Documentation
¶
Overview ¶
Package effects models bounded, reference-first effect evidence and grades typed effect contracts without executing or mutating external systems.
Index ¶
- Constants
- func ComposeDependencyAvailable(binary string) bool
- func ComposeProjectValid(project string) bool
- func LoadPublicKey(path string) (ed25519.PublicKey, error)
- func MarshalComposeCollectorResult(result CaptureResult) ([]byte, error)
- func ValidateComposeOptions(options ComposeRunOptions) error
- func WriteCaptureResult(path string, r CaptureResult) error
- func WriteJUnit(path string, result GradeResult) error
- func WriteSnapshot(path string, s Snapshot) error
- type Capture
- type CaptureRequest
- type CaptureResult
- type Collector
- type ComposeRunOptions
- type ComposeRunResult
- type Contract
- type Correlation
- type CorrelationExpectation
- type GradeOptions
- type GradeResult
- type Observation
- type Predicate
- type PredicateEvaluation
- type Provenance
- type Redaction
- type Selector
- type Snapshot
- type ValidationResult
Constants ¶
View Source
const ( MaxCaptureBytes = 1 << 20 MaxCaptureFiles = 1024 MaxCaptureURLBytes = 1 << 20 )
View Source
const ( SnapshotSchemaID = "https://gait.dev/schemas/v1/effects/effect-snapshot.schema.json" ContractSchemaID = "https://gait.dev/schemas/v1/effects/effect-contract.schema.json" GradeSchemaID = "https://gait.dev/schemas/v1/effects/effect-grading-result.schema.json" SchemaVersion = "1.0.0" )
View Source
const ( ResourcePostgres = "postgres" ResourceFilesystem = "filesystem" ResourceHTTP = "http" ResourceGeneric = "resource" ObservationPresent = "present" ObservationAbsent = "absent" ObservationUnknown = "unknown" CompletenessComplete = "complete" CompletenessPartial = "partial" CompletenessUnknown = "unknown" EnforcementVerified = "verified" EnforcementObservedOnly = "observed_only" EnforcementPartial = "partial" EnforcementUnknown = "unknown" GradePass = "pass" GradeFail = "fail" GradeInconclusive = "inconclusive" PredicateExpect = "expect" PredicateForbid = "forbid" PredicateInvariant = "invariant" )
View Source
const ( ReasonSchemaUnsupported = "effect_schema_unsupported" ReasonSnapshotIDMissing = "effect_snapshot_id_missing" ReasonResourceKindInvalid = "effect_resource_kind_invalid" ReasonSelectorMissing = "effect_selector_missing" ReasonObservationInvalid = "effect_observation_invalid" ReasonDigestInvalid = "effect_digest_invalid" ReasonDigestMismatch = "effect_digest_mismatch" ReasonCollectorMissing = "effect_collector_missing" ReasonCaptureInvalid = "effect_capture_invalid" ReasonRedactionInvalid = "effect_redaction_invalid" ReasonCompletenessInvalid = "effect_completeness_invalid" ReasonEnforcementInvalid = "effect_enforcement_invalid" ReasonEvidenceMissing = "effect_evidence_missing" ReasonContractIDMissing = "effect_contract_id_missing" ReasonPredicateInvalid = "effect_predicate_invalid" ReasonContractInvalid = "effect_contract_invalid" ReasonSnapshotInvalid = "effect_snapshot_invalid" ReasonContractMismatch = "effect_contract_mismatch" ReasonPredicateFailed = "effect_predicate_failed" ReasonPredicateInconclusive = "effect_predicate_inconclusive" ReasonEvidenceIncomplete = "effect_evidence_incomplete" ReasonObservedOnly = "effect_observed_only" ReasonWhitespaceInvalid = "effect_whitespace_invalid" ReasonSchemaValidationFailed = "effect_schema_validation_failed" ReasonProvenanceMissing = "effect_provenance_missing" ReasonProvenanceInvalid = "effect_provenance_invalid" ReasonNonAuthoritative = "effect_non_authoritative_provenance" ReasonTrustedKeyMissing = "effect_trusted_collector_key_missing" ReasonTrustedKeyMismatch = "effect_trusted_collector_key_mismatch" ReasonCorrelationMissing = "effect_correlation_missing" ReasonCorrelationMismatch = "effect_correlation_mismatch" ReasonTemporalOrderInvalid = "effect_temporal_order_invalid" )
Variables ¶
This section is empty.
Functions ¶
func ComposeDependencyAvailable ¶ added in v1.7.0
func ComposeProjectValid ¶ added in v1.7.0
func MarshalComposeCollectorResult ¶ added in v1.7.0
func MarshalComposeCollectorResult(result CaptureResult) ([]byte, error)
func ValidateComposeOptions ¶ added in v1.7.0
func ValidateComposeOptions(options ComposeRunOptions) error
func WriteCaptureResult ¶ added in v1.6.0
func WriteCaptureResult(path string, r CaptureResult) error
func WriteJUnit ¶
func WriteJUnit(path string, result GradeResult) error
func WriteSnapshot ¶ added in v1.6.0
Types ¶
type CaptureRequest ¶ added in v1.6.0
type CaptureResult ¶ added in v1.6.0
type CaptureResult struct {
Observation Observation `json:"observation"`
Complete bool `json:"complete"`
Reason string `json:"reason,omitempty"`
}
func CaptureLocal ¶ added in v1.6.0
func CaptureLocal(req CaptureRequest) (CaptureResult, error)
Capture observes a filesystem path, an HTTP URL, or a generic reference. Generic capture is deliberately reference-only and does not invoke commands.
