string(csrPEM)}
-	cert, err = s.Sign(signReq)
-	return
-}
-
-// RenewFromSigner re-creates a root certificate from the CA cert and crypto.Signer.
-// The resulting root certificate will have ca certificate
-// as the template and have the same expiry length. E.g. the existing CA
-// is valid for a year from Jan 01 2015 to Jan 01 2016, the renewed certificate
-// will be valid from now and expire in one year as well.
-func RenewFromSigner(ca *x509.Certificate, priv crypto.Signer) ([]byte, error) {
-	if !ca.IsCA {
-		return nil, errors.New("input certificate is not a CA cert")
-	}
-
-	// matching certificate public key vs private key
-	switch {
-	case ca.PublicKeyAlgorithm == x509.RSA:
-		var rsaPublicKey *rsa.PublicKey
-		var ok bool
-		if rsaPublicKey, ok = priv.Public().(*rsa.PublicKey); !ok {
-			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
-		}
-		if ca.PublicKey.(*rsa.PublicKey).N.Cmp(rsaPublicKey.N) != 0 {
-			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
-		}
-	case ca.PublicKeyAlgorithm == x509.ECDSA:
-		var ecdsaPublicKey *ecdsa.PublicKey
-		var ok bool
-		if ecdsaPublicKey, ok = priv.Public().(*ecdsa.PublicKey); !ok {
-			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
-		}
-		if ca.PublicKey.(*ecdsa.PublicKey).X.Cmp(ecdsaPublicKey.X) != 0 {
-			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
-		}
-	default:
-		return nil, cferr.New(cferr.PrivateKeyError, cferr.NotRSAOrECC)
-	}
-
-	req := csr.ExtractCertificateRequest(ca)
-	cert, _, err := NewFromSigner(req, priv)
-	return cert, err
-
-}
-
-// CAPolicy contains the CA issuing policy as default policy.
-var CAPolicy = func() *config.Signing {
-	return &config.Signing{
-		Default: &config.SigningProfile{
-			Usage:        []string{"cert sign", "crl sign"},
-			ExpiryString: "43800h",
-			Expiry:       5 * helpers.OneYear,
-			CAConstraint: config.CAConstraint{IsCA: true},
-		},
-	}
-}
-
-// Update copies the CA certificate, updates the NotBefore and
-// NotAfter fields, and then re-signs the certificate.
-func Update(ca *x509.Certificate, priv crypto.Signer) (cert []byte, err error) {
-	copy, err := x509.ParseCertificate(ca.Raw)
-	if err != nil {
-		return
-	}
-
-	validity := ca.NotAfter.Sub(ca.NotBefore)
-	copy.NotBefore = time.Now().Round(time.Minute).Add(-5 * time.Minute)
-	copy.NotAfter = copy.NotBefore.Add(validity)
-	cert, err = x509.CreateCertificate(rand.Reader, copy, copy, priv.Public(), priv)
-	if err != nil {
-		return
-	}
-
-	cert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert})
-	return
-}

vendor/github.com/cloudflare/cfssl/log/log.go

@@ -1,162 +0,0 @@
-// Package log implements a wrapper around the Go standard library's
-// logging package. Clients should set the current log level; only
-// messages below that level will actually be logged. For example, if
-// Level is set to LevelWarning, only log messages at the Warning,
-// Error, and Critical levels will be logged.
-package log
-
-import (
-	"fmt"
-	"log"
-	"os"
-)
-
-// The following constants represent logging levels in increasing levels of seriousness.
-const (
-	// LevelDebug is the log level for Debug statements.
-	LevelDebug = iota
-	// LevelInfo is the log level for Info statements.
-	LevelInfo
-	// LevelWarning is the log level for Warning statements.
-	LevelWarning
-	// LevelError is the log level for Error statements.
-	LevelError
-	// LevelCritical is the log level for Critical statements.
-	LevelCritical
-	// LevelFatal is the log level for Fatal statements.
-	LevelFatal
-)
-
-var levelPrefix = [...]string{
-	LevelDebug:    "DEBUG",
-	LevelInfo:     "INFO",
-	LevelWarning:  "WARNING",
-	LevelError:    "ERROR",
-	LevelCritical: "CRITICAL",
-	LevelFatal:    "FATAL",
-}
-
-// Level stores the current logging level.
-var Level = LevelInfo
-
-// SyslogWriter specifies the necessary methods for an alternate output
-// destination passed in via SetLogger.
-//
-// SyslogWriter is satisfied by *syslog.Writer.
-type SyslogWriter interface {
-	Debug(string)
-	Info(string)
-	Warning(string)
-	Err(string)
-	Crit(string)
-	Emerg(string)
-}
-
-// syslogWriter stores the SetLogger() parameter.
-var syslogWriter SyslogWriter
-
-// SetLogger sets the output used for output by this package.
-// A *syslog.Writer is a good choice for the logger parameter.
-// Call with a nil parameter to revert to default behavior.
-func SetLogger(logger SyslogWriter) {
-	syslogWriter = logger
-}
-
-func print(l int, msg string) {
-	if l >= Level {
-		if syslogWriter != nil {
-			switch l {
-			case LevelDebug:
-				syslogWriter.Debug(msg)
-			case LevelInfo:
-				syslogWriter.Info(msg)
-			case LevelWarning:
-				syslogWriter.Warning(msg)
-			case LevelError:
-				syslogWriter.Err(msg)
-			case LevelCritical:
-				syslogWriter.Crit(msg)
-			case LevelFatal:
-				syslogWriter.Emerg(msg)
-			}
-		} else {
-			log.Printf("[%s] %s", levelPrefix[l], msg)
-		}
-	}
-}
-
-func outputf(l int, format string, v []interface{}) {
-	print(l, fmt.Sprintf(format, v...))
-}
-
-func output(l int, v []interface{}) {
-	print(l, fmt.Sprint(v...))
-}
-
-// Fatalf logs a formatted message at the "fatal" level and then exits. The
-// arguments are handled in the same manner as fmt.Printf.
-func Fatalf(format string, v ...interface{}) {
-	outputf(LevelFatal, format, v)
-	os.Exit(1)
-}
-
-// Fatal logs its arguments at the "fatal" level and then exits.
-func Fatal(v ...interface{}) {
-	output(LevelFatal, v)
-	os.Exit(1)
-}
-
-// Criticalf logs a formatted message at the "critical" level. The
-// arguments are handled in the same manner as fmt.Printf.
-func Criticalf(format string, v ...interface{}) {
-	outputf(LevelCritical, format, v)
-}
-
-// Critical logs its arguments at the "critical" level.
-func Critical(v ...interface{}) {
-	output(LevelCritical, v)
-}
-
-// Errorf logs a formatted message at the "error" level. The arguments
-// are handled in the same manner as fmt.Printf.
-func Errorf(format string, v ...interface{}) {
-	outputf(LevelError, format, v)
-}
-
-// Error logs its arguments at the "error" level.
-func Error(v ...interface{}) {
-	output(LevelError, v)
-}
-
-// Warningf logs a formatted message at the "warning" level. The
-// arguments are handled in the same manner as fmt.Printf.
-func Warningf(format string, v ...interface{}) {
-	outputf(LevelWarning, format, v)
-}
-
-// Warning logs its arguments at the "warning" level.
-func Warning(v ...interface{}) {
-	output(LevelWarning, v)
-}
-
-// Infof logs a formatted message at the "info" level. The arguments
-// are handled in the same manner as fmt.Printf.
-func Infof(format string, v ...interface{}) {
-	outputf(LevelInfo, format, v)
-}
-
-// Info logs its arguments at the "info" level.
-func Info(v ...interface{}) {
-	output(LevelInfo, v)
-}
-
-// Debugf logs a formatted message at the "debug" level. The arguments
-// are handled in the same manner as fmt.Printf.
-func Debugf(format string, v ...interface{}) {
-	outputf(LevelDebug, format, v)
-}
-
-// Debug logs its arguments at the "debug" level.
-func Debug(v ...interface{}) {
-	output(LevelDebug, v)
-}

vendor/github.com/cloudflare/cfssl/ocsp/config/config.go

@@ -1,13 +0,0 @@
-// Package config in the ocsp directory provides configuration data for an OCSP
-// signer.
-package config
-
-import "time"
-
-// Config contains configuration information required to set up an OCSP signer.
-type Config struct {
-	CACertFile        string
-	ResponderCertFile string
-	KeyFile           string
-	Interval          time.Duration
-}

vendor/github.com/cloudflare/cfssl/signer/local/local.go

@@ -1,569 +0,0 @@
-// Package local implements certificate signature functionality for CFSSL.
-package local
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/rand"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"encoding/hex"
-	"encoding/pem"
-	"errors"
-	"io"
-	"math/big"
-	"net"
-	"net/http"
-	"net/mail"
-	"net/url"
-	"os"
-
-	"github.com/cloudflare/cfssl/certdb"
-	"github.com/cloudflare/cfssl/config"
-	cferr "github.com/cloudflare/cfssl/errors"
-	"github.com/cloudflare/cfssl/helpers"
-	"github.com/cloudflare/cfssl/info"
-	"github.com/cloudflare/cfssl/log"
-	"github.com/cloudflare/cfssl/signer"
-	"github.com/google/certificate-transparency-go"
-	"github.com/google/certificate-transparency-go/client"
-	"github.com/google/certificate-transparency-go/jsonclient"
-	"golang.org/x/net/context"
-)
-
-// Signer contains a signer that uses the standard library to
-// support both ECDSA and RSA CA keys.
-type Signer struct {
-	ca         *x509.Certificate
-	priv       crypto.Signer
-	policy     *config.Signing
-	sigAlgo    x509.SignatureAlgorithm
-	dbAccessor certdb.Accessor
-}
-
-// NewSigner creates a new Signer directly from a
-// private key and certificate, with optional policy.
-func NewSigner(priv crypto.Signer, cert *x509.Certificate, sigAlgo x509.SignatureAlgorithm, policy *config.Signing) (*Signer, error) {
-	if policy == nil {
-		policy = &config.Signing{
-			Profiles: map[string]*config.SigningProfile{},
-			Default:  config.DefaultConfig()}
-	}
-
-	if !policy.Valid() {
-		return nil, cferr.New(cferr.PolicyError, cferr.InvalidPolicy)
-	}
-
-	return &Signer{
-		ca:      cert,
-		priv:    priv,
-		sigAlgo: sigAlgo,
-		policy:  policy,
-	}, nil
-}
-
-// NewSignerFromFile generates a new local signer from a caFile
-// and a caKey file, both PEM encoded.
-func NewSignerFromFile(caFile, caKeyFile string, policy *config.Signing) (*Signer, error) {
-	log.Debug("Loading CA: ", caFile)
-	ca, err := helpers.ReadBytes(caFile)
-	if err != nil {
-		return nil, err
-	}
-	log.Debug("Loading CA key: ", caKeyFile)
-	cakey, err := helpers.ReadBytes(caKeyFile)
-	if err != nil {
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.ReadFailed, err)
-	}
-
-	parsedCa, err := helpers.ParseCertificatePEM(ca)
-	if err != nil {
-		return nil, err
-	}
-
-	strPassword := os.Getenv("CFSSL_CA_PK_PASSWORD")
-	password := []byte(strPassword)
-	if strPassword == "" {
-		password = nil
-	}
-
-	priv, err := helpers.ParsePrivateKeyPEMWithPassword(cakey, password)
-	if err != nil {
-		log.Debug("Malformed private key %v", err)
-		return nil, err
-	}
-
-	return NewSigner(priv, parsedCa, signer.DefaultSigAlgo(priv), policy)
-}
-
-func (s *Signer) sign(template *x509.Certificate) (cert []byte, err error) {
-	var initRoot bool
-	if s.ca == nil {
-		if !template.IsCA {
-			err = cferr.New(cferr.PolicyError, cferr.InvalidRequest)
-			return
-		}
-		template.DNSNames = nil
-		template.EmailAddresses = nil
-		template.URIs = nil
-		s.ca = template
-		initRoot = true
-	}
-
-	derBytes, err := x509.CreateCertificate(rand.Reader, template, s.ca, template.PublicKey, s.priv)
-	if err != nil {
-		return nil, cferr.Wrap(cferr.CertificateError, cferr.Unknown, err)
-	}
-	if initRoot {
-		s.ca, err = x509.ParseCertificate(derBytes)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CertificateError, cferr.ParseFailed, err)
-		}
-	}
-
-	cert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
-	log.Infof("signed certificate with serial number %d", template.SerialNumber)
-	return
-}
-
-// replaceSliceIfEmpty replaces the contents of replaced with newContents if
-// the slice referenced by replaced is empty
-func replaceSliceIfEmpty(replaced, newContents *[]string) {
-	if len(*replaced) == 0 {
-		*replaced = *newContents
-	}
-}
-
-// PopulateSubjectFromCSR has functionality similar to Name, except
-// it fills the fields of the resulting pkix.Name with req's if the
-// subject's corresponding fields are empty
-func PopulateSubjectFromCSR(s *signer.Subject, req pkix.Name) pkix.Name {
-	// if no subject, use req
-	if s == nil {
-		return req
-	}
-
-	name := s.Name()
-
-	if name.CommonName == "" {
-		name.CommonName = req.CommonName
-	}
-
-	replaceSliceIfEmpty(&name.Country, &req.Country)
-	replaceSliceIfEmpty(&name.Province, &req.Province)
-	replaceSliceIfEmpty(&name.Locality, &req.Locality)
-	replaceSliceIfEmpty(&name.Organization, &req.Organization)
-	replaceSliceIfEmpty(&name.OrganizationalUnit, &req.OrganizationalUnit)
-	if name.SerialNumber == "" {
-		name.SerialNumber = req.SerialNumber
-	}
-	return name
-}
-
-// OverrideHosts fills template's IPAddresses, EmailAddresses, DNSNames, and URIs with the
-// content of hosts, if it is not nil.
-func OverrideHosts(template *x509.Certificate, hosts []string) {
-	if hosts != nil {
-		template.IPAddresses = []net.IP{}
-		template.EmailAddresses = []string{}
-		template.DNSNames = []string{}
-		template.URIs = []*url.URL{}
-	}
-
-	for i := range hosts {
-		if ip := net.ParseIP(hosts[i]); ip != nil {
-			template.IPAddresses = append(template.IPAddresses, ip)
-		} else if email, err := mail.ParseAddress(hosts[i]); err == nil && email != nil {
-			template.EmailAddresses = append(template.EmailAddresses, email.Address)
-		} else if uri, err := url.ParseRequestURI(hosts[i]); err == nil && uri != nil {
-			template.URIs = append(template.URIs, uri)
-		} else {
-			template.DNSNames = append(template.DNSNames, hosts[i])
-		}
-	}
-
-}
-
-// Sign signs a new certificate based on the PEM-encoded client
-// certificate or certificate request with the signing profile,
-// specified by profileName.
-func (s *Signer) Sign(req signer.SignRequest) (cert []byte, err error) {
-	profile, err := signer.Profile(s, req.Profile)
-	if err != nil {
-		return
-	}
-
-	block, _ := pem.Decode([]byte(req.Request))
-	if block == nil {
-		return nil, cferr.New(cferr.CSRError, cferr.DecodeFailed)
-	}
-
-	if block.Type != "NEW CERTIFICATE REQUEST" && block.Type != "CERTIFICATE REQUEST" {
-		return nil, cferr.Wrap(cferr.CSRError,
-			cferr.BadRequest, errors.New("not a csr"))
-	}
-
-	csrTemplate, err := signer.ParseCertificateRequest(s, block.Bytes)
-	if err != nil {
-		return nil, err
-	}
-
-	// Copy out only the fields from the CSR authorized by policy.
-	safeTemplate := x509.Certificate{}
-	// If the profile contains no explicit whitelist, assume that all fields
-	// should be copied from the CSR.
-	if profile.CSRWhitelist == nil {
-		safeTemplate = *csrTemplate
-	} else {
-		if profile.CSRWhitelist.Subject {
-			safeTemplate.Subject = csrTemplate.Subject
-		}
-		if profile.CSRWhitelist.PublicKeyAlgorithm {
-			safeTemplate.PublicKeyAlgorithm = csrTemplate.PublicKeyAlgorithm
-		}
-		if profile.CSRWhitelist.PublicKey {
-			safeTemplate.PublicKey = csrTemplate.PublicKey
-		}
-		if profile.CSRWhitelist.SignatureAlgorithm {
-			safeTemplate.SignatureAlgorithm = csrTemplate.SignatureAlgorithm
-		}
-		if profile.CSRWhitelist.DNSNames {
-			safeTemplate.DNSNames = csrTemplate.DNSNames
-		}
-		if profile.CSRWhitelist.IPAddresses {
-			safeTemplate.IPAddresses = csrTemplate.IPAddresses
-		}
-		if profile.CSRWhitelist.EmailAddresses {
-			safeTemplate.EmailAddresses = csrTemplate.EmailAddresses
-		}
-		if profile.CSRWhitelist.URIs {
-			safeTemplate.URIs = csrTemplate.URIs
-		}
-	}
-
-	if req.CRLOverride != "" {
-		safeTemplate.CRLDistributionPoints = []string{req.CRLOverride}
-	}
-
-	if safeTemplate.IsCA {
-		if !profile.CAConstraint.IsCA {
-			log.Error("local signer policy disallows issuing CA certificate")
-			return nil, cferr.New(cferr.PolicyError, cferr.InvalidRequest)
-		}
-
-		if s.ca != nil && s.ca.MaxPathLen > 0 {
-			if safeTemplate.MaxPathLen >= s.ca.MaxPathLen {
-				log.Error("local signer certificate disallows CA MaxPathLen extending")
-				// do not sign a cert with pathlen > current
-				return nil, cferr.New(cferr.PolicyError, cferr.InvalidRequest)
-			}
-		} else if s.ca != nil && s.ca.MaxPathLen == 0 && s.ca.MaxPathLenZero {
-			log.Error("local signer certificate disallows issuing CA certificate")
-			// signer has pathlen of 0, do not sign more intermediate CAs
-			return nil, cferr.New(cferr.PolicyError, cferr.InvalidRequest)
-		}
-	}
-
-	OverrideHosts(&safeTemplate, req.Hosts)
-	safeTemplate.Subject = PopulateSubjectFromCSR(req.Subject, safeTemplate.Subject)
-
-	// If there is a whitelist, ensure that both the Common Name and SAN DNSNames match
-	if profile.NameWhitelist != nil {
-		if safeTemplate.Subject.CommonName != "" {
-			if profile.NameWhitelist.Find([]byte(safeTemplate.Subject.CommonName)) == nil {
-				return nil, cferr.New(cferr.PolicyError, cferr.UnmatchedWhitelist)
-			}
-		}
-		for _, name := range safeTemplate.DNSNames {
-			if profile.NameWhitelist.Find([]byte(name)) == nil {
-				return nil, cferr.New(cferr.PolicyError, cferr.UnmatchedWhitelist)
-			}
-		}
-		for _, name := range safeTemplate.EmailAddresses {
-			if profile.NameWhitelist.Find([]byte(name)) == nil {
-				return nil, cferr.New(cferr.PolicyError, cferr.UnmatchedWhitelist)
-			}
-		}
-		for _, name := range safeTemplate.URIs {
-			if profile.NameWhitelist.Find([]byte(name.String())) == nil {
-				return nil, cferr.New(cferr.PolicyError, cferr.UnmatchedWhitelist)
-			}
-		}
-	}
-
-	if profile.ClientProvidesSerialNumbers {
-		if req.Serial == nil {
