Method Fetch

pkg/blobserver/encrypt/encrypt.go:204–239

(ctx context.Context, plainBR blob.Ref)

}

func (s *storage) Fetch(ctx context.Context, plainBR blob.Ref) (io.ReadCloser, uint32, error) {
	plainSize, encBR, err := s.fetchMeta(ctx, plainBR)
	if err != nil {
		return nil, 0, err
	}
	encData, _, err := s.blobs.Fetch(ctx, encBR)
	if err != nil {
		return nil, 0, fmt.Errorf("encrypt: error fetching plaintext %s's encrypted %v blob: %v", plainBR, encBR, err)
	}
	defer encData.Close()

	encBytes := pools.BytesBuffer()
	defer pools.PutBuffer(encBytes)

	encHash := encBR.Hash()
	_, err = io.Copy(io.MultiWriter(encBytes, encHash), encData)
	if err != nil {
		return nil, 0, err
	}

	// We have a signed statement in the meta blob that attests that the
	// ciphertext hash corresponds to the plaintext hash, so no need to check
	// the latter.  However, check the former to make sure the encrypted blob
	// was not swapped for another.
	if !encBR.HashMatches(encHash) {
		return nil, 0, blobserver.ErrCorruptBlob
	}

	// Using the pool here would be racy since the caller will read this asynchronously
	plainBytes := bytes.NewBuffer(nil)
	if err := s.decryptBlob(plainBytes, encBytes); err != nil {
		return nil, 0, fmt.Errorf("encrypt: encrypted blob %s failed validation: %s", encBR, err)
	}

	return io.NopCloser(plainBytes), plainSize, nil
}

func (s *storage) EnumerateBlobs(ctx context.Context, dest chan<- blob.SizedRef, after string, limit int) error {
	defer close(dest)