verify

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 13, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Index

Constants

View Source
const (
	SandboxAdapterSchemaV1        = "sandbox-adapter/v1"
	CapabilityNetworkIsolation    = "network.isolated"
	CapabilityCredentialIsolation = "credentials.hidden"
	CapabilitySyntheticHome       = "home.synthetic"
	CapabilityWritableBoundary    = "filesystem.write-bounded"
	CapabilityResourceLimits      = "resources.bounded"
)
View Source
const (
	TimeoutExitCode = 124
	LimitExitCode   = 125
)
View Source
const Redacted = "[REDACTED]"

Variables

View Source
var DefaultLimits = Limits{
	CPUSeconds: 300, MemoryBytes: 2 << 30, Processes: 256,
	OutputBytes: 8 << 20, WallSeconds: 600, FileBytes: 1 << 30,
}

Functions

This section is empty.

Types

type Limits added in v0.4.0

type Limits struct {
	CPUSeconds  int
	MemoryBytes int64
	Processes   int
	OutputBytes int
	WallSeconds int
	FileBytes   int64
}

Limits is adapter-neutral verify resource policy. Zero leaves a dimension unset. Production callers supply non-zero values through DefaultLimits.

type Options

type Options struct {
	Command        string
	Dir            string
	Sandbox        bool
	RequireSandbox bool
	SandboxBinary  string
	Stdin          string
	TimeoutSecs    int
	Limits         Limits
	Secrets        []string
	Adapter        *SandboxAdapterV1
}

type RedactingWriter added in v0.4.0

type RedactingWriter struct {
	// contains filtered or unexported fields
}

func NewRedactingWriter added in v0.4.0

func NewRedactingWriter(dst io.Writer, secrets []string) *RedactingWriter

func (*RedactingWriter) Close added in v0.4.0

func (w *RedactingWriter) Close() error

func (*RedactingWriter) Write added in v0.4.0

func (w *RedactingWriter) Write(p []byte) (int, error)

type Redactor added in v0.4.0

type Redactor struct {
	// contains filtered or unexported fields
}

func NewRedactor added in v0.4.0

func NewRedactor(secrets []string) Redactor

func (Redactor) String added in v0.4.0

func (r Redactor) String(value string) string

type Result

type Result struct {
	ExitCode       int
	Stdout, Stderr string
}

func Run

func Run(ctx context.Context, opts Options) (Result, error)

type SandboxAdapterV1 added in v0.4.0

type SandboxAdapterV1 struct {
	SchemaVersion string   `json:"schema_version"`
	Name          string   `json:"name"`
	Platform      string   `json:"platform"`
	Binary        string   `json:"binary,omitempty"`
	Args          []string `json:"args,omitempty"`
	Capabilities  []string `json:"capabilities"`
}

SandboxAdapterV1 is adapter-supplied metadata validated before execution. Binary and Args describe transport only; capabilities decide policy.

func (SandboxAdapterV1) CanonicalCapabilities added in v0.4.0

func (a SandboxAdapterV1) CanonicalCapabilities() []string

CanonicalCapabilities returns stable order for attestations and reports.

func (SandboxAdapterV1) Validate added in v0.4.0

func (a SandboxAdapterV1) Validate(production bool) error

Validate negotiates sandbox policy without probing host state. Production accepts only complete capability declarations; unknown claims fail closed.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL