Documentation
¶
Overview ¶
Package update checks a release's signature before a product installs anything from it: the cosign signature of an artifact (typically checksums.txt), keyless against the identity of the release workflow or key-pair against a public key, then the checksums of the files. A product's `update` command and lockfile's plugin install share it.
Verification runs the cosign CLI (verify-blob with a sigstore bundle). A missing cosign is a refusal, never a skip. Both modes require the bundle's transparency log (Rekor) entry: --insecure-ignore-tlog is never passed.
Index ¶
- Variables
- func CheckSHA256(data []byte, want string) error
- func ChecksumFor(sums []byte, name string) (string, error)
- func Verify(ctx context.Context, artifact, bundle []byte, id Identity, o Options) error
- func VerifyFiles(ctx context.Context, artifact, bundle string, id Identity, o Options) error
- type Identity
- type Options
- type VerifyError
Constants ¶
This section is empty.
Variables ¶
var ErrCosignMissing = errors.New("cosign is not installed")
ErrCosignMissing means cosign is not installed: the signature cannot be checked, so nothing may be installed.
Functions ¶
func CheckSHA256 ¶
CheckSHA256 reports whether data has the hex sha256 want.
func ChecksumFor ¶
ChecksumFor returns the sha256 (lower case) a checksums.txt lists for name ("<hex> <name>" or "<hex> *<name>").
Types ¶
type Identity ¶
type Identity struct {
CertIdentityRegexp string
OIDCIssuer string
// PublicKey is a PEM cosign public key ("-----BEGIN PUBLIC KEY-----").
// When set, CertIdentityRegexp and OIDCIssuer must be empty. The
// product reads the key file itself; lockkit only takes its bytes.
PublicKey []byte
}
Identity is who must have signed: keyless, the certificate identity (a regular expression over the signing workflow's URL, anchored at "^https://") and the OIDC issuer of the certificate; or key-pair, a cosign public key.
type Options ¶
type Options struct {
// Cosign is the cosign binary; "" looks it up in PATH.
Cosign string
}
Options configure Verify.
type VerifyError ¶
VerifyError is a signature that does not verify; Output is cosign's.
func (*VerifyError) Error ¶
func (e *VerifyError) Error() string
func (*VerifyError) Unwrap ¶
func (e *VerifyError) Unwrap() error
Source Files