-			return nil, cferr.New(cferr.CertificateError, cferr.MissingSerial)
-		}
-		safeTemplate.SerialNumber = req.Serial
-	} else {
-		// RFC 5280 4.1.2.2:
-		// Certificate users MUST be able to handle serialNumber
-		// values up to 20 octets.  Conforming CAs MUST NOT use
-		// serialNumber values longer than 20 octets.
-		//
-		// If CFSSL is providing the serial numbers, it makes
-		// sense to use the max supported size.
-		serialNumber := make([]byte, 20)
-		_, err = io.ReadFull(rand.Reader, serialNumber)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CertificateError, cferr.Unknown, err)
-		}
-
-		// SetBytes interprets buf as the bytes of a big-endian
-		// unsigned integer. The leading byte should be masked
-		// off to ensure it isn't negative.
-		serialNumber[0] &= 0x7F
-
-		safeTemplate.SerialNumber = new(big.Int).SetBytes(serialNumber)
-	}
-
-	if len(req.Extensions) > 0 {
-		for _, ext := range req.Extensions {
-			oid := asn1.ObjectIdentifier(ext.ID)
-			if !profile.ExtensionWhitelist[oid.String()] {
-				return nil, cferr.New(cferr.CertificateError, cferr.InvalidRequest)
-			}
-
-			rawValue, err := hex.DecodeString(ext.Value)
-			if err != nil {
-				return nil, cferr.Wrap(cferr.CertificateError, cferr.InvalidRequest, err)
-			}
-
-			safeTemplate.ExtraExtensions = append(safeTemplate.ExtraExtensions, pkix.Extension{
-				Id:       oid,
-				Critical: ext.Critical,
-				Value:    rawValue,
-			})
-		}
-	}
-
-	var distPoints = safeTemplate.CRLDistributionPoints
-	err = signer.FillTemplate(&safeTemplate, s.policy.Default, profile, req.NotBefore, req.NotAfter)
-	if err != nil {
-		return nil, err
-	}
-	if distPoints != nil && len(distPoints) > 0 {
-		safeTemplate.CRLDistributionPoints = distPoints
-	}
-
-	var certTBS = safeTemplate
-
-	if len(profile.CTLogServers) > 0 || req.ReturnPrecert {
-		// Add a poison extension which prevents validation
-		var poisonExtension = pkix.Extension{Id: signer.CTPoisonOID, Critical: true, Value: []byte{0x05, 0x00}}
-		var poisonedPreCert = certTBS
-		poisonedPreCert.ExtraExtensions = append(safeTemplate.ExtraExtensions, poisonExtension)
-		cert, err = s.sign(&poisonedPreCert)
-		if err != nil {
-			return
-		}
-
-		if req.ReturnPrecert {
-			return cert, nil
-		}
-
-		derCert, _ := pem.Decode(cert)
-		prechain := []ct.ASN1Cert{{Data: derCert.Bytes}, {Data: s.ca.Raw}}
-		var sctList []ct.SignedCertificateTimestamp
-
-		for _, server := range profile.CTLogServers {
-			log.Infof("submitting poisoned precertificate to %s", server)
-			ctclient, err := client.New(server, nil, jsonclient.Options{})
-			if err != nil {
-				return nil, cferr.Wrap(cferr.CTError, cferr.PrecertSubmissionFailed, err)
-			}
-			var resp *ct.SignedCertificateTimestamp
-			ctx := context.Background()
-			resp, err = ctclient.AddPreChain(ctx, prechain)
-			if err != nil {
-				return nil, cferr.Wrap(cferr.CTError, cferr.PrecertSubmissionFailed, err)
-			}
-			sctList = append(sctList, *resp)
-		}
-
-		var serializedSCTList []byte
-		serializedSCTList, err = helpers.SerializeSCTList(sctList)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CTError, cferr.Unknown, err)
-		}
-
-		// Serialize again as an octet string before embedding
-		serializedSCTList, err = asn1.Marshal(serializedSCTList)
-		if err != nil {
-			return nil, cferr.Wrap(cferr.CTError, cferr.Unknown, err)
-		}
-
-		var SCTListExtension = pkix.Extension{Id: signer.SCTListOID, Critical: false, Value: serializedSCTList}
-		certTBS.ExtraExtensions = append(certTBS.ExtraExtensions, SCTListExtension)
-	}
-	var signedCert []byte
-	signedCert, err = s.sign(&certTBS)
-	if err != nil {
-		return nil, err
-	}
-
-	// Get the AKI from signedCert.  This is required to support Go 1.9+.
-	// In prior versions of Go, x509.CreateCertificate updated the
-	// AuthorityKeyId of certTBS.
-	parsedCert, _ := helpers.ParseCertificatePEM(signedCert)
-
-	if s.dbAccessor != nil {
-		var certRecord = certdb.CertificateRecord{
-			Serial: certTBS.SerialNumber.String(),
-			// this relies on the specific behavior of x509.CreateCertificate
-			// which sets the AuthorityKeyId from the signer's SubjectKeyId
-			AKI:     hex.EncodeToString(parsedCert.AuthorityKeyId),
-			CALabel: req.Label,
-			Status:  "good",
-			Expiry:  certTBS.NotAfter,
-			PEM:     string(signedCert),
-		}
-
-		err = s.dbAccessor.InsertCertificate(certRecord)
-		if err != nil {
-			return nil, err
-		}
-		log.Debug("saved certificate with serial number ", certTBS.SerialNumber)
-	}
-
-	return signedCert, nil
-}
-
-// SignFromPrecert creates and signs a certificate from an existing precertificate
-// that was previously signed by Signer.ca and inserts the provided SCTs into the
-// new certificate. The resulting certificate will be a exact copy of the precert
-// except for the removal of the poison extension and the addition of the SCT list
-// extension. SignFromPrecert does not verify that the contents of the certificate
-// still match the signing profile of the signer, it only requires that the precert
-// was previously signed by the Signers CA.
-func (s *Signer) SignFromPrecert(precert *x509.Certificate, scts []ct.SignedCertificateTimestamp) ([]byte, error) {
-	// Verify certificate was signed by s.ca
-	if err := precert.CheckSignatureFrom(s.ca); err != nil {
-		return nil, err
-	}
-
-	// Verify certificate is a precert
-	isPrecert := false
-	poisonIndex := 0
-	for i, ext := range precert.Extensions {
-		if ext.Id.Equal(signer.CTPoisonOID) {
-			if !ext.Critical {
-				return nil, cferr.New(cferr.CTError, cferr.PrecertInvalidPoison)
-			}
-			// Check extension contains ASN.1 NULL
-			if bytes.Compare(ext.Value, []byte{0x05, 0x00}) != 0 {
-				return nil, cferr.New(cferr.CTError, cferr.PrecertInvalidPoison)
-			}
-			isPrecert = true
-			poisonIndex = i
-			break
-		}
-	}
-	if !isPrecert {
-		return nil, cferr.New(cferr.CTError, cferr.PrecertMissingPoison)
-	}
-
-	// Serialize SCTs into list format and create extension
-	serializedList, err := helpers.SerializeSCTList(scts)
-	if err != nil {
-		return nil, err
-	}
-	// Serialize again as an octet string before embedding
-	serializedList, err = asn1.Marshal(serializedList)
-	if err != nil {
-		return nil, cferr.Wrap(cferr.CTError, cferr.Unknown, err)
-	}
-	sctExt := pkix.Extension{Id: signer.SCTListOID, Critical: false, Value: serializedList}
-
-	// Create the new tbsCert from precert. Do explicit copies of any slices so that we don't
-	// use memory that may be altered by us or the caller at a later stage.
-	tbsCert := x509.Certificate{
-		SignatureAlgorithm:          precert.SignatureAlgorithm,
-		PublicKeyAlgorithm:          precert.PublicKeyAlgorithm,
-		PublicKey:                   precert.PublicKey,
-		Version:                     precert.Version,
-		SerialNumber:                precert.SerialNumber,
-		Issuer:                      precert.Issuer,
-		Subject:                     precert.Subject,
-		NotBefore:                   precert.NotBefore,
-		NotAfter:                    precert.NotAfter,
-		KeyUsage:                    precert.KeyUsage,
-		BasicConstraintsValid:       precert.BasicConstraintsValid,
-		IsCA:                        precert.IsCA,
-		MaxPathLen:                  precert.MaxPathLen,
-		MaxPathLenZero:              precert.MaxPathLenZero,
-		PermittedDNSDomainsCritical: precert.PermittedDNSDomainsCritical,
-	}
-	if len(precert.Extensions) > 0 {
-		tbsCert.ExtraExtensions = make([]pkix.Extension, len(precert.Extensions))
-		copy(tbsCert.ExtraExtensions, precert.Extensions)
-	}
-
-	// Remove the poison extension from ExtraExtensions
-	tbsCert.ExtraExtensions = append(tbsCert.ExtraExtensions[:poisonIndex], tbsCert.ExtraExtensions[poisonIndex+1:]...)
-	// Insert the SCT list extension
-	tbsCert.ExtraExtensions = append(tbsCert.ExtraExtensions, sctExt)
-
-	// Sign the tbsCert
-	return s.sign(&tbsCert)
-}
-
-// Info return a populated info.Resp struct or an error.
-func (s *Signer) Info(req info.Req) (resp *info.Resp, err error) {
-	cert, err := s.Certificate(req.Label, req.Profile)
-	if err != nil {
-		return
-	}
-
-	profile, err := signer.Profile(s, req.Profile)
-	if err != nil {
-		return
-	}
-
-	resp = new(info.Resp)
-	if cert.Raw != nil {
-		resp.Certificate = string(bytes.TrimSpace(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})))
-	}
-	resp.Usage = profile.Usage
-	resp.ExpiryString = profile.ExpiryString
-
-	return
-}
-
-// SigAlgo returns the RSA signer's signature algorithm.
-func (s *Signer) SigAlgo() x509.SignatureAlgorithm {
-	return s.sigAlgo
-}
-
-// Certificate returns the signer's certificate.
-func (s *Signer) Certificate(label, profile string) (*x509.Certificate, error) {
-	cert := *s.ca
-	return &cert, nil
-}
-
-// SetPolicy sets the signer's signature policy.
-func (s *Signer) SetPolicy(policy *config.Signing) {
-	s.policy = policy
-}
-
-// SetDBAccessor sets the signers' cert db accessor
-func (s *Signer) SetDBAccessor(dba certdb.Accessor) {
-	s.dbAccessor = dba
-}
-
-// GetDBAccessor returns the signers' cert db accessor
-func (s *Signer) GetDBAccessor() certdb.Accessor {
-	return s.dbAccessor
-}
-
-// SetReqModifier does nothing for local
-func (s *Signer) SetReqModifier(func(*http.Request, []byte)) {
-	// noop
-}
-
-// Policy returns the signer's policy.
-func (s *Signer) Policy() *config.Signing {
-	return s.policy
-}

vendor/github.com/cloudflare/cfssl/signer/signer.go

@@ -1,438 +0,0 @@
-// Package signer implements certificate signature functionality for CFSSL.
-package signer
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rsa"
-	"crypto/sha1"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"errors"
-	"math/big"
-	"net/http"
-	"strings"
-	"time"
-
-	"github.com/cloudflare/cfssl/certdb"
-	"github.com/cloudflare/cfssl/config"
-	"github.com/cloudflare/cfssl/csr"
-	cferr "github.com/cloudflare/cfssl/errors"
-	"github.com/cloudflare/cfssl/info"
-)
-
-// Subject contains the information that should be used to override the
-// subject information when signing a certificate.
-type Subject struct {
-	CN           string
-	Names        []csr.Name `json:"names"`
-	SerialNumber string
-}
-
-// Extension represents a raw extension to be included in the certificate.  The
-// "value" field must be hex encoded.
-type Extension struct {
-	ID       config.OID `json:"id"`
-	Critical bool       `json:"critical"`
-	Value    string     `json:"value"`
-}
-
-// SignRequest stores a signature request, which contains the hostname,
-// the CSR, optional subject information, and the signature profile.
-//
-// Extensions provided in the signRequest are copied into the certificate, as
-// long as they are in the ExtensionWhitelist for the signer's policy.
-// Extensions requested in the CSR are ignored, except for those processed by
-// ParseCertificateRequest (mainly subjectAltName).
-type SignRequest struct {
-	Hosts       []string    `json:"hosts"`
-	Request     string      `json:"certificate_request"`
-	Subject     *Subject    `json:"subject,omitempty"`
-	Profile     string      `json:"profile"`
-	CRLOverride string      `json:"crl_override"`
-	Label       string      `json:"label"`
-	Serial      *big.Int    `json:"serial,omitempty"`
-	Extensions  []Extension `json:"extensions,omitempty"`
-	// If provided, NotBefore will be used without modification (except
-	// for canonicalization) as the value of the notBefore field of the
-	// certificate. In particular no backdating adjustment will be made
-	// when NotBefore is provided.
-	NotBefore time.Time
-	// If provided, NotAfter will be used without modification (except
-	// for canonicalization) as the value of the notAfter field of the
-	// certificate.
-	NotAfter time.Time
-	// If ReturnPrecert is true a certificate with the CT poison extension
-	// will be returned from the Signer instead of attempting to retrieve
-	// SCTs and populate the tbsCert with them itself. This precert can then
-	// be passed to SignFromPrecert with the SCTs in order to create a
-	// valid certificate.
-	ReturnPrecert bool
-}
-
-// appendIf appends to a if s is not an empty string.
-func appendIf(s string, a *[]string) {
-	if s != "" {
-		*a = append(*a, s)
-	}
-}
-
-// Name returns the PKIX name for the subject.
-func (s *Subject) Name() pkix.Name {
-	var name pkix.Name
-	name.CommonName = s.CN
-
-	for _, n := range s.Names {
-		appendIf(n.C, &name.Country)
-		appendIf(n.ST, &name.Province)
-		appendIf(n.L, &name.Locality)
-		appendIf(n.O, &name.Organization)
-		appendIf(n.OU, &name.OrganizationalUnit)
-	}
-	name.SerialNumber = s.SerialNumber
-	return name
-}
-
-// SplitHosts takes a comma-spearated list of hosts and returns a slice
-// with the hosts split
-func SplitHosts(hostList string) []string {
-	if hostList == "" {
-		return nil
-	}
-
-	return strings.Split(hostList, ",")
-}
-
-// A Signer contains a CA's certificate and private key for signing
-// certificates, a Signing policy to refer to and a SignatureAlgorithm.
-type Signer interface {
-	Info(info.Req) (*info.Resp, error)
-	Policy() *config.Signing
-	SetDBAccessor(certdb.Accessor)
-	GetDBAccessor() certdb.Accessor
-	SetPolicy(*config.Signing)
-	SigAlgo() x509.SignatureAlgorithm
-	Sign(req SignRequest) (cert []byte, err error)
-	SetReqModifier(func(*http.Request, []byte))
-}
-
-// Profile gets the specific profile from the signer
-func Profile(s Signer, profile string) (*config.SigningProfile, error) {
-	var p *config.SigningProfile
-	policy := s.Policy()
-	if policy != nil && policy.Profiles != nil && profile != "" {
-		p = policy.Profiles[profile]
-	}
-
-	if p == nil && policy != nil {
-		p = policy.Default
-	}
-
-	if p == nil {
-		return nil, cferr.Wrap(cferr.APIClientError, cferr.ClientHTTPError, errors.New("profile must not be nil"))
-	}
-	return p, nil
-}
-
-// DefaultSigAlgo returns an appropriate X.509 signature algorithm given
-// the CA's private key.
-func DefaultSigAlgo(priv crypto.Signer) x509.SignatureAlgorithm {
-	pub := priv.Public()
-	switch pub := pub.(type) {
-	case *rsa.PublicKey:
-		keySize := pub.N.BitLen()
-		switch {
-		case keySize >= 4096:
-			return x509.SHA512WithRSA
-		case keySize >= 3072:
-			return x509.SHA384WithRSA
-		case keySize >= 2048:
-			return x509.SHA256WithRSA
-		default:
-			return x509.SHA1WithRSA
-		}
-	case *ecdsa.PublicKey:
-		switch pub.Curve {
-		case elliptic.P256():
-			return x509.ECDSAWithSHA256
-		case elliptic.P384():
-			return x509.ECDSAWithSHA384
-		case elliptic.P521():
-			return x509.ECDSAWithSHA512
-		default:
-			return x509.ECDSAWithSHA1
-		}
-	default:
-		return x509.UnknownSignatureAlgorithm
-	}
-}
-
-// ParseCertificateRequest takes an incoming certificate request and
-// builds a certificate template from it.
-func ParseCertificateRequest(s Signer, csrBytes []byte) (template *x509.Certificate, err error) {
-	csrv, err := x509.ParseCertificateRequest(csrBytes)
-	if err != nil {
-		err = cferr.Wrap(cferr.CSRError, cferr.ParseFailed, err)
-		return
-	}
-
-	err = csrv.CheckSignature()
-	if err != nil {
-		err = cferr.Wrap(cferr.CSRError, cferr.KeyMismatch, err)
-		return
-	}
-
-	template = &x509.Certificate{
-		Subject:            csrv.Subject,
-		PublicKeyAlgorithm: csrv.PublicKeyAlgorithm,
-		PublicKey:          csrv.PublicKey,
-		SignatureAlgorithm: s.SigAlgo(),
-		DNSNames:           csrv.DNSNames,
-		IPAddresses:        csrv.IPAddresses,
-		EmailAddresses:     csrv.EmailAddresses,
-		URIs:               csrv.URIs,
-	}
-
-	for _, val := range csrv.Extensions {
-		// Check the CSR for the X.509 BasicConstraints (RFC 5280, 4.2.1.9)
-		// extension and append to template if necessary
-		if val.Id.Equal(asn1.ObjectIdentifier{2, 5, 29, 19}) {
-			var constraints csr.BasicConstraints
-			var rest []byte
-
-			if rest, err = asn1.Unmarshal(val.Value, &constraints); err != nil {
-				return nil, cferr.Wrap(cferr.CSRError, cferr.ParseFailed, err)
-			} else if len(rest) != 0 {
-				return nil, cferr.Wrap(cferr.CSRError, cferr.ParseFailed, errors.New("x509: trailing data after X.509 BasicConstraints"))
-			}
-
-			template.BasicConstraintsValid = true
-			template.IsCA = constraints.IsCA
-			template.MaxPathLen = constraints.MaxPathLen
-			template.MaxPathLenZero = template.MaxPathLen == 0
-		}
-	}
-
-	return
-}
-
-type subjectPublicKeyInfo struct {
-	Algorithm        pkix.AlgorithmIdentifier
-	SubjectPublicKey asn1.BitString
-}
-
-// ComputeSKI derives an SKI from the certificate's public key in a
-// standard manner. This is done by computing the SHA-1 digest of the
-// SubjectPublicKeyInfo component of the certificate.
-func ComputeSKI(template *x509.Certificate) ([]byte, error) {
-	pub := template.PublicKey
-	encodedPub, err := x509.MarshalPKIXPublicKey(pub)
-	if err != nil {
-		return nil, err
-	}
-
-	var subPKI subjectPublicKeyInfo
-	_, err = asn1.Unmarshal(encodedPub, &subPKI)
-	if err != nil {
-		return nil, err
-	}
-
-	pubHash := sha1.Sum(subPKI.SubjectPublicKey.Bytes)
-	return pubHash[:], nil
-}
-
-// FillTemplate is a utility function that tries to load as much of
-// the certificate template as possible from the profiles and current
-// template. It fills in the key uses, expiration, revocation URLs
-// and SKI.
-func FillTemplate(template *x509.Certificate, defaultProfile, profile *config.SigningProfile, notBefore time.Time, notAfter time.Time) error {
-	ski, err := ComputeSKI(template)
-	if err != nil {
-		return err
-	}
-
-	var (
-		eku             []x509.ExtKeyUsage
-		ku              x509.KeyUsage
-		backdate        time.Duration
-		expiry          time.Duration
-		crlURL, ocspURL string
-		issuerURL       = profile.IssuerURL
-	)
-
-	// The third value returned from Usages is a list of unknown key usages.
-	// This should be used when validating the profile at load, and isn't used
-	// here.
-	ku, eku, _ = profile.Usages()
-	if profile.IssuerURL == nil {
-		issuerURL = defaultProfile.IssuerURL
-	}
-
-	if ku == 0 && len(eku) == 0 {
-		return cferr.New(cferr.PolicyError, cferr.NoKeyUsages)
-	}
-
-	if expiry = profile.Expiry; expiry == 0 {
-		expiry = defaultProfile.Expiry
-	}
-
-	if crlURL = profile.CRL; crlURL == "" {
-		crlURL = defaultProfile.CRL
-	}
-	if ocspURL = profile.OCSP; ocspURL == "" {
-		ocspURL = defaultProfile.OCSP
-	}
-
-	if notBefore.IsZero() {
-		if !profile.NotBefore.IsZero() {
-			notBefore = profile.NotBefore
-		} else {
-			if backdate = profile.Backdate; backdate == 0 {
-				backdate = -5 * time.Minute
-			} else {
-				backdate = -1 * profile.Backdate
-			}
-			notBefore = time.Now().Round(time.Minute).Add(backdate)
-		}
-	}
-	notBefore = notBefore.UTC()
-
-	if notAfter.IsZero() {
-		if !profile.NotAfter.IsZero() {
-			notAfter = profile.NotAfter
-		} else {
-			notAfter = notBefore.Add(expiry)
-		}
-	}
-	notAfter = notAfter.UTC()
-
-	template.NotBefore = notBefore
-	template.NotAfter = notAfter
-	template.KeyUsage = ku
-	template.ExtKeyUsage = eku
-	template.BasicConstraintsValid = true
-	template.IsCA = profile.CAConstraint.IsCA
-	if template.IsCA {
-		template.MaxPathLen = profile.CAConstraint.MaxPathLen
-		if template.MaxPathLen == 0 {
-			template.MaxPathLenZero = profile.CAConstraint.MaxPathLenZero
-		}
-		template.DNSNames = nil
-		template.EmailAddresses = nil
-		template.URIs = nil
-	}
-	template.SubjectKeyId = ski
-
-	if ocspURL != "" {
-		template.OCSPServer = []string{ocspURL}
-	}
-	if crlURL != "" {
-		template.CRLDistributionPoints = []string{crlURL}
-	}
-
-	if len(issuerURL) != 0 {
-		template.IssuingCertificateURL = issuerURL
-	}
-	if len(profile.Policies) != 0 {
-		err = addPolicies(template, profile.Policies)
-		if err != nil {
-			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, err)
-		}
-	}
-	if profile.OCSPNoCheck {
-		ocspNoCheckExtension := pkix.Extension{
-			Id:       asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1, 5},
-			Critical: false,
-			Value:    []byte{0x05, 0x00},
-		}
-		template.ExtraExtensions = append(template.ExtraExtensions, ocspNoCheckExtension)
-	}
-
-	return nil
-}
-
-type policyInformation struct {
-	PolicyIdentifier asn1.ObjectIdentifier
-	Qualifiers       []interface{} `asn1:"tag:optional,omitempty"`
-}
-
-type cpsPolicyQualifier struct {
-	PolicyQualifierID asn1.ObjectIdentifier
-	Qualifier         string `asn1:"tag:optional,ia5"`
-}
-
-type userNotice struct {
-	ExplicitText string `asn1:"tag:optional,utf8"`
-}
-type userNoticePolicyQualifier struct {
-	PolicyQualifierID asn1.ObjectIdentifier
-	Qualifier         userNotice
-}
-
-var (
-	// Per https://tools.ietf.org/html/rfc3280.html#page-106, this represents:
-	// iso(1) identified-organization(3) dod(6) internet(1) security(5)
-	//   mechanisms(5) pkix(7) id-qt(2) id-qt-cps(1)
-	iDQTCertificationPracticeStatement = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 2, 1}
-	// iso(1) identified-organization(3) dod(6) internet(1) security(5)
-	//   mechanisms(5) pkix(7) id-qt(2) id-qt-unotice(2)
-	iDQTUserNotice = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 2, 2}
-
-	// CTPoisonOID is the object ID of the critical poison extension for precertificates
-	// https://tools.ietf.org/html/rfc6962#page-9
-	CTPoisonOID = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 3}
-
-	// SCTListOID is the object ID for the Signed Certificate Timestamp certificate extension
-	// https://tools.ietf.org/html/rfc6962#page-14
-	SCTListOID = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 2}
-)
-
-// addPolicies adds Certificate Policies and optional Policy Qualifiers to a
-// certificate, based on the input config. Go's x509 library allows setting
-// Certificate Policies easily, but does not support nested Policy Qualifiers
-// under those policies. So we need to construct the ASN.1 structure ourselves.
-func addPolicies(template *x509.Certificate, policies []config.CertificatePolicy) error {
-	asn1PolicyList := []policyInformation{}
-
-	for _, policy := range policies {
-		pi := policyInformation{
-			// The PolicyIdentifier is an OID assigned to a given issuer.
-			PolicyIdentifier: asn1.ObjectIdentifier(policy.ID),
-		}
-		for _, qualifier := range policy.Qualifiers {
-			switch qualifier.Type {
-			case "id-qt-unotice":
-				pi.Qualifiers = append(pi.Qualifiers,
-					userNoticePolicyQualifier{
-						PolicyQualifierID: iDQTUserNotice,
-						Qualifier: userNotice{
-							ExplicitText: qualifier.Value,
-						},
-					})
-			case "id-qt-cps":
-				pi.Qualifiers = append(pi.Qualifiers,
-					cpsPolicyQualifier{
-						PolicyQualifierID: iDQTCertificationPracticeStatement,
-						Qualifier:         qualifier.Value,
-					})
-			default:
-				return errors.New("Invalid qualifier type in Policies " + qualifier.Type)
-			}
-		}
-		asn1PolicyList = append(asn1PolicyList, pi)
-	}
-
-	asn1Bytes, err := asn1.Marshal(asn1PolicyList)
-	if err != nil {
-		return err
-	}
-
-	template.ExtraExtensions = append(template.ExtraExtensions, pkix.Extension{
-		Id:       asn1.ObjectIdentifier{2, 5, 29, 32},
-		Critical: false,
-		Value:    asn1Bytes,
-	})
-	return nil
-}

vendor/github.com/emicklei/go-restful-openapi/.gitignore

@@ -1 +0,0 @@
-examples/examples

vendor/github.com/emicklei/go-restful-openapi/.travis.yml

@@ -1,4 +0,0 @@
-language: go
-
-go:
-  - 1.x

vendor/github.com/emicklei/go-restful-openapi/CHANGES.md

@@ -1,16 +0,0 @@
-# changes to the go-restful-openapi package
-
-## v1.0.0
-
-- Fix for #19 MapModelTypeNameFunc has incomplete behavior
-- prevent array param.Type be overwritten in the else case below (#47)
-- Merge paths with existing paths from other webServices (#48)
-
-## v0.11.0
-
-    - Register pointer to array/slice of primitives as such rather than as reference to the primitive type definition. (#46)
-    - Add support for map types using "additional properties" (#44) 
-
-## <= v0.10.0
-
-See `git log`.

vendor/github.com/emicklei/go-restful-openapi/LICENSE

@@ -1,22 +0,0 @@
-Copyright (c) 2017 Ernest Micklei
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

vendor/github.com/emicklei/go-restful-openapi/README.md

@@ -1,26 +0,0 @@
-# go-restful-openapi
-
-[![Build Status](https://travis-ci.org/emicklei/go-restful-openapi.png)](https://travis-ci.org/emicklei/go-restful-openapi)
-[![GoDoc](https://godoc.org/github.com/emicklei/go-restful-openapi?status.svg)](https://godoc.org/github.com/emicklei/go-restful-openapi)
-
-[openapi](https://www.openapis.org) extension to the go-restful package, targeting [version 2.0](https://github.com/OAI/OpenAPI-Specification)
-
-## The following Go field tags are translated to OpenAPI equivalents
-- description
-- minimum
-- maximum
-- optional ( if set to "true" then it is not listed in `required`)
-- unique
-- modelDescription
-- type (overrides the Go type String())
-- enum
-- readOnly
-
-See TestThatExtraTagsAreReadIntoModel for examples.
-
-## dependencies
-
-- [go-restful](https://github.com/emicklei/go-restful)
-- [go-openapi](https://github.com/go-openapi/spec)
-
-© 2018, ernestmicklei.com.  MIT License. Contributions welcome.

vendor/github.com/emicklei/go-restful-openapi/build_definitions.go

@@ -1,32 +0,0 @@
-package restfulspec
-
-import (
-	"reflect"
-
-	restful "github.com/emicklei/go-restful"
-	"github.com/go-openapi/spec"
-)
-
-func buildDefinitions(ws *restful.WebService, cfg Config) (definitions spec.Definitions) {
-	definitions = spec.Definitions{}
-	for _, each := range ws.Routes() {
-		addDefinitionsFromRouteTo(each, cfg, definitions)
-	}
-	return
-}
-
-func addDefinitionsFromRouteTo(r restful.Route, cfg Config, d spec.Definitions) {
-	builder := definitionBuilder{Definitions: d, Config: cfg}
-	if r.ReadSample != nil {
-		builder.addModel(reflect.TypeOf(r.ReadSample), "")
-	}
-	if r.WriteSample != nil {
-		builder.addModel(reflect.TypeOf(r.WriteSample), "")
-	}
-	for _, v := range r.ResponseErrors {
-		if v.Model == nil {
-			continue
-		}
-		builder.addModel(reflect.TypeOf(v.Model), "")
-	}
-}

vendor/github.com/emicklei/go-restful-openapi/build_path.go

@@ -1,254 +0,0 @@
-package restfulspec
-
-import (
-	"net/http"
-	"reflect"
-	"regexp"
-	"strconv"
-	"strings"
-
-	restful "github.com/emicklei/go-restful"
-	"github.com/go-openapi/spec"
-)
-
-// KeyOpenAPITags is a Metadata key for a restful Route
-const KeyOpenAPITags = "openapi.tags"
-
-func buildPaths(ws *restful.WebService, cfg Config) spec.Paths {
-	p := spec.Paths{Paths: map[string]spec.PathItem{}}
-	for _, each := range ws.Routes() {
-		path, patterns := sanitizePath(each.Path)
-		existingPathItem, ok := p.Paths[path]
-		if !ok {
-			existingPathItem = spec.PathItem{}
-		}
-		p.Paths[path] = buildPathItem(ws, each, existingPathItem, patterns, cfg)
-	}
-	return p
-}
-
-// sanitizePath removes regex expressions from named path params,
-// since openapi only supports setting the pattern as a a property named "pattern".
-// Expressions like "/api/v1/{name:[a-z]/" are converted to "/api/v1/{name}/".
-// The second return value is a map which contains the mapping from the path parameter
-// name to the extracted pattern
-func sanitizePath(restfulPath string) (string, map[string]string) {
-	openapiPath := ""
-	patterns := map[string]string{}
-	for _, fragment := range strings.Split(restfulPath, "/") {
-		if fragment == "" {
-			continue
-		}
-		if strings.HasPrefix(fragment, "{") && strings.Contains(fragment, ":") {
-			split := strings.Split(fragment, ":")
-			fragment = split[0][1:]
-			pattern := split[1][:len(split[1])-1]
-			patterns[fragment] = pattern
-			fragment = "{" + fragment + "}"
-		}
-		openapiPath += "/" + fragment
-	}
-	return openapiPath, patterns
-}
-
-func buildPathItem(ws *restful.WebService, r restful.Route, existingPathItem spec.PathItem, patterns map[string]string, cfg Config) spec.PathItem {
-	op := buildOperation(ws, r, patterns, cfg)
-	switch r.Method {
-	case "GET":
-		existingPathItem.Get = op
-	case "POST":
-		existingPathItem.Post = op
-	case "PUT":
-		existingPathItem.Put = op
-	case "DELETE":
-		existingPathItem.Delete = op
-	case "PATCH":
-		existingPathItem.Patch = op
-	case "OPTIONS":
-		existingPathItem.Options = op
-	case "HEAD":
-		existingPathItem.Head = op
-	}
-	return existingPathItem
-}
-
-func buildOperation(ws *restful.WebService, r restful.Route, patterns map[string]string, cfg Config) *spec.Operation {
-	o := spec.NewOperation(r.Operation)
-	o.Description = r.Notes
-	o.Summary = stripTags(r.Doc)
-	o.Consumes = r.Consumes
-	o.Produces = r.Produces
-	o.Deprecated = r.Deprecated
-	if r.Metadata != nil {
-		if tags, ok := r.Metadata[KeyOpenAPITags]; ok {
-			if tagList, ok := tags.([]string); ok {
-				o.Tags = tagList
-			}
-		}
-	}
-	// collect any path parameters
-	for _, param := range ws.PathParameters() {
-		o.Parameters = append(o.Parameters, buildParameter(r, param, patterns[param.Data().Name], cfg))
-	}
-	// route specific params
-	for _, each := range r.ParameterDocs {
-		o.Parameters = append(o.Parameters, buildParameter(r, each, patterns[each.Data().Name], cfg))
-	}
-	o.Responses = new(spec.Responses)
-	props := &o.Responses.ResponsesProps
-	props.StatusCodeResponses = map[int]spec.Response{}
-	for k, v := range r.ResponseErrors {
-		r := buildResponse(v, cfg)
-		props.StatusCodeResponses[k] = r
-		if 200 == k { // any 2xx code?
-			o.Responses.Default = &r
-		}
-	}
-	if len(o.Responses.StatusCodeResponses) == 0 {
-		o.Responses.StatusCodeResponses[200] = spec.Response{ResponseProps: spec.ResponseProps{Description: http.StatusText(http.StatusOK)}}
-	}
-	return o
-}
-
-// stringAutoType automatically picks the correct type from an ambiguously typed
-// string. Ex. numbers become int, true/false become bool, etc.
-func stringAutoType(ambiguous string) interface{} {
-	if ambiguous == "" {
-		return nil
-	}
-	if parsedInt, err := strconv.ParseInt(ambiguous, 10, 64); err == nil {
-		return parsedInt
-	}
-	if parsedBool, err := strconv.ParseBool(ambiguous); err == nil {
-		return parsedBool
-	}
-	return ambiguous
-}
-
-func buildParameter(r restful.Route, restfulParam *restful.Parameter, pattern string, cfg Config) spec.Parameter {
-	p := spec.Parameter{}
-	param := restfulParam.Data()
-	p.In = asParamType(param.Kind)
-	p.Description = param.Description
-	p.Name = param.Name
-	p.Required = param.Required
-
-	if param.Kind == restful.PathParameterKind {
-		p.Pattern = pattern
-	}
-	st := reflect.TypeOf(r.ReadSample)
-	if param.Kind == restful.BodyParameterKind && r.ReadSample != nil && param.DataType == st.String() {
-		p.Schema = new(spec.Schema)
-		p.SimpleSchema = spec.SimpleSchema{}
-		if st.Kind() == reflect.Array || st.Kind() == reflect.Slice {
-			dataTypeName := keyFrom(st.Elem(), cfg)
-			p.Schema.Type = []string{"array"}
-			p.Schema.Items = &spec.SchemaOrArray{
-				Schema: &spec.Schema{},
-			}
-			isPrimitive := isPrimitiveType(dataTypeName)
-			if isPrimitive {
-				mapped := jsonSchemaType(dataTypeName)
-				p.Schema.Items.Schema.Type = []string{mapped}
-			} else {
-				p.Schema.Items.Schema.Ref = spec.MustCreateRef("#/definitions/" + dataTypeName)
-			}
-		} else {
-			dataTypeName := keyFrom(st, cfg)
-			p.Schema.Ref = spec.MustCreateRef("#/definitions/" + dataTypeName)
-		}
-
-	} else {
-		if param.AllowMultiple {
-			p.Type = "array"
-			p.Items = spec.NewItems()
-			p.Items.Type = param.DataType
-			p.CollectionFormat = param.CollectionFormat
-		} else {
-			p.Type = param.DataType
-		}
-		p.Default = stringAutoType(param.DefaultValue)
-		p.Format = param.DataFormat
-	}
-
-	return p
-}
-
-func buildResponse(e restful.ResponseError, cfg Config) (r spec.Response) {
-	r.Description = e.Message
-	if e.Model != nil {
-		st := reflect.TypeOf(e.Model)
-		if st.Kind() == reflect.Ptr {
-			// For pointer type, use element type as the key; otherwise we'll
-			// endup with '#/definitions/*Type' which violates openapi spec.
-			st = st.Elem()
-		}
-		r.Schema = new(spec.Schema)
-		if st.Kind() == reflect.Array || st.Kind() == reflect.Slice {
-			modelName := keyFrom(st.Elem(), cfg)
-			r.Schema.Type = []string{"array"}
-			r.Schema.Items = &spec.SchemaOrArray{
-				Schema: &spec.Schema{},
-			}
-			isPrimitive := isPrimitiveType(modelName)
-			if isPrimitive {
-				mapped := jsonSchemaType(modelName)
-				r.Schema.Items.Schema.Type = []string{mapped}
-			} else {
-				r.Schema.Items.Schema.Ref = spec.MustCreateRef("#/definitions/" + modelName)
-			}
-		} else {
-			modelName := keyFrom(st, cfg)
-			if isPrimitiveType(modelName) {
-				// If the response is a primitive type, then don't reference any definitions.
-				// Instead, set the schema's "type" to the model name.
-				r.Schema.AddType(modelName, "")
-			} else {
-				modelName := keyFrom(st, cfg)
-				r.Schema.Ref = spec.MustCreateRef("#/definitions/" + modelName)
-			}
-		}
-	}
-	return r
-}
-
-// stripTags takes a snippet of HTML and returns only the text content.
-// For example, `<b>&lt;Hi!&gt;</b> <br>` -> `&lt;Hi!&gt; `.
-func stripTags(html string) string {
-	re := regexp.MustCompile("<[^>]*>")
-	return re.ReplaceAllString(html, "")
-}
-
-func isPrimitiveType(modelName string) bool {
-	if len(modelName) == 0 {
-		return false
-	}
-	return strings.Contains("uint uint8 uint16 uint32 uint64 int int8 int16 int32 int64 float32 float64 bool string byte rune time.Time", modelName)
-}
-
-func jsonSchemaType(modelName string) string {
-	schemaMap := map[string]string{
-		"uint":   "integer",
-		"uint8":  "integer",
-		"uint16": "integer",
-		"uint32": "integer",
-		"uint64": "integer",
-
-		"int":   "integer",
-		"int8":  "integer",
-		"int16": "integer",
-		"int32": "integer",
-		"int64": "integer",
-
-		"byte":      "integer",
-		"float64":   "number",
-		"float32":   "number",
-		"bool":      "boolean",
-		"time.Time": "string",
-	}
-	mapped, ok := schemaMap[modelName]
-	if !ok {
-		return modelName // use as is (custom or struct)
-	}
-	return mapped
-}

vendor/github.com/emicklei/go-restful-openapi/config.go

@@ -1,41 +0,0 @@
-package restfulspec
-
-import (
-	"reflect"
-
-	restful "github.com/emicklei/go-restful"
-	"github.com/go-openapi/spec"
-)
-
-// MapSchemaFormatFunc can be used to modify typeName at definition time.
-// To use it set the SchemaFormatHandler in the config.
-type MapSchemaFormatFunc func(typeName string) string
-
-// MapModelTypeNameFunc can be used to return the desired typeName for a given
-// type. It will return false if the default name should be used.
-// To use it set the ModelTypeNameHandler in the config.
-type MapModelTypeNameFunc func(t reflect.Type) (string, bool)
-
-// PostBuildSwaggerObjectFunc can be used to change the creates Swagger Object
-// before serving it. To use it set the PostBuildSwaggerObjectHandler in the config.
-type PostBuildSwaggerObjectFunc func(s *spec.Swagger)
-
-// Config holds service api metadata.
-type Config struct {
-	// WebServicesURL is a DEPRECATED field; it never had any effect in this package.
-	WebServicesURL string
-	// APIPath is the path where the JSON api is avaiable , e.g. /apidocs.json
-	APIPath string
-	// api listing is constructed from this list of restful WebServices.
-	WebServices []*restful.WebService
-	// [optional] on default CORS (Cross-Origin-Resource-Sharing) is enabled.
-	DisableCORS bool
-	// Top-level API version. Is reflected in the resource listing.
-	APIVersion string
-	// [optional] If set, model builder should call this handler to get addition typename-to-swagger-format-field conversion.
-	SchemaFormatHandler MapSchemaFormatFunc
-	// [optional] If set, model builder should call this handler to retrieve the name for a given type.
-	ModelTypeNameHandler MapModelTypeNameFunc
-	// [optional] If set then call this function with the generated Swagger Object
-	PostBuildSwaggerObjectHandler PostBuildSwaggerObjectFunc
-}

vendor/github.com/emicklei/go-restful-openapi/definition_builder.go

@@ -1,493 +0,0 @@
-package restfulspec
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-
-	"github.com/go-openapi/spec"
-)
-
-type definitionBuilder struct {
-	Definitions spec.Definitions
-	Config      Config
-}
-
-// Documented is
-type Documented interface {
-	SwaggerDoc() map[string]string
-}
-
-// Check if this structure has a method with signature func (<theModel>) SwaggerDoc() map[string]string
-// If it exists, retrieve the documentation and overwrite all struct tag descriptions
-func getDocFromMethodSwaggerDoc2(model reflect.Type) map[string]string {
-	if docable, ok := reflect.New(model).Elem().Interface().(Documented); ok {
-		return docable.SwaggerDoc()
-	}
-	return make(map[string]string)
-}
-
-// addModelFrom creates and adds a Schema to the builder and detects and calls
-// the post build hook for customizations
-func (b definitionBuilder) addModelFrom(sample interface{}) {
-	b.addModel(reflect.TypeOf(sample), "")
-}
-
-func (b definitionBuilder) addModel(st reflect.Type, nameOverride string) *spec.Schema {
-	// Turn pointers into simpler types so further checks are
-	// correct.
-	if st.Kind() == reflect.Ptr {
-		st = st.Elem()
-	}
-
-	modelName := keyFrom(st, b.Config)
-	if nameOverride != "" {
-		modelName = nameOverride
-	}
-	// no models needed for primitive types
-	if b.isPrimitiveType(modelName) {
-		return nil
-	}
-	// golang encoding/json packages says array and slice values encode as
-	// JSON arrays, except that []byte encodes as a base64-encoded string.
-	// If we see a []byte here, treat it at as a primitive type (string)
-	// and deal with it in buildArrayTypeProperty.
-	if (st.Kind() == reflect.Slice || st.Kind() == reflect.Array) &&
-		st.Elem().Kind() == reflect.Uint8 {
-		return nil
-	}
-	// see if we already have visited this model
-	if _, ok := b.Definitions[modelName]; ok {
-		return nil
-	}
-	sm := spec.Schema{
-		SchemaProps: spec.SchemaProps{
-			Required:   []string{},
-			Properties: map[string]spec.Schema{},
-		},
-	}
-
-	// reference the model before further initializing (enables recursive structs)
-	b.Definitions[modelName] = sm
-
-	// check for slice or array
-	if st.Kind() == reflect.Slice || st.Kind() == reflect.Array {
-		st = st.Elem()
-	}
-	// check for structure or primitive type
-	if st.Kind() != reflect.Struct {
-		return &sm
-	}
-
-	fullDoc := getDocFromMethodSwaggerDoc2(st)
-	modelDescriptions := []string{}
-
-	for i := 0; i < st.NumField(); i++ {
-		field := st.Field(i)
-		jsonName, modelDescription, prop := b.buildProperty(field, &sm, modelName)
-		if len(modelDescription) > 0 {
-			modelDescriptions = append(modelDescriptions, modelDescription)
-		}
-
-		// add if not omitted
-		if len(jsonName) != 0 {
-			// update description
-			if fieldDoc, ok := fullDoc[jsonName]; ok {
-				prop.Description = fieldDoc
-			}
-			// update Required
-			if b.isPropertyRequired(field) {
-				sm.Required = append(sm.Required, jsonName)
-			}
-			sm.Properties[jsonName] = prop
-		}
-	}
-
-	// We always overwrite documentation if SwaggerDoc method exists
-	// "" is special for documenting the struct itself
-	if modelDoc, ok := fullDoc[""]; ok {
-		sm.Description = modelDoc
-	} else if len(modelDescriptions) != 0 {
-		sm.Description = strings.Join(modelDescriptions, "\n")
-	}
-	// Needed to pass openapi validation. This field exists for json-schema compatibility,
-	// but it conflicts with the openapi specification.
-	// See https://github.com/go-openapi/spec/issues/23 for more context
-	sm.ID = ""
-
-	// update model builder with completed model
-	b.Definitions[modelName] = sm
-
-	return &sm
-}
-
-func (b definitionBuilder) isPropertyRequired(field reflect.StructField) bool {
-	required := true
-	if optionalTag := field.Tag.Get("optional"); optionalTag == "true" {
-		return false
-	}
-	if jsonTag := field.Tag.Get("json"); jsonTag != "" {
-		s := strings.Split(jsonTag, ",")
-		if len(s) > 1 && s[1] == "omitempty" {
-			return false
-		}
-	}
-	return required
-}
-
-func (b definitionBuilder) buildProperty(field reflect.StructField, model *spec.Schema, modelName string) (jsonName, modelDescription string, prop spec.Schema) {
-	jsonName = b.jsonNameOfField(field)
-	if len(jsonName) == 0 {
-		// empty name signals skip property
-		return "", "", prop
-	}
-
-	if field.Name == "XMLName" && field.Type.String() == "xml.Name" {
-		// property is metadata for the xml.Name attribute, can be skipped
-		return "", "", prop
-	}
-
-	if tag := field.Tag.Get("modelDescription"); tag != "" {
-		modelDescription = tag
-	}
-
-	setPropertyMetadata(&prop, field)
-	if prop.Type != nil {
-		return jsonName, modelDescription, prop
-	}
-	fieldType := field.Type
-
-	// check if type is doing its own marshalling
-	marshalerType := reflect.TypeOf((*json.Marshaler)(nil)).Elem()
-	if fieldType.Implements(marshalerType) {
-		var pType = "string"
-		if prop.Type == nil {
-			prop.Type = []string{pType}
-		}
-		if prop.Format == "" {
-			prop.Format = b.jsonSchemaFormat(keyFrom(fieldType, b.Config))
-		}
-		return jsonName, modelDescription, prop
-	}
-
-	// check if annotation says it is a string
-	if jsonTag := field.Tag.Get("json"); jsonTag != "" {
-		s := strings.Split(jsonTag, ",")
-		if len(s) > 1 && s[1] == "string" {
-			stringt := "string"
-			prop.Type = []string{stringt}
-			return jsonName, modelDescription, prop
-		}
-	}
-
-	fieldKind := fieldType.Kind()
-	switch {
-	case fieldKind == reflect.Struct:
-		jsonName, prop := b.buildStructTypeProperty(field, jsonName, model)
-		return jsonName, modelDescription, prop
-	case fieldKind == reflect.Slice || fieldKind == reflect.Array:
-		jsonName, prop := b.buildArrayTypeProperty(field, jsonName, modelName)
-		return jsonName, modelDescription, prop
-	case fieldKind == reflect.Ptr:
-		jsonName, prop := b.buildPointerTypeProperty(field, jsonName, modelName)
-		return jsonName, modelDescription, prop
-	case fieldKind == reflect.String:
-		stringt := "string"
-		prop.Type = []string{stringt}
-		return jsonName, modelDescription, prop
-	case fieldKind == reflect.Map:
-		jsonName, prop := b.buildMapTypeProperty(field, jsonName, modelName)
-		return jsonName, modelDescription, prop
-	}
-
-	fieldTypeName := keyFrom(fieldType, b.Config)
-	if b.isPrimitiveType(fieldTypeName) {
-		mapped := b.jsonSchemaType(fieldTypeName)
-		prop.Type = []string{mapped}
-		prop.Format = b.jsonSchemaFormat(fieldTypeName)
-		return jsonName, modelDescription, prop
-	}
-	modelType := keyFrom(fieldType, b.Config)
-	prop.Ref = spec.MustCreateRef("#/definitions/" + modelType)
-
-	if fieldType.Name() == "" { // override type of anonymous structs
-		// FIXME: Still need a way to handle anonymous struct model naming.
-		nestedTypeName := modelName + "." + jsonName
-		prop.Ref = spec.MustCreateRef("#/definitions/" + nestedTypeName)
-		b.addModel(fieldType, nestedTypeName)
-	}
-	return jsonName, modelDescription, prop
-}
-
-func hasNamedJSONTag(field reflect.StructField) bool {
-	parts := strings.Split(field.Tag.Get("json"), ",")
-	if len(parts) == 0 {
-		return false
-	}
-	for _, s := range parts[1:] {
-		if s == "inline" {
-			return false
-		}
-	}
-	return len(parts[0]) > 0
-}
-
-func (b definitionBuilder) buildStructTypeProperty(field reflect.StructField, jsonName string, model *spec.Schema) (nameJson string, prop spec.Schema) {
-	setPropertyMetadata(&prop, field)
-	fieldType := field.Type
-	// check for anonymous
-	if len(fieldType.Name()) == 0 {
-		// anonymous
-		// FIXME: Still need a way to handle anonymous struct model naming.
-		anonType := model.ID + "." + jsonName
-		b.addModel(fieldType, anonType)
-		prop.Ref = spec.MustCreateRef("#/definitions/" + anonType)
-		return jsonName, prop
-	}
-
-	if field.Name == fieldType.Name() && field.Anonymous && !hasNamedJSONTag(field) {
-		// embedded struct
-		sub := definitionBuilder{make(spec.Definitions), b.Config}
-		sub.addModel(fieldType, "")
-		subKey := keyFrom(fieldType, b.Config)
-		// merge properties from sub
-		subModel, _ := sub.Definitions[subKey]
-		for k, v := range subModel.Properties {
-			model.Properties[k] = v
-			// if subModel says this property is required then include it
-			required := false
-			for _, each := range subModel.Required {
-				if k == each {
-					required = true
-					break
-				}
-			}
-			if required {
-				model.Required = append(model.Required, k)
-			}
-		}
-		// add all new referenced models
-		for key, sub := range sub.Definitions {
-			if key != subKey {
-				if _, ok := b.Definitions[key]; !ok {
-					b.Definitions[key] = sub
-				}
-			}
-		}
-		// empty name signals skip property
-		return "", prop
-	}
-	// simple struct
-	b.addModel(fieldType, "")
-	var pType = keyFrom(fieldType, b.Config)
-	prop.Ref = spec.MustCreateRef("#/definitions/" + pType)
-	return jsonName, prop
-}
-
-func (b definitionBuilder) buildArrayTypeProperty(field reflect.StructField, jsonName, modelName string) (nameJson string, prop spec.Schema) {
-	setPropertyMetadata(&prop, field)
-	fieldType := field.Type
-	if fieldType.Elem().Kind() == reflect.Uint8 {
-		stringt := "string"
-		prop.Type = []string{stringt}
-		return jsonName, prop
-	}
-	var pType = "array"
-	prop.Type = []string{pType}
-	isPrimitive := b.isPrimitiveType(fieldType.Elem().Name())
-	elemTypeName := b.getElementTypeName(modelName, jsonName, fieldType.Elem())
-	prop.Items = &spec.SchemaOrArray{
-		Schema: &spec.Schema{},
-	}
-	if isPrimitive {
-		mapped := b.jsonSchemaType(elemTypeName)
-		prop.Items.Schema.Type = []string{mapped}
-	} else {
-		prop.Items.Schema.Ref = spec.MustCreateRef("#/definitions/" + elemTypeName)
-	}
-	// add|overwrite model for element type
-	if fieldType.Elem().Kind() == reflect.Ptr {
-		fieldType = fieldType.Elem()
-	}
-	if !isPrimitive {
-		b.addModel(fieldType.Elem(), elemTypeName)
-	}
-	return jsonName, prop
-}
-
-func (b definitionBuilder) buildMapTypeProperty(field reflect.StructField, jsonName, modelName string) (nameJson string, prop spec.Schema) {
-	setPropertyMetadata(&prop, field)
-	fieldType := field.Type
-	var pType = "object"
-	prop.Type = []string{pType}
-
-	// As long as the element isn't an interface, we should be able to figure out what the
-	// intended type is and represent it in `AdditionalProperties`.
-	// See: https://swagger.io/docs/specification/data-models/dictionaries/
-	if fieldType.Elem().Kind().String() != "interface" {
-		isPrimitive := b.isPrimitiveType(fieldType.Elem().Name())
-		elemTypeName := b.getElementTypeName(modelName, jsonName, fieldType.Elem())
-		prop.AdditionalProperties = &spec.SchemaOrBool{
-			Schema: &spec.Schema{},
-		}
-		if isPrimitive {
-			mapped := b.jsonSchemaType(elemTypeName)
-			prop.AdditionalProperties.Schema.Type = []string{mapped}
-		} else {
-			prop.AdditionalProperties.Schema.Ref = spec.MustCreateRef("#/definitions/" + elemTypeName)
-		}
-		// add|overwrite model for element type
-		if fieldType.Elem().Kind() == reflect.Ptr {
-			fieldType = fieldType.Elem()
-		}
-		if !isPrimitive {
-			b.addModel(fieldType.Elem(), elemTypeName)
-		}
-	}
-	return jsonName, prop
-}
-
-func (b definitionBuilder) buildPointerTypeProperty(field reflect.StructField, jsonName, modelName string) (nameJson string, prop spec.Schema) {
-	setPropertyMetadata(&prop, field)
-	fieldType := field.Type
-
-	// override type of pointer to list-likes
-	if fieldType.Elem().Kind() == reflect.Slice || fieldType.Elem().Kind() == reflect.Array {
-		var pType = "array"
-		prop.Type = []string{pType}
-		isPrimitive := b.isPrimitiveType(fieldType.Elem().Elem().Name())
-		elemName := b.getElementTypeName(modelName, jsonName, fieldType.Elem().Elem())
-		prop.Items = &spec.SchemaOrArray{
-			Schema: &spec.Schema{},
-		}
-		if isPrimitive {
-			primName := b.jsonSchemaType(elemName)
-			prop.Items.Schema.Type = []string{primName}
-		} else {
-			prop.Items.Schema.Ref = spec.MustCreateRef("#/definitions/" + elemName)
-		}
-		if !isPrimitive {
-			// add|overwrite model for element type
-			b.addModel(fieldType.Elem().Elem(), elemName)
-		}
-	} else {
-		// non-array, pointer type
-		fieldTypeName := keyFrom(fieldType.Elem(), b.Config)
-		var pType = b.jsonSchemaType(fieldTypeName) // no star, include pkg path
-		if b.isPrimitiveType(fieldTypeName) {
-			prop.Type = []string{pType}
-			prop.Format = b.jsonSchemaFormat(fieldTypeName)
-			return jsonName, prop
-		}
-		prop.Ref = spec.MustCreateRef("#/definitions/" + pType)
-		elemName := ""
-		if fieldType.Elem().Name() == "" {
-			elemName = modelName + "." + jsonName
-			prop.Ref = spec.MustCreateRef("#/definitions/" + elemName)
-		}
-		b.addModel(fieldType.Elem(), elemName)
-	}
-	return jsonName, prop
-}
-
-func (b definitionBuilder) getElementTypeName(modelName, jsonName string, t reflect.Type) string {
-	if t.Kind() == reflect.Ptr {
-		t = t.Elem()
-	}
-	if t.Name() == "" {
-		return modelName + "." + jsonName
-	}
-	return keyFrom(t, b.Config)
-}
-
-func keyFrom(st reflect.Type, cfg Config) string {
-	key := st.String()
-	if cfg.ModelTypeNameHandler != nil {
-		if name, ok := cfg.ModelTypeNameHandler(st); ok {
-			key = name
-		}
-	}
-	if len(st.Name()) == 0 { // unnamed type
-		// If it is an array, remove the leading []
-		key = strings.TrimPrefix(key, "[]")
-		// Swagger UI has special meaning for [
-		key = strings.Replace(key, "[]", "||", -1)
-	}
-	return key
-}
-
-// see also https://golang.org/ref/spec#Numeric_types
-func (b definitionBuilder) isPrimitiveType(modelName string) bool {
-	if len(modelName) == 0 {
-		return false
-	}
-	return strings.Contains("uint uint8 uint16 uint32 uint64 int int8 int16 int32 int64 float32 float64 bool string byte rune time.Time", modelName)
-}
-
-// jsonNameOfField returns the name of the field as it should appear in JSON format
-// An empty string indicates that this field is not part of the JSON representation
-func (b definitionBuilder) jsonNameOfField(field reflect.StructField) string {
-	if jsonTag := field.Tag.Get("json"); jsonTag != "" {
-		s := strings.Split(jsonTag, ",")
-		if s[0] == "-" {
-			// empty name signals skip property
-			return ""
-		} else if s[0] != "" {
-			return s[0]
-		}
-	}
-	return field.Name
-}
-
-// see also http://json-schema.org/latest/json-schema-core.html#anchor8
-func (b definitionBuilder) jsonSchemaType(modelName string) string {
-	schemaMap := map[string]string{
-		"uint":   "integer",
-		"uint8":  "integer",
-		"uint16": "integer",
-		"uint32": "integer",
-		"uint64": "integer",
-
-		"int":   "integer",
-		"int8":  "integer",
-		"int16": "integer",
-		"int32": "integer",
-		"int64": "integer",
-
-		"byte":      "integer",
-		"float64":   "number",
-		"float32":   "number",
-		"bool":      "boolean",
-		"time.Time": "string",
-	}
-	mapped, ok := schemaMap[modelName]
-	if !ok {
-		return modelName // use as is (custom or struct)
-	}
-	return mapped
-}
-
-func (b definitionBuilder) jsonSchemaFormat(modelName string) string {
-	if b.Config.SchemaFormatHandler != nil {
-		if mapped := b.Config.SchemaFormatHandler(modelName); mapped != "" {
-			return mapped
-		}
-	}
-	schemaMap := map[string]string{
-		"int":        "int32",
-		"int32":      "int32",
-		"int64":      "int64",
-		"byte":       "byte",
-		"uint":       "integer",
-		"uint8":      "byte",
-		"float64":    "double",
-		"float32":    "float",
-		"time.Time":  "date-time",
-		"*time.Time": "date-time",
-	}
-	mapped, ok := schemaMap[modelName]
-	if !ok {
-		return "" // no format
-	}
-	return mapped
-}

vendor/github.com/emicklei/go-restful-openapi/lookup.go

@@ -1,19 +0,0 @@
-package restfulspec
-
-import restful "github.com/emicklei/go-restful"
-
-func asParamType(kind int) string {
-	switch {
-	case kind == restful.PathParameterKind:
-		return "path"
-	case kind == restful.QueryParameterKind:
-		return "query"
-	case kind == restful.BodyParameterKind:
-		return "body"
-	case kind == restful.HeaderParameterKind:
-		return "header"
-	case kind == restful.FormParameterKind:
-		return "formData"
-	}
-	return ""
-}

vendor/github.com/emicklei/go-restful-openapi/property_ext.go

@@ -1,104 +0,0 @@
-package restfulspec
-
-import (
-	"reflect"
-	"strconv"
-	"strings"
-
-	"github.com/go-openapi/spec"
-)
-
-func setDescription(prop *spec.Schema, field reflect.StructField) {
-	if tag := field.Tag.Get("description"); tag != "" {
-		prop.Description = tag
-	}
-}
-
-func setDefaultValue(prop *spec.Schema, field reflect.StructField) {
-	if tag := field.Tag.Get("default"); tag != "" {
-		prop.Default = stringAutoType(tag)
-	}
-}
-
-func setEnumValues(prop *spec.Schema, field reflect.StructField) {
-	// We use | to separate the enum values.  This value is chosen
-	// since its unlikely to be useful in actual enumeration values.
-	if tag := field.Tag.Get("enum"); tag != "" {
-		enums := []interface{}{}
-		for _, s := range strings.Split(tag, "|") {
-			enums = append(enums, s)
-		}
-		prop.Enum = enums
-	}
-}
-
-func setMaximum(prop *spec.Schema, field reflect.StructField) {
-	if tag := field.Tag.Get("maximum"); tag != "" {
-		value, err := strconv.ParseFloat(tag, 64)
-		if err == nil {
-			prop.Maximum = &value
-		}
-	}
-}
-
-func setMinimum(prop *spec.Schema, field reflect.StructField) {
-	if tag := field.Tag.Get("minimum"); tag != "" {
-		value, err := strconv.ParseFloat(tag, 64)
-		if err == nil {
-			prop.Minimum = &value
-		}
-	}
-}
-
-func setType(prop *spec.Schema, field reflect.StructField) {
-	if tag := field.Tag.Get("type"); tag != "" {
-		// Check if the first two characters of the type tag are
-		// intended to emulate slice/array behaviour.
-		//
-		// If type is intended to be a slice/array then add the
-		// overriden type to the array item instead of the main property
-		if len(tag) > 2 && tag[0:2] == "[]" {
-			pType := "array"
-			prop.Type = []string{pType}
-			prop.Items = &spec.SchemaOrArray{
-				Schema: &spec.Schema{},
-			}
-			iType := tag[2:]
-			prop.Items.Schema.Type = []string{iType}
-			return
-		}
-
-		prop.Type = []string{tag}
-	}
-}
-
-func setUniqueItems(prop *spec.Schema, field reflect.StructField) {
-	tag := field.Tag.Get("unique")
-	switch tag {
-	case "true":
-		prop.UniqueItems = true
-	case "false":
-		prop.UniqueItems = false
-	}
-}
-
-func setReadOnly(prop *spec.Schema, field reflect.StructField) {
-	tag := field.Tag.Get("readOnly")
-	switch tag {
-	case "true":
-		prop.ReadOnly = true
-	case "false":
-		prop.ReadOnly = false
-	}
-}
-
-func setPropertyMetadata(prop *spec.Schema, field reflect.StructField) {
-	setDescription(prop, field)
-	setDefaultValue(prop, field)
-	setEnumValues(prop, field)
-	setMinimum(prop, field)
-	setMaximum(prop, field)
-	setUniqueItems(prop, field)
-	setType(prop, field)
-	setReadOnly(prop, field)
-}

vendor/github.com/emicklei/go-restful-openapi/spec_resource.go

@@ -1,76 +0,0 @@
-package restfulspec
-
-import (
-	restful "github.com/emicklei/go-restful"
-	"github.com/go-openapi/spec"
-)
-
-// NewOpenAPIService returns a new WebService that provides the API documentation of all services
-// conform the OpenAPI documentation specifcation.
-func NewOpenAPIService(config Config) *restful.WebService {
-
-	ws := new(restful.WebService)
-	ws.Path(config.APIPath)
-	ws.Produces(restful.MIME_JSON)
-	if config.DisableCORS {
-		ws.Filter(enableCORS)
-	}
-
-	swagger := BuildSwagger(config)
-	resource := specResource{swagger: swagger}
-	ws.Route(ws.GET("/").To(resource.getSwagger))
-	return ws
-}
-
-// BuildSwagger returns a Swagger object for all services' API endpoints.
-func BuildSwagger(config Config) *spec.Swagger {
-	// collect paths and model definitions to build Swagger object.
-	paths := &spec.Paths{Paths: map[string]spec.PathItem{}}
-	definitions := spec.Definitions{}
-
-	for _, each := range config.WebServices {
-		for path, item := range buildPaths(each, config).Paths {
-			existingPathItem, ok := paths.Paths[path]
-			if ok {
-				for _, r := range each.Routes() {
-					_, patterns := sanitizePath(r.Path)
-					item = buildPathItem(each, r, existingPathItem, patterns, config)
-				}
-			}
-			paths.Paths[path] = item
-		}
-		for name, def := range buildDefinitions(each, config) {
-			definitions[name] = def
-		}
-	}
-	swagger := &spec.Swagger{
-		SwaggerProps: spec.SwaggerProps{
-			Swagger:     "2.0",
-			Paths:       paths,
-			Definitions: definitions,
-		},
-	}
-	if config.PostBuildSwaggerObjectHandler != nil {
-		config.PostBuildSwaggerObjectHandler(swagger)
-	}
-	return swagger
-}
-
-func enableCORS(req *restful.Request, resp *restful.Response, chain *restful.FilterChain) {
-	if origin := req.HeaderParameter(restful.HEADER_Origin); origin != "" {
-		// prevent duplicate header
-		if len(resp.Header().Get(restful.HEADER_AccessControlAllowOrigin)) == 0 {
-			resp.AddHeader(restful.HEADER_AccessControlAllowOrigin, origin)
-		}
-	}
-	chain.ProcessFilter(req, resp)
-}
-
-// specResource is a REST resource to serve the Open-API spec.
-type specResource struct {
-	swagger *spec.Swagger
-}
-
-func (s specResource) getSwagger(req *restful.Request, resp *restful.Response) {
-	resp.WriteAsJson(s.swagger)
-}

vendor/github.com/emicklei/go-restful/.gitignore

@@ -1,70 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe
-
-restful.html
-
-*.out
-
-tmp.prof
-
-go-restful.test
-
-examples/restful-basic-authentication
-
-examples/restful-encoding-filter
-
-examples/restful-filters
-
-examples/restful-hello-world
-
-examples/restful-resource-functions
-
-examples/restful-serve-static
-
-examples/restful-user-service
-
-*.DS_Store
-examples/restful-user-resource
-
-examples/restful-multi-containers
-
-examples/restful-form-handling
-
-examples/restful-CORS-filter
-
-examples/restful-options-filter
-
-examples/restful-curly-router
-
-examples/restful-cpuprofiler-service
-
-examples/restful-pre-post-filters
-
-curly.prof
-
-examples/restful-NCSA-logging
-
-examples/restful-html-template
-
-s.html
-restful-path-tail

