Class (GI Class)

Gio-2.0 ▶ Gio ▶ TlsDatabaseAbstractSince 2.30

Gio.TlsDatabase is used to look up certificates and other information from a certificate or key store. It is an abstract base class which TLS library specific subtypes override.

A Gio.TlsDatabase may be accessed from multiple threads by the TLS backend. All implementations are required to be fully thread-safe.

Most common client applications will not directly interact with Gio.TlsDatabase. It is used internally by Gio.TlsConnection.

2.30

Hierarchy (View Summary)

Index

Constructors

constructor

Properties

$signals $gtype

Methods

_init connect connect_after create_certificate_handle emit lookup_certificate_for_handle lookup_certificate_for_handle_async lookup_certificate_for_handle_finish lookup_certificate_issuer lookup_certificate_issuer_async lookup_certificate_issuer_finish lookup_certificates_issued_by lookup_certificates_issued_by_async lookup_certificates_issued_by_finish verify_chain verify_chain_async verify_chain_finish vfunc_create_certificate_handle vfunc_lookup_certificate_for_handle vfunc_lookup_certificate_for_handle_async vfunc_lookup_certificate_for_handle_finish vfunc_lookup_certificate_issuer vfunc_lookup_certificate_issuer_async vfunc_lookup_certificate_issuer_finish vfunc_lookup_certificates_issued_by vfunc_lookup_certificates_issued_by_async vfunc_lookup_certificates_issued_by_finish vfunc_verify_chain vfunc_verify_chain_async vfunc_verify_chain_finish

Methods - Inherited from GObject

bind_property bind_property_full block_signal_handler disconnect force_floating freeze_notify get_data get_property get_qdata getv is_floating notify notify_by_pspec ref ref_sink run_dispose set set_data set_property steal_data steal_qdata stop_emission_by_name thaw_notify unblock_signal_handler unref vfunc_constructed vfunc_dispatch_properties_changed vfunc_dispose vfunc_finalize vfunc_get_property vfunc_notify vfunc_set_property watch_closure _classInit compat_control find_property install_properties install_property interface_find_property interface_install_property interface_list_properties list_properties newv override_property

Constructors

Properties

$signals: Gio.TlsDatabase.SignalSignatures

Compile-time signal type information.

This instance property is generated only for TypeScript type checking. It is not defined at runtime and should not be accessed in JS code.

$gtype: GType<Gio.TlsDatabase>

Methods

_init

  • Create a handle string for the certificate. The database will only be able to create a handle for certificates that originate from the database. In cases where the database cannot create a handle for a certificate, null will be returned.

    This handle should be stable across various instances of the application, and between applications. If a certificate is modified in the database, then it is not guaranteed that this handle will continue to point to it.

    Parameters

    Returns string

    a newly allocated string containing the handle.

  • Look up a certificate by its handle.

    The handle should have been created by calling g_tls_database_create_certificate_handle() on a Gio.TlsDatabase object of the same TLS backend. The handle is designed to remain valid across instantiations of the database.

    If the handle is no longer valid, or does not point to a certificate in this database, then null will be returned.

    This function can block, use g_tls_database_lookup_certificate_for_handle_async() to perform the lookup operation asynchronously.

    Parameters

    Returns Gio.TlsCertificate

    a newly allocated Gio.TlsCertificate, or null. Use g_object_unref() to release the certificate.

  • Look up the issuer of certificate in the database. The Gio.TlsCertificate.issuer property of certificate is not modified, and the two certificates are not hooked into a chain.

    This function can block. Use g_tls_database_lookup_certificate_issuer_async() to perform the lookup operation asynchronously.

    Beware this function cannot be used to build certification paths. The issuer certificate returned by this function may not be the same as the certificate that would actually be used to construct a valid certification path during certificate verification. RFC 4158 explains why an issuer certificate cannot be naively assumed to be part of the the certification path (though GLib's TLS backends may not follow the path building strategies outlined in this RFC). Due to the complexity of certification path building, GLib does not provide any way to know which certification path will actually be used when verifying a TLS certificate. Accordingly, this function cannot be used to make security-related decisions. Only GLib itself should make security decisions about TLS certificates.

