OCIcrypt

https://pkg.go.dev/github.com/containers/ocicrypt
Admin
OCIcrypt is the OCI image spec implementation of container image encryption that provides encoding...
Tokens:25,274
Snippets:363
Trust Score:9.6
Update:5 months ago
Show doc for...
Tokens:
Raw
### Run SoftHSM Setup and Get Public Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Executes the 'softhsm_setup setup' command to initialize the SoftHSM and returns the displayed public key. This function is crucial for setting up the HSM environment.

```go
func (s *SoftHSMSetup) RunSoftHSMSetup(softhsmSetup string) (string, error)
```

--------------------------------

### Get Default PKCS#11 Module Directories

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Retrieves a list of default PKCS#11 module directories that cover various Linux distributions.

```go
func GetDefaultModuleDirectories() []string
```

--------------------------------

### Get Default PKCS#11 Module Directories in YAML Format

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Returns the default PKCS#11 module directories formatted for YAML output, with specified indentation.

```go
func GetDefaultModuleDirectoriesYaml(indent string) string
```

--------------------------------

### Run SoftHSM Get Public Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Executes the 'softhsm_setup getpubkey' command to retrieve the public key from the SoftHSM. This is useful for verifying the HSM's configuration or for use in other cryptographic operations.

```go
func (s *SoftHSMSetup) RunSoftHSMGetPubkey(softhsmSetup string) (string, error)
```

--------------------------------

### Get Key Wrapper by Scheme

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Retrieves the appropriate key wrapper implementation based on the provided encryption scheme string (e.g., "gpg", "jwe").

```go
func GetKeyWrapper(scheme string) keywrap.KeyWrapper
```

--------------------------------

### Get User PKCS#11 Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/pkcs11config

Retrieves the user's PKCS#11 configuration. It first attempts to load from a configuration file, and if none is found, it returns default configurations.

```go
func GetUserPkcs11Config() (*pkcs11.Pkcs11Config, error)
```

--------------------------------

### Get Ocicrypt Configuration Function

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Attempts to read the ocicrypt configuration from the environment variable ${OCICRYPT_KEYPROVIDER_CONFIG} or a default path. Returns a null pointer if no configuration is found or readable.

```go
func GetConfiguration() (*OcicryptConfig, error)
```

--------------------------------

### Define SoftHSMSetup Struct

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Defines the structure for SoftHSM setup. This struct contains internal fields and is typically used to manage the state of the SoftHSM setup process.

```go
type SoftHSMSetup struct {
	// contains filtered or unexported fields
}
```

--------------------------------

### GuessGPGVersion Function

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Attempts to automatically determine the installed GPG version.

```go
func GuessGPGVersion() GPGVersion
```

--------------------------------

### Get SoftHSM Configuration Filename

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Retrieves the path to the SoftHSM configuration file. This function should only be called after 'RunSoftHSMSetup' has been successfully executed.

```go
func (s *SoftHSMSetup) GetConfigFilename() string
```

--------------------------------

### Get Wrapped Keys Map

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Parses a descriptor to extract wrapped keys and returns them as a map where keys are encryption schemes and values are the corresponding wrapped keys.

```go
func GetWrappedKeysMap(desc ocispec.Descriptor) map[string]string
```

--------------------------------

### UnimplementedKeyProviderServiceServer Methods

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Provides default implementations for the UnimplementedKeyProviderServiceServer. These methods are typically used as placeholders or for backward compatibility.

```go
func (*UnimplementedKeyProviderServiceServer) UnWrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
```

```go
func (*UnimplementedKeyProviderServiceServer) WrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
```

--------------------------------

### NewGPGVault Function

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Initializes and returns a new GPGVault.

```go
func NewGPGVault() GPGVault
```

--------------------------------

### IsPrivateKey

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Returns true if the given byte array represents a private key. It returns an error if for example the password is wrong.

```APIDOC
## IsPrivateKey

### Description
Returns true if the given byte array represents a private key. It returns an error if for example the password is wrong.

### Function Signature
```go
func IsPrivateKey(data []byte, password []byte) (bool, error)
```
```

--------------------------------

### Initialize SoftHSMSetup

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Creates a new instance of SoftHSMSetup. This function is used to begin the process of interacting with the SoftHSM.

```go
func NewSoftHSMSetup() *SoftHSMSetup
```

--------------------------------

### SoftHSMSetup Methods

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Provides methods for initializing, configuring, and managing SoftHSM instances.

```APIDOC
## func NewSoftHSMSetup()

### Description
Initializes a new SoftHSMSetup object.

### Returns
* (*SoftHSMSetup) - A pointer to the newly created SoftHSMSetup object.
```

```APIDOC
## func (*SoftHSMSetup) GetConfigFilename()

### Description
GetConfigFilename returns the path to the softhsm configuration file; this function may only be called after RunSoftHSMSetup.

### Returns
* (string) - The path to the SoftHSM configuration file.
```

```APIDOC
## func (*SoftHSMSetup) RunSoftHSMGetPubkey(softhsmSetup string)

### Description
RunSoftHSMGetPubkey runs 'softhsm_setup getpubkey' and returns the public key.

### Parameters
#### Path Parameters
- **softhsmSetup** (string) - Required - The setup string for SoftHSM.

### Returns
* (string) - The retrieved public key.
* (error) - An error if the operation fails.
```

```APIDOC
## func (*SoftHSMSetup) RunSoftHSMSetup(softhsmSetup string)

### Description
RunSoftHSMSetup runs 'softhsm_setup setup' and returns the public key that was displayed.

### Parameters
#### Path Parameters
- **softhsmSetup** (string) - Required - The setup string for SoftHSM.

### Returns
* (string) - The displayed public key.
* (error) - An error if the operation fails.
```

```APIDOC
## func (*SoftHSMSetup) RunSoftHSMTeardown(softhsmSetup string)

### Description
RunSoftHSMTeardown runs 'softhsm_setup teardown'.

### Parameters
#### Path Parameters
- **softhsmSetup** (string) - Required - The setup string for SoftHSM.
```

