// NewRSAVerifier returns a Verifier that uses the RSA algorithm to verify updates.
968671
func NewRSAVerifier() Verifier {
	return verifyFn(func(checksum, signature []byte, hash crypto.Hash, publicKey crypto.PublicKey) error {
		key, ok := publicKey.(*rsa.PublicKey)
		if !ok {
			return errors.New("not a valid RSA public key")
		}
		return rsa.VerifyPKCS1v15(key, hash, checksum, signature)
	})
}
614177
func (r *claimResolver) Verifier(iss string) (*oidc.IDTokenVerifier, error) {
	r.m.Lock()
	av := r.verifierPerIssuer[iss]
	if av == nil {
		// This lazy init should normally be very quick.
		// TODO: Make this context cancelable.
		ctx := oidc.ClientContext(context.Background(), r.client)
		av = newAsyncIDTokenVerifier(ctx, r.config, iss)
		r.verifierPerIssuer[iss] = av
	}
	r.m.Unlock()

	v := av.verifier()
	if v == nil {
		return nil, fmt.Errorf("verifier not initialized for issuer: %q", iss)
	}
	return v, nil
}
1075489
func NewValidator(method *structs.ACLAuthMethod) (Validator, error) {
	typesMu.RLock()
	factory, ok := types[method.Type]
	typesMu.RUnlock()

	if !ok {
		return nil, fmt.Errorf("no auth method registered with type: %s", method.Type)
	}

	return factory(method)
}
102731
func NewVerifierFromPEM(jwtCertPEM []byte, redirectURI string, redirectOnFail, redirectOnNoToken bool) (*PKIJWTVerifier, error) {
	keys, err := parsePublicKeysFromPEM(jwtCertPEM)
	// pay attention to the return format of parsePublicKeysFromPEM
	// when checking for an error here
	if keys == nil && err != nil {
		return nil, fmt.Errorf("failed to read JWT signing certificates or public keys from PEM: %s", err)
	}
	return &PKIJWTVerifier{
		JWTCertPEM:  jwtCertPEM,
		keys:        keys,
		RedirectURL: redirectURI,
	}, nil
}
430233
func New(opts x509.VerifyOptions, user UserConversion) *Authenticator {
	return &Authenticator{opts, user}
}
534683
func newNodeVerifier(name string) (server.Verifier, error) {
	switch name {
	case "aws":
		return aws.NewVerifier()
	case "alwaysallow":
		return alwaysallow.NewVerifier()
	}

	return nil, errors.New("unsupported authorizer")
}
216930
func NewCSR(certSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration) (*x509.CertificateRequest, crypto.Signer, error) {
	certConfig, err := certSpec.GetConfig(cfg)
	if err != nil {
		return nil, nil, errors.Wrap(err, "failed to retrieve cert configuration")
	}

	return pkiutil.NewCSRAndKey(certConfig)
}
391500
func NewRSAPublicKey(creationTime time.Time, pub *rsa.PublicKey) *PublicKey {
	pk := &PublicKey{
		CreationTime: creationTime,
		PubKeyAlgo:   PubKeyAlgoRSA,
		PublicKey:    pub,
		n:            fromBig(pub.N),
		e:            fromBig(big.NewInt(int64(pub.E))),
	}

	pk.setFingerPrintAndKeyId()
	return pk
}
1269141
func NewValidator() Validator {
	return &validator{
		conflicts: make(map[string]set.Strings),
		vocab:     make(map[string][]interface{}),
	}
}
193305
func builtinJWTVerifyPS256(a ast.Value, b ast.Value) (ast.Value, error) {
	return builtinJWTVerifyRSA(a, b, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
		return rsa.VerifyPSS(
			publicKey,
			crypto.SHA256,
			digest,
			signature,
			nil)
	})
}
841661
func (tm2pb) NewValidatorUpdate(pubkey crypto.PubKey, power int64) abci.ValidatorUpdate {
	pubkeyABCI := TM2PB.PubKey(pubkey)
	return abci.ValidatorUpdate{
		PubKey: pubkeyABCI,
		Power:  power,
	}
}
1219757
func NewPolicyAuthorizer(parent Authorizer, policies []*Policy, sentinel sentinel.Evaluator) (*PolicyAuthorizer, error) {
	p := &PolicyAuthorizer{
		parent:             parent,
		agentRules:         radix.New(),
		intentionRules:     radix.New(),
		keyRules:           radix.New(),
		nodeRules:          radix.New(),
		serviceRules:       radix.New(),
		sessionRules:       radix.New(),
		eventRules:         radix.New(),
		preparedQueryRules: radix.New(),
		sentinel:           sentinel,
	}

	policy := MergePolicies(policies)

	// Load the agent policy (exact matches)
	for _, ap := range policy.Agents {
		insertPolicyIntoRadix(ap.Node, p.agentRules, ap.Policy, nil)
	}

	// Load the agent policy (prefix matches)
	for _, ap := range policy.AgentPrefixes {
		insertPolicyIntoRadix(ap.Node, p.agentRules, nil, ap.Policy)
	}

	// Load the key policy (exact matches)
	for _, kp := range policy.Keys {
		policyRule := RulePolicy{
			aclPolicy:      kp.Policy,
			sentinelPolicy: kp.Sentinel,
		}
		insertPolicyIntoRadix(kp.Prefix, p.keyRules, policyRule, nil)
	}

