Documentation
¶
Overview ¶
Package verify is the engine module and command surface for supply-chain verification. It answers, for an image, the question a deploy gate cares about: "is this signed by someone we trust, does it carry the attestations we require, and does every signature actually bind to *this* digest?" The heavy lifting lives in internal/sig (DSSE, trust, transparency log) and internal/attest (in-toto statements); this package resolves inputs, drives the verification, and projects the outcome into the unified Finding model with the DS-RAT-SUP- rule namespace.
It fails closed. When no trust root is configured it does not pretend an image is fine — it reports that verification is not configured (INFO) and verifies nothing. When a trust root *is* present, an unsigned or unverifiable image is a finding, and a signature that binds to a different digest is treated as a tamper attempt (CRITICAL), never quietly ignored.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AttestCommand ¶
AttestCommand implements `dsecrat attest`: build a signed in-toto attestation (SBOM, SLSA provenance, VEX, or an AI-agent-action) and add it to a bundle.
func Register ¶
Register adds the verify module to the registry. The master agent calls this from modules.Default() during integration; this package never edits the shared registry file.
func SignCommand ¶
SignCommand implements `dsecrat sign`: sign an image by digest and write a verification bundle. The master wires this as a top-level subcommand; the body lives here so cli.go stays a thin dispatcher.
func VerifyCommand ¶
VerifyCommand implements `dsecrat verify`: verify a bundle against a trust config and print the findings. Exit code is non-zero if the verdict fails.
Types ¶
type Config ¶
type Config struct {
// Trust is the set of trusted signing keys and the signer policy.
Trust sig.TrustConfig `json:"trust"`
// LogPublicKeyPEM, if set, is the transparency-log public key used to verify
// inclusion proofs carried in a bundle.
LogPublicKeyPEM string `json:"log_public_key_pem,omitempty"`
// RequireAttestations lists predicate type URIs that must each be present and
// verified (e.g. an SBOM or SLSA provenance attestation). An image missing a
// required attestation is a finding.
RequireAttestations []string `json:"require_attestations,omitempty"`
// RequireTransparencyLog demands a valid inclusion proof for each signature.
RequireTransparencyLog bool `json:"require_transparency_log,omitempty"`
// EnableAgentActions turns on processing of AI-agent-action attestations.
// Off by default: the deterministic verify core never depends on it.
EnableAgentActions bool `json:"enable_agent_actions,omitempty"`
}
Config is the operator-supplied verification policy. It is JSON so it can be committed and reviewed alongside the images it governs.
func ParseConfig ¶
ParseConfig decodes a module Config from JSON.
type Module ¶
type Module struct{}
Module is the supply-chain verification capability (CAPABILITY_SPEC domain 9). It supports image and registry targets and emits DS-RAT-SUP- findings.
func (*Module) Analyze ¶
Analyze resolves the verification inputs for the target (a trust config, a signature/attestation bundle, and the image digest), runs verification, and returns findings plus a verdict summary. Configuration travels via the target's Metadata so the module stays a pure function of its inputs:
verify.config path to a JSON module Config (trust + requirements)
verify.trust path to a raw sig.TrustConfig (shorthand for config.trust)
verify.bundle path to a signature/attestation bundle JSON
image.digest the manifest digest under test ("sha256:...")
verify.online "true" to fetch the bundle from the registry via referrers
With nothing configured it reports "not configured" (INFO) and verifies nothing — never a false pass.
Source Files