    Parameters

    Returns Gio.TlsCertificate

    a newly allocated issuer Gio.TlsCertificate, or null. Use g_object_unref() to release the certificate.

  • Determines the validity of a certificate chain, outside the context of a TLS session.

    chain is a chain of Gio.TlsCertificate objects each pointing to the next certificate in the chain by its Gio.TlsCertificate.issuer property.

    purpose describes the purpose (or usage) for which the certificate is being used. Typically purpose will be set to G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER which means that the certificate is being used to authenticate a server (and we are acting as the client).

    The identity is used to ensure the server certificate is valid for the expected peer identity. If the identity does not match the certificate, Gio.TlsCertificateFlags.BAD_IDENTITY will be set in the return value. If identity is null, that bit will never be set in the return value. The peer identity may also be used to check for pinned certificates (trust exceptions) in the database. These may override the normal verification process on a host-by-host basis.

    Currently there are no flags, and Gio.TlsDatabaseVerifyFlags.NONE should be used.

    If chain is found to be valid, then the return value will be 0. If chain is found to be invalid, then the return value will indicate at least one problem found. If the function is unable to determine whether chain is valid (for example, because cancellable is triggered before it completes) then the return value will be Gio.TlsCertificateFlags.GENERIC_ERROR and error will be set accordingly. error is not set when chain is successfully analyzed but found to be invalid.

    GLib guarantees that if certificate verification fails, at least one error will be set in the return value, but it does not guarantee that all possible errors will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask Gio.TlsCertificateFlags.EXPIRED if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate.

    Prior to GLib 2.48, GLib's default TLS backend modified chain to represent the certification path built by Gio.TlsDatabase during certificate verification by adjusting the Gio.TlsCertificate.issuer property of each certificate in chain. Since GLib 2.48, this no longer occurs, so you cannot rely on Gio.TlsCertificate.issuer to represent the actual certification path used during certificate verification.

    Because TLS session context is not used, Gio.TlsDatabase may not perform as many checks on the certificates as Gio.TlsConnection would. For example, certificate constraints may not be honored, and revocation checks may not be performed. The best way to verify TLS certificates used by a TLS connection is to let Gio.TlsConnection handle the verification.

    The TLS backend may attempt to look up and add missing certificates to the chain. This may involve HTTP requests to download missing certificates.

    This function can block. Use g_tls_database_verify_chain_async() to perform the verification operation asynchronously.

    Parameters

    Returns Gio.TlsCertificateFlags

    the appropriate Gio.TlsCertificateFlags which represents the result of verification.

  • Create a handle string for the certificate. The database will only be able to create a handle for certificates that originate from the database. In cases where the database cannot create a handle for a certificate, null will be returned.

    This handle should be stable across various instances of the application, and between applications. If a certificate is modified in the database, then it is not guaranteed that this handle will continue to point to it.

    Parameters

    Returns string

  • Look up a certificate by its handle.

    The handle should have been created by calling g_tls_database_create_certificate_handle() on a Gio.TlsDatabase object of the same TLS backend. The handle is designed to remain valid across instantiations of the database.

    If the handle is no longer valid, or does not point to a certificate in this database, then null will be returned.

    This function can block, use g_tls_database_lookup_certificate_for_handle_async() to perform the lookup operation asynchronously.

    Parameters

    Returns Gio.TlsCertificate

  • Look up the issuer of certificate in the database. The Gio.TlsCertificate.issuer property of certificate is not modified, and the two certificates are not hooked into a chain.

    This function can block. Use g_tls_database_lookup_certificate_issuer_async() to perform the lookup operation asynchronously.

    Beware this function cannot be used to build certification paths. The issuer certificate returned by this function may not be the same as the certificate that would actually be used to construct a valid certification path during certificate verification. RFC 4158 explains why an issuer certificate cannot be naively assumed to be part of the the certification path (though GLib's TLS backends may not follow the path building strategies outlined in this RFC). Due to the complexity of certification path building, GLib does not provide any way to know which certification path will actually be used when verifying a TLS certificate. Accordingly, this function cannot be used to make security-related decisions. Only GLib itself should make security decisions about TLS certificates.

