barometer: update DMA's vendoring packages

[barometer.git] / src / dma / vendor / golang.org / x / crypto / acme / acme.go

diff --git a/src/dma/vendor/golang.org/x/crypto/acme/acme.go b/src/dma/vendor/golang.org/x/crypto/acme/acme.go
index 7df6476..00ee955 100644 (file)
--- a/src/dma/vendor/golang.org/x/crypto/acme/acme.go
+++ b/src/dma/vendor/golang.org/x/crypto/acme/acme.go
@@ -77,6 +77,10 @@ const (
 type Client struct {
        // Key is the account key used to register with a CA and sign requests.
        // Key.Public() must return a *rsa.PublicKey or *ecdsa.PublicKey.
+       //
+       // The following algorithms are supported:
+       // RS256, ES256, ES384 and ES512.
+       // See RFC7518 for more details about the algorithms.
        Key crypto.Signer
 
        // HTTPClient optionally specifies an HTTP client to use
@@ -124,11 +128,7 @@ func (c *Client) Discover(ctx context.Context) (Directory, error) {
                return *c.dir, nil
        }
 
-       dirURL := c.DirectoryURL
-       if dirURL == "" {
-               dirURL = LetsEncryptURL
-       }
-       res, err := c.get(ctx, dirURL, wantStatus(http.StatusOK))
+       res, err := c.get(ctx, c.directoryURL(), wantStatus(http.StatusOK))
        if err != nil {
                return Directory{}, err
        }
@@ -161,6 +161,13 @@ func (c *Client) Discover(ctx context.Context) (Directory, error) {
        return *c.dir, nil
 }
 
+func (c *Client) directoryURL() string {
+       if c.DirectoryURL != "" {
+               return c.DirectoryURL
+       }
+       return LetsEncryptURL
+}
+
 // CreateCert requests a new certificate using the Certificate Signing Request csr encoded in DER format.
 // The exp argument indicates the desired certificate validity duration. CA may issue a certificate
 // with a different duration.
@@ -319,6 +326,20 @@ func (c *Client) UpdateReg(ctx context.Context, a *Account) (*Account, error) {
 // a valid authorization (Authorization.Status is StatusValid). If so, the caller
 // need not fulfill any challenge and can proceed to requesting a certificate.
 func (c *Client) Authorize(ctx context.Context, domain string) (*Authorization, error) {
+       return c.authorize(ctx, "dns", domain)
+}
+
+// AuthorizeIP is the same as Authorize but requests IP address authorization.
+// Clients which successfully obtain such authorization may request to issue
+// a certificate for IP addresses.
+//
+// See the ACME spec extension for more details about IP address identifiers:
+// https://tools.ietf.org/html/draft-ietf-acme-ip.
+func (c *Client) AuthorizeIP(ctx context.Context, ipaddr string) (*Authorization, error) {
+       return c.authorize(ctx, "ip", ipaddr)
+}
+
+func (c *Client) authorize(ctx context.Context, typ, val string) (*Authorization, error) {
        if _, err := c.Discover(ctx); err != nil {
                return nil, err
        }
@@ -332,7 +353,7 @@ func (c *Client) Authorize(ctx context.Context, domain string) (*Authorization,
                Identifier authzID `json:"identifier"`
        }{
                Resource:   "new-authz",
-               Identifier: authzID{Type: "dns", Value: domain},
+               Identifier: authzID{Type: typ, Value: val},
        }
        res, err := c.post(ctx, c.Key, c.dir.AuthzURL, req, wantStatus(http.StatusCreated))
        if err != nil {
@@ -693,12 +714,18 @@ func (c *Client) doReg(ctx context.Context, url string, typ string, acct *Accoun
 }
 
 // popNonce returns a nonce value previously stored with c.addNonce
-// or fetches a fresh one from the given URL.
+// or fetches a fresh one from a URL by issuing a HEAD request.
+// It first tries c.directoryURL() and then the provided url if the former fails.
 func (c *Client) popNonce(ctx context.Context, url string) (string, error) {
        c.noncesMu.Lock()
        defer c.noncesMu.Unlock()
        if len(c.nonces) == 0 {
-               return c.fetchNonce(ctx, url)
+               dirURL := c.directoryURL()
+               v, err := c.fetchNonce(ctx, dirURL)
+               if err != nil && url != dirURL {
+                       v, err = c.fetchNonce(ctx, url)
+               }
+               return v, err
        }
        var nonce string
        for nonce = range c.nonces {