Documentation
¶
Overview ¶
Package autosign resolves the effective signer for a target, applying Tier-0 auto-provision ONLY when the operator has consented (enabled && auto_provision && a configured state_dir). It is the one place the "never silently mint a trust identity" policy is enforced: with auto_provision off (the default) or no state_dir, an unresolved key yields "do not sign", never a freshly-minted key.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EffectiveSigner ¶
func EffectiveSigner(ctx context.Context, cfg config.SigningConfig, profile *config.ResolvedSigningProfile, rootDir, repoRoot string, desired map[string]config.ToolConstraint, now string) (sign.SignPlan, string, bool, error)
EffectiveSigner resolves the SignPlan a target signs under. `profile` may be nil (no explicit profile). Returns:
- plan: the resolved signing plan
- tier: assurance tier ("" for an operator-supplied signer; "tier0-software" when auto-provisioned) — recorded so trust is never overstated
- ok: whether signing should proceed
- err: FATAL (continuity violation, state-dir guard, resolve failure)
func InactiveReason ¶
func InactiveReason(cfg config.SigningConfig) string
InactiveReason explains — for a highly-visible advisory — why signing did not run despite being enabled, so an operator never silently produces unsigned artifacts believing signing is on.
Types ¶
type SigningContext ¶
SigningContext is the REALIZED signing semantics for a target: the resolved signer plan, the declared capability Env, the assurance tier, and whether to sign. It is a SEMANTIC context object, deliberately NOT an orchestration one — it holds no artifact refs, no result manifests, no recorders, and no publication handles. The call sites keep ownership of transport (image vs blob), phase (Build sign vs Publish attest), and recording sink; this owns "what signer, what env, what evidence" so every site resolves them IDENTICALLY. Adding a new evidence dimension is then a one-place change here, not a synchronized edit across four hand-rolled sites.
func ResolveSigningContext ¶
func ResolveSigningContext(ctx context.Context, cfg config.SigningConfig, profile *config.ResolvedSigningProfile, rootDir, repoRoot string, desired map[string]config.ToolConstraint, now string) (SigningContext, error)
ResolveSigningContext resolves the effective signer (EffectiveSigner) and binds its declared capability Env in one step — the canonical path for the build sites (auto-sign with consented Tier-0 fallback). DoSign==false means no signer resolved (the caller skips); a non-nil error is FATAL (continuity / state-dir guard / explicit-profile no-downgrade), surfaced unchanged. sign.go does NOT use this: a human-chosen profile compiles directly with no Tier-0 fallback, so it builds a SigningContext itself and shares only Evidence().
func (SigningContext) Evidence ¶
func (c SigningContext) Evidence(signedAt string) artifact.TrustEvidence
Evidence is the CANONICAL TrustEvidence for this context — the single definition of how a realized signer becomes recorded trust facts. Every signing site routes through here so class, tier, presence, non-exportability, transparency, signer ref, and trust domain are populated consistently (the omission of any one was the exact drift this consolidates). signedAt is an RFC3339 timestamp ("" to omit).
Source Files