verify

package

v0.1.0 Latest Latest Go to latest Published: Oct 19, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DavidGodefroid/lockfile

Links

Open Source Insights

Documentation ¶

Overview ¶

Package verify checks signatures of marketplace indexes and plugin artifacts against a trust root. There is no unsigned mode.

Constants ¶

This section is empty.

Variables ¶

View Source

var Official = TrustRoot{
	IdentityRegexp: `^https://github\.com/DavidGodefroid/lockfile-marketplace/\.github/workflows/release\.yml@refs/tags/`,
	OIDCIssuer:     "https://token.actions.githubusercontent.com",
}

Official is the trust root of the official marketplace: its release workflow, run on a tag, signing keyless through GitHub Actions OIDC.

Functions ¶

This section is empty.

Types ¶

type TrustRoot ¶

type TrustRoot struct {
	IdentityRegexp string
	OIDCIssuer     string
	PublicKeyPath  string
}

TrustRoot is who may sign: a keyless identity (certificate identity regexp and OIDC issuer) or a public key, exactly one of the two.

func (TrustRoot) Validate ¶

func (r TrustRoot) Validate() error

Validate checks that exactly one kind of trust root is set.

type Verifier ¶

type Verifier interface {
	VerifyBlob(ctx context.Context, blob, bundle string, root TrustRoot) error
}

Verifier checks that bundle is a valid signature of the file blob by root. blob and bundle are paths.

func NewCosign ¶

func NewCosign() (Verifier, error)

NewCosign returns a Verifier backed by the cosign CLI found on PATH.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL