Documentation
¶
Overview ¶
Package deployreceipt assembles a one-document record of a deploy from data the control plane already holds. It is unsigned and is not an attestation.
Index ¶
Constants ¶
const ( MatchedHeldAttempt = "held_attempt" MatchedImageAndTime = "image_and_time" )
Approval match kinds.
const NotRecorded = "not recorded"
NotRecorded marks a field the control plane has no data for.
const SchemaVersion = 1
SchemaVersion is bumped when a field changes meaning or is removed.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Approval ¶
type Approval struct {
ID string `json:"id"`
Action string `json:"action"`
Status string `json:"status"`
Requester Person `json:"requester"`
Approver *Person `json:"approver,omitempty"`
FreezeOverride string `json:"freeze_override,omitempty"`
// MatchedBy is "held_attempt" for an exact link or "image_and_time" for a heuristic match.
MatchedBy string `json:"matched_by"`
}
Approval is the approval that released the deploy, when one was needed.
type Commit ¶
type Commit struct {
SHA string `json:"sha,omitempty"`
Branch string `json:"branch,omitempty"`
Author string `json:"author,omitempty"`
Message string `json:"message,omitempty"`
}
Commit is the source identity of the build.
type GateStep ¶
type GateStep struct {
At string `json:"at"`
Phase string `json:"phase"`
Status string `json:"status"`
Reason string `json:"reason,omitempty"`
Message string `json:"message,omitempty"`
}
GateStep is one pre or post cutover check, in order.
type Image ¶
type Image struct {
Tag string `json:"tag"`
Digest string `json:"digest"`
DigestSource string `json:"digest_source"`
}
Image is the content identity that ran.
type Inputs ¶
type Inputs struct {
Attempt store.DeployAttempt
Verdict string
Requester Person
Approval *store.DeployApproval
SBOM *supplychain.Record
Gate []store.DeployGateEvent
// ApprovalMatchedBy says how Approval was linked to the attempt.
ApprovalMatchedBy string
LookupErrors []string
Now time.Time
}
Inputs are the already-loaded records a receipt is derived from.
type Person ¶
type Person struct {
Kind string `json:"kind,omitempty"`
ID string `json:"id,omitempty"`
Name string `json:"name,omitempty"`
At string `json:"at,omitempty"`
}
Person names who did something; only what the audit log already shows.
type Receipt ¶
type Receipt struct {
SchemaVersion int `json:"schema_version"`
GeneratedAt string `json:"generated_at"`
Signed bool `json:"signed"`
DeployID string `json:"deploy_id"`
App string `json:"app"`
Source string `json:"source"`
Status string `json:"status"`
Verdict string `json:"verdict,omitempty"`
StartedAt string `json:"started_at"`
FinishedAt string `json:"finished_at,omitempty"`
Requester *Person `json:"requester,omitempty"`
Approval *Approval `json:"approval,omitempty"`
Commit Commit `json:"commit"`
Image Image `json:"image"`
SBOM SBOM `json:"sbom"`
Gate []GateStep `json:"gate_timeline"`
RerunOf string `json:"rerun_of,omitempty"`
// Incomplete is true when a lookup failed, so absent sections mean unknown.
Incomplete bool `json:"incomplete,omitempty"`
LookupErrors []string `json:"lookup_errors,omitempty"`
}
Receipt is the document served at the receipt endpoint.
type SBOM ¶
type SBOM struct {
Recorded bool `json:"recorded"`
Note string `json:"note,omitempty"`
Format string `json:"format,omitempty"`
PackageCount int `json:"package_count,omitempty"`
Provenance bool `json:"provenance,omitempty"`
GeneratedAt string `json:"generated_at,omitempty"`
ScanStatus string `json:"scan_status,omitempty"`
Scanner string `json:"scanner,omitempty"`
Findings map[string]int `json:"findings,omitempty"`
}
SBOM summarizes the recorded bill of materials.
Source Files