    Parameters

    Returns Gio.TlsCertificate

  • Determines the validity of a certificate chain, outside the context of a TLS session.

    chain is a chain of Gio.TlsCertificate objects each pointing to the next certificate in the chain by its Gio.TlsCertificate.issuer property.

    purpose describes the purpose (or usage) for which the certificate is being used. Typically purpose will be set to G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER which means that the certificate is being used to authenticate a server (and we are acting as the client).

    The identity is used to ensure the server certificate is valid for the expected peer identity. If the identity does not match the certificate, Gio.TlsCertificateFlags.BAD_IDENTITY will be set in the return value. If identity is null, that bit will never be set in the return value. The peer identity may also be used to check for pinned certificates (trust exceptions) in the database. These may override the normal verification process on a host-by-host basis.

    Currently there are no flags, and Gio.TlsDatabaseVerifyFlags.NONE should be used.

    If chain is found to be valid, then the return value will be 0. If chain is found to be invalid, then the return value will indicate at least one problem found. If the function is unable to determine whether chain is valid (for example, because cancellable is triggered before it completes) then the return value will be Gio.TlsCertificateFlags.GENERIC_ERROR and error will be set accordingly. error is not set when chain is successfully analyzed but found to be invalid.

    GLib guarantees that if certificate verification fails, at least one error will be set in the return value, but it does not guarantee that all possible errors will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask Gio.TlsCertificateFlags.EXPIRED if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate.

    Prior to GLib 2.48, GLib's default TLS backend modified chain to represent the certification path built by Gio.TlsDatabase during certificate verification by adjusting the Gio.TlsCertificate.issuer property of each certificate in chain. Since GLib 2.48, this no longer occurs, so you cannot rely on Gio.TlsCertificate.issuer to represent the actual certification path used during certificate verification.

    Because TLS session context is not used, Gio.TlsDatabase may not perform as many checks on the certificates as Gio.TlsConnection would. For example, certificate constraints may not be honored, and revocation checks may not be performed. The best way to verify TLS certificates used by a TLS connection is to let Gio.TlsConnection handle the verification.

    The TLS backend may attempt to look up and add missing certificates to the chain. This may involve HTTP requests to download missing certificates.

    This function can block. Use g_tls_database_verify_chain_async() to perform the verification operation asynchronously.

    Parameters

    Returns Gio.TlsCertificateFlags

  • Finish an asynchronous verify chain operation. See g_tls_database_verify_chain() for more information.

    If chain is found to be valid, then the return value will be 0. If chain is found to be invalid, then the return value will indicate the problems found. If the function is unable to determine whether chain is valid or not (eg, because cancellable is triggered before it completes) then the return value will be Gio.TlsCertificateFlags.GENERIC_ERROR and error will be set accordingly. error is not set when chain is successfully analyzed but found to be invalid.

    Parameters

    Returns Gio.TlsCertificateFlags

Methods - Inherited from GObject

  • Creates a binding between source_property on source and target_property on target.

    Whenever the source_property is changed the target_property is updated using the same value. For instance:

      g_object_bind_property (action, "active", widget, "sensitive", 0);

    Will result in the "sensitive" property of the widget GObject.Object instance to be updated with the same value of the "active" property of the action GObject.Object instance.

    If flags contains GObject.BindingFlags.BIDIRECTIONAL then the binding will be mutual: if target_property on target changes then the source_property on source will be updated as well.

    The binding will automatically be removed when either the source or the target instances are finalized. To remove the binding without affecting the source and the target you can just call g_object_unref() on the returned GObject.Binding instance.

    Removing the binding by calling g_object_unref() on it must only be done if the binding, source and target are only used from a single thread and it is clear that both source and target outlive the binding. Especially it is not safe to rely on this if the binding, source or target can be finalized from different threads. Keep another reference to the binding and use g_binding_unbind() instead to be on the safe side.

    A GObject.Object can have multiple bindings.

    Parameters

    Returns GObject.Binding

    the GObject.Binding instance representing the binding between the two GObject.Object instances. The binding is released whenever the GObject.Binding reference count reaches zero.