--------------------------------

### Create a New Key Wrapper

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/pkcs7

Use NewKeyWrapper to obtain a new instance of the key wrapping interface. This function initializes the PKCS#7 key wrapper.

```go
func NewKeyWrapper() keywrap.KeyWrapper
```

--------------------------------

### NewKeyProviderServiceClient Function

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Creates a new KeyProviderServiceClient. This function is used to establish a client connection to the Key Provider service.

```go
func NewKeyProviderServiceClient(cc grpc.ClientConnInterface) KeyProviderServiceClient
```

--------------------------------

### Command Structure for Executable

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Represents a command to be executed, including its path and arguments. Used for invoking external key provider binaries.

```go
type Command struct {
	Path string   `json:"path,omitempty"`
	Args []string `json:"args,omitempty"`
}
```

--------------------------------

### NewGPGClient Function

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Creates a new GPG client instance. Requires specifying the GPG version and the GPG home directory.

```go
func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput String Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Returns a string representation of the KeyProviderKeyWrapProtocolOutput message. Useful for debugging.

```go
func (m *KeyProviderKeyWrapProtocolOutput) String() string
```

--------------------------------

### Define Configuration File Constant

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/pkcs11config

Defines the default configuration file name used by the package.

```go
const CONFIGFILE = "ocicrypt.conf"
```

--------------------------------

### Create Test CA

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Generates a root Certificate Authority (CA) for testing environments. Returns the CA's private key and certificate.

```go
func CreateTestCA() (*rsa.PrivateKey, *x509.Certificate, error)
```

--------------------------------

### KeyProviderKeyWrapProtocolInput String Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Returns a string representation of the KeyProviderKeyWrapProtocolInput message. Useful for debugging.

```go
func (m *KeyProviderKeyWrapProtocolInput) String() string
```

--------------------------------

### CreateRSATestKey

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates an RSA key of the given size and returns the public and private key in PEM or DER format.

```APIDOC
## CreateRSATestKey

### Description
Creates an RSA key of the given size and returns the public and private key in PEM or DER format.

### Function Signature
```go
func CreateRSATestKey(bits int, password []byte, pemencode bool) ([]byte, []byte, error)
```
```

--------------------------------

### UnimplementedKeyProviderServiceServer WrapKey Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Default implementation for the WrapKey RPC. This method is part of the UnimplementedKeyProviderServiceServer and can be overridden.

```go
func (*UnimplementedKeyProviderServiceServer) WrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput ProtoMessage Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Indicates that KeyProviderKeyWrapProtocolOutput is a protobuf message. This is part of the protobuf interface.

```go
func (*KeyProviderKeyWrapProtocolOutput) ProtoMessage()
```

--------------------------------

### Runner Exec Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Executes a Linux command line command, returning its output and any error.

```go
func (r Runner) Exec(cmdName string, args []string, input []byte) ([]byte, error)
```

--------------------------------

### DecryptWithPrivKeys

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for decryption using provided private keys.

```APIDOC
## DecryptWithPrivKeys

### Description
Returns a CryptoConfig to decrypt with configured private keys.

### Signature
```go
func DecryptWithPrivKeys(privKeys [][]byte, privKeysPasswords [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### Create Crypto Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/helpers

Use this function to create an encryption configuration from a list of recipient strings and private key paths. Ensure all necessary keys and recipient identifiers are provided.

```go
func CreateCryptoConfig(recipients []string, keys []string) (encconfig.CryptoConfig, error)
```

--------------------------------

### EncryptWithPkcs7

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for encryption using PKCS#7.

```APIDOC
## EncryptWithPkcs7

### Description
Returns a CryptoConfig to encrypt with pkcs7 x509 certs.

### Signature
```go
func EncryptWithPkcs7(x509s [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### EncryptWithKeyProvider

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for encryption using a key provider.

```APIDOC
## EncryptWithKeyProvider

### Description
Returns a CryptoConfig to encrypt with configured keyprovider parameters.

### Signature
```go
func EncryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### Initialize Decryption Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

InitDecryption initializes a CryptoConfig object with parameters specifically for decryption.

```go
func InitDecryption(dcparameters map[string][][]byte) CryptoConfig
```

--------------------------------

### NewGPGVault

Source: https://pkg.go.dev/github.com/containers/ocicrypt

NewGPGVault creates an empty GPGVault.

```APIDOC
## func NewGPGVault

### Description
Creates an empty GPGVault.

### Signature
```go
func NewGPGVault() GPGVault
```
```

--------------------------------

### Create RSA Test Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates an RSA key of a given size for testing. Returns public and private keys in PEM or DER format, with optional password protection.

```go
func CreateRSATestKey(bits int, password []byte, pemencode bool) ([]byte, []byte, error)
```

--------------------------------

### NewGPGClient

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Creates a new GPG client for interacting with GPG.

```APIDOC
## NewGPGClient

### Description
Initializes a new GPG client.

### Function Signature
```go
func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error)
```

### Parameters
- **gpgVersion** (string) - The version of GPG to use.
- **gpgHomeDir** (string) - The home directory for GPG.

### Returns
- **GPGClient** - An initialized GPG client.
- **error** - An error if the client creation fails.
```

--------------------------------

### UnimplementedKeyProviderServiceServer UnWrapKey Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Default implementation for the UnWrapKey RPC. This method is part of the UnimplementedKeyProviderServiceServer and can be overridden.

```go
func (*UnimplementedKeyProviderServiceServer) UnWrapKey(ctx context.Context, req *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
```

