Documentation
¶
Overview ¶
Package releaseverify retrieves and independently verifies a public release artifact manifest without a repository checkout.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type FetchFunc ¶
func DirectoryFetcher ¶ added in v0.4.0
DirectoryFetcher resolves canonical release URLs to exact regular files in one explicitly supplied staging directory. It exists only for qualification of pre-publication candidates; ordinary installers use HTTPFetcher.
func HTTPFetcher ¶
type VerifiedRelease ¶
type VerifiedRelease struct {
Manifest releasecontract.ArtifactManifest
ManifestBytes []byte
}
func ArtifactManifest ¶
func CandidateDirectory ¶ added in v0.4.0
func CandidateDirectory(ctx context.Context, directory string) (VerifiedRelease, error)
CandidateDirectory verifies the one candidate artifact manifest and every referenced release object from an explicit staging directory.
func RecordedArtifactManifest ¶ added in v0.6.0
func RecordedArtifactManifest(ctx context.Context, location string, fetch FetchFunc) (VerifiedRelease, error)
RecordedArtifactManifest verifies a previously published release while treating its immutable standard Profile lineage as recorded data. This lets a newer updater authenticate an older release after code-owned policy has appended later Profile revisions.
Source Files