func LoadCaptureResult ¶ added in v1.6.0
func LoadCaptureResult(path string) (CaptureResult, error)
type ComposeRunOptions ¶ added in v1.7.0
type ComposeRunOptions struct {
ComposeFile string
Project string
WorkingDir string
DockerBinary string
Service string
MountedPath string
ProxyURL string
Reset []string
Seed []string
Run []string
Diff []string
Accept []string
Repeat []string
Timeout time.Duration
Now time.Time
Capture func(CaptureRequest) (CaptureResult, error)
PostgresCollector func(context.Context) (CaptureResult, error)
PostgresReference string
PostgresCollectorCommand []string
}
type ComposeRunResult ¶ added in v1.7.0
type ComposeRunResult struct {
Status string `json:"status"`
ReasonCodes []string `json:"reason_codes,omitempty"`
Project string `json:"project"`
ComposeFile string `json:"compose_file"`
Observations []CaptureResult `json:"observations,omitempty"`
Before []CaptureResult `json:"before,omitempty"`
After []CaptureResult `json:"after,omitempty"`
Changed bool `json:"changed,omitempty"`
Commands []string `json:"commands,omitempty"`
}
func RunCompose ¶ added in v1.7.0
func RunCompose(ctx context.Context, options ComposeRunOptions) ComposeRunResult
type Contract ¶
type Contract struct {
SchemaID string `json:"schema_id"`
SchemaVersion string `json:"schema_version"`
ContractID string `json:"contract_id"`
Name string `json:"name"`
Predicates []Predicate `json:"predicates"`
}
func LoadContract ¶
type Correlation ¶
type Correlation struct {
ActionDigest string `json:"action_digest,omitempty"`
ActivationDigest string `json:"activation_digest,omitempty"`
ProofDigest string `json:"proof_digest,omitempty"`
RunID string `json:"run_id,omitempty"`
LifecycleID string `json:"lifecycle_id,omitempty"`
ProofRefs []string `json:"proof_refs,omitempty"`
}
type CorrelationExpectation ¶
type CorrelationExpectation struct {
ActionDigest string
ActivationDigest string
ProofDigest string
}
CorrelationExpectation is the caller-owned identity binding for an effect grade. At least one digest must be supplied before a pass is authoritative.
type GradeOptions ¶
type GradeOptions struct {
TrustedCollectorPublicKey ed25519.PublicKey
// AllowFixtureTestProvenance is reserved for the committed fixture generator
// and package tests; the production CLI does not expose this bypass.
AllowFixtureTestProvenance bool
ExpectedCorrelation *CorrelationExpectation
}
type GradeResult ¶
type GradeResult struct {
SchemaID string `json:"schema_id"`
SchemaVersion string `json:"schema_version"`
ContractID string `json:"contract_id"`
SnapshotID string `json:"snapshot_id"`
Status string `json:"status"`
EvidenceStatus string `json:"evidence_status"`
ReasonCodes []string `json:"reason_codes"`
Evaluations []PredicateEvaluation `json:"evaluations"`
}
func Grade ¶
func Grade(snapshot Snapshot, contract Contract) GradeResult
func GradeWithOptions ¶
func GradeWithOptions(snapshot Snapshot, contract Contract, options GradeOptions) GradeResult
type Observation ¶
type Observation struct {
State string `json:"state"`
Digest string `json:"digest,omitempty"`
Count *int64 `json:"count,omitempty"`
Identity string `json:"identity,omitempty"`
Owner string `json:"owner,omitempty"`
TTLSeconds *int64 `json:"ttl_seconds,omitempty"`
ObservedAt string `json:"observed_at"`
EvidenceRefs []string `json:"evidence_refs,omitempty"`
}
type PredicateEvaluation ¶
type Provenance ¶
type Snapshot ¶
type Snapshot struct {
SchemaID string `json:"schema_id"`
SchemaVersion string `json:"schema_version"`
SnapshotID string `json:"snapshot_id"`
ResourceKind string `json:"resource_kind"`
Selector Selector `json:"selector"`
Before Observation `json:"before"`
After Observation `json:"after"`
Collector Collector `json:"collector"`
Capture Capture `json:"capture"`
Redaction Redaction `json:"redaction"`
Correlation Correlation `json:"correlation"`
Provenance Provenance `json:"provenance"`
Completeness string `json:"completeness"`
Enforcement string `json:"enforcement"`
EvidenceRefs []string `json:"evidence_refs,omitempty"`
CanonicalContentDigest string `json:"canonical_content_digest"`
}
func BuildSnapshot ¶ added in v1.6.0
func BuildSnapshot(req CaptureRequest, correlation Correlation, privateKey []byte) (Snapshot, error)
BuildSnapshot turns a capture observation into the existing signed effect snapshot envelope. Both observations are intentionally identical: callers needing before/after semantics must capture both sides explicitly.
func BuildSnapshotFromObservations ¶ added in v1.6.0
func BuildSnapshotFromObservations(before, after CaptureResult, resource string, selector Selector, correlation Correlation, privateKey []byte) (Snapshot, error)
func LoadSnapshot ¶
func (Snapshot) CanonicalDigest ¶
func (Snapshot) VerifyProvenance ¶
type ValidationResult ¶
type ValidationResult struct {
Valid bool `json:"valid"`
ReasonCodes []string `json:"reason_codes,omitempty"`
}
func ValidateContract ¶
func ValidateContract(c Contract) ValidationResult
func ValidateSnapshot ¶
func ValidateSnapshot(s Snapshot) ValidationResult
Click to show internal directories.
Click to hide internal directories.