Documentation
¶
Overview ¶
Package endpointrule holds the one predicate that decides whether an endpoint a well-known manifest advertises may be used at all.
The rule is normative — WellKnownManifest.endpoint states it as a MUST — and it is checked in two places for two different reasons: the resolver refuses to hand such an endpoint back, and the client refuses to send a signed call to one even when a caller injected its own resolver. Two call sites, two error vocabularies, but there must only ever be ONE predicate. Written twice it drifts, and this repo has watched a duplicated host predicate drift inside a single commit.
Internal because Python and TypeScript grow their own implementations rather than binding to a Go export; the predicates the rule is built from are the shared public surface, and all three languages are held to one answer by the endpoint-vet conformance vectors rather than by this package being importable.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Vet ¶
Vet reports whether endpoint may be used for host — the host that served the manifest advertising it — returning nil when it may and a describing error when it may not.
Two conditions refuse. The endpoint must be on host or a subdomain of it: the manifest is only as trustworthy as the host that served it, so an endpoint naming an unrelated host would let whoever answers for that document redirect a signed call to a party the offer's signature never covered. A dial-time address guard has no objection to an unrelated PUBLIC host, so nothing below this catches it.
And the endpoint must carry no userinfo. The host comparison reads the authority's host and ignores any user:password before it, so credentials would otherwise pass the first check and then have net/http stamp an Authorization header the SDK never chose — on a leg that already carries the agent's own signature.
Both conditions apply the SAME normalization rule: a value naming no scheme is read as https, exactly as the anchor check reads it. That is not tidiness — a value naming no scheme is a URL to one parser and a path to another, and the two answers put the credential on opposite sides of the check.
The rule is stated twice, here and in helpers' own parse, and what holds the two together is the endpoint-vet corpus rather than a shared reading. Reaching one reading would mean exporting it, and the ports bind to the vectors rather than to a Go symbol, so the export would buy nothing they can use. A divergence between the two copies fails CI instead of shipping.
The caller supplies the vocabulary: the errors here describe what was wrong, and each call site wraps them in whatever sentinel its own tier classifies on.
Types ¶
This section is empty.
Source Files