Documentation
¶
Overview ¶
Package trustdisclosure interprets a publish ResultsManifest into a STRUCTURED trust disclosure — typed facts, never pre-baked prose. It is the first narrow slice of trust-CONSUMPTION logic lifted out of the release command, so the publisher stays a transcriber: the release renderer (and later an API, a policy UI, or the verification engine) formats these facts however it needs, rather than each re-deriving "the primary signature" or "which layers" from raw outcomes.
Interpretation here is PURE — no filesystem, no config, no rendering. The continuity anchor is loaded at the edge (impure: state dir + identity) and passed IN, so this package is a total function of (results, anchor). That keeps the boundary the rest of the subsystem already holds: interpretation pure, acquisition impure. As the verification engine matures it will own this summarization; the release renderer is then a formatter around its output.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Anchor ¶
type Anchor struct {
Fingerprint string
Asset string // release-asset filename for the public key (e.g. "cosign.pub")
}
Anchor is the pinnable continuity identity — loaded at the edge and passed to Build.
type AttestationFact ¶
type AttestationFact struct {
PredicateType string
Class string
Tier string
TrustDomain string
NonExportable bool
PhysicalPresence bool
VerifiedDigest string
}
AttestationFact is one provenance attestation's recorded dimensions.
type Disclosure ¶
type Disclosure struct {
Primary *SignatureFact // headline signature (Tier-0 first, else first); nil if no signatures
Layers []SignatureFact // other signatures, deduped, primary excluded
Attestations []AttestationFact // provenance attestations, deduped
Anchor *Anchor // pinnable continuity anchor, when this release carries a Tier-0 sig + a loaded identity
}
Disclosure is the structured trust disclosure for one release.
func Build ¶
func Build(results *artifact.ResultsManifest, anchor *Anchor) *Disclosure
Build interprets the results manifest into a structured disclosure. Pure: the caller loads the identity (if any) and passes it as anchor; Build attaches it only when this release actually carries a Tier-0 signature (never a stale anchor for a release it did not sign). Returns nil when there is nothing to disclose.
func (*Disclosure) ChecksumSig ¶
func (d *Disclosure) ChecksumSig() string
ChecksumSig returns the detached-checksum signature asset for a verify recipe — the first blob signature (Tier-0 preferred, since signatures are sorted Tier-0-first).
type SignatureFact ¶
type SignatureFact struct {
Class string // key | oidc | kms | hardware
Tier string // raw tier ("tier0-software", …); the renderer maps to a human label
TrustDomain string // oidc/keyless ecosystem ("public-sigstore", a label, a Fulcio host)
SignerRef string
Transparency bool
NonExportable bool
PhysicalPresence bool
Asset string // detached-signature filename (blob) or image digest ref
IsBlob bool
}
SignatureFact is one signature's recorded trust dimensions — the SAME type for the primary and for additional layers (a layer is just a non-primary signature).
Source Files