	// Load the key policy (prefix matches)
	for _, kp := range policy.KeyPrefixes {
		policyRule := RulePolicy{
			aclPolicy:      kp.Policy,
			sentinelPolicy: kp.Sentinel,
		}
		insertPolicyIntoRadix(kp.Prefix, p.keyRules, nil, policyRule)
	}

	// Load the node policy (exact matches)
	for _, np := range policy.Nodes {
		policyRule := RulePolicy{
			aclPolicy:      np.Policy,
			sentinelPolicy: np.Sentinel,
		}
		insertPolicyIntoRadix(np.Name, p.nodeRules, policyRule, nil)
	}

	// Load the node policy (prefix matches)
	for _, np := range policy.NodePrefixes {
		policyRule := RulePolicy{
			aclPolicy:      np.Policy,
			sentinelPolicy: np.Sentinel,
		}
		insertPolicyIntoRadix(np.Name, p.nodeRules, nil, policyRule)
	}

	// Load the service policy (exact matches)
	for _, sp := range policy.Services {
		policyRule := RulePolicy{
			aclPolicy:      sp.Policy,
			sentinelPolicy: sp.Sentinel,
		}
		insertPolicyIntoRadix(sp.Name, p.serviceRules, policyRule, nil)

		intention := sp.Intentions
		if intention == "" {
			switch sp.Policy {
			case PolicyRead, PolicyWrite:
				intention = PolicyRead
			default:
				intention = PolicyDeny
			}
		}

		policyRule = RulePolicy{
			aclPolicy:      intention,
			sentinelPolicy: sp.Sentinel,
		}
		insertPolicyIntoRadix(sp.Name, p.intentionRules, policyRule, nil)
	}

	// Load the service policy (prefix matches)
	for _, sp := range policy.ServicePrefixes {
		policyRule := RulePolicy{
			aclPolicy:      sp.Policy,
			sentinelPolicy: sp.Sentinel,
		}
		insertPolicyIntoRadix(sp.Name, p.serviceRules, nil, policyRule)

		intention := sp.Intentions
		if intention == "" {
			switch sp.Policy {
			case PolicyRead, PolicyWrite:
				intention = PolicyRead
			default:
				intention = PolicyDeny
			}
		}

		policyRule = RulePolicy{
			aclPolicy:      intention,
			sentinelPolicy: sp.Sentinel,
		}
		insertPolicyIntoRadix(sp.Name, p.intentionRules, nil, policyRule)
	}

	// Load the session policy (exact matches)
	for _, sp := range policy.Sessions {
		insertPolicyIntoRadix(sp.Node, p.sessionRules, sp.Policy, nil)
	}

	// Load the session policy (prefix matches)
	for _, sp := range policy.SessionPrefixes {
		insertPolicyIntoRadix(sp.Node, p.sessionRules, nil, sp.Policy)
	}

	// Load the event policy (exact matches)
	for _, ep := range policy.Events {
		insertPolicyIntoRadix(ep.Event, p.eventRules, ep.Policy, nil)
	}

	// Load the event policy (prefix matches)
	for _, ep := range policy.EventPrefixes {
		insertPolicyIntoRadix(ep.Event, p.eventRules, nil, ep.Policy)
	}

	// Load the prepared query policy (exact matches)
	for _, qp := range policy.PreparedQueries {
		insertPolicyIntoRadix(qp.Prefix, p.preparedQueryRules, qp.Policy, nil)
	}

	// Load the prepared query policy (prefix matches)
	for _, qp := range policy.PreparedQueryPrefixes {
		insertPolicyIntoRadix(qp.Prefix, p.preparedQueryRules, nil, qp.Policy)
	}

	// Load the acl policy
	p.aclRule = policy.ACL

	// Load the keyring policy
	p.keyringRule = policy.Keyring

	// Load the operator policy
	p.operatorRule = policy.Operator

	return p, nil
}
828603
func (p *Plugin) NewWatcher(keyPrefix string) keyval.ProtoWatcher {
	return p.protoWrapper.NewWatcher(keyPrefix)
}
1226473
func NewACLAuthorizer(acl ACL) (Authorizer, error) {
	if err := ValidateACL(acl); err != nil {
		return nil, err
	}
	glog.V(1).Infof("Created ACL Authorizer with %d entries", len(acl))
	return &aclAuthorizer{acl: acl}, nil
}
157416
func NewBaseVerifier(chainID string, height int64, valset *types.ValidatorSet) *BaseVerifier {
	if valset.IsNilOrEmpty() {
		panic("NewBaseVerifier requires a valid valset")
	}
	return &BaseVerifier{
		chainID: chainID,
		height:  height,
		valset:  valset,
	}
}
153626
func builtinJWTVerifyRSA(a ast.Value, b ast.Value, verify func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error) (ast.Value, error) {
	return builtinJWTVerify(a, b, func(publicKey interface{}, digest []byte, signature []byte) error {
		publicKeyRsa, ok := publicKey.(*rsa.PublicKey)
		if !ok {
			return fmt.Errorf("incorrect public key type")
		}
		return verify(publicKeyRsa, digest, signature)
	})
}
1060491
func NewACIdentifier(s string) (*ACIdentifier, error) {
	n := ACIdentifier(s)
	if err := n.assertValid(); err != nil {
		return nil, err
	}
	return &n, nil
}