owen
981587e83d
urapt is a self-hostable APT repository server with a companion CLI for pushing and managing Debian .deb packages. Server (urapt-server): - REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO) - .deb files stored content-addressed on disk, reference-counted for dedup - Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto) - APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand from the DB, cached in memory, signed with the server key - Full APT model: repositories -> distributions -> components -> architectures - Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads - First registrant becomes admin; repo-scoped permissions (read/write/read-write/admin) plus owner and server-admin roles - Multipart package push with control-field extraction, list/show/delete, pool serving, blob ref-count cleanup - Audit log CLI (urapt): - register/login/logout/whoami, token management - repo/distro/component/arch CRUD, member management - push/pull/ls/show/rm for packages - apt-config helper that emits apt setup commands (key, sources.list, auth.conf for private repos) Packaging & docs: - Dockerfile (multi-stage distroless), docker-compose.yml, sample config - README quick start, architecture overview, config reference, security notes - PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE - GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64) - Makefile release target producing static binaries + tarballs + checksums Tests cover the data-access layer, auth/permission checks, APT index generation, .deb parsing, GPG signing, the REST API, and the typed API client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing a real package.
52 lines
1.6 KiB
Go
52 lines
1.6 KiB
Go
// Package crypto provides password hashing and API token generation utilities
|
|
// shared by the server and (for verification symmetry) tests.
|
|
package crypto
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"fmt"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
// TokenPrefix is the textual prefix attached to all urapt API tokens so they
|
|
// are easy to identify and not confused with other secrets.
|
|
const TokenPrefix = "urapt_"
|
|
|
|
// HashPassword returns a bcrypt hash of the given plaintext password.
|
|
func HashPassword(password string) (string, error) {
|
|
h, err := bcrypt.GenerateFromPassword([]byte(password), 12)
|
|
if err != nil {
|
|
return "", fmt.Errorf("bcrypt: %w", err)
|
|
}
|
|
return string(h), nil
|
|
}
|
|
|
|
// VerifyPassword reports whether password matches the stored bcrypt hash.
|
|
func VerifyPassword(hash, password string) bool {
|
|
return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil
|
|
}
|
|
|
|
// GenerateToken creates a new random API token (TokenPrefix + base64url of 32
|
|
// random bytes) and returns it together with its SHA-256 hash (for storage)
|
|
// and an 8-char display prefix.
|
|
func GenerateToken() (token, hash, prefix string, err error) {
|
|
raw := make([]byte, 32)
|
|
if _, err = rand.Read(raw); err != nil {
|
|
return "", "", "", fmt.Errorf("rand: %w", err)
|
|
}
|
|
body := base64.RawURLEncoding.EncodeToString(raw)
|
|
token = TokenPrefix + body
|
|
hash = HashToken(token)
|
|
prefix = token[:len(TokenPrefix)+8]
|
|
return token, hash, prefix, nil
|
|
}
|
|
|
|
// HashToken returns the SHA-256 hex digest of a token, for storage/lookup.
|
|
func HashToken(token string) string {
|
|
sum := sha256.Sum256([]byte(token))
|
|
return fmt.Sprintf("%x", sum)
|
|
}
|