vendor/github.com/emicklei/go-restful/.travis.yml

@@ -1,6 +0,0 @@
-language: go
-
-go:
-  - 1.x
-
-script: go test -v

vendor/github.com/emicklei/go-restful/CHANGES.md

@@ -1,246 +0,0 @@
-Change history of go-restful
-=
-
-v2.8.1
-- Fix Parameter 'AllowableValues' to populate swagger definition
-
-v2.8.0
-- add Request.QueryParameters()
-- add json-iterator (via build tag)
-- disable vgo module (until log is moved)
-
-v2.7.1
-- add vgo module
-
-v2.6.1
-- add JSONNewDecoderFunc to allow custom JSON Decoder usage (go 1.10+)
-
-v2.6.0
-- Make JSR 311 routing and path param processing consistent
-- Adding description to RouteBuilder.Reads()
-- Update example for Swagger12 and OpenAPI
-
-2017-09-13
-- added route condition functions using `.If(func)` in route building.
-
-2017-02-16
-- solved issue #304, make operation names unique
-
-2017-01-30
- 
-	[IMPORTANT] For swagger users, change your import statement to:	
-	swagger "github.com/emicklei/go-restful-swagger12"
-
-- moved swagger 1.2 code to go-restful-swagger12
-- created TAG 2.0.0
-
-2017-01-27
-
-- remove defer request body close
-- expose Dispatch for testing filters and Routefunctions
-- swagger response model cannot be array 
-- created TAG 1.0.0
-
-2016-12-22
-
-- (API change) Remove code related to caching request content. Removes SetCacheReadEntity(doCache bool)
-
-2016-11-26
-
-- Default change! now use CurlyRouter (was RouterJSR311)
-- Default change! no more caching of request content
-- Default change! do not recover from panics
-
-2016-09-22
-
-- fix the DefaultRequestContentType feature
-
-2016-02-14
-
-- take the qualify factor of the Accept header mediatype into account when deciding the contentype of the response
-- add constructors for custom entity accessors for xml and json 
-
-2015-09-27
-
-- rename new WriteStatusAnd... to WriteHeaderAnd... for consistency
-
-2015-09-25
-
-- fixed problem with changing Header after WriteHeader (issue 235)
-
-2015-09-14
-
-- changed behavior of WriteHeader (immediate write) and WriteEntity (no status write)
-- added support for custom EntityReaderWriters.
-
-2015-08-06
-
-- add support for reading entities from compressed request content
-- use sync.Pool for compressors of http response and request body
-- add Description to Parameter for documentation in Swagger UI
-
-2015-03-20
-
-- add configurable logging
-
-2015-03-18
-
-- if not specified, the Operation is derived from the Route function
-
-2015-03-17
-
-- expose Parameter creation functions
-- make trace logger an interface
-- fix OPTIONSFilter
-- customize rendering of ServiceError
-- JSR311 router now handles wildcards
-- add Notes to Route
-
-2014-11-27
-
-- (api add) PrettyPrint per response. (as proposed in #167)
-
-2014-11-12
-
-- (api add) ApiVersion(.) for documentation in Swagger UI
-
-2014-11-10
-
-- (api change) struct fields tagged with "description" show up in Swagger UI
-
-2014-10-31
-
-- (api change) ReturnsError -> Returns
-- (api add)    RouteBuilder.Do(aBuilder) for DRY use of RouteBuilder
-- fix swagger nested structs
-- sort Swagger response messages by code
-
-2014-10-23
-
-- (api add) ReturnsError allows you to document Http codes in swagger
-- fixed problem with greedy CurlyRouter
-- (api add) Access-Control-Max-Age in CORS
-- add tracing functionality (injectable) for debugging purposes
-- support JSON parse 64bit int 
-- fix empty parameters for swagger
-- WebServicesUrl is now optional for swagger
-- fixed duplicate AccessControlAllowOrigin in CORS
-- (api change) expose ServeMux in container
-- (api add) added AllowedDomains in CORS
-- (api add) ParameterNamed for detailed documentation
-
-2014-04-16
-
-- (api add) expose constructor of Request for testing.
-
-2014-06-27
-
-- (api add) ParameterNamed gives access to a Parameter definition and its data (for further specification).
-- (api add) SetCacheReadEntity allow scontrol over whether or not the request body is being cached (default true for compatibility reasons).
-
-2014-07-03
-
-- (api add) CORS can be configured with a list of allowed domains
-
-2014-03-12
-
-- (api add) Route path parameters can use wildcard or regular expressions. (requires CurlyRouter)
-
-2014-02-26
-
-- (api add) Request now provides information about the matched Route, see method SelectedRoutePath 
-
-2014-02-17
-
-- (api change) renamed parameter constants (go-lint checks)
-
-2014-01-10
-
-- (api add) support for CloseNotify, see http://golang.org/pkg/net/http/#CloseNotifier
-
-2014-01-07
-
-- (api change) Write* methods in Response now return the error or nil.
-- added example of serving HTML from a Go template.
-- fixed comparing Allowed headers in CORS (is now case-insensitive)
-
-2013-11-13
-
-- (api add) Response knows how many bytes are written to the response body.
-
-2013-10-29
-
-- (api add) RecoverHandler(handler RecoverHandleFunction) to change how panic recovery is handled. Default behavior is to log and return a stacktrace. This may be a security issue as it exposes sourcecode information.
-
-2013-10-04
-
-- (api add) Response knows what HTTP status has been written
-- (api add) Request can have attributes (map of string->interface, also called request-scoped variables
-
-2013-09-12
-
-- (api change) Router interface simplified
-- Implemented CurlyRouter, a Router that does not use|allow regular expressions in paths
-
-2013-08-05
- - add OPTIONS support
- - add CORS support
-
-2013-08-27
-
-- fixed some reported issues (see github)
-- (api change) deprecated use of WriteError; use WriteErrorString instead
-
-2014-04-15
-
-- (fix) v1.0.1 tag: fix Issue 111: WriteErrorString
-
-2013-08-08
-
-- (api add) Added implementation Container: a WebServices collection with its own http.ServeMux allowing multiple endpoints per program. Existing uses of go-restful will register their services to the DefaultContainer.
-- (api add) the swagger package has be extended to have a UI per container.
-- if panic is detected then a small stack trace is printed (thanks to runner-mei)
-- (api add) WriteErrorString to Response
-
-Important API changes:
-
-- (api remove) package variable DoNotRecover no longer works ; use restful.DefaultContainer.DoNotRecover(true) instead.
-- (api remove) package variable EnableContentEncoding no longer works ; use restful.DefaultContainer.EnableContentEncoding(true) instead.
- 
- 
-2013-07-06
-
-- (api add) Added support for response encoding (gzip and deflate(zlib)). This feature is disabled on default (for backwards compatibility). Use restful.EnableContentEncoding = true in your initialization to enable this feature.
-
-2013-06-19
-
-- (improve) DoNotRecover option, moved request body closer, improved ReadEntity
-
-2013-06-03
-
-- (api change) removed Dispatcher interface, hide PathExpression
-- changed receiver names of type functions to be more idiomatic Go
-
-2013-06-02
-
-- (optimize) Cache the RegExp compilation of Paths.
-
-2013-05-22
-	
-- (api add) Added support for request/response filter functions
-
-2013-05-18
-
-
-- (api add) Added feature to change the default Http Request Dispatch function (travis cline)
-- (api change) Moved Swagger Webservice to swagger package (see example restful-user)
-
-[2012-11-14 .. 2013-05-18>
- 
-- See https://github.com/emicklei/go-restful/commits
-
-2012-11-14
-
-- Initial commit
-
-

vendor/github.com/emicklei/go-restful/LICENSE

@@ -1,22 +0,0 @@
-Copyright (c) 2012,2013 Ernest Micklei
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

vendor/github.com/emicklei/go-restful/Makefile

@@ -1,7 +0,0 @@
-all: test
-
-test:
-	go test -v .
-
-ex:
-	cd examples && ls *.go | xargs go build -o /tmp/ignore

vendor/github.com/emicklei/go-restful/README.md

@@ -1,88 +0,0 @@
-go-restful
-==========
-package for building REST-style Web Services using Google Go
-
-[![Build Status](https://travis-ci.org/emicklei/go-restful.png)](https://travis-ci.org/emicklei/go-restful)
-[![Go Report Card](https://goreportcard.com/badge/github.com/emicklei/go-restful)](https://goreportcard.com/report/github.com/emicklei/go-restful)
-[![GoDoc](https://godoc.org/github.com/emicklei/go-restful?status.svg)](https://godoc.org/github.com/emicklei/go-restful)
-
-- [Code examples](https://github.com/emicklei/go-restful/tree/master/examples)
-
-REST asks developers to use HTTP methods explicitly and in a way that's consistent with the protocol definition. This basic REST design principle establishes a one-to-one mapping between create, read, update, and delete (CRUD) operations and HTTP methods. According to this mapping:
-
-- GET = Retrieve a representation of a resource
-- POST = Create if you are sending content to the server to create a subordinate of the specified resource collection, using some server-side algorithm.
-- PUT = Create if you are sending the full content of the specified resource (URI).
-- PUT = Update if you are updating the full content of the specified resource.
-- DELETE = Delete if you are requesting the server to delete the resource
-- PATCH = Update partial content of a resource
-- OPTIONS = Get information about the communication options for the request URI
-    
-### Example
-
-```Go
-ws := new(restful.WebService)
-ws.
-	Path("/users").
-	Consumes(restful.MIME_XML, restful.MIME_JSON).
-	Produces(restful.MIME_JSON, restful.MIME_XML)
-
-ws.Route(ws.GET("/{user-id}").To(u.findUser).
-	Doc("get a user").
-	Param(ws.PathParameter("user-id", "identifier of the user").DataType("string")).
-	Writes(User{}))		
-...
-	
-func (u UserResource) findUser(request *restful.Request, response *restful.Response) {
-	id := request.PathParameter("user-id")
-	...
-}
-```
-	
-[Full API of a UserResource](https://github.com/emicklei/go-restful/tree/master/examples/restful-user-resource.go) 
-		
-### Features
-
-- Routes for request → function mapping with path parameter (e.g. {id}) support
-- Configurable router:
-	- (default) Fast routing algorithm that allows static elements, regular expressions and dynamic parameters in the URL path (e.g. /meetings/{id} or /static/{subpath:*}
-	- Routing algorithm after [JSR311](http://jsr311.java.net/nonav/releases/1.1/spec/spec.html) that is implemented using (but does **not** accept) regular expressions
-- Request API for reading structs from JSON/XML and accesing parameters (path,query,header)
-- Response API for writing structs to JSON/XML and setting headers
-- Customizable encoding using EntityReaderWriter registration
-- Filters for intercepting the request → response flow on Service or Route level
-- Request-scoped variables using attributes
-- Containers for WebServices on different HTTP endpoints
-- Content encoding (gzip,deflate) of request and response payloads
-- Automatic responses on OPTIONS (using a filter)
-- Automatic CORS request handling (using a filter)
-- API declaration for Swagger UI ([go-restful-openapi](https://github.com/emicklei/go-restful-openapi), see [go-restful-swagger12](https://github.com/emicklei/go-restful-swagger12))
-- Panic recovery to produce HTTP 500, customizable using RecoverHandler(...)
-- Route errors produce HTTP 404/405/406/415 errors, customizable using ServiceErrorHandler(...)
-- Configurable (trace) logging
-- Customizable gzip/deflate readers and writers using CompressorProvider registration
-
-## How to customize
-There are several hooks to customize the behavior of the go-restful package.
-
-- Router algorithm
-- Panic recovery
-- JSON decoder
-- Trace logging
-- Compression
-- Encoders for other serializers
-- Use [jsoniter](https://github.com/json-iterator/go) by build this package using a tag, e.g. `go build -tags=jsoniter .`
-
-TODO: write examples of these.
-
-## Resources
-
-- [Example posted on blog](http://ernestmicklei.com/2012/11/go-restful-first-working-example/)
-- [Design explained on blog](http://ernestmicklei.com/2012/11/go-restful-api-design/)
-- [sourcegraph](https://sourcegraph.com/github.com/emicklei/go-restful)
-- [showcase: Zazkia - tcp proxy for testing resiliency](https://github.com/emicklei/zazkia)
-- [showcase: Mora - MongoDB REST Api server](https://github.com/emicklei/mora)
-
-Type ```git shortlog -s``` for a full list of contributors.
-
-© 2012 - 2018, http://ernestmicklei.com. MIT License. Contributions are welcome.