--------------------------------

### NewKeyProviderServiceClient Function

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Factory function to create a new KeyProviderServiceClient.

```APIDOC
## NewKeyProviderServiceClient

### Description
Creates a new instance of the KeyProviderServiceClient.

### Signature
```go
func NewKeyProviderServiceClient(cc grpc.ClientConnInterface) KeyProviderServiceClient
```

### Parameters
- **cc** (grpc.ClientConnInterface) - The gRPC client connection to use for the service client.
```

--------------------------------

### Pkcs11KeyFileObject Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Represents a PKCS#11 key file with the PKCS#11 URI parsed into an object.

```go
type Pkcs11KeyFileObject struct {
	Uri *pkcs11uri.Pkcs11URI
}
```

--------------------------------

### KeyProviderServiceServer Interface Definition

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Defines the server interface for the KeyProviderService. It includes methods for handling key wrap and unwrap requests.

```go
type KeyProviderServiceServer interface {
	WrapKey(context.Context, *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
	UnWrapKey(context.Context, *KeyProviderKeyWrapProtocolInput) (*KeyProviderKeyWrapProtocolOutput, error)
}
```

--------------------------------

### Pkcs11KeyFile Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Defines the structure for a PKCS#11 key file, including the PKCS#11 URI and module-related environment variables.

```go
type Pkcs11KeyFile struct {
	Pkcs11 struct {
		Uri string `yaml:"uri"`
	} `yaml:"pkcs11"`
	Module struct {
		Env map[string]string `yaml:"env,omitempty"`
	} `yaml:"module"`
}
```

--------------------------------

### Run SoftHSM Teardown

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/softhsm

Executes the 'softhsm_setup teardown' command to clean up and remove the SoftHSM instance. This function is used to reset the HSM to its initial state.

```go
func (s *SoftHSMSetup) RunSoftHSMTeardown(softhsmSetup string)
```

--------------------------------

### PKCS#11 Configuration Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Represents the structure of a PKCS#11 configuration file, specifying module directories and allowed module paths.

```go
type Pkcs11Config struct {
	ModuleDirectories  []string `yaml:"module-directories"`
	AllowedModulePaths []string `yaml:"allowed-module-paths"`
}
```

--------------------------------

### Encrypt with PKCS7

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

EncryptWithPkcs7 returns a CryptoConfig configured for encryption using PKCS7 with provided X509 certificates.

```go
func EncryptWithPkcs7(x509s [][]byte) (CryptoConfig, error)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput XXX_Size Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Returns the size of the KeyProviderKeyWrapProtocolOutput message in bytes. Used for serialization and other protobuf operations.

```go
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Size() int
```

--------------------------------

### EncryptWithPkcs11

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for encryption using PKCS#11.

```APIDOC
## EncryptWithPkcs11

### Description
Returns a CryptoConfig to encrypt with configured pkcs11 parameters.

### Signature
```go
func EncryptWithPkcs11(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Pubkeys, pkcs11Yamls [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput Descriptor Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Returns the descriptor for the KeyProviderKeyWrapProtocolOutput type. This is part of the protobuf reflection interface.

```go
func (*KeyProviderKeyWrapProtocolOutput) Descriptor() ([]byte, []int)
```

--------------------------------

### KeyProviderKeyWrapProtocolInput XXX_Size Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Returns the size of the KeyProviderKeyWrapProtocolInput message in bytes. Used for serialization and other protobuf operations.

```go
func (m *KeyProviderKeyWrapProtocolInput) XXX_Size() int
```

--------------------------------

### InitDecryption

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig object with parameters for decryption.

```APIDOC
## InitDecryption

### Description
Initialized a CryptoConfig object with parameters used for decryption.

### Signature
```go
func InitDecryption(dcparameters map[string][][]byte) CryptoConfig
```
```

--------------------------------

### KeyProviderKeyWrapProtocolInput ProtoMessage Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Indicates that KeyProviderKeyWrapProtocolInput is a protobuf message. This is part of the protobuf interface.

```go
func (*KeyProviderKeyWrapProtocolInput) ProtoMessage()
```

--------------------------------

### CommandExecuter Interface

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Defines an interface for executing commands with arguments and input, returning output and errors.

```go
type CommandExecuter interface {
	Exec(string, []string, []byte) ([]byte, error)
}
```

--------------------------------

### GetConfiguration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Retrieves the ocicrypt configuration. It attempts to read the configuration from the environment variable OCICRYPT_KEYPROVIDER_CONFIG or defaults to /etc/ocicrypt_keyprovider.yaml. If no configuration is found or readable, it returns a nil pointer and an error.

```APIDOC
## GetConfiguration

### Description
Retrieves the ocicrypt configuration from the specified file path or environment variable.

### Function Signature
```go
func GetConfiguration() (*OcicryptConfig, error)
```

### Returns
- `*OcicryptConfig`: A pointer to the OcicryptConfig structure if the configuration is successfully read.
- `error`: An error if the configuration file cannot be found or read.
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput XXX_Marshal Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Marshals the KeyProviderKeyWrapProtocolOutput message into a byte slice. Supports deterministic marshaling.

```go
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
```

--------------------------------

### Runner.Exec

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Executes a command with the given arguments and input.

```APIDOC
## Runner.Exec

### Description
Executes a command with the given arguments and input.

### Method Signature
```go
func (r Runner) Exec(cmdName string, args []string, input []byte) ([]byte, error)
```
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/keyprovider

KeyProviderKeyWrapProtocolOutput defines the output of the key provider binary or grpc method. It contains results for either key wrap or key unwrap operations.

```APIDOC
## type KeyProviderKeyWrapProtocolOutput

### Description
KeyProviderKeyWrapProtocolOutput defines the output of the key provider binary or grpc method.

### Fields
- **KeyWrapResults** (KeyWrapResults) - Optional - Encodes the results of a key wrap operation.
- **KeyUnwrapResults** (KeyUnwrapResults) - Optional - Encodes the results of a key unwrap operation.

### JSON Structure
```json
{
  "keywrapresults": { ... },
  "keyunwrapresults": { ... }
}
```
```

--------------------------------

### DecryptWithGpgPrivKeys

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for decryption using GPG private keys.

```APIDOC
## DecryptWithGpgPrivKeys

### Description
Returns a CryptoConfig to decrypt with configured gpg private keys.

### Signature
```go
func DecryptWithGpgPrivKeys(gpgPrivKeys, gpgPrivKeysPwds [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### Parse PKCS#11 Configuration File

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Parses a PKCS#11 configuration file from a byte slice, influencing module search behavior and allowed modules.

```go
func ParsePkcs11ConfigFile(yamlstr []byte) (*Pkcs11Config, error)
```

--------------------------------

### Register Key Wrapper

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Allows for the registration of custom key wrapper implementations, associating them with a specific encryption scheme string.

```go
func RegisterKeyWrapper(scheme string, iface keywrap.KeyWrapper)
```

--------------------------------

### NewGPGClient

Source: https://pkg.go.dev/github.com/containers/ocicrypt

NewGPGClient creates a new GPGClient object representing the given version and using the given home directory.

```APIDOC
## func NewGPGClient

### Description
Creates a new GPGClient object representing the given version and using the given home directory.

### Signature
```go
func NewGPGClient(gpgVersion, gpgHomeDir string) (GPGClient, error)
```
```

--------------------------------

### Create RSA Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates an RSA private key with a specified bit size. Use this for RSA cryptography.

```go
func CreateRSAKey(bits int) (*rsa.PrivateKey, error)
```

--------------------------------

### EncryptWithGpg

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for encryption using GPG.

```APIDOC
## EncryptWithGpg

### Description
Returns a CryptoConfig to encrypt with configured gpg parameters.

### Signature
```go
func EncryptWithGpg(gpgRecipients [][]byte, gpgPubRingFile []byte) (CryptoConfig, error)
```
```

--------------------------------

### Register KeyProviderServiceServer

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Registers a KeyProviderServiceServer implementation with a gRPC server. This is essential for making the key provider service available over gRPC.

```go
func RegisterKeyProviderServiceServer(s *grpc.Server, srv KeyProviderServiceServer)
```

--------------------------------

### DecryptWithKeyProvider

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for decryption using a key provider.

```APIDOC
## DecryptWithKeyProvider

### Description
Returns a CryptoConfig to decrypt with configured keyprovider parameters.

### Signature
```go
func DecryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### DecryptWithX509s

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for decryption using X.509 certificates.

```APIDOC
## DecryptWithX509s

### Description
Returns a CryptoConfig to decrypt with configured x509 certs.

### Signature
```go
func DecryptWithX509s(x509s [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### KeyProviderKeyWrapProtocolInput XXX_Marshal Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Marshals the KeyProviderKeyWrapProtocolInput message into a byte slice. Supports deterministic marshaling.

```go
func (m *KeyProviderKeyWrapProtocolInput) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
```

--------------------------------

### CreateRSAKey

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates an RSA key.

```APIDOC
## CreateRSAKey

### Description
Creates an RSA key.

### Function Signature
```go
func CreateRSAKey(bits int) (*rsa.PrivateKey, error)
```
```

--------------------------------

### Create Decrypt Crypto Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/helpers

Use this function to create a decryption configuration from a list of key paths and recipient strings. This is useful for setting up decryption from command-line options.

```go
func CreateDecryptCryptoConfig(keys []string, decRecipients []string) (encconfig.CryptoConfig, error)
```

--------------------------------

### Initialize OCICrypt Encryption Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig object for encryption. It accepts parameters for encryption and optional parameters needed for decryption when adding recipients to an already encrypted image.

```go
func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig
```

--------------------------------

### NewGPGVault

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Creates a new GPG vault.

```APIDOC
## NewGPGVault

### Description
Initializes a new GPG vault.

### Function Signature
```go
func NewGPGVault() GPGVault
```

### Returns
- **GPGVault** - An initialized GPG vault.
```

--------------------------------

### Create io.Reader from io.ReaderAt

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Converts an io.ReaderAt interface to an io.Reader interface, allowing for reading data sequentially.

```go
func ReaderFromReaderAt(r io.ReaderAt) io.Reader
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput GetKeyProviderKeyWrapProtocolOutput Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Retrieves the byte slice containing the wrapped key data.

```go
func (m *KeyProviderKeyWrapProtocolOutput) GetKeyProviderKeyWrapProtocolOutput() []byte
```

--------------------------------

### Encrypt with GPG

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

EncryptWithGpg returns a CryptoConfig configured for encryption using provided GPG recipients and a public ring file.

```go
func EncryptWithGpg(gpgRecipients [][]byte, gpgPubRingFile []byte) (CryptoConfig, error)
```

--------------------------------

### KeyProviderKeyWrapProtocolInput XXX_Unmarshal Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Unmarshals data from a byte slice into the KeyProviderKeyWrapProtocolInput message. Handles parsing protobuf data.

```go
func (m *KeyProviderKeyWrapProtocolInput) XXX_Unmarshal(b []byte) error
```

--------------------------------

### KeyProviderKeyWrapProtocolInput GetKeyProviderKeyWrapProtocolInput Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Retrieves the byte slice containing the data for key wrap protocol input.

```go
func (m *KeyProviderKeyWrapProtocolInput) GetKeyProviderKeyWrapProtocolInput() []byte
```

--------------------------------

### KeyProviderServiceClient Interface Definition

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Defines the client interface for the KeyProviderService. It includes methods for wrapping and unwrapping keys.

```go
type KeyProviderServiceClient interface {
	WrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error)
	UnWrapKey(ctx context.Context, in *KeyProviderKeyWrapProtocolInput, opts ...grpc.CallOption) (*KeyProviderKeyWrapProtocolOutput, error)
}
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput Reset Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Resets the KeyProviderKeyWrapProtocolOutput message to its default state. This is a standard method for protobuf messages.

```go
func (m *KeyProviderKeyWrapProtocolOutput) Reset()
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput XXX_Unmarshal Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Unmarshals data from a byte slice into the KeyProviderKeyWrapProtocolOutput message. Handles parsing protobuf data.

```go
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Unmarshal(b []byte) error
```

--------------------------------

### InitEncryption

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig object with parameters for encryption.

```APIDOC
## InitEncryption

### Description
Initialized a CryptoConfig object with parameters used for encryption.

### Signature
```go
func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig
```
```

--------------------------------

### Encrypt with PKCS11

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

EncryptWithPkcs11 returns a CryptoConfig configured for encryption using PKCS11 with provided configuration, public keys, and YAML files. Added in v1.1.0.

```go
func EncryptWithPkcs11(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Pubkeys, pkcs11Yamls [][]byte) (CryptoConfig, error)
```

--------------------------------

### InitEncryption

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig object with parameters for encryption and decryption.

```APIDOC
## InitEncryption

### Description
Initializes a CryptoConfig object with parameters used for encryption. It also takes dcparameters that may be needed for decryption when adding a recipient to an already encrypted image.

### Signature
```go
func InitEncryption(parameters, dcparameters map[string][][]byte) CryptoConfig
```
```

--------------------------------

### KeyProviderKeyWrapProtocolInput XXX_Merge Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Merges another protobuf message into the KeyProviderKeyWrapProtocolInput message. Handles merging fields from a source message.

```go
func (m *KeyProviderKeyWrapProtocolInput) XXX_Merge(src proto.Message)
```

--------------------------------

### KeyProviderKeyWrapProtocolInput

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/keyprovider

KeyProviderKeyWrapProtocolInput defines the input to the key provider binary or grpc method. It specifies the operation (keywrap or keyunwrap) and associated parameters.

```APIDOC
## type KeyProviderKeyWrapProtocolInput

### Description
KeyProviderKeyWrapProtocolInput defines the input to the key provider binary or grpc method.

### Fields
- **Operation** (KeyProviderKeyWrapProtocolOperation) - Required - Specifies the operation, either "keywrap" or "keyunwrap".
- **KeyWrapParams** (KeyWrapParams) - Optional - Encodes the arguments for key wrap operation.
- **KeyUnwrapParams** (KeyUnwrapParams) - Optional - Encodes the arguments for key unwrap operation.

### JSON Structure
```json
{
  "op": "keywrap" | "keyunwrap",
  "keywrapparams": { ... },
  "keyunwrapparams": { ... }
}
```
```

--------------------------------

### KeyProviderServiceServer Interface

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

The server interface for the KeyProviderService, defining methods that must be implemented by a server.

```APIDOC
## KeyProviderServiceServer Interface

### Description
This interface defines the server-side operations for the KeyProviderService. Implementations of this interface handle incoming requests for key operations.

### Methods
- **WrapKey**: Handles requests to wrap a key.
- **UnWrapKey**: Handles requests to unwrap a key.

### Server Implementation Example (Conceptual)
```go
type myKeyProviderServer struct {
	keyprovider.UnimplementedKeyProviderServiceServer
}

func (s *myKeyProviderServer) WrapKey(ctx context.Context, req *keyprovider.KeyProviderKeyWrapProtocolInput) (*keyprovider.KeyProviderKeyWrapProtocolOutput, error) {
	// Implementation for wrapping key
	return &keyprovider.KeyProviderKeyWrapProtocolOutput{}, nil
}

func (s *myKeyProviderServer) UnWrapKey(ctx context.Context, req *keyprovider.KeyProviderKeyWrapProtocolInput) (*keyprovider.KeyProviderKeyWrapProtocolOutput, error) {
	// Implementation for unwrapping key
	return &keyprovider.KeyProviderKeyWrapProtocolOutput{}, nil
}
```
```

--------------------------------

### CreateECDSAKey

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates an elliptic curve key for the given curve.

```APIDOC
## CreateECDSAKey

### Description
Creates an elliptic curve key for the given curve.

### Function Signature
```go
func CreateECDSAKey(curve elliptic.Curve) (*ecdsa.PrivateKey, error)
```
```

--------------------------------

### KeyProviderKeyWrapProtocolInput Descriptor Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Returns the descriptor for the KeyProviderKeyWrapProtocolInput type. This is part of the protobuf reflection interface.

```go
func (*KeyProviderKeyWrapProtocolInput) Descriptor() ([]byte, []int)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput XXX_Merge Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Merges another protobuf message into the KeyProviderKeyWrapProtocolOutput message. Handles merging fields from a source message.

```go
func (m *KeyProviderKeyWrapProtocolOutput) XXX_Merge(src proto.Message)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Defines the output structure for key wrap protocol operations. It contains the result of the key wrap, typically a byte slice.

```go
type KeyProviderKeyWrapProtocolOutput struct {
	KeyProviderKeyWrapProtocolOutput []byte   `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolOutput,proto3" json:"KeyProviderKeyWrapProtocolOutput,omitempty"
	XXX_NoUnkeyedLiteral            struct{} `json:"-"
	XXX_unrecognized                []byte   `json:"-"
	XXX_sizecache                   int32    `json:"-"
}
```

--------------------------------

### CreateTestCA

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates a root CA for testing.

```APIDOC
## CreateTestCA

### Description
Creates a root CA for testing.

### Function Signature
```go
func CreateTestCA() (*rsa.PrivateKey, *x509.Certificate, error)
```
```

--------------------------------

### GetDefaultModuleDirectories

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

GetDefaultModuleDirectories returns module directories covering a variety of Linux distros

```APIDOC
## GetDefaultModuleDirectories

### Description
GetDefaultModuleDirectories returns module directories covering a variety of Linux distros

### Function Signature
```go
func GetDefaultModuleDirectories() []string
```
```

--------------------------------

### GetUserPkcs11Config

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/pkcs11config

Retrieves the user's PKCS#11 configuration. It first attempts to load the configuration from a file. If no configuration file is found, it returns the default PKCS#11 configurations.

```APIDOC
## GetUserPkcs11Config

### Description
GetUserPkcs11Config gets the user's Pkcs11Conig either from a configuration file or if none is found the default ones are returned.

### Function Signature
```go
func GetUserPkcs11Config() (*pkcs11.Pkcs11Config, error)
```

### Returns
- `*pkcs11.Pkcs11Config`: A pointer to the PKCS#11 configuration object.
- `error`: An error if the configuration cannot be retrieved.
```

--------------------------------

### Runner Exec Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Executes a Linux command line command and returns its output along with any error that occurs.

```APIDOC
## func (Runner) Exec

### Description
ExecuteCommand is used to execute a linux command line command and return the output of the command with an error if it exists.

### Signature
```go
func (r Runner) Exec(cmdName string, args []string, input []byte) ([]byte, error)
```
```

--------------------------------

### Ocicrypt Configuration Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Represents the overall structure of an ocicrypt provider configuration file, mapping key provider names to their attributes.

```go
type OcicryptConfig struct {
	KeyProviderConfig map[string]KeyProviderAttrs `json:"key-providers"`
}
```

--------------------------------

### Environment Variable for Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Defines the environment variable name used to specify the ocicrypt key provider configuration file path.

```go
const ENVVARNAME = "OCICRYPT_KEYPROVIDER_CONFIG"
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Represents the output structure for key wrap protocol operations. It contains the wrapped key data.

```APIDOC
## type KeyProviderKeyWrapProtocolOutput

### Description
Represents the output structure for key wrap protocol operations.

### Fields
- **KeyProviderKeyWrapProtocolOutput** ([]byte) - The wrapped key data.
```

--------------------------------

### KeyProviderKeyWrapProtocolInput Reset Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Resets the KeyProviderKeyWrapProtocolInput message to its default state. This is a standard method for protobuf messages.

```go
func (m *KeyProviderKeyWrapProtocolInput) Reset()
```

--------------------------------

### Encrypt with Key Provider

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

EncryptWithKeyProvider returns a CryptoConfig for encryption using parameters from a configured key provider. Added in v1.1.0.

```go
func EncryptWithKeyProvider(keyProviders [][]byte) (CryptoConfig, error)
```

--------------------------------

### CreateCryptoConfig

Source: https://pkg.go.dev/github.com/containers/ocicrypt/helpers

Creates a CryptoConfig object from a list of recipient strings and private key paths. This is used for encrypting data.

```APIDOC
## func CreateCryptoConfig

### Description
CreateCryptoConfig from the list of recipient strings and list of key paths of private keys.

### Signature
```go
func CreateCryptoConfig(recipients []string, keys []string) (encconfig.CryptoConfig, error)
```

### Parameters
#### Path Parameters
- **recipients** ([]string) - Description: List of recipient identifiers.
- **keys** ([]string) - Description: List of paths to private keys.

### Returns
- **encconfig.CryptoConfig** - The created crypto configuration object.
- **error** - An error if the configuration creation fails.
```

--------------------------------

### Parse Certificate

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Parses an x.509 certificate from a byte array, with an optional prefix. Returns the certificate object or an error.

```go
func ParseCertificate(certBytes []byte, prefix string) (*x509.Certificate, error)
```

--------------------------------

### DecryptWithPkcs11Yaml

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for decryption using PKCS#11 configurations from YAML files.

```APIDOC
## DecryptWithPkcs11Yaml

### Description
Returns a CryptoConfig to decrypt with pkcs11 YAML formatted key files.

### Signature
```go
func DecryptWithPkcs11Yaml(pkcs11Config *pkcs11.Pkcs11Config, pkcs11Yamls [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### UnimplementedKeyProviderServiceServer Struct Definition

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

A base struct for implementing the KeyProviderServiceServer interface. Embedding this struct allows for forward-compatible implementations.

```go
type UnimplementedKeyProviderServiceServer struct {
}
```

--------------------------------

### Define Environment Variable Constant

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/pkcs11config

Defines the environment variable name for overriding the configuration file path.

```go
const ENVVARNAME = "OCICRYPT_CONFIG"
```

--------------------------------

### NewKeyWrapper

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/keyprovider

NewKeyWrapper returns a new key wrapping interface using keyprovider.

```APIDOC
## func NewKeyWrapper

### Description
NewKeyWrapper returns a new key wrapping interface using keyprovider.

### Signature
```go
func NewKeyWrapper(p string, a keyproviderconfig.KeyProviderAttrs) keywrap.KeyWrapper
```
```

--------------------------------

### CommandExecuter Interface

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

An interface for executing commands. It defines a single method `Exec` which takes a command name, arguments, and input bytes, returning output bytes and an error.

```APIDOC
## type CommandExecuter

### Description
An interface for executing commands. The first argument is the command, like `cat` or `echo`, the second is the list of arguments to pass to it.

### Methods
#### Exec
```go
func (c *CommandExecuter) Exec(string, []string, []byte) ([]byte, error)
```
```

--------------------------------

### Combine Multiple CryptoConfigs

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

CombineCryptoConfigs takes a list of CryptoConfig objects and merges them into a single CryptoConfig.

```go
func CombineCryptoConfigs(ccs []CryptoConfig) CryptoConfig
```

--------------------------------

### Parse Public Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Parses a public key from byte data, with an optional prefix. Returns the parsed key or an error.

```go
func ParsePublicKey(pubKey []byte, prefix string) (interface{}, error)
```

--------------------------------

### GetOpt Method for LayerBlockCipherOptions

Source: https://pkg.go.dev/github.com/containers/ocicrypt/blockcipher

Retrieves the value of a cipher option by its key. Indicates whether the option exists.

```go
func (lbco LayerBlockCipherOptions) GetOpt(key string) (value []byte, ok bool)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput Struct Definition

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Defines the output structure for key wrap protocol operations. This struct contains the wrapped key data.

```go
type KeyProviderKeyWrapProtocolOutput struct {
	KeyProviderKeyWrapProtocolOutput []byte   `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolOutput,proto3" json:"KeyProviderKeyWrapProtocolOutput,omitempty"
	XXX_NoUnkeyedLiteral             struct{} `json:"-"
	XXX_unrecognized                 []byte   `json:"-"
	XXX_sizecache                    int32    `json:"-"
}
```

--------------------------------

### KeyProviderKeyWrapProtocolInput Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Defines the input structure for key wrap protocol operations. It contains the data to be wrapped, typically a byte slice.

```go
type KeyProviderKeyWrapProtocolInput struct {
	KeyProviderKeyWrapProtocolInput []byte   `protobuf:"bytes,1,opt,name=KeyProviderKeyWrapProtocolInput,proto3" json:"KeyProviderKeyWrapProtocolInput,omitempty"
	XXX_NoUnkeyedLiteral            struct{} `json:"-"
	XXX_unrecognized                []byte   `json:"-"
	XXX_sizecache                   int32    `json:"-"
}
```

--------------------------------

### Key Provider Attributes Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Defines the attributes for a key provider, specifying how it can be invoked, either via a command or gRPC with TLS settings.

```go
type KeyProviderAttrs struct {
	Command *Command `json:"cmd,omitempty"`
	Grpc    string   `json:"grpc,omitempty"`
	GrpcTLS *GrpcTLS `json:"grpc-tls,omitempty"`
}
```

--------------------------------

### OcicryptConfig Structure

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/pkcs11config

Represents the structure of an imgcrypt.conf configuration file, specifically for PKCS#11 settings.

```go
type OcicryptConfig struct {
	Pkcs11Config pkcs11.Pkcs11Config `yaml:"pkcs11"`
}
```

--------------------------------

### Parse Private Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Parses a private key from byte data, supporting different formats with an optional password and prefix. Returns the parsed key or an error.

```go
func ParsePrivateKey(privKey, privKeyPassword []byte, prefix string) (interface{}, error)
```

--------------------------------

### NewKeyWrapper

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/pkcs11

NewKeyWrapper returns a new key wrapping interface using pkcs11.

```APIDOC
## func NewKeyWrapper()

### Description
NewKeyWrapper returns a new key wrapping interface using pkcs11.

### Signature
```go
func NewKeyWrapper() keywrap.KeyWrapper
```
```

--------------------------------

### Encrypt Data with PKCS#11 Public Keys

Source: https://pkg.go.dev/github.com/containers/ocicrypt/crypto/pkcs11

Encrypts data for one or multiple PKCS#11 devices using provided public keys. The output is a JSON string of encrypted blobs.

```go
func EncryptMultiple(pubKeys []interface{}, data []byte) ([]byte, error)
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput Type - OCICrypt

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/keyprovider

Defines the output structure for the key provider's binary or gRPC method. Contains results for either key wrap or key unwrap operations.

```go
type KeyProviderKeyWrapProtocolOutput struct {
	// KeyWrapResult encodes the results to key wrap if operation is to wrap
	KeyWrapResults KeyWrapResults `json:"keywrapresults,omitempty"`
	// KeyUnwrapResult encodes the result to key unwrap if operation is to unwrap
	KeyUnwrapResults KeyUnwrapResults `json:"keyunwrapresults,omitempty"`
}
```

--------------------------------

### Decrypt with Private Keys

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

DecryptWithPrivKeys returns a CryptoConfig configured for decryption using provided private keys and their passwords.

```go
func DecryptWithPrivKeys(privKeys [][]byte, privKeysPasswords [][]byte) (CryptoConfig, error)
```

--------------------------------

### NewKeyWrapper Function - OCICrypt

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/keyprovider

Returns a new key wrapping interface using the specified key provider.

```go
func NewKeyWrapper(p string, a keyproviderconfig.KeyProviderAttrs) keywrap.KeyWrapper
```

--------------------------------

### Decrypt Layer Symmetric Keys with GPG

Source: https://pkg.go.dev/github.com/containers/ocicrypt

Walks through layer descriptors to decrypt symmetric keys using GPG. It checks for private keys in the GPG vault or on the system and prompts for passwords if necessary. An error is returned if a private key cannot be found for a layer's symmetric key.

```go
func GPGGetPrivateKey(descs []ocispec.Descriptor, gpgClient GPGClient, gpgVault GPGVault, mustFindKey bool) (gpgPrivKeys [][]byte, gpgPrivKeysPwds [][]byte, err error)
```

--------------------------------

### KeyProviderServiceClient Interface

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

The client interface for the KeyProviderService, defining methods for clients to interact with the service.

```APIDOC
## KeyProviderServiceClient Interface

### Description
This interface defines the client-side operations available for the KeyProviderService.

### Methods
- **WrapKey**: Encrypts a key using the Key Provider service.
- **UnWrapKey**: Decrypts a key using the Key Provider service.

### Usage Example (Conceptual)
```go
// Assuming cc is an established grpc.ClientConn
client := keyprovider.NewKeyProviderServiceClient(cc)

// To wrap a key:
// wrapReq := &keyprovider.KeyProviderKeyWrapProtocolInput{...}
// wrapResp, err := client.WrapKey(context.Background(), wrapReq)

// To unwrap a key:
// unwrapReq := &keyprovider.KeyProviderKeyWrapProtocolInput{...}
// unwrapResp, err := client.UnWrapKey(context.Background(), unwrapReq)
```
```

--------------------------------

### EncryptWithJwe

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Initializes a CryptoConfig for encryption using JSON Web Encryption (JWE).

```APIDOC
## EncryptWithJwe

### Description
Returns a CryptoConfig to encrypt with jwe public keys.

### Signature
```go
func EncryptWithJwe(pubKeys [][]byte) (CryptoConfig, error)
```
```

--------------------------------

### gRPC TLS Configuration

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config/keyprovider-config

Defines TLS settings for gRPC connections, including certificate authority files, client certificates, and server name verification. Use 'InsecureSkipVerify' only for testing.

```go
type GrpcTLS struct {
	// RootCAFile defines path to the PEM file with the set of root certificate authorities
	// that clients use when verifying server certificates.
	// If RootCAs is nil, TLS uses the host's root CA set.
	RootCAFile string `json:"root-ca-file,omitempty"`

	// CertFile contains the path to the x509 PEM encoded client certificate.
	CertFile string `json:"cert-file,omitempty"`
	// KeyFile contains the path to the PEM encoded client key.
	KeyFile string `json:"key-file,omitempty"`

	// ServerName is used to verify the hostname on the returned
	// certificates unless InsecureSkipVerify is given. It is also included
	// in the client's handshake to support virtual hosting unless it is
	// an IP address.
	ServerName string `json:"server-name,omitempty"`

	// InsecureSkipVerify controls whether a client verifies the
	// server's certificate chain and host name.
	// If InsecureSkipVerify is true, TLS accepts any certificate
	// presented by the server and any host name in that certificate.
	// In this mode, TLS is susceptible to man-in-the-middle attacks.
	// This should be used only for testing.
	InsecureSkipVerify bool `json:"insecure-skip-verify,omitempty"`
}
```

--------------------------------

### ParsePublicKey

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Parses a public key from byte slices, attempting DER format first, then PEM format. Returns an error if parsing fails.

```APIDOC
## func ParsePublicKey

### Description
ParsePublicKey tries to parse a public key in DER format first and PEM format after, returning an error if the parsing failed

### Signature
```go
func ParsePublicKey(pubKey []byte, prefix string) (interface{}, error)
```
```

--------------------------------

### KeyProviderKeyWrapProtocolOutput XXX_DiscardUnknown Method

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Discards unknown fields in the KeyProviderKeyWrapProtocolOutput message. Part of the protobuf generated code.

```go
func (m *KeyProviderKeyWrapProtocolOutput) XXX_DiscardUnknown()
```

--------------------------------

### Create ECDSA Test Key

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils

Creates an elliptic curve key for testing purposes. Returns the public and private keys in DER format.

```go
func CreateECDSATestKey(curve elliptic.Curve) ([]byte, []byte, error)
```

--------------------------------

### RegisterKeyProviderServiceServer

Source: https://pkg.go.dev/github.com/containers/ocicrypt/utils/keyprovider

Registers a KeyProviderServiceServer implementation with a gRPC server. This function is used to make the key provider service available over gRPC.

```APIDOC
## func RegisterKeyProviderServiceServer

### Description
Registers a KeyProviderServiceServer implementation with a gRPC server.

### Signature
```go
func RegisterKeyProviderServiceServer(s *grpc.Server, srv KeyProviderServiceServer)
```

### Parameters
- **s** (*grpc.Server) - The gRPC server to register the service with.
- **srv** (KeyProviderServiceServer) - The implementation of the KeyProviderServiceServer.
```

--------------------------------

### EncryptConfig

Source: https://pkg.go.dev/github.com/containers/ocicrypt/config

Configuration for PGP encryption of container images.

```APIDOC
## EncryptConfig

### Description
EncryptConfig is the container image PGP encryption configuration holding the identifiers of those that will be able to decrypt the container and the PGP public keyring file data that contains their public keys.

### Fields
- **Parameters** (map[string][][]byte) - map holding 'gpg-recipients', 'gpg-pubkeyringfile', 'pubkeys', 'x509s'
- **DecryptConfig** (DecryptConfig)
```

--------------------------------

### KeyProviderKeyWrapProtocolInput Type - OCICrypt

Source: https://pkg.go.dev/github.com/containers/ocicrypt/keywrap/keyprovider

Defines the input structure for the key provider's binary or gRPC method. Use for either 'keywrap' or 'keyunwrap' operations.

```go
type KeyProviderKeyWrapProtocolInput struct {
	// Operation is either "keywrap" or "keyunwrap"
	Operation KeyProviderKeyWrapProtocolOperation `json:"op"`
	// KeyWrapParams encodes the arguments to key wrap if operation is set to wrap
	KeyWrapParams KeyWrapParams `json:"keywrapparams,omitempty"`
	// KeyUnwrapParams encodes the arguments to key unwrap if operation is set to unwrap
	KeyUnwrapParams KeyUnwrapParams `json:"keyunwrapparams,omitempty"`
}
```
Tokens:
Raw