// readMerkleRoot reads the merkle root out of the link if this link is unstubbed.
338991
func readMerkleRoot(m libkb.MetaContext, link *ChainLinkUnpacked) (*keybase1.MerkleRootV2, error) {
	if link.inner == nil {
		return nil, nil
	}
	ret := link.inner.Body.MerkleRoot.ToMerkleRootV2()
	return &ret, nil
}
134108
func StoreChtRoot(db ethdb.Database, sectionIdx uint64, sectionHead, root common.Hash) {
	var encNumber [8]byte
	binary.BigEndian.PutUint64(encNumber[:], sectionIdx)
	db.Put(append(append(chtPrefix, encNumber[:]...), sectionHead.Bytes()...), root.Bytes())
}
1349746
func (c *Cellar) getRoot(reason ...string) segmentList {
	c.rootLock.RLock()
	defer c.rootLock.RUnlock()
	return c.getRootLocked(reason...)
}
619302
func LoadRoot(cfg map[string]string) (*Root, error) {
	var root Root
	var err error
	spec, ok := cfg["private"]
	if !ok {
		return nil, ErrMissingPrivateKey
	}

	certPath, ok := cfg["certificate"]
	if !ok {
		return nil, ErrMissingCertificatePath
	}

	configPath, ok := cfg["config"]
	if !ok {
		return nil, ErrMissingConfigPath
	}

	root.PrivateKey, err = parsePrivateKeySpec(spec, cfg)
	if err != nil {
		return nil, err
	}

	in, err := ioutil.ReadFile(certPath)
	if err != nil {
		return nil, err
	}

	root.Certificate, err = helpers.ParseCertificatePEM(in)
	if err != nil {
		return nil, err
	}

	conf, err := config.LoadFile(configPath)
	if err != nil {
		return nil, err
	}
	root.Config = conf.Signing

	nets := cfg["nets"]
	if nets != "" {
		root.ACL, err = parseACL(nets)
		if err != nil {
			return nil, err
		}
	}

	dbConfig := cfg["dbconfig"]
	if dbConfig != "" {
		db, err := dbconf.DBFromConfig(dbConfig)
		if err != nil {
			return nil, err
		}
		root.DB = db
	}

	return &root, nil
}
1226293
func (m *MemEngine) LookupRoot(_ context.Context) (Hash, error) {
	return m.root, nil
}
576466
func (l *SigChainLoader) GetMerkleTriple() (ret *MerkleTriple) {
	if l.leaf != nil {
		ret = l.chainType.GetMerkleTriple(l.leaf)
	}
	return
}
966595
func (f *Finder) findRoot(ctx context.Context, root *list.Element, parts []string) bool {
	if len(parts) == 0 {
		return false
	}

	ix := len(parts) - 1

	if parts[ix] != "..." {
		return false
	}

	if ix == 0 {
		return true // We already have the Object for root.Path
	}

	// Lookup the Object for the new root.Path
	rootPath := path.Join(root.Path, path.Join(parts[:ix]...))

	ref, err := f.si.FindByInventoryPath(ctx, rootPath)
	if err != nil || ref == nil {
		// If we get an error or fail to match, fall through to find() with the original root and path
		return false
	}

	root.Path = rootPath
	root.Object = ref

	return true
}
500888
func (r *Ref) IsRoot() bool {
	return r.referenceURL != nil &&
		!r.IsCanonical() &&
		!r.HasURLPathOnly &&
		r.referenceURL.Fragment == ""
}
445862
func validateReadonlyRootfs(hc *container.HostConfig) error {
	// We may not be passed a host config, such as in the case of docker commit
	if hc == nil {
		return nil
	}
	if hc.ReadonlyRootfs {
		return fmt.Errorf("Windows does not support root filesystem in read-only mode")
	}
	return nil
}
884924
func DecryptMerkleLeaf(
	privateKey TLFPrivateKey, publicKey TLFEphemeralPublicKey,
	encryptedMerkleLeaf EncryptedMerkleLeaf) ([]byte, error) {
	nonce, err := PrepareMerkleLeaf(encryptedMerkleLeaf)
	if err != nil {
		return nil, err
	}

	publicKeyData := publicKey.Data()
	privateKeyData := privateKey.Data()
	decryptedData, ok := box.Open(nil, encryptedMerkleLeaf.EncryptedData,
		&nonce, &publicKeyData, &privateKeyData)
	if !ok {
		return nil, errors.WithStack(
			libkb.DecryptionError{Cause: errors.New("Cannot open box")})
	}
	return decryptedData, nil
}
1062395
func (fs *FS) Chroot(p string) (newFS billy.Filesystem, err error) {
	return fs.ChrootAsLibFS(p)
}
311840
func StripLibRootURL(libFile string, libRootURLs []string) string {
	if !IsRemote(libFile) {
		return libFile
	}
	for _, root := range libRootURLs {
		if strings.HasPrefix(libFile, root) {
			libFile = strings.TrimPrefix(libFile, root)
			libFile = strings.TrimPrefix(libFile, "/")
			break
		}
	}
	return libFile
}
333938
func UserRoot() string {
	//  pam_systemd sets XDG_RUNTIME_DIR but not other dirs.
	xdgDataHome := os.Getenv("XDG_DATA_HOME")
	if xdgDataHome != "" {
		dirs := strings.Split(xdgDataHome, ":")
		return filepath.Join(dirs[0], "buildkit")
	}
	home := os.Getenv("HOME")
	if home != "" {
		return filepath.Join(home, ".local", "share", "buildkit")
	}
	return Root
}
359682
func (rfs *RootFS) Chroot(_ string) (newFS billy.Filesystem, err error) {
	// Don't allow chroot'ing anywhere outside of the root FS since we
	// haven't yet implemented folderlist browsing.
	return nil, errors.New("RootFS cannot chroot")
}
820682
func Chroot(rootfs string) error {
	if err := syscall.Chroot(rootfs); err != nil {
		return errors.Wrapf(err, "unable to chroot to %s", rootfs)
	}
	root := filepath.FromSlash("/")
	if err := os.Chdir(root); err != nil {
		return errors.Wrapf(err, "unable to chdir to %s", root)
	}
	return nil
}
562243
func NewEventuallyConsistentMerkleRoot(
	config Config, getter idutil.MerkleRootGetter) *EventuallyConsistentMerkleRoot {
	ecmr := &EventuallyConsistentMerkleRoot{
		config: config,
		log:    config.MakeLogger(ECMRID),
		getter: getter,
	}
	ecmr.fetcher = newFetchDecider(
		ecmr.log, config.MakeVLogger(ecmr.log), ecmr.getAndCache,
		ECMRCtxTagKey{}, ECMRID, ecmr.config)
	return ecmr
}
552158
func (el EncryptedMerkleLeaf) Decrypt(codec kbfscodec.Codec,
	privKey kbfscrypto.TLFPrivateKey, nonce *[24]byte,
	ePubKey kbfscrypto.TLFEphemeralPublicKey) (MerkleLeaf, error) {
	eLeaf := kbfscrypto.MakeEncryptedMerkleLeaf(
		el.Version, el.EncryptedData, nonce)
	leafBytes, err := kbfscrypto.DecryptMerkleLeaf(privKey, ePubKey, eLeaf)
	if err != nil {
		return MerkleLeaf{}, err
	}
	// decode the leaf
	var leaf MerkleLeaf
	if err := codec.Decode(leafBytes, &leaf); err != nil {
		return MerkleLeaf{}, err
	}
	return leaf, nil
}