Documentation
¶
Overview ¶
Package allowlist loads and validates the maintained signer allowlist at recipes/evidence/allowlist.yaml. The allowlist is the trust root for the interim evidence-corroboration dashboard (epic #1400, contract #1347): it pins, per class, the signers that may contribute corroborating evidence. GP2's verify step and GP4's consensus model read it to classify a verified signer and weight its corroboration; a verified-but-unlisted signer is admitted as "reported," never corroborating.
Privacy: community/partner entries are keyed by the one-way source slug (attestation.SourceSlug of the signer's issuer+identity) and never store the cleartext identity, so a contributor's personal email is not committed to the repo. First-party entries pin their CI workflow identity as a tightly-bounded regex — a workflow URL, not personal PII.
The allowlist must not itself become a sybil surface, so Validate enforces that every entry is anchored (a content-addressed slug, or a tightly-bounded regex with no wildcard in the issuer/org/repo/workflow segment), that the three classes are disjoint, and that no two entries overlap.
Index ¶
Constants ¶
const SchemaVersion = "1.0.0"
SchemaVersion is the on-disk allowlist schema version. Validate accepts the 1.0.x line.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Allowlist ¶
type Allowlist struct {
SchemaVersion string `yaml:"schemaVersion"`
FirstParty []Entry `yaml:"firstParty"`
Community []Entry `yaml:"community"`
Partner []Entry `yaml:"partner"`
}
Allowlist is the parsed recipes/evidence/allowlist.yaml document.
func (*Allowlist) Classify ¶
Classify resolves a verified signer to its allowlist class and entry. The bool is false when the signer is not listed — callers admit such a signer as "reported" (never corroborating). Slug matches (community/partner) take precedence over pattern matches (first-party); Validate keeps the classes administratively disjoint.
type Entry ¶
type Entry struct {
Label string `yaml:"label,omitempty"`
Issuer string `yaml:"issuer"`
Source string `yaml:"source,omitempty"`
IdentityPattern string `yaml:"identityPattern,omitempty"`
}
Entry pins one contributing signer. Exactly one of Source (the one-way per-source slug, for community/partner parties that commit pointers) or IdentityPattern (a tightly-bounded anchored regex, for branch-varying first-party CI that ingests directly) must be set.
Source is attestation.SourceSlug(issuer, identity) of the verified signer. The cleartext identity is intentionally NOT stored — the slug is the stable key and is recomputed from the verified cert at ingest time. Label is an optional, non-PII display string (e.g. a GitHub handle or org name) surfaced by the dashboard; omit it to keep the entry fully pseudonymous.
Source Files