Documentation
¶
Overview ¶
Package git implements the AnchorProvider interface by committing the Merkle root to a git repository and pushing to a configured remote. Git anchoring provides near-instant finalization — once the push succeeds, the commit is permanent (assuming the remote is trustworthy). Confirmation is therefore returned as ConfirmationFinalized immediately after a successful push.
Redundancy note: git anchoring is lightweight and free but depends on the trust of the repository hosting provider. BMW uses it alongside OpenTimestamps for fast redundant anchoring.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CommitTemplateData ¶
type CommitTemplateData struct {
MerkleRoot string // hex-encoded merkle root
AnchoredAt string // RFC3339 timestamp of the anchor operation
}
CommitTemplateData is the data available to CommitTemplate.
type Config ¶
type Config struct {
// Remote is the git remote URL (file path, https, git+ssh, etc.).
Remote string `json:"remote"`
// Branch is the branch to push anchors to. Defaults to "main".
Branch string `json:"branch,omitempty"`
// CommitTemplate is a Go text/template string for the commit message.
// Template data: CommitTemplateData. Defaults to "anchor: {{.MerkleRoot}}".
CommitTemplate string `json:"commit_template,omitempty"`
// AuthorName is the git commit author name. Defaults to "audit-chain-bot".
AuthorName string `json:"author_name,omitempty"`
// AuthorEmail is the git commit author email. Defaults to "audit-chain-bot@localhost".
AuthorEmail string `json:"author_email,omitempty"`
// UseSSHAgent uses the system SSH agent for authentication (production default
// for git+ssh remotes like git@github.com:org/repo.git).
UseSSHAgent bool `json:"use_ssh_agent,omitempty"`
// SSHKeyPath is the path to a PEM-encoded private key file.
// Used when UseSSHAgent is false and the remote is SSH.
SSHKeyPath string `json:"ssh_key_path,omitempty"`
// SSHKeyPassword is the passphrase for an encrypted PEM key at SSHKeyPath.
// Leave empty for unencrypted keys.
SSHKeyPassword string `json:"ssh_key_password,omitempty"`
// HTTPUsername and HTTPPassword provide HTTP Basic Auth credentials
// (or personal-access token in the Password field) for HTTPS remotes.
HTTPUsername string `json:"http_username,omitempty"`
HTTPPassword string `json:"http_password,omitempty"`
}
Config holds configuration for the git anchor provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements providers.AnchorProvider using a git remote.
func NewProvider ¶
NewProvider creates a new git anchor provider. Returns an error if Remote is empty, CommitTemplate is invalid, or auth credentials cannot be loaded (e.g., SSHKeyPath does not exist).
func (*Provider) Anchor ¶
Anchor commits the Merkle root to the configured git remote.
It clones the remote into a temporary directory, writes an anchor JSON file to anchors/<YYYY-MM-DD>/<first16hexchars>.json, commits with the rendered CommitTemplate, and pushes. Returns Confirmation: Finalized immediately — a successful push is permanent in git.
func (*Provider) Verify ¶
func (p *Provider) Verify(ctx context.Context, anchor providers.Anchor) (providers.Verification, error)
Verify checks that the anchor's remote is reachable and returns ConfirmationFinalized. Git commits are permanent once pushed; transient connectivity errors are swallowed per § 3.5c.
Swallow contract:
- Remote unreachable / network error → Swallowed=true, confirmation preserved.
- Malformed ProofData → hard error.