verify

package

v0.2.0 Latest Latest Go to latest Published: Oct 19, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DavidGodefroid/lockfile

Links

Open Source Insights

Documentation ¶

Overview ¶

Package verify checks signatures of marketplace indexes and plugin artifacts against a trust root. There is no unsigned mode.

Index ¶

Variables
type TrustRoot
- func OfficialRelease(name, version string) TrustRoot
- func (r TrustRoot) Validate() error
type Verifier
- func NewLockkit(o update.Options) Verifier

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrCosignMissing = update.ErrCosignMissing

ErrCosignMissing means cosign is not installed: nothing can be verified, so nothing is installed.

View Source

var ErrPublicKeyRoot = errors.New("verify: public-key trust roots need lockkit support (not in lockkit v0.1.0)")

ErrPublicKeyRoot refuses a public-key trust root: lockkit's signature check (update.VerifyFiles, v0.1.0) is keyless only.

View Source

var Official = TrustRoot{
	IdentityRegexp: `^https://github\.com/DavidGodefroid/lockfile-marketplace/\.github/workflows/release\.yml@refs/tags/`,
	OIDCIssuer:     "https://token.actions.githubusercontent.com",
}

Official is the trust root of the official marketplace: its release workflow, run on a tag, signing keyless through GitHub Actions OIDC.

Functions ¶

This section is empty.

Types ¶

type TrustRoot ¶

type TrustRoot struct {
	IdentityRegexp string
	OIDCIssuer     string
	PublicKeyPath  string
}

TrustRoot is who may sign: a keyless identity (certificate identity regexp and OIDC issuer) or a public key, exactly one of the two.

func OfficialRelease ¶ added in v0.1.1

func OfficialRelease(name, version string) TrustRoot

OfficialRelease is the trust root of one official plugin version: the release workflow run on that version's exact tag, <name>/v<version>. A plugin binary or manifest signed by the run of another tag is refused.

func (TrustRoot) Validate ¶

func (r TrustRoot) Validate() error

Validate checks that exactly one kind of trust root is set.

type Verifier ¶

type Verifier interface {
	VerifyBlob(ctx context.Context, blob, bundle string, root TrustRoot) error
}

Verifier checks that bundle is a valid signature of the file blob by root. blob and bundle are paths.

func NewLockkit ¶ added in v0.2.0

func NewLockkit(o update.Options) Verifier

NewLockkit returns a Verifier backed by lockkit's update.VerifyFiles (cosign verify-blob, keyless). A missing cosign fails every check.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL