Documentation
¶
Overview ¶
Package policybundle distributes runeward policies as signed OCI artifacts. A bundle is a single-layer manifest: the layer is the raw policy (.rego or a TOML [[cel]] fragment) and the config blob records the engine and optional Rego query.
Signing the manifest digest would be circular (the signature lives in the manifest annotations), so we instead sign a canonical payload built from the sha256 digests of the config and layer blobs:
runeward.policy.bundle.v1 config=<config-blob-digest> layer=<layer-blob-digest>
That transitively covers the policy bytes and metadata. On pull, blob bytes are checked against the descriptor digests (content.FetchAll fails closed) and the payload is recomputed and verified against the signature, so a tampered blob or manifest breaks verification. Signature, public key, and key id are stored as manifest annotations.
Index ¶
- Constants
- func DecodePrivateKey(s string) (ed25519.PrivateKey, error)
- func DecodePublicKey(s string) (ed25519.PublicKey, error)
- func EncodeKey(b []byte) string
- func KeyID(pub ed25519.PublicKey) string
- func Push(ctx context.Context, ref string, b *Bundle, priv ed25519.PrivateKey, ...) (string, error)
- func StripScheme(ref string) string
- type Bundle
- type PullOptions
- type PushOptions
Constants ¶
const ( EngineRego = "rego" EngineCEL = "cel" )
Engine identifiers carried in the bundle config.
const ( // MediaTypeConfig is the bundle config blob (engine + query). MediaTypeConfig = "application/vnd.runeward.policy.config.v1+json" // MediaTypeLayerRego is the layer media type for a Rego module. MediaTypeLayerRego = "application/vnd.runeward.policy.layer.v1.rego" // MediaTypeLayerCEL is the layer media type for a CEL TOML fragment. MediaTypeLayerCEL = "application/vnd.runeward.policy.layer.v1.cel+toml" // ArtifactType identifies runeward policy bundle manifests. ArtifactType = "application/vnd.runeward.policy.v1" )
Media types used by runeward policy bundles.
const ( // AnnotationSignature is the base64 signature over the signing payload. AnnotationSignature = "runeward.dev/signature" // AnnotationSigningKey is the base64 public key of the signer. AnnotationSigningKey = "runeward.dev/signing-key" // AnnotationKeyID is a short fingerprint of the signing key. AnnotationKeyID = "runeward.dev/key-id" )
Manifest annotation keys carrying the ed25519 signature material.
Variables ¶
This section is empty.
Functions ¶
func DecodePrivateKey ¶
func DecodePrivateKey(s string) (ed25519.PrivateKey, error)
DecodePrivateKey parses a base64-encoded ed25519 private key.
func DecodePublicKey ¶
DecodePublicKey parses a base64-encoded ed25519 public key.
func Push ¶
func Push(ctx context.Context, ref string, b *Bundle, priv ed25519.PrivateKey, opts PushOptions) (string, error)
Push signs b with priv and pushes it to the OCI reference ref (an optional "oci://" prefix is stripped), returning the manifest digest.
func StripScheme ¶
StripScheme removes an optional "oci://" prefix from a reference.
Types ¶
type Bundle ¶
type Bundle struct {
// Engine is "rego" or "cel".
Engine string
// Query is the optional Rego decision entrypoint (ignored for CEL).
Query string
// Policy is the raw policy bytes.
Policy []byte
// Annotations are the manifest annotations returned on pull; ignored on
// push.
Annotations map[string]string
}
Bundle is the decoded content of a policy bundle.
func Pull ¶
func Pull(ctx context.Context, ref string, verify ed25519.PublicKey, opts PullOptions) (*Bundle, error)
Pull fetches a policy bundle from the OCI reference ref (an optional "oci://" prefix is stripped). When verify is non-nil a valid ed25519 signature is required; missing or invalid signatures fail closed. When verify is nil no signature check is done.
type PullOptions ¶
type PullOptions struct {
// PlainHTTP allows non-TLS registries.
PlainHTTP bool
}
PullOptions tunes how a bundle is pulled from a remote registry.
type PushOptions ¶
type PushOptions struct {
// PlainHTTP allows non-TLS registries (local testing).
PlainHTTP bool
}
PushOptions tunes how a bundle is pushed to a remote registry.
Source Files