  • Complete version of g_object_bind_property().

    Creates a binding between source_property on source and target_property on target, allowing you to set the transformation functions to be used by the binding.

    If flags contains GObject.BindingFlags.BIDIRECTIONAL then the binding will be mutual: if target_property on target changes then the source_property on source will be updated as well. The transform_from function is only used in case of bidirectional bindings, otherwise it will be ignored

    The binding will automatically be removed when either the source or the target instances are finalized. This will release the reference that is being held on the GObject.Binding instance; if you want to hold on to the GObject.Binding instance, you will need to hold a reference to it.

    To remove the binding, call g_binding_unbind().

    A GObject.Object can have multiple bindings.

    The same user_data parameter will be used for both transform_to and transform_from transformation functions; the notify function will be called once, when the binding is removed. If you need different data for each transformation function, please use g_object_bind_property_with_closures() instead.

    Parameters

    • source_property: string

      the property on source to bind

    • target: GObject.Object

      the target GObject.Object

    • target_property: string

      the property on target to bind

    • flags: GObject.BindingFlags

      flags to pass to GObject.Binding

    • Optionaltransform_to: BindingTransformFunc

      the transformation function from the source to the target, or null to use the default

    • Optionaltransform_from: BindingTransformFunc

      the transformation function from the target to the source, or null to use the default

    • Optionalnotify: DestroyNotify

      a function to call when disposing the binding, to free resources used by the transformation functions, or null if not required

    Returns GObject.Binding

    the GObject.Binding instance representing the binding between the two GObject.Object instances. The binding is released whenever the GObject.Binding reference count reaches zero.

  • Creates a binding between source_property on source and target_property on target, allowing you to set the transformation functions to be used by the binding.

    This function is the language bindings friendly version of g_object_bind_property_full(), using GClosures instead of function pointers.

    Parameters

    Returns GObject.Binding

    the GObject.Binding instance representing the binding between the two GObject.Object instances. The binding is released whenever the GObject.Binding reference count reaches zero.

  • Disconnects a handler from an instance so it will not be called during any future or currently ongoing emissions of the signal it has been connected to.

    Parameters

    • id: number

      Handler ID of the handler to be disconnected

    Returns void

  • This function is intended for GObject.Object implementations to re-enforce a [floating][floating-ref] object reference. Doing this is seldom required: all GInitiallyUnowneds are created with a floating reference which usually just needs to be sunken by calling g_object_ref_sink().

    Returns void

  • Increases the freeze count on object. If the freeze count is non-zero, the emission of "notify" signals on object is stopped. The signals are queued until the freeze count is decreased to zero. Duplicate notifications are squashed so that at most one GObject.Object::notify signal is emitted for each property modified while the object is frozen.

    This is necessary for accessors that modify multiple properties to prevent premature notification while the object is still being modified.

    Returns void

  • Gets a named field from the objects table of associations (see g_object_set_data()).

    Parameters

    • key: string

      name of the key for that association

    Returns any

    the data if found, or null if no such data exists.

  • Gets a property of an object.

    The value can be:

    • an empty GObject.Value initialized by G_VALUE_INIT, which will be automatically initialized with the expected type of the property (since GLib 2.60)
    • a GObject.Value initialized with the expected type of the property
    • a GObject.Value initialized with a type to which the expected type of the property can be transformed

    In general, a copy is made of the property contents and the caller is responsible for freeing the memory by calling GObject.Value.unset.

    Note that GObject.Object.get_property is really intended for language bindings, GObject.Object.get is much more convenient for C programming.

    Parameters

    • property_name: string

      The name of the property to get

    • value: any

      Return location for the property value. Can be an empty GObject.Value initialized by G_VALUE_INIT (auto-initialized with expected type since GLib 2.60), a GObject.Value initialized with the expected property type, or a GObject.Value initialized with a transformable type

    Returns any

  • This function gets back user data pointers stored via g_object_set_qdata().

    Parameters

    • quark: number

      A GLib.Quark, naming the user data pointer

    Returns any

    The user data pointer set, or null

  • Gets n_properties properties for an object. Obtained properties will be set to values. All properties must be valid. Warnings will be emitted and undefined behaviour may result if invalid properties are passed in.

    Parameters

    • names: string[]

      the names of each property to get

    • values: any[]

      the values of each property to get

    Returns void

  • Emits a "notify" signal for the property property_name on object.

    When possible, eg. when signaling a property change from within the class that registered the property, you should use g_object_notify_by_pspec() instead.

    Note that emission of the notify signal may be blocked with g_object_freeze_notify(). In this case, the signal emissions are queued and will be emitted (in reverse order) when g_object_thaw_notify() is called.

    Parameters

    • property_name: string

      the name of a property installed on the class of object.

    Returns void

  • Emits a "notify" signal for the property specified by pspec on object.

    This function omits the property name lookup, hence it is faster than g_object_notify().

    One way to avoid using g_object_notify() from within the class that registered the properties, and using g_object_notify_by_pspec() instead, is to store the GParamSpec used with g_object_class_install_property() inside a static array, e.g.:

      typedef enum
      {
        PROP_FOO = 1,
        PROP_LAST
      } MyObjectProperty;

      static GParamSpec *properties[PROP_LAST];

      static void
      my_object_class_init (MyObjectClass *klass)
      {
        properties[PROP_FOO] = g_param_spec_int ("foo", NULL, NULL,
                                                 0, 100,
                                                 50,
                                                 G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
        g_object_class_install_property (gobject_class,
                                         PROP_FOO,
                                         properties[PROP_FOO]);
      }

    and then notify a change on the "foo" property with:

      g_object_notify_by_pspec (self, properties[PROP_FOO]);

    Parameters

    Returns void

  • Increases the reference count of object.

    Since GLib 2.56, if GLIB_VERSION_MAX_ALLOWED is 2.56 or greater, the type of object will be propagated to the return type (using the GCC typeof() extension), so any casting the caller needs to do on the return type must be explicit.

    Returns GObject.Object

    the same object

  • Increase the reference count of object, and possibly remove the [floating][floating-ref] reference, if object has a floating reference.

    In other words, if the object is floating, then this call "assumes ownership" of the floating reference, converting it to a normal reference by clearing the floating flag while leaving the reference count unchanged. If the object is not floating, then this call adds a new normal reference increasing the reference count by one.

    Since GLib 2.56, the type of object will be propagated to the return type under the same conditions as for g_object_ref().

    Returns GObject.Object

    object

  • Releases all references to other objects. This can be used to break reference cycles.

    This function should only be called from object system implementations.

    Returns void

  • Sets multiple properties of an object at once. The properties argument should be a dictionary mapping property names to values.

    Parameters

    • properties: { [key: string]: any }

      Object containing the properties to set

    Returns void

  • Each object carries around a table of associations from strings to pointers. This function lets you set an association.

    If the object already had an association with that name, the old association will be destroyed.

    Internally, the key is converted to a GLib.Quark using g_quark_from_string(). This means a copy of key is kept permanently (even after object has been finalized) — so it is recommended to only use a small, bounded set of values for key in your program, to avoid the GLib.Quark storage growing unbounded.

    Parameters

    • key: string

      name of the key

    • Optionaldata: any

      data to associate with that key

    Returns void

  • Sets a property on an object.

    Parameters

    • property_name: string

      The name of the property to set

    • value: any

      The value to set the property to

    Returns void

  • Remove a specified datum from the object's data associations, without invoking the association's destroy handler.

    Parameters

    • key: string

      name of the key

    Returns any

    the data if found, or null if no such data exists.

  • This function gets back user data pointers stored via g_object_set_qdata() and removes the data from object without invoking its destroy() function (if any was set). Usually, calling this function is only required to update user data pointers with a destroy notifier, for example:

    void
    object_add_to_user_list (GObject     *object,
                             const gchar *new_string)
    {
      // the quark, naming the object data
      GQuark quark_string_list = g_quark_from_static_string ("my-string-list");
      // retrieve the old string list
      GList *list = g_object_steal_qdata (object, quark_string_list);

      // prepend new string
      list = g_list_prepend (list, g_strdup (new_string));
      // this changed 'list', so we need to set it again
      g_object_set_qdata_full (object, quark_string_list, list, free_string_list);
    }
    static void
    free_string_list (gpointer data)
    {
      GList *node, *list = data;

      for (node = list; node; node = node->next)
        g_free (node->data);
      g_list_free (list);
    }

    Using g_object_get_qdata() in the above example, instead of g_object_steal_qdata() would have left the destroy function set, and thus the partial string list would have been freed upon g_object_set_qdata_full().

    Parameters

    • quark: number

      A GLib.Quark, naming the user data pointer

    Returns any

    The user data pointer set, or null

  • Stops a signal's emission by the given signal name. This will prevent the default handler and any subsequent signal handlers from being invoked.

    Parameters

    • detailedName: string

      Name of the signal to stop emission of

    Returns void

  • Reverts the effect of a previous call to g_object_freeze_notify(). The freeze count is decreased on object and when it reaches zero, queued "notify" signals are emitted.

    Duplicate notifications for each property are squashed so that at most one GObject.Object::notify signal is emitted for each property, in the reverse order in which they have been queued.

    It is an error to call this function when the freeze count is zero.

    Returns void

  • Decreases the reference count of object. When its reference count drops to 0, the object is finalized (i.e. its memory is freed).

    If the pointer to the GObject.Object may be reused in future (for example, if it is an instance variable of another object), it is recommended to clear the pointer to null rather than retain a dangling pointer to a potentially invalid GObject.Object instance. Use g_clear_object() for this.

    Returns void

  • the constructed function is called by g_object_new() as the final step of the object creation process. At the point of the call, all construction properties have been set on the object. The purpose of this call is to allow for object initialisation steps that can only be performed after construction properties have been set. constructed implementors should chain up to the constructed call of their parent class to allow it to complete its initialisation.

    Returns void

  • the dispose function is supposed to drop all references to other objects, but keep the instance otherwise intact, so that client method invocations still work. It may be run multiple times (due to reference loops). Before returning, dispose should chain up to the dispose method of the parent class.

    Returns void

  • instance finalization function, should finish the finalization of the instance begun in dispose and chain up to the finalize method of the parent class.

    Returns void

  • Emits a "notify" signal for the property property_name on object.

    When possible, eg. when signaling a property change from within the class that registered the property, you should use g_object_notify_by_pspec() instead.

    Note that emission of the notify signal may be blocked with g_object_freeze_notify(). In this case, the signal emissions are queued and will be emitted (in reverse order) when g_object_thaw_notify() is called.

    Parameters

    Returns void

  • the generic setter for all properties of this type. Should be overridden for every type with properties. If implementations of set_property don't emit property change notification explicitly, this will be done implicitly by the type system. However, if the notify signal is emitted explicitly, the type system will not emit it a second time.

    Parameters

    Returns void

  • This function essentially limits the life time of the closure to the life time of the object. That is, when the object is finalized, the closure is invalidated by calling g_closure_invalidate() on it, in order to prevent invocations of the closure with a finalized (nonexisting) object. Also, g_object_ref() and g_object_unref() are added as marshal guards to the closure, to ensure that an extra reference count is held on object during invocation of the closure. Usually, this function will be called on closures that use this object as closure data.

    Parameters

    Returns void

Static_classInit

  • Add a property to an interface; this is only useful for interfaces that are added to GObject-derived types. Adding a property to an interface forces all objects classes with that interface to have a compatible property. The compatible property could be a newly created GObject.ParamSpec, but normally g_object_class_override_property() will be used so that the object class only needs to provide an implementation and inherits the property description, default value, bounds, and so forth from the interface property.

    This function is meant to be called from the interface's default vtable initialization function (the class_init member of GObject.TypeInfo.) It must not be called after after class_init has been called for any object types implementing this interface.

    If pspec is a floating reference, it will be consumed.

    Parameters

    Returns void

  • Parameters

    • property_id: number

      the new property ID

    • name: string

      the name of a property registered in a parent class or in an interface of this class.

    Returns void

Interfaces

ConstructorProps
SignalSignatures