view release on metacpan or  search on metacpan

lib/AWS/Signature/V4/X509.pm  view on Meta::CPAN

   my $chain = $self->chain;
   if (!defined $chain && defined $self->chain_files) {
      my $files = _items($self->chain_files, 'chain_files');    # a single path or an arrayref
      $chain = [map { _slurp($_) } $files->@*];
   }
   if (defined $chain && !ref $chain) {    # a plain string is a PEM bundle
      $chain =~ m{-----BEGIN CERTIFICATE-----}
         or fail 400, 'x509/chain as a string must be PEM-encoded';
   }
   return [map { _to_ders($_) } _items($chain // [], 'chain')->@*];
}

sub _build_credential_id ($self) {
   return $self->serial // _certificate_serial($self->_der);
}

sub _build__signer ($self) {
   my $type = $self->_type;
   my $signer = $self->signer;
   fail 400, '"signer" must be a code reference'
      if defined $signer && ref $signer ne 'CODE';
   if (!$signer && defined $self->_private_key) {    # the content wins, as for certificate
      my $key = $self->_private_key;    # CryptX wants a reference for a PEM/DER text
      $signer = _cryptx_signer($type, \$key, $self->_private_key_password);
   }
   elsif (!$signer && defined $self->private_key_file) {
      $signer = _cryptx_signer($type, $self->private_key_file, $self->_private_key_password);
   }
   return $signer
      // fail 400, 'x509 needs one of "signer", "private_key_file", "private_key"';
}

# ---- what AWS::Signature::V4 wants from a variant --------------------------

# hex signature of the string to sign; the scope is not used here
sub signature ($self, $scope, $string_to_sign) {
   my $sig = $self->_signer->($string_to_sign);
   fail 400, 'the x509 signer returned no signature'
      unless defined $sig && !ref $sig && length $sig;
   utf8::downgrade($sig, 1)
      or fail 400, 'the x509 signer returned a string with wide characters';
   return unpack 'H*', $sig;
}

# what goes with the request besides the signature, as (name => value) pairs
sub extra_fields ($self) {
   my $chain = $self->_chain;
   return (
      'X-Amz-X509' => _b64($self->_der),
      ($chain->@* ? ('X-Amz-X509-Chain' => join ',', map { _b64($_) } $chain->@*) : ()),
   );
}

# No derived key, so no signed chunks. This is stated twice, on purpose:
# AWS::Signature::V4 asks can_sign_chunks() up front, to refuse the request
# before doing anything else, and signing_key() is what fails if somebody
# asks for the key anyway. If this ever changes, change BOTH, and the
# corresponding tests in t/variants.t.
sub can_sign_chunks ($self) { 0 }
sub signing_key ($self, $scope) {
   fail 400, 'signed streaming needs the credentials variant, not x509';
}

1;