Documentation
¶
Overview ¶
Package verify checks signatures of marketplace indexes and plugin artifacts against a trust root. There is no unsigned mode.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrCosignMissing = update.ErrCosignMissing
ErrCosignMissing means cosign is not installed: nothing can be verified, so nothing is installed.
var ErrPublicKeyRoot = errors.New("verify: public-key trust roots need lockkit support (not in lockkit yet)")
ErrPublicKeyRoot refuses a public-key trust root: lockkit's signature check (update.VerifyFiles) is keyless only.
var Official = TrustRoot{
IdentityRegexp: `^https://github\.com/DavidGodefroid/lockfile-marketplace/\.github/workflows/release\.yml@refs/tags/`,
OIDCIssuer: "https://token.actions.githubusercontent.com",
}
Official is the trust root of the official marketplace: its release workflow, run on a tag, signing keyless through GitHub Actions OIDC.
Functions ¶
This section is empty.
Types ¶
type TrustRoot ¶
TrustRoot is who may sign: a keyless identity (certificate identity regexp and OIDC issuer) or a public key, exactly one of the two.
func OfficialRelease ¶ added in v0.1.1
OfficialRelease is the trust root of one official plugin version: the release workflow run on that version's exact tag, <name>/v<version>. A plugin binary or manifest signed by the run of another tag is refused.
type Verifier ¶
type Verifier interface {
VerifyBlob(ctx context.Context, blob, bundle string, root TrustRoot) error
}
Verifier checks that bundle is a valid signature of the file blob by root. blob and bundle are paths.
func NewLockkit ¶ added in v0.2.0
NewLockkit returns a Verifier backed by lockkit's update.VerifyFiles (cosign verify-blob, keyless). A missing cosign fails every check.
Source Files