from cachetools import lru_cache from data import model from util.expiresdict import ExpiresDict, ExpiresEntry from util.security import jwtutil class CachingKey(object): def __init__(self, service_key): self._service_key = service_key self._cached_public_key = None @property def public_key(self): cached_key = self._cached_public_key if cached_key is not None: return cached_key # Convert the JWK into a public key and cache it (since the conversion can take > 200ms). public_key = jwtutil.jwk_dict_to_public_key(self._service_key.jwk) self._cached_public_key = public_key return public_key class InstanceKeys(object): """ InstanceKeys defines a helper class for interacting with the Quay instance service keys used for JWT signing of registry tokens as well as requests from Quay to other services such as Clair. Each container will have a single registered instance key. """ def __init__(self, app): self.app = app self.instance_keys = ExpiresDict(self._load_instance_keys) def clear_cache(self): """ Clears the cache of instance keys. """ self.instance_keys = ExpiresDict(self._load_instance_keys) def _load_instance_keys(self): # Load all the instance keys. keys = {} for key in model.service_keys.list_service_keys(self.service_name): keys[key.kid] = ExpiresEntry(CachingKey(key), key.expiration_date) return keys @property def service_name(self): """ Returns the name of the instance key's service (i.e. 'quay'). """ return self.app.config['INSTANCE_SERVICE_KEY_SERVICE'] @property def service_key_expiration(self): """ Returns the defined expiration for instance service keys, in minutes. """ return self.app.config.get('INSTANCE_SERVICE_KEY_EXPIRATION', 120) @property @lru_cache(maxsize=1) def local_key_id(self): """ Returns the ID of the local instance service key. """ return _load_file_contents(self.app.config['INSTANCE_SERVICE_KEY_KID_LOCATION']) @property @lru_cache(maxsize=1) def local_private_key(self): """ Returns the private key of the local instance service key. """ return _load_file_contents(self.app.config['INSTANCE_SERVICE_KEY_LOCATION']) def get_service_key_public_key(self, kid): """ Returns the public key associated with the given instance service key or None if none. """ caching_key = self.instance_keys.get(kid) if caching_key is None: return None return caching_key.public_key def _load_file_contents(path): """ Returns the contents of the specified file path. """ with open(path) as f: return f.read()