Versions in this module Expand all Collapse all v1 v1.4.0 Oct 20, 2026 Changes in this version + const ManifestSchema + const SBOMSpecVersion + var ErrABIIncompatible = errors.New("security pipeline: syscall ABI version incompatible with kernel") + var ErrCapabilityDenied = errors.New("security pipeline: admission policy denied requested capabilities") + var ErrDigestMismatch = errors.New("security pipeline: SBOM or OCI layer digest mismatch") + var ErrPackageBindingMismatch = errors.New("agent package does not bind to this publication") + var ErrPackageManifestInvalid = errors.New("agent package manifest is invalid") + var ErrPackageSignatureInvalid = errors.New("agent package signature is invalid") + var ErrPackageUnsigned = errors.New("agent package is not signed") + var ErrSignatureVerificationFailed = errors.New("security pipeline: package signature verification failed") + func DecodePrivateKey(encoded string) (ed25519.PrivateKey, error) + func DecodePublicKey(encoded string) (ed25519.PublicKey, error) + func EncodePublicKey(key ed25519.PublicKey) string + func GenerateSBOM(manifest Manifest) ([]byte, error) + func GenerateSigningKey(id string) (*SigningKey, *Key, error) + func ManifestDigest(manifest Manifest) ([sha256.Size]byte, error) + func Verify(pkg *Package, keys map[string]ed25519.PublicKey) error + func VerifyImageSignature(manifest Manifest, keys map[string]ed25519.PublicKey) error + func VerifySBOM(document []byte, expected Digest) error + type CompatibilityRule struct + MaxKernelVersion string + MinKernelVersion string + SupportedABIs []string + type Digest struct + Algorithm string + Hex string + func ComputeContentDigest(content []byte) Digest + func SBOMDigest(document []byte) Digest + func SpecSHA256(spec []byte) Digest + func (d Digest) String() string + func (d Digest) Verify(content []byte) bool + type Key struct + ID string + PublicKey ed25519.PublicKey + type Manifest struct + AgentVersionRef string + ImageSignature *Signature + MemorySchema Digest + Permissions Digest + Provenance Provenance + RuntimeLock []Digest + SBOM Digest + Schema string + SignedImageDigest Digest + Spec json.RawMessage + SpecDigest Digest + ToolLock []Digest + func FromAgentManifest(manifest agentversion.Manifest, provenance Provenance) (Manifest, error) + func (m Manifest) Validate() error + type MetadataIndex struct + Capabilities []string + Compatibility CompatibilityRule + Manifest Manifest + OCIDigest Digest + PublishedAt time.Time + Publisher PublisherInfo + RuntimeRequirements RuntimeRequirements + SBOM Digest + Signature Signature + SyscallABIVersion string + Version string + func BuildMetadataIndex(pkg *Package, publisher PublisherInfo, ociDigest Digest) (*MetadataIndex, error) + type Package struct + Manifest Manifest + Signature Signature + func Sign(manifest Manifest, key *SigningKey) (*Package, error) + type Provenance struct + BuildWorkflow string + Builder string + BuiltAt time.Time + GitCommit string + type PublisherInfo struct + Email string + ID string + Name string + Organization string + Verified bool + type Registry struct + func NewRegistry() *Registry + func (r *Registry) Add(key Key) error + func (r *Registry) Len() int + func (r *Registry) Trusted() map[string]ed25519.PublicKey + func (r *Registry) Verify(pkg *Package) error + type RuntimeRequirements struct + CPU string + Features []string + Isolation string + Memory string + type SecurityInstallRequest struct + AllowedCapabilities map[string]bool + DryRun bool + ExpectedKeyID string + Package *Package + TenantID string + type SecurityInstallResult struct + AgentVersionRef string + RegisteredAt time.Time + VerifiedABI bool + VerifiedDigest bool + VerifiedPolicy bool + VerifiedSBOM bool + VerifiedSignature bool + func ExecuteSecurityPipeline(ctx context.Context, req SecurityInstallRequest, keyRegistry *Registry) (*SecurityInstallResult, error) + type Signature struct + CreatedAt time.Time + Ed25519 string + KeyID string + func SignImage(digest Digest, key *SigningKey) (*Signature, error) + type SigningKey struct + ID string + PrivateKey ed25519.PrivateKey
Go to main page