Documentation
¶
Overview ¶
Package audit is the read/verify use case over the append-only audit log. It adds an OPTIONAL ed25519 attestation over the verified chain head, bringing the audit chain to parity with the evidence chain: both are hash-chained AND origin-attested. Verification of the chain itself lives in the repositories behind ports.AuditReader; this service orchestrates "verify then sign the head".
Scope of the guarantee (same as evidence): the attestation proves the head was signed by THIS instance's key (origin / non-repudiation), and the hash chain makes edits/deletions that leave a verifiable suffix detectable. It does NOT, on its own, stop a privileged operator who reforges the whole chain and re-signs – that needs an external anchor (RFC-3161 via ports.TimestampAuthority, wired through SetTimestamper). The signed head is also returned on read so an external party can archive it out-of-band.
Index ¶
- Constants
- type Service
- func (s *Service) List(ctx context.Context, limit int) ([]ports.AuditEntry, error)
- func (s *Service) SetLogger(l *slog.Logger)
- func (s *Service) SetSigner(signer ports.ChainSigner)
- func (s *Service) SetTimestamper(tsa ports.TimestampAuthority, store ports.TimestampStore)
- func (s *Service) Verify(ctx context.Context) (VerifiedReport, error)
- type VerifiedReport
Constants ¶
const ChainAudit = "audit"
ChainAudit names the audit chain in the out-of-band timestamp store. The audit chain is global (not per-engagement), so it is anchored under the empty engagement id.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service reads and verifies the append-only audit log.
func NewService ¶
func NewService(reader ports.AuditReader) (*Service, error)
NewService validates its reader and returns the service.
func (*Service) SetLogger ¶
SetLogger sets the logger for best-effort anchor warnings; defaults to slog.Default().
func (*Service) SetSigner ¶
func (s *Service) SetSigner(signer ports.ChainSigner)
SetSigner enables chain-head attestation. Optional – nil leaves the audit chain integrity-only (the same signer the evidence vault uses is wired here for parity).
func (*Service) SetTimestamper ¶
func (s *Service) SetTimestamper(tsa ports.TimestampAuthority, store ports.TimestampStore)
SetTimestamper enables external RFC-3161 anchoring of the audit head, at parity with the evidence chain. Best-effort + bounded; the token is stored/returned out-of-band. Optional.
func (*Service) Verify ¶
func (s *Service) Verify(ctx context.Context) (VerifiedReport, error)
Verify re-derives the audit hash chain and, when a signer is set and the chain is intact + non-empty, attests the head. A signing failure is non-fatal: integrity still holds, so the report is returned without an attestation rather than failing the read (mirrors the evidence vault).
type VerifiedReport ¶
type VerifiedReport struct {
auditdom.Report
Attestation *evidence.Attestation `json:"attestation,omitempty"`
// Anchored/Timestamp carry the external RFC-3161 anchor over the head (tamper-proof,
// E13). Empty/false = tamper-evident + signed only.
Anchored bool `json:"anchored"`
Timestamp *ports.TimestampToken `json:"timestamp,omitempty"`
}
VerifiedReport is the audit chain's verification status plus, when a signer is configured and the chain is intact, a detached attestation over the chain head. The embedded Report is flattened in JSON; Attestation is an added optional field, so the wire shape stays backward compatible.
Source Files