Documentation
¶
Overview ¶
Package update checks a release's signature before a product installs anything from it: the keyless cosign signature of an artifact (typically checksums.txt) against the identity of the release workflow, then the checksums of the files. A product's `update` command and lockfile's plugin install share it.
Verification runs the cosign CLI (verify-blob with a sigstore bundle). A missing cosign is a refusal, never a skip.
Index ¶
- Variables
- func CheckSHA256(data []byte, want string) error
- func ChecksumFor(sums []byte, name string) (string, error)
- func Verify(ctx context.Context, artifact, bundle []byte, id Identity, o Options) error
- func VerifyFiles(ctx context.Context, artifact, bundle string, id Identity, o Options) error
- type Identity
- type Options
- type VerifyError
Constants ¶
This section is empty.
Variables ¶
var ErrCosignMissing = errors.New("cosign is not installed")
ErrCosignMissing means cosign is not installed: the signature cannot be checked, so nothing may be installed.
Functions ¶
func CheckSHA256 ¶
CheckSHA256 reports whether data has the hex sha256 want.
func ChecksumFor ¶
ChecksumFor returns the sha256 (lower case) a checksums.txt lists for name ("<hex> <name>" or "<hex> *<name>").
Types ¶
type Identity ¶
Identity is who must have signed: the certificate identity (a regular expression over the signing workflow's URL, anchored at "^https://") and the OIDC issuer of the certificate.
type Options ¶
type Options struct {
// Cosign is the cosign binary; "" looks it up in PATH.
Cosign string
}
Options configure Verify.
type VerifyError ¶
VerifyError is a signature that does not verify; Output is cosign's.
func (*VerifyError) Error ¶
func (e *VerifyError) Error() string
func (*VerifyError) Unwrap ¶
func (e *VerifyError) Unwrap() error
Source Files