Documentation
¶
Overview ¶
Package redact minimizes the sensitive operational detail an evidence bundle physically ships, while leaving the cryptographic verification story intact.
The signed predicate commits to artifacts by hash and carries the derived fingerprint / criteria-match / per-phase counts — that is the conformance signal. The snapshot and CTRF payloads are the *backing content* those digests point at, not the signal itself, so they can be shrunk without weakening the binding.
Two transforms are applied by the minimal policy:
- Snapshot: a fail-closed allowlist that is enforced at every level — measurement type, subtype, AND data key. Only enumerated types, subtypes, and keys survive; a new type, subtype, or key a future collector adds is dropped until explicitly allowlisted (there is no keep-all subtype). Node names, provider instance IDs, the raw node label/taint set, kernel/sysctl tuning, loaded modules, and systemd service config are dropped.
- CTRF: per-test Stdout and Message (free-form log text that can leak IPs, DNS names, secret/cert names, internal URLs) are omitted; the pass/fail signal (name, status, duration, suite, summary counts) is preserved. The structured per-test Extra map is rebuilt against a fail-closed key AND value allowlist (ctrfExtraAllowlist): only enumerated low-cardinality keys survive, and each surviving value must additionally pass its key's validator (non-negative decimal count, or a closed set of known skip codes) — so an identifier smuggled under an allowed key (e.g. an IP in nodesTotal, a hostname or unminted code in skipReason) is dropped, not published. This is the publication boundary: emission-side validation alone is bypassable via raw prefixed stdout. A signed bundle can still distinguish a 1-of-2-node pass from 2-of-2 and preserve a skip reason without shipping free-form log text. An Extra map that retains nothing is dropped rather than shipped as an empty object.
Both functions are pure and non-mutating: they build fresh structures and never alter their inputs, so the full (unredacted) artifacts remain available for the --full emit path and for computing the predicate fingerprint from the raw snapshot.
Index ¶
Constants ¶
const ( // PolicyName identifies the redaction policy recorded in the predicate. PolicyName = "minimal" // PolicyVersion is the allowlist/scrub-rule version. Bump on any change // to what survives redaction so verifiers can tell which rules ran. // // v2 added the per-test CTRF Extra allowlist (ctrfExtraAllowlist): // allowlisted structured keys whose values match the key's canonical shape // (count / enum code) now survive minimal redaction. PolicyVersion = "v2" )
Variables ¶
This section is empty.
Functions ¶
func CTRF ¶
CTRF returns a redacted deep copy of in with per-test Stdout and Message omitted and each per-test Extra map rebuilt against ctrfExtraAllowlist, plus the sorted list of applied rule identifiers. It never mutates in. Returns (nil, nil) when in is nil.
func Snapshot ¶
func Snapshot(in *snapshotter.Snapshot) (*snapshotter.Snapshot, []string)
Snapshot returns a redacted deep copy of in and the sorted list of applied rule identifiers. It never mutates in. Returns (nil, nil) when in is nil.
Types ¶
This section is